CVE-2025-59142 is a high-severity supply chain vulnerability affecting the 'color-string' npm package, a widely used parser and generator for CSS color strings maintained by the Qix- project. On September 8, 2025, attackers successfully compromised the npm publishing account of 'color-string' via a phishing attack. They published a malicious version 2.1.1 that was functionally identical to the previous patch but contained embedded malware targeting browser environments. Specifically, the malware attempts to intercept and redirect cryptocurrency transactions by manipulating wallet interactions, such as those involving MetaMask, to attacker-controlled addresses. This malicious payload activates only in browser contexts where the package is bundled or directly included as a script, leaving local, server, and command-line environments unaffected. The malicious package was promptly removed from the npm registry the same day, and a clean patch version 2.1.2 was released on September 13 to invalidate cached compromised versions, especially in private registries. The vulnerability is classified under CWE-506 (Embedded Malicious Code) and carries a CVSS 4.0 score of 8.8, reflecting its network attack vector, no required privileges or user interaction, and high impact on integrity due to unauthorized transaction redirection. Although no known exploits in the wild have been reported, the potential for financial theft via cryptocurrency wallets makes this a critical supply chain threat for web applications relying on this package in browser contexts. Developers using 'color-string' in frontend builds with tools like Babel, Rollup, Vite, or Next.js must audit their dependencies and rebuild bundles with the patched version to eliminate the malware.

For European organizations, the impact of this vulnerability can be significant, particularly for those involved in fintech, cryptocurrency services, e-commerce platforms accepting crypto payments, and any web applications that integrate the 'color-string' package in browser environments. The malware’s ability to silently redirect cryptocurrency transactions compromises the integrity and confidentiality of financial operations, potentially leading to direct financial losses and reputational damage. Organizations relying on frontend JavaScript bundles that include 'color-string' version 2.1.1 risk exposure to theft of digital assets from users interacting with compromised web applications. This could undermine trust in digital payment systems and complicate regulatory compliance with European data protection and financial security standards. Additionally, the supply chain nature of the attack highlights risks in software development practices, emphasizing the need for stringent package management and verification processes. While server-side and local environments are not affected, the widespread use of npm packages in frontend development means many European organizations could be indirectly impacted if they have not updated or rebuilt their browser bundles after the incident.

To mitigate this threat, European organizations should: 1) Immediately audit all frontend projects to identify any usage of 'color-string' version 2.1.1, especially in browser-targeted bundles. 2) Rebuild all affected frontend bundles using the patched version 2.1.2 or later to purge the malicious code. 3) Clear caches in private npm registries and CI/CD pipelines to prevent inadvertent reuse of the compromised package. 4) Implement strict supply chain security measures such as package signing verification, integrity checks (e.g., using npm’s 'integrity' field), and monitoring for unexpected package updates. 5) Educate development teams on phishing risks to prevent credential compromise of publishing accounts. 6) Employ runtime monitoring in browser environments to detect suspicious wallet transaction redirections or anomalies. 7) Coordinate with security teams to review incident response plans for supply chain attacks and ensure rapid patch deployment capabilities. 8) Consider adopting tools that provide automated dependency vulnerability scanning and alerting to catch similar threats early.