CVE-2025-59330: error-ex@1.3.3 contains malware after npm account takeover
N/A
Basic Information
JavaScriptTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| error-ex | npm | = 1.3.3 | 1.3.4 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability is a result of a supply chain attack where the npm account of a popular developer was compromised, and malicious versions of several packages, including error-ex, were published. The malicious code, found in version 1.3.3 of error-ex, was designed to steal cryptocurrency from users in a browser environment.
My analysis is based on a deobfuscated version of the malware's code, which was published in a blog post by Socket.dev. This code clearly shows the attack vector and the functions involved.
The malware operates by monkey-patching the standard browser APIs fetch and XMLHttpRequest. This allows it to intercept all network traffic from the compromised application. The malicious wrappers for these functions then inspect the content of the responses. If the content contains what appears to be a cryptocurrency transaction, the malware uses the replaceCryptoHashes function to replace the legitimate recipient's wallet address with an address controlled by the attacker. To make the malicious address less conspicuous, the findNearestAddressLevenshtein function is used to select an attacker's address that is visually similar to the original address.
Therefore, the key functions that would appear in a runtime profile during exploitation are:
fetchandXMLHttpRequest.prototype.send: These are the entry points for the malware, as they are the hooked browser APIs.replaceCryptoHashes: This is the core malicious function that performs the address replacement.findNearestAddressLevenshtein: This is a helper function for the core malicious logic.
Any of these functions appearing in a profiler or stack trace for an application using error-ex@1.3.3 would be a strong indicator of compromise.