CVE-2025-59331

CVE-2025-59331 describes a supply chain attack affecting the 'is-arrayish' npm package, where a compromised publishing account was used to inject malware into version 0.3.3. This malware, targeting cryptocurrency transactions and wallets like MetaMask, specifically impacts browser environments where the package is used. The vulnerability carries a high CVSS score of 8.8 due to its network attack vector and high impact on integrity, though it does not affect local or server environments. While the malicious package was quickly removed from npm, users must update to version 0.3.4, clear caches, and rebuild browser bundles to mitigate the risk, as there is no active exploit intelligence or community discussion reported.