CVE-2025-59144

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-59144", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-09T15:23:16.326Z", "datePublished": "2025-09-15T19:10:04.053Z", "dateUpdated": "2026-09-23T16:08:56.854Z"}, "containers": {"cna": {"title": "debug@4.4.2 contains malware after npm account takeover", "problemTypes": [{"descriptions": [{"cweId": "CWE-506", "lang": "en", "description": "CWE-506: Embedded Malicious Code", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red", "version": "4.0"}}], "references": [{"name": "https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px"}, {"name": "https://github.com/debug-js/debug/issues/1005", "tags": ["x_refsource_MISC"], "url": "https://github.com/debug-js/debug/issues/1005"}, {"name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack", "tags": ["x_refsource_MISC"], "url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"}, {"name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised", "tags": ["x_refsource_MISC"], "url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"}, {"name": "https://www.ox.security/blog/npm-packages-compromised", "tags": ["x_refsource_MISC"], "url": "https://www.ox.security/blog/npm-packages-compromised"}], "affected": [{"vendor": "debug-js", "product": "debug", "versions": [{"version": "= 4.4.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-15T19:10:04.053Z"}, "descriptions": [{"lang": "en", "value": "debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue has been resolved in 4.4.3."}], "source": {"advisory": "GHSA-4x49-vf9v-38px", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-15T19:46:32.027005Z", "id": "CVE-2025-59144", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-15T19:46:39.190Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/23/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-23T16:08:56.854Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/23/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-23T16:08:56.854Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59144", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-15T19:46:32.027005Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-15T19:46:35.500Z"}}], "cna": {"title": "debug@4.4.2 contains malware after npm account takeover", "source": {"advisory": "GHSA-4x49-vf9v-38px", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "debug-js", "product": "debug", "versions": [{"status": "affected", "version": "= 4.4.2"}]}], "references": [{"url": "https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px", "name": "https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/debug-js/debug/issues/1005", "name": "https://github.com/debug-js/debug/issues/1005", "tags": ["x_refsource_MISC"]}, {"url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack", "name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack", "tags": ["x_refsource_MISC"]}, {"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised", "name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised", "tags": ["x_refsource_MISC"]}, {"url": "https://www.ox.security/blog/npm-packages-compromised", "name": "https://www.ox.security/blog/npm-packages-compromised", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue has been resolved in 4.4.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-506", "description": "CWE-506: Embedded Malicious Code"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-15T19:10:04.053Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59144", "state": "PUBLISHED", "dateUpdated": "2026-09-23T16:08:56.854Z", "dateReserved": "2025-09-09T15:23:16.326Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-15T19:10:04.053Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "debug", "vendor": "debug-js", "versions": [{"status": "affected", "version": "= 4.4.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue has been resolved in 4.4.3."}, {"lang": "es", "value": "debug es una utilidad de depuraci\u00f3n de JavaScript. El 8 de septiembre de 2025, la cuenta de publicaci\u00f3n de npm para debug fue comprometida despu\u00e9s de un ataque de phishing. La versi\u00f3n 4.4.2 fue publicada, funcionalmente id\u00e9ntica a la versi\u00f3n de parche anterior, pero con una carga \u00fatil de malware a\u00f1adida que intentaba redirigir transacciones de criptomonedas a las propias direcciones del atacante desde entornos de navegador. Los entornos locales, entornos de servidor, aplicaciones de l\u00ednea de comandos, etc. no est\u00e1n afectados. Si el paquete fue utilizado en un contexto de navegador (p. ej., una inclusi\u00f3n directa de <script>, o a trav\u00e9s de una herramienta de empaquetado como Babel, Rollup, Vite, Next.js, etc.) existe la posibilidad de que el malware a\u00fan exista y dichos paquetes deber\u00e1n ser reconstruidos. El malware aparentemente solo apunta a transacciones de criptomonedas y billeteras como MetaMask. npm elimin\u00f3 el paquete ofensivo del registro a lo largo del d\u00eda el 8 de septiembre, impidiendo descargas adicionales desde npm propiamente dicho. El 13 de septiembre, el propietario del paquete public\u00f3 nuevas versiones de parche para ayudar a invalidar la cach\u00e9 de aquellos que usan registros privados y que a\u00fan podr\u00edan tener la versi\u00f3n comprometida en cach\u00e9. Los usuarios deben actualizar a la \u00faltima versi\u00f3n de parche, eliminar completamente su directorio node_modules, limpiar la cach\u00e9 global de su gestor de paquetes y reconstruir cualquier paquete de navegador desde cero. Aquellos que operan registros privados o espejos de registro deben purgar las versiones ofensivas de cualquier cach\u00e9. Este problema ha sido resuelto en 4.4.3."}], "id": "CVE-2025-59144", "lastModified": "2026-10-19T17:10:00.173", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "ATTACKED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59144", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-15T19:46:32.027005Z", "version": "2.0.3"}}]}, "published": "2025-09-15T20:15:39.073", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/debug-js/debug/issues/1005"}, {"source": "security-advisories@github.com", "url": "https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px"}, {"source": "security-advisories@github.com", "url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"}, {"source": "security-advisories@github.com", "url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"}, {"source": "security-advisories@github.com", "url": "https://www.ox.security/blog/npm-packages-compromised"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/09/23/8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-506"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "debug: debug@4.4.2 contains malware after npm account takeover", "id": "2395497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395497"}, "csaw": false, "cwe": "CWE-506", "details": ["debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue has been resolved in 4.4.3."], "name": "CVE-2025-59144", "public_date": "2025-09-15T19:10:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-59144\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59144\nhttps://access.redhat.com/security/supply-chain-attacks-NPM-packages\nhttps://github.com/debug-js/debug/issues/1005\nhttps://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px\nhttps://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack\nhttps://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised\nhttps://www.ox.security/blog/npm-packages-compromised"], "statement": "No Red Hat products use any compromised version of the impacted package(s). For more details see https://access.redhat.com/security/supply-chain-attacks-NPM-packages", "threat_severity": "Important"}

{}