CVE-2025-59144: debug npm package supply chain compromise via account takeover

CVE-2025-59144 · Severity: medium · CVSS 4 · Published 2025-09-15

The debug package, a widely-used JavaScript debugging utility, was compromised on npm when its publishing account was taken over via phishing. Version 4.4.2 was released with injected malware designed to intercept cryptocurrency transactions in web browsers, targeting wallets like MetaMask. While server and command-line environments are unaffected, any web applications or browser-bundled code using this version may have active malware embedded in their production bundles. Developers must rebuild all browser bundles, purge cached versions, and upgrade to patched releases to eliminate the threat.

Technologies: debug (npm). Vendors: npm.

Quick answers

Is CVE-2025-59144 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-59144 being exploited in the wild.
How severe is CVE-2025-59144?
Medium severity, with a CVSS score of 4, published 15 September 2025.
Which products and versions are affected?
debug (npm) SEMVER:introduced=4.4.2,fixed=4.4.3.
Is there a fix for CVE-2025-59144?
Yes. debug (npm): upgrade to 4.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59144 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-59144?
Check whether you run debug (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • debug (npm): upgrade to 4.4.3 or later
    npm install debug@4.4.3

Technical details

This supply-chain compromise stems from a phishing attack that compromised the npm publishing credentials of the debug package maintainer on 8 September 2025. The attacker published version 4.4.2, which is functionally identical to 4.4.1 but with embedded malware injected into src/index.js. The malware payload targets browser environments (checks for typeof window !== 'undefined') and attempts to redirect cryptocurrency transactions to attacker-controlled addresses, specifically targeting MetaMask and other crypto wallets. Node.js, local, and server-side environments are not affected due to the runtime check. npm removed the malicious version from the registry the same day, and the maintainer published patch versions 4.4.3+ on 13 September to cache-bust compromised versions. Users must not only upgrade but also completely rebuild browser bundles from scratch to remove any embedded instances of the malware.

Affected products

  • debug-js debug 4.4.2

Identifiers

  • CVE-2025-59144
  • GHSA-4x49-vf9v-38px

Timeline

  • 2025-09-08: other: npm publishing account for debug compromised via phishing attack
  • 2025-09-08: exploited: Malicious version 4.4.2 published to npm with embedded malware
  • 2025-09-08: other: npm removed version 4.4.2 from registry during same day
  • 2025-09-15: disclosed: Public disclosure via GitHub advisory GHSA-4x49-vf9v-38px and CVE-2025-59144
  • 2025-09-13: patched: Patched versions 4.4.3+ published by maintainer

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.