Skip to content
OpenAdvisories

Package · npm

color-string

2 known vulnerabilities.

Malicious versions reported for this package

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.8
    CVE-2025-59142

    color-string@2.1.1 contains malware after npm account takeover

    color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken over after a phishing attack. Version 2.1.1 was published, functionally identical to the previous patch version, but with …

    Qix- color-string color-string npm
  • Medium 5.3
    CVE-2021-29060

    Regular Expression Denial of Service (ReDOS)

    A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.

    color-string node-color-string node-color-string Debian Ubuntu npm