CVE-2025-59140

CVEs › CVE-2025-59140

Description

backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0.2.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issues is resolved in 0.2.2.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: HIGH
CVSS score: 8.8 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red
Effective score: 8.8 / 10 HIGH source: CNA overview
CWE(s): CWE-506
Reserved: 2025-09-09
Published: 2025-09-15 21:09 UTC
Last updated: 2025-09-16 15:48 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/59xxx/CVE-2025-59140.json
Linked Threat: CVE-2025-59140 — backslash@0.2.1 contains malware after npm account takeover

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2025-09-15 20:15:38 UTC
NVD last modified: 2026-06-17 09:45:36 UTC
EPSS score: 0.0038 (probability of exploitation in next 30 days)
EPSS percentile: 30.41% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27

NVD / KEV / EPSS data refreshed 2026-07-27 16:13 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2025-29229
Assigner: GitHub_M
Published: Sep 15, 2025, 7:09:53 PM
Updated: Sep 16, 2025, 1:48:48 PM
EUVD base score (CVSS 4.0): 8.8 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red
EUVD-reported EPSS: 0.1400
Vendors: Qix-
Products: node-backslash (= 0.2.1)
Aliases: GHSA-53mq-f4w3-f7qv

ENISA description: backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0.2.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issues is resolved in 0.2.2.

EUVD references (5)

Affected products (1)

Vendor	Product	Versions	Platforms
Qix-	node-backslash	`= 0.2.1` (affected)	—

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

https://github.com/Qix-/node-backslash/security/advisories/GHSA-53mq-f4w3-f7qv x_refsource_CONFIRM
https://github.com/debug-js/debug/issues/1005 x_refsource_MISC
https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack x_refsource_MISC
https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised x_refsource_MISC
https://www.ox.security/blog/npm-packages-compromised x_refsource_MISC

MITRE references (5) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://github.com/Qix-/node-backslash/security/advisories/GHSA-53mq-f4w3-f7qv x_refsource_CONFIRM
https://github.com/debug-js/debug/issues/1005 x_refsource_MISC
https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack x_refsource_MISC
https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised x_refsource_MISC
https://www.ox.security/blog/npm-packages-compromised x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (5)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/Qix-/node-backslash/security/advisories/GHSA-53mq-f4w3-f7qv security-advisories@github.com
https://github.com/debug-js/debug/issues/1005 security-advisories@github.com
https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack security-advisories@github.com
https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised security-advisories@github.com
https://www.ox.security/blog/npm-packages-compromised security-advisories@github.com

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
domain	`next.js`	no local data	2026-05-18 21:19 UTC

Remediations (24)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Database CVE, CWE, CISA KEV & Vulnerability Intelligence | CVE Find

web:www.cvefind.com

CVE Find is a real-time vulnerability database indexing 398 254 security flaws ( CVE ) from MITRE, NVD, CISA KEV, CWE and CAPEC. 2724 new CVEs were published in the last 7 days. Data aggregated from: MITRE Corporation ( CVE , CWE, CAPEC), National Vulnerability Database - NIST (NVD), CISA Known Exploited Vulnerabilities (KEV), FIRST (EPSS).

2026-09-26 17:33 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-09-26 17:33 UTC
Security Update Guide FAQs - microsoft.com

web:www.microsoft.com

These Knowledge Base articles accompany all security updates and advisories, and include caveats or known issues with security updates. Additionally, support engineers document common concerns from customers in these KB articles. These Knowledge Base articles are published the Security Update Guide with each release on Patch Tuesday.

2026-09-26 17:33 UTC
Microsoft Technical Security Notifications

web:www.microsoft.com

Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed. You can choose the type of updates for which you want to be notified: Major ...

2026-09-26 17:33 UTC
August 11, 2026—Hotpatch KB5120994 (OS Builds 26200.9106 and 26100.9106 ...

web:support.microsoft.com

This Hotpatch update for Windows 11, version 25H2 and 24H2 (KB5120994) includes security improvements. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows software updates. To ...

