color@5.0.1 contains malware after npm account takeover

{
  "id": "0a1319b2d2751fe0e21c747211dbda73300d266b136cc112d87a0f9596a5ab95",
  "url": "https://osv.dev/vulnerability/CVE-2025-59143",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "color@5.0.1 contains malware after npm account takeover",
    "summary": "color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for color was taken over after a phishing attack. Version 5.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct",
    "evidence": "osv:CVE-2025-59143",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-59143",
      "aliases": [
        "CVE-2025-59143",
        "GHSA-j8fv-6x8p-p766",
        "GHSA-qrmh-qg46-72pp",
        "MAL-2025-46985"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/qix-/color",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "02a615f268c1c98bea928986b8fba8fdf18c0cc9"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "5.0.2"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "5.0.0",
            "4.2.3",
            "4.2.2",
            "4.2.1",
            "4.2.0",
            "4.1.0",
            "4.0.2",
            "4.0.1",
            "3.2.0",
            "4.0.0",
            "3.1.4",
            "3.1.3",
            "3.1.2",
            "3.1.1",
            "3.1.0",
            "3.0.0",
            "2.0.1",
            "2.0.0",
            "1.0.3",
            "1.0.2",
            "1.0.1",
            "1.0.0",
            "0.11.4",
            "0.11.3",
            "0.11.2",
            "0.11.1",
            "0.11.0",
            "0.10.1",
            "0.10.0",
            "0.9.0",
            "0.8.0",
            "0.7.3",
            "0.7.2"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59143.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:50.590412115Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59143.json",
        "https://github.com/Qix-/color/security/advisories/GHSA-qrmh-qg46-72pp",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-59143",
        "https://github.com/debug-js/debug/issues/1005",
        "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
        "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
        "https://www.ox.security/blog/npm-packages-compromised"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-506"
        ],
        "cna_assigner": "GitHub_M",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "= 5.0.1"
                  },
                  {
                    "last_affected": "= 5.0.1"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandaloneSingleVersion"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59143.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-59143",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 518841,
  "published_at": "2025-09-15T19:10:01.61+00:00"
}