CVE-2025-59142

CVE-2025-59142 describes a supply chain attack where the color-string npm package (version 2.1.1) was compromised via a phishing attack on its publisher's account. This malicious version, functionally identical to its predecessor, included a malware payload designed to redirect cryptocurrency transactions within browser environments. The vulnerability primarily impacts web applications using color-string in a browser context, with local or server environments unaffected. The vulnerability carries a high CVSS score of 8.8, indicating a significant risk due to its network-based attack vector and low attack complexity. The potential impact is high integrity loss, as the malware aims to steal cryptocurrency, though it does not affect confidentiality or availability. While the compromised package was quickly removed from npm, and patched versions (2.1.2 and above) were released, there is no evidence of active exploitation in the wild, nor are there publicly available exploit tools. Community discussion and media coverage for this CVE are minimal.