2026-09-26 17:33 UTC
Microsoft's August 2025 Patch Tuesday Addresses 107 CVEs ... - Tenable

web:www.tenable.com

Microsoft's August 2025 Patch Tuesday Addresses 107 CVEs ( CVE - 2025 -53779) By Research Special Operations Subscribe 13 Critical 91 Important 2 Moderate 1 Low Microsoft addresses 107 CVEs , including one zero-day vulnerability that was publicly disclosed.

2026-09-26 17:33 UTC
Microsoft Update Catalog

web:catalog.update.microsoft.com

Welcome to the Microsoft Update Catalog site. We want your feedback! Visit our newsgroup or send us an email to provide us with your thoughts and suggestions. To get started using the site, enter in your search terms in the Search box above or visit our FAQ for search tips. |Newsgroup|Send us your feedback

2026-09-26 17:33 UTC
Adobe Security Bulletins and Advisories | Security

web:helpx.adobe.com

This page contains important information regarding security vulnerabilities that could affect specific versions of Adobe products. Use this information to take the prescribed corrective actions.

2026-09-26 17:33 UTC
NVD - Vulnerabilities

web:nvd.nist.gov

Vulnerabilities All vulnerabilities in the NVD have been assigned a CVE identifier and thus, abide by the definition below. CVE defines a vulnerability as: "A weakness in the computational logic (e.g., code) found in software and hardware components that, when exploited, results in a negative impact to confidentiality, integrity, or availability. Mitigation of the vulnerabilities in this ...

2026-05-22 14:44 UTC
CISA KEV Update: 5 Actively Exploited Vulnerabilities

web:dailysecurityreview.com

This wave of updates underscores the criticality of monitoring the KEV Catalog for timely vulnerability remediation—especially for federal agencies, which are mandated to patch listed vulnerabilities within defined time frames. Private sector organizations are also strongly advised to assess their exposure and implement risk mitigation measures.

2026-05-22 14:44 UTC
Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws

web:www.bleepingcomputer.com

Today is Microsoft's February 2025 Patch Tuesday, which includes security updates for 55 flaws, including four zero-day vulnerabilities, with two actively exploited in attacks.

2026-05-22 14:44 UTC
CVE Vault - CVE Database & Security Research Hub

web:cvevault.com

CVE Vault - Search and explore Common Vulnerabilities and Exposures ( CVE ) database. Find security vulnerabilities by CVE ID, vendor, severity, and year. Stay secure with comprehensive CVE information.

2026-05-22 14:44 UTC
Patch Tuesday - October 2025 - Rapid7

web:www.rapid7.com

Microsoft has published 172 new vulnerabilities, including six zero-day vulnerabilities. Windows 10 moves past the end of support, sort of. Critical RCE in Windows Server Update Service.

2026-05-22 14:44 UTC
Microsoft Issues Massive Windows Patch for 160+ Bugs ... - TechRepublic

web:www.techrepublic.com

Microsoft's April 2026 Patch Tuesday fixes 165 vulnerabilities, including two zero-days, in one of the company's largest monthly security updates.

2026-05-22 14:44 UTC
Microsoft Releases Out-of-Band Security Update to Mitigate ... - CISA

web:www.cisa.gov

Updated October 29, 2025 : CISA has updated this Alert to include revised information on vulnerable product identification, potential threat activity detections, and additional resources. Microsoft released an update to address a critical remote code execution vulnerability impacting Windows Server Update Service (WSUS) in Windows Server (2012, 2016, 2019, 2022, and 2025 ), CVE - 2025 -59287

2026-05-22 02:51 UTC
Microsoft's record-breaking October 2025 Patch Tuesday fixes 175 flaws

web:fieldeffect.com

Microsoft's October 2025 Patch Tuesday fixes 175 vulnerabilities, including three zero-days under active exploitation and eight critical flaws requiring urgent patching.

