GHSA-pxx3-g568-hxr4 CVE-2025-59162 GHSA-ch7m-m9rf-8gvv MAL-2025-46971
color-convert@3.1.1 contains malware after npm account takeover
- Severity
- 8.8 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.43%
- Chance of exploitation in the next 30 days. Higher than 36.87% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-506 Embedded Malicious Code
- Fix
3.1.2- Upgrade color-convert to this version or later
Description
Impact
On 8 September 2025, the npm publishing account for color-convert was taken over after a phishing attack. Version 3.1.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments.
Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt.
The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload.
Patches
npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper.
On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. This version is functionally identical to the previously known-good version, published as a patch version bump above the compromised version.
Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch.
Those operating private registries or registry mirrors should purge the offending versions from any caches.
References
- https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
- https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
- https://www.ox.security/blog/npm-packages-compromised/
Point of Contact
In the event suspicious behavior is still observed for the package listed in this security advisory after performing all of the above cleaning operations (see Patches above), please reach out via one of the following channels of communication:
- Bluesky, package owner: https://bsky.app/profile/bad-at-computer.bsky.social
debugrepository, tracking issue (applies to all packages affected in the breach): https://github.com/debug-js/debug/issues/1005
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| color-convert | 1 listed versions | No fix yet |
| color-convert | >= 3.1.1, < 3.1.2 |
3.1.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
color-convert npm → 3.1.2
- npm
npm install color-convert@3.1.2- yarn
yarn add color-convert@3.1.2- pnpm
pnpm add color-convert@3.1.2
Severity breakdown
CVSS 4.0 8.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Attacked
Weakness
CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
How to prevent it
- Implementation, Operation: Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
References
Advisories
Write-ups
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2026-48027 Compromised Nx Console version 18.95.0 | Critical Known exploited | Same weakness, CWE-506 |
| CVE-2026-8398 A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from… | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-g7cv-rxg3-hmpx Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-5mg7-485q-xm76 Two LiteLLM versions published containing credential harvesting malware | Critical | Same weakness, CWE-506 |
| GHSA-69fq-xp46-6x23 Trivy ecosystem supply chain was briefly compromised | Critical Known exploited | Same weakness, CWE-506 |
| CVE-2025-59374 "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain… | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-5fvm-p68v-5wmh color-name@2.0.1 contains malware after npm account takeover | High | Same weakness, CWE-506 |
| GHSA-4x49-vf9v-38px debug@4.4.2 contains malware after npm account takeover | High | Same weakness, CWE-506 |
Credits: Amazon Inspector
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor