CVE-2025-59142: color-string Package Malware Injection Due to npm Account Takeover
Summary
CVE-2025-59142: color-string@2.1.1 contains malware after npm account takeover. Affects color-string versions >= 2.1.1, < 2.1.2. Fixed in 2.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The color-string package is a popular npm library used for parsing and manipulating color strings in various formats. It is widely utilized in web development for tasks involving color management. However, it became vulnerable due to a security breach that allowed an attacker to publish a compromised version of the package.
Vulnerability Detail
On September 8, 2025, the npm publishing account for color-string was compromised through a phishing attack. The attacker published version 2.1.1, which was functionally identical to the previous version but included a malware payload designed to redirect cryptocurrency transactions to the attacker's addresses. This vulnerability primarily affects applications that use the package in browser contexts, potentially exposing users' cryptocurrency wallets to theft.
How To Fix
Latest published version: 2.1.4 as of 22 Oct 2026
npm install color-string@2.1.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.2
This is the first release that contains the fix.
npm install color-string@2.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider avoiding the use of the color-string package in browser environments until the update is applied. For those using private registries, ensure that the compromised version is purged from any caches.
Conclusion
The color-string package was compromised due to an npm account takeover, leading to the release of a malicious version that targets cryptocurrency transactions. Users are urged to update to the patched version and follow recommended cleaning procedures to mitigate risks.
See every vulnerability recorded for color-string →
FAQ
You should immediately update to version 2.1.2 or later and follow the cleaning steps outlined in the 'how_to_fix' section.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, you can identify if your application is affected.
Failing to address this vulnerability may expose users to malware that can redirect cryptocurrency transactions, leading to potential financial loss.
Yes, the vulnerability primarily affects applications using the color-string package in browser contexts. Local and server environments are not impacted.
You can refer to the provided references in the advisory for detailed information about the incident and its implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for color-string.
