CVE-2025-59140 is a high-severity supply chain vulnerability affecting the npm package 'node-backslash' maintained by the Qix- project. The vulnerability arises from a malicious code injection in version 0.2.1 of the package, which was published after the npm publishing account was compromised via a phishing attack on September 8, 2025. The malicious payload embedded in this version targets browser environments specifically, attempting to intercept and redirect cryptocurrency transactions to attacker-controlled addresses. This attack vector exploits the package's use in client-side JavaScript contexts, such as direct script inclusion or through bundling tools like Babel, Rollup, Vite, or Next.js. Importantly, server-side, local, or command-line environments using this package are not affected. The malware focuses on cryptocurrency wallets such as MetaMask, aiming to hijack transaction flows within the browser. The compromised package was promptly removed from the npm registry on the same day, and subsequent patch version 0.2.2 was released on September 13 to remediate the issue and assist users in cache busting. The CVSS 4.0 score of 8.8 reflects the high impact and ease of exploitation without authentication or user interaction, with a significant impact on the integrity of cryptocurrency transactions. Organizations using this package in browser contexts must ensure they upgrade to the fixed version, clear caches, remove node_modules directories, and rebuild all browser bundles to eliminate the malicious code. Private registries and mirrors must also purge cached compromised versions to prevent further exposure.

For European organizations, the impact of this vulnerability is significant, especially for those involved in cryptocurrency transactions or developing web applications that integrate cryptocurrency wallet interactions within browsers. The malicious code compromises transaction integrity by redirecting funds to attacker-controlled wallets, potentially leading to direct financial losses. Since the attack targets client-side environments, any web application or service that bundles the compromised package for browser use is at risk. This could affect fintech companies, cryptocurrency exchanges, blockchain service providers, and any enterprise offering browser-based crypto wallet integrations. The reputational damage and regulatory implications under GDPR and other European data protection laws could be severe if customer funds are stolen or if the breach leads to data exposure. Additionally, organizations relying on private npm registries or mirrors may unknowingly continue to distribute the compromised package, extending the threat's reach. The swift removal of the package from the public npm registry mitigates further spread, but the persistence of cached versions in private environments remains a concern.

1. Immediately upgrade all instances of node-backslash to version 0.2.2 or later. 2. Completely remove the node_modules directory and any lock files (package-lock.json or yarn.lock) to ensure no residual compromised code remains. 3. Clear all package manager caches globally (npm cache clean --force) and locally, including private registries and mirrors, to prevent inadvertent reinstallation of the malicious version. 4. Rebuild all browser bundles from scratch using clean environments to eliminate embedded malicious payloads. 5. Audit all web applications and browser-based tools that use node-backslash, especially those handling cryptocurrency wallets or transactions, to verify no malicious code persists. 6. Monitor network traffic for suspicious redirection attempts or unauthorized cryptocurrency transactions. 7. Educate development and DevOps teams about phishing risks to prevent future account compromises. 8. Implement strict access controls and multi-factor authentication on npm publishing accounts and private registries. 9. Employ supply chain security tools that verify package integrity and provenance before deployment. 10. For organizations running private npm registries or mirrors, purge all cached versions of node-backslash 0.2.1 and enforce policies to prevent use of compromised versions.