CVE-2025-59145: color-name@2.0.1 contains malware after npm account takeover
N/A
Basic Information
JavaScriptTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| color-name | npm | = 2.0.1 | 2.0.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability is a result of a supply chain attack where a malicious version (2.0.1) of the color-name npm package was published. This version contained malware designed to steal cryptocurrency from users of applications that included this package. The malware activates in a browser environment, where it can intercept cryptocurrency transactions.
My analysis is based on a detailed report from Socket.dev, which includes a deobfuscated version of the malware's code. The malware's primary mechanism is to monkey-patch fundamental networking APIs, fetch and XMLHttpRequest, to inspect and tamper with network traffic.
The key malicious functions identified are:
fetchandXMLHttpRequest.prototype.sendoverrides: These are the entry points for the malware to intercept application data. Any application logic that uses these functions for communication becomes a vector for the attack.replaceCryptoHashes: This is the core of the malicious logic, performing the search and replacement of cryptocurrency addresses.findNearestAddressLevenshtein: A supporting function for the address replacement, making the attack slightly more sophisticated.
These functions would appear in a runtime profile during the exploitation of the vulnerability, for instance, when a user of an affected web application initiates a cryptocurrency transaction. The profiler would show calls to the overridden fetch or XMLHttpRequest.prototype.send, which would then call replaceCryptoHashes.