CVE-2025-59145: color-name Package Malware Injection Due to Account Takeover
Summary
CVE-2025-59145: color-name@2.0.1 contains malware after npm account takeover. Affects color-name versions >= 2.0.1, < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The color-name package is a popular npm library used for managing color names in web development. It provides a simple interface for accessing color names and their corresponding values. However, it became vulnerable due to a security breach where an npm publishing account was compromised, leading to the introduction of malicious code in version 2.0.1.
Vulnerability Detail
On September 8, 2025, the npm publishing account for color-name was taken over following a phishing attack. The attacker published version 2.0.1, which was functionally identical to the previous version but included a malware payload designed to redirect cryptocurrency transactions to the attacker's addresses. This vulnerability primarily affects browser environments where the package is used, such as through script tags or bundling tools like Babel, Rollup, and Next.js. Local and server environments are not impacted.
How To Fix
Latest published version: 2.1.1 as of 23 Oct 2026
npm install color-name@2.1.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.2
This is the first release that contains the fix.
npm install color-name@2.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, users can temporarily avoid using the color-name package in browser contexts until the update is applied. Ensure that any cached versions in private registries are purged.
Conclusion
The color-name package was compromised due to an npm account takeover, resulting in the introduction of malware in version 2.0.1. Users are urged to update to version 2.0.2 or later and take necessary precautions to ensure their applications are secure.
See every vulnerability recorded for color-name →
FAQ
The vulnerability allows attackers to redirect cryptocurrency transactions from users' wallets, particularly targeting browser environments.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If you have used version 2.0.1, you should update to version 2.0.2, remove your node_modules directory, clean your cache, and rebuild your bundles.
No, the vulnerability primarily affects browser environments. Local and server environments are not impacted.
For more details, you can refer to the resources linked in the advisory, including blog posts and security reports.
References
Related vulnerabilities
Recent vulnerabilities recorded for color-name.
