[email protected] contains malware after npm account takeover

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2025-59145 · CVE overview and exploitation status

EUVD-2025-29260

GHSA-5fvm-p68v-5wmh

GHSA-m99c-cfww-cxqx

MAL-2025-46972

cve-program · CVE-2025-59145

• https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh
• https://github.com/debug-js/debug/issues/1005
• https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
• https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
• https://www.ox.security/blog/npm-packages-compromised

euvd · EUVD-2025-29260

• https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh
• https://github.com/debug-js/debug/issues/1005
• https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
• https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
• https://www.ox.security/blog/npm-packages-compromised

nvd · CVE-2025-59145

• https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh
• https://github.com/debug-js/debug/issues/1005
• https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
• https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
• https://www.ox.security/blog/npm-packages-compromised

osv · GHSA-5fvm-p68v-5wmh

• https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh
• https://nvd.nist.gov/vuln/detail/CVE-2025-59145
• https://github.com/debug-js/debug/issues/1005
• https://github.com/colorjs/color-name
• https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
• https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
• https://www.ox.security/blog/npm-packages-compromised

osv · MAL-2025-46972

• https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
• https://www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/
• https://github.com/github/advisory-database/issues/6099
• https://github.com/advisories/GHSA-m99c-cfww-cxqx
• https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh

No related changes are available here.