Platform
nodejs
Component
color-name
Fixed in
2.0.2
2.0.2
CVE-2025-59145 represents a critical security issue within the color-name Node.js package. This vulnerability involves the malicious injection of code, leading to a potential full system compromise for affected systems. The vulnerability impacts versions of color-name up to and including 2.0.1. A fix is available in version 2.0.2.
The core impact of CVE-2025-59145 is the complete compromise of any system running the affected color-name package. The malicious code allows an attacker to gain full control over the system, potentially exfiltrating sensitive data, installing persistent malware, or using the compromised system as a launchpad for further attacks. The description explicitly states that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted computer, highlighting the severity of the compromise. This is a supply-chain attack, similar in nature to other package compromise events, where malicious code is inserted into a legitimate package before distribution, impacting a wide range of downstream users.
This vulnerability was identified through ghsa-malware analysis. The public disclosure date is 2025-09-08. Given the nature of the compromise (malware injection), there is a high probability of exploitation. While no specific exploit details are publicly available yet, the potential for widespread impact is significant due to the popularity of Node.js and the use of npm packages. It is likely to be added to the CISA KEV catalog soon.
Exploit Status
EPSS
0.09% (25% percentile)
CISA SSVC
The primary mitigation for CVE-2025-59145 is to immediately upgrade the color-name package to version 2.0.2 or later. However, given the nature of the compromise, simply upgrading may not be sufficient. It is strongly recommended to remove the package entirely after upgrading. Due to the potential for persistent malware, a full system re-imaging or forensic analysis is advisable. Rotate all secrets and keys that were stored on the affected system from a clean, trusted machine. Consider implementing stricter dependency scanning and code review processes to prevent future supply-chain attacks. After upgrade and removal, confirm by scanning the system for any unusual processes or network connections.
Update the color-name package to version 2.0.2 or higher. Completely remove the node_modules directory, clear your package manager's global cache (npm or yarn), and rebuild any browser bundles from scratch. If you operate private registries or registry mirrors, purge affected versions from any cache.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-59145 is a HIGH severity vulnerability where malicious code was injected into the color-name Node.js package, potentially leading to full system compromise.
Yes, if you are using color-name version 2.0.1 or earlier, you are affected and must take immediate action.
Upgrade to color-name version 2.0.2 or later, remove the package, rotate all secrets, and consider a full system re-imaging.
While no specific exploits are publicly known, the high severity and potential for widespread impact suggest a high probability of exploitation.
Check the npm registry and the color-name project's repository for updates and advisories related to this vulnerability.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.