CVE-2025-59331 is a high-severity supply chain vulnerability affecting the npm package 'node-is-arrayish' maintained by the Qix- project. The vulnerability arose after the npm publishing account for 'is-arrayish' was compromised via a phishing attack on September 8, 2025. The attacker published version 0.3.3 of the package, which was functionally identical to the previous patch version but contained embedded malicious code. This malicious payload specifically targets browser environments where the package is used, attempting to intercept and redirect cryptocurrency transactions to attacker-controlled addresses. The attack vector exploits the package's usage in browser contexts, such as direct script inclusion or through bundling tools like Babel, Rollup, Vite, or Next.js. Local, server-side, or command-line environments are not affected by this payload. The malicious code focuses on cryptocurrency wallets, including popular ones like MetaMask, aiming to hijack transaction flows. The npm registry removed the compromised package version on the same day to prevent further downloads. Subsequently, on September 13, the package owner released version 0.3.4 to remediate the issue and assist users in cache-busting compromised versions. Users are strongly advised to update to 0.3.4, fully remove their node_modules directories, clear package manager caches, and rebuild all browser bundles from scratch to eliminate the malware. Private registries and mirrors should also purge cached compromised versions. The CVSS 4.0 score is 8.8 (high), reflecting the network attack vector, no required privileges or user interaction, and significant impact on integrity and confidentiality within affected browser environments. No known exploits in the wild have been reported yet, but the potential for targeted cryptocurrency theft is significant.

For European organizations, this vulnerability poses a substantial risk primarily to web applications and front-end projects that incorporate 'node-is-arrayish' in browser bundles. Organizations involved in fintech, cryptocurrency services, or any sector where browser-based cryptocurrency wallets are used are at heightened risk of financial theft through transaction redirection. The integrity and confidentiality of cryptocurrency transactions can be compromised, leading to direct financial losses and reputational damage. Since the malicious payload does not affect server-side or local environments, backend systems remain secure from this specific threat. However, the widespread use of JavaScript bundlers in modern web development means many European companies could unknowingly distribute compromised code to end users, especially if they rely on private registries or have not updated dependencies promptly. The attack also highlights the broader risk of supply chain compromises in open-source ecosystems, which can undermine trust and disrupt operations. Regulatory compliance concerns may arise under GDPR and other data protection laws if customer funds or data are impacted, potentially leading to legal and financial penalties.

European organizations should immediately audit their projects for usage of 'node-is-arrayish' version 0.3.3 or earlier vulnerable versions. They must upgrade to version 0.3.4 or later without delay. Complete removal of the node_modules directory and clearing of all package manager caches (npm, yarn, pnpm, etc.) is essential to prevent residual compromised code. All browser bundles that include this package must be rebuilt from scratch to ensure the malicious payload is eliminated. Organizations operating private npm registries or mirrors should purge any cached copies of the compromised version 0.3.3 to prevent inadvertent reuse. Implementing strict supply chain security practices, such as verifying package integrity via checksums or signatures, and enabling two-factor authentication on publishing accounts can reduce the risk of similar account takeovers. Monitoring for unusual cryptocurrency transaction patterns in browser environments and educating developers about phishing risks are also recommended. Finally, integrating automated dependency scanning tools that flag compromised or malicious packages can help detect and prevent future incidents.