Skip to content
Heist/ feed
Back to feed
High

is-arrayish@0.3.3 contains malware after npm account takeover

Type: advisorySources: OSV

is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-59331
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 19:25 UTC · Revision 1

Source evidence

is-arrayish@0.3.3 contains malware after npm account takeover

core-osv · Original source

Published 15 Sept 2025, 19:21 UTC

is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct

osv:CVE-2025-59331
Complete source record
{
  "id": "1430dc22cbe9cc9ad2a795ede7d61c8576b5ad3a35d0af17218884745042cc77",
  "url": "https://osv.dev/vulnerability/CVE-2025-59331",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "is-arrayish@0.3.3 contains malware after npm account takeover",
    "summary": "is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct",
    "evidence": "osv:CVE-2025-59331",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-59331",
      "aliases": [
        "CVE-2025-59331",
        "GHSA-frh7-2f84-v9mw",
        "GHSA-hfm8-9jrf-7g9w",
        "MAL-2025-46977"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/qix-/node-is-arrayish",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "db809c0ff45fa21ce3e22c3bbf435614aedad21d"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.3.4"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "0.3.2",
            "0.3.1",
            "0.3.0",
            "0.2.1",
            "0.2.0",
            "0.1.1",
            "0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59331.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:38.876341928Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59331.json",
        "https://github.com/Qix-/node-is-arrayish/security/advisories/GHSA-frh7-2f84-v9mw",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-59331",
        "https://github.com/debug-js/debug/issues/1005",
        "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
        "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
        "https://www.ox.security/blog/npm-packages-compromised"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-506"
        ],
        "cna_assigner": "GitHub_M",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "= 0.3.3"
                  },
                  {
                    "last_affected": "= 0.3.3"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandaloneSingleVersion"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59331.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-59331",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 506144,
  "published_at": "2025-09-15T19:21:29.858+00:00"
}