2026-05-22 02:51 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-22 02:51 UTC
Microsoft October 2025 Patch Tuesday: Urgent Fixes and Windows 10 End ...

web:windowsforum.com

Microsoft's October Patch Tuesday arrived as a high‑stakes operational moment: the company shipped fixes for a large, cross‑cutting set of vulnerabilities while simultaneously closing the chapter on Windows 10 support, removing a legacy in‑box driver, and patching at least two zero‑day...

2026-05-22 02:51 UTC
Microsoft and Adobe Patch Tuesday, September 2025 Security Update ...

web:blog.qualys.com

EVALUATE Vendor-Suggested Mitigation with Policy Audit With Qualys Policy Audit's Out-of-the-Box Mitigation or Compensatory Controls, reduce the risk of a vulnerability being exploited because the remediation ( fix / patch ) cannot be done now; these security controls are not recommended by any industry standards, such as CIS, DISA-STIG.

2026-05-22 02:51 UTC
February's Patch Tuesday release fixes 59 flaws ... - Computerworld

web:www.computerworld.com

Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...

2026-05-22 02:51 UTC
ArcGIS Server Security 2025 Update 2 Patch - Esri

web:www.esri.com

Key highlights The ArcGIS Server Security 2025 update 2 is available This patch resolves 10 Medium severity vulnerabilities This security patch is cumulative, and includes fixes provided in the ArcGIS Server Security 2025 update 1.

2026-05-22 02:51 UTC
Microsoft Patch Tuesday - November 2025 - Lansweeper

web:www.lansweeper.com

Which vulnerabilities, issues, and other things did Microsoft update? Discover what's new using Lansweeper's Patch Tuesday November 2025 summary.

2026-05-22 02:51 UTC
Oracle Critical Patch Update Advisory - October 2025

web:www.oracle.com

This Critical Patch Update contains 374 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2025 Critical Patch Update: Executive Summary and Analysis.

2026-05-22 02:51 UTC
Patch Tuesday 2025 Year In Review | Tenable®

web:www.tenable.com

Key takeaways: Microsoft's 2025 Patch Tuesday releases addressed 1,130 CVEs . This is the second year in a row where the CVE count was over 1,000. Elevation of Privilege vulnerabilities accounted for 38.3% of all Patch Tuesday vulnerabilities in 2025 , followed by Remote Code Execution flaws at 30.8%. 41 zero-day vulnerabilities were addressed across all Patch Tuesday releases in 2025 , including ...

2026-05-22 02:51 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2025-59140.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59140",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-16T13:48:40.390109Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-16T13:48:48.092Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-backslash",
          "vendor": "Qix-",
          "versions": [
            {
              "status": "affected",
              "version": "= 0.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0.2.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issues is resolved in 0.2.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-506",
              "description": "CWE-506: Embedded Malicious Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T19:09:53.500Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Qix-/node-backslash/security/advisories/GHSA-53mq-f4w3-f7qv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Qix-/node-backslash/security/advisories/GHSA-53mq-f4w3-f7qv"
        },
        {
          "name": "https://github.com/debug-js/debug/issues/1005",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/debug-js/debug/issues/1005"
        },
        {
          "name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
        },
        {
          "name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
        },
        {
          "name": "https://www.ox.security/blog/npm-packages-compromised",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.ox.security/blog/npm-packages-compromised"
        }
      ],
      "source": {
        "advisory": "GHSA-53mq-f4w3-f7qv",
        "discovery": "UNKNOWN"
      },
      "title": "backslash@0.2.1 contains malware after npm account takeover"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-59140",
    "datePublished": "2025-09-15T19:09:53.500Z",
    "dateReserved": "2025-09-09T15:23:16.326Z",
    "dateUpdated": "2025-09-16T13:48:48.092Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}