Listen to this Post
The CVE-2025-XXXX vulnerability stems from a compromised npm publisher account for the `error-ex` package. An attacker used stolen credentials to publish a malicious version (1.3.3). This version contained obfuscated JavaScript payloads designed to execute exclusively in browser environments. The malicious code hooks into the Web3 JavaScript environment, specifically intercepting API calls related to cryptocurrency transactions from wallets like MetaMask. It performs method replacement to silently redirect transaction details to an attacker-controlled server before the user confirms them, effectively altering the recipient address. The payload uses environmental checks to avoid detection in non-browser contexts like Node.js, ensuring it only activates when bundled into a front-end application.
Platform: npm
Version: 1.3.3
Vulnerability: Supply Chain
Severity: Critical
date: 2025-09-08
Prediction: Patch: 2025-09-13
What Undercode Say:
`npm cache clean –force`
`rm -rf node_modules/`
`npm install error-ex@latest`
`./build.sh`
How Exploit:
Malicious version published.
Credential phishing attack.
Targets browser Web3 APIs.
Protection from this CVE:
Update to latest version.
Purge npm caches.
Rebuild all bundles.
Impact:
Cryptocurrency theft.
Browser bundle compromise.
Limited to client-side.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
