CVE-2025-59330

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59330
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59330.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-59330
Aliases
Published
2025-09-15T19:19:22Z
Modified
2026-10-21T02:54:08Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red CVSS Calculator
Summary
error-ex@1.3.3 contains malware after npm account takeover
Details

error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack. Version 1.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-506"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59330.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "= 1.3.3"
                        },
                        {
                            "last_affected":  "= 1.3.3"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/qix-/node-error-ex

Affected ranges

Type
GIT
Repo
https://github.com/qix-/node-error-ex
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3c336b9a923d636328e9a7857d11ae0db79f3196
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.3.4"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

0.*
0.1.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
1.*
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.3.0
1.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59330.json"