Skip to content
OpenAdvisories

Package · npm

color-string

2 known vulnerabilities.

Malicious versions reported for this package

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2025-59142

    color-string@2.1.1 contains malware after npm account takeover

    color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken over after a phishing attack. Version 2.1.1 was published, functionally identical to the previous patch version, but with …

    Qix- color-string color-string npm