CVE-2025-59143 [email protected] contains malware after npm account takeover

color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for color was taken over after a phishing attack. Version 5.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to...

CVE-2025-59141 [email protected] contains malware after npm account takeover

simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version 0.2.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect...

CVE-2025-59141

CVE-2025-59141 concerns the Node.js package simple-swizzle. An account takeover via phishing led to a malicious 0.2.3 release that, when used in browser contexts (e.g., direct script tags or bundlers), attempts to redirect cryptocurrency transactions to attacker-controlled addresses. Local/server...

CVE-2025-59141 [email protected] contains malware after npm account takeover

simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version 0.2.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect...

CVE-2025-59141 [email protected] contains malware after npm account takeover

simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version 0.2.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect...

CVE-2025-59140 [email protected] contains malware after npm account takeover

backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0.2.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect...

CVE-2025-59140 [email protected] contains malware after npm account takeover

backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0.2.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect...

CVE-2025-59140

The CVE-2025-59140 issue concerns the backslash npm package. A phishing-attack comp compromised the package owner’s account on 8 September 2025 and published v0.2.1, which added a malware payload targeting cryptocurrency transactions in browser contexts (e.g., MetaMask), while local/server/CLI en...

Color-String 安全漏洞

Color-String is a library for parsing and generating CSS color strings by the individual developer Josh Junon. A security vulnerability exists in Color-String version 2.1.1, which stems from malware payload injection and could lead to the redirection of cryptocurrency transactions in a browser...

color 安全漏洞

color is a Javascript manipulation library by Josh Junon Personal Developer. A security vulnerability exists in color version 5.0.1 that stems from a phishing attack resulting in an account takeover, where malware may redirect cryptocurrency transactions in the browser environment...

debug 安全漏洞

debug is a small JavaScript debugging utility open-sourced by Debug.js modeled on core Node.js debugging techniques. A security vulnerability exists in debug version 4.4.2, which stems from a phishing attack leading to account takeover, where malware may redirect cryptocurrency transactions...

color-convert 安全漏洞

color-convert is a color conversion function in JavaScript by Josh Junon Personal Developer. A security vulnerability exists in color-convert version 3.1.1, which stems from malicious code implanted after a phishing attack on an account, and could lead to the redirection of cryptocurrency...

color-name 安全漏洞

color-name is a JavaScript library open-sourced by color.js. A security vulnerability exists in color-name version 2.0.1, which stems from a phishing attack resulting in an account takeover that could redirect cryptocurrency transactions...

CVE-2025-59331: Embedded Malicious Code

is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to...

CVE-2025-59330: Embedded Malicious Code

error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack. Version 1.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect...

CVE-2025-59142: Embedded Malicious Code

color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken over after a phishing attack. Version 2.1.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to...

CVE-2025-59140: Embedded Malicious Code

backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0.2.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect...

CVE-2025-59141: Embedded Malicious Code

simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version 0.2.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect...

simple-swizzle 安全漏洞

simple-swizzle is a codebase by Josh Junon Personal Developer. A security vulnerability exists in version 0.2.3 of simple-swizzle that stems from a phishing attack resulting in account takeover and implanted malware that may redirect cryptocurrency transactions...

CVE-2025-59145: Embedded Malicious Code

color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrenc...