npm package
color-name
pkg:npm/color-name
Malware
3 malicious versions on record
One or more versions of this package have been flagged as containing malicious code. Audit any system that installed an affected version.
- GHSA-5fvm-p68v-5wmh[email protected] contains malware after npm account takeoverSep 15, 2025
- MAL-2025-46972Malicious code in color-name (npm)Sep 8, 2025
- GHSA-m99c-cfww-cxqxDuplicate Advisory: Malware in color-nameSep 8, 2025
Vulnerabilities (1)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-59145 | Hig | — | >= 2.0.1, < 2.0.2 | 2.0.2 | Sep 15, 2025 | color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redir |
- affected >= 2.0.1, < 2.0.2fixed 2.0.2
color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redir