JavaScript Color Manipulation Library Vulnerability Impacting Users

CVE-2025-59143

What is CVE-2025-59143?

On September 8, 2025, the npm publishing account for the 'color' library was compromised due to a phishing attack, leading to the publication of version 5.0.1. This version contained a malicious payload designed to redirect cryptocurrency transactions from targeted wallets to the attacker's accounts. Affected environments include any that utilize the 'color' library in a browser context, such as through script inclusions or bundling tools like Babel and Next.js. Users are strongly advised to remove the compromised version, clear their package manager's cache, and update to the secure version 5.0.2. It's critical to ensure that any browser bundles are rebuilt to eliminate the malware threat.

References