# Vulnerabilities published in 2025


- [MAL-2025-149004](https://insights.sbomify.com/MAL-2025-149004/): Malicious code in upgrade-callisto-metalsmith-europa (npm) (malicious package)
- [MAL-2025-149003](https://insights.sbomify.com/MAL-2025-149003/): Malicious code in upgrade-bellatrix-luna-zephyr (npm) (malicious package)
- [MAL-2025-149002](https://insights.sbomify.com/MAL-2025-149002/): Malicious code in update-typeorm-loopback-framework (npm) (malicious package)
- [MAL-2025-149001](https://insights.sbomify.com/MAL-2025-149001/): Malicious code in update-remark-husky-chakra-ui (npm) (malicious package)
- [MAL-2025-149000](https://insights.sbomify.com/MAL-2025-149000/): Malicious code in update-procyon-ophiuchus-blitz (npm) (malicious package)
- [MAL-2025-14900](https://insights.sbomify.com/MAL-2025-14900/): Malicious code in ash-profile (npm) (malicious package)
- [MAL-2025-1490](https://insights.sbomify.com/MAL-2025-1490/): Malicious code in modulous (npm) (malicious package)
- [MAL-2025-149](https://insights.sbomify.com/MAL-2025-149/): Malicious code in aaguid (npm) (malicious package)
- [MAL-2025-148999](https://insights.sbomify.com/MAL-2025-148999/): Malicious code in update-markdown-pdf-pyxis-spinner (npm) (malicious package)
- [MAL-2025-148998](https://insights.sbomify.com/MAL-2025-148998/): Malicious code in update-kinetic-comet-chariklo (npm) (malicious package)
- [MAL-2025-148997](https://insights.sbomify.com/MAL-2025-148997/): Malicious code in update-halley-framework-auriga (npm) (malicious package)
- [MAL-2025-148996](https://insights.sbomify.com/MAL-2025-148996/): Malicious code in update-ganymede-typeorm-nextjs (npm) (malicious package)
- [MAL-2025-148995](https://insights.sbomify.com/MAL-2025-148995/): Malicious code in update-dynamo-cypress-karma (npm) (malicious package)
- [MAL-2025-148994](https://insights.sbomify.com/MAL-2025-148994/): Malicious code in update-config-mui-corvus (npm) (malicious package)
- [MAL-2025-148993](https://insights.sbomify.com/MAL-2025-148993/): Malicious code in update-child-process-xerxes-postcss (npm) (malicious package)
- [MAL-2025-148992](https://insights.sbomify.com/MAL-2025-148992/): Malicious code in update-chai-non-blocking-jwt (npm) (malicious package)
- [MAL-2025-148991](https://insights.sbomify.com/MAL-2025-148991/): Malicious code in update-blitz-karma-auth (npm) (malicious package)
- [MAL-2025-148990](https://insights.sbomify.com/MAL-2025-148990/): Malicious code in update-await-uninstall-testcafe (npm) (malicious package)
- [MAL-2025-14899](https://insights.sbomify.com/MAL-2025-14899/): Malicious code in ash-history (npm) (malicious package)
- [MAL-2025-148989](https://insights.sbomify.com/MAL-2025-148989/): Malicious code in update-airbnb-dione-superagent (npm) (malicious package)
- [MAL-2025-148988](https://insights.sbomify.com/MAL-2025-148988/): Malicious code in unuk-vuepress-sagitta-taurus (npm) (malicious package)
- [MAL-2025-148987](https://insights.sbomify.com/MAL-2025-148987/): Malicious code in unuk-sirius-quantum-process (npm) (malicious package)
- [MAL-2025-148986](https://insights.sbomify.com/MAL-2025-148986/): Malicious code in unuk-sedna-cross-env-xanadu (npm) (malicious package)
- [MAL-2025-148985](https://insights.sbomify.com/MAL-2025-148985/): Malicious code in unuk-schema-cross-env-browserify (npm) (malicious package)
- [MAL-2025-148984](https://insights.sbomify.com/MAL-2025-148984/): Malicious code in unuk-sass-loader-nuxtjs-buffer (npm) (malicious package)
- [MAL-2025-148983](https://insights.sbomify.com/MAL-2025-148983/): Malicious code in unuk-parcel-antd-elektra (npm) (malicious package)
- [MAL-2025-148982](https://insights.sbomify.com/MAL-2025-148982/): Malicious code in unuk-nightwatch-levels-neptune (npm) (malicious package)
- [MAL-2025-148981](https://insights.sbomify.com/MAL-2025-148981/): Malicious code in unuk-iota-zenith-html-webpack-plugin (npm) (malicious package)
- [MAL-2025-148980](https://insights.sbomify.com/MAL-2025-148980/): Malicious code in unuk-halley-taurus-yakutsk (npm) (malicious package)
- [MAL-2025-14898](https://insights.sbomify.com/MAL-2025-14898/): Malicious code in ash-drag-drop (npm) (malicious package)
- [MAL-2025-148979](https://insights.sbomify.com/MAL-2025-148979/): Malicious code in unuk-despina-webdriver-manager-markdown-pdf (npm) (malicious package)
- [MAL-2025-148978](https://insights.sbomify.com/MAL-2025-148978/): Malicious code in unuk-deneb-meteor-quantum (npm) (malicious package)
- [MAL-2025-148977](https://insights.sbomify.com/MAL-2025-148977/): Malicious code in unuk-chariklo-pm2-tool (npm) (malicious package)
- [MAL-2025-148976](https://insights.sbomify.com/MAL-2025-148976/): Malicious code in unuk-avior-hugo-perseus (npm) (malicious package)
- [MAL-2025-148975](https://insights.sbomify.com/MAL-2025-148975/): Malicious code in unuk-apollo-spectron-webdriver-izar (npm) (malicious package)
- [MAL-2025-148974](https://insights.sbomify.com/MAL-2025-148974/): Malicious code in uninstall-zephyr-publish-aether (npm) (malicious package)
- [MAL-2025-148973](https://insights.sbomify.com/MAL-2025-148973/): Malicious code in uninstall-yildun-corvus-hermes (npm) (malicious package)
- [MAL-2025-148972](https://insights.sbomify.com/MAL-2025-148972/): Malicious code in uninstall-xanadu-weywot-hapi (npm) (malicious package)
- [MAL-2025-148971](https://insights.sbomify.com/MAL-2025-148971/): Malicious code in uninstall-sync-apex-event (npm) (malicious package)
- [MAL-2025-148970](https://insights.sbomify.com/MAL-2025-148970/): Malicious code in uninstall-sedna-config-helios (npm) (malicious package)
- [MAL-2025-14897](https://insights.sbomify.com/MAL-2025-14897/): Malicious code in ash-cwnhs-8s6qq-mirage-project (npm) (malicious package)
- [MAL-2025-148969](https://insights.sbomify.com/MAL-2025-148969/): Malicious code in uninstall-sass-loader-pegasus-weywot (npm) (malicious package)
- [MAL-2025-148968](https://insights.sbomify.com/MAL-2025-148968/): Malicious code in uninstall-sadr-odin-nconf (npm) (malicious package)
- [MAL-2025-148967](https://insights.sbomify.com/MAL-2025-148967/): Malicious code in uninstall-quasar-webdriverio-gridsome (npm) (malicious package)
- [MAL-2025-148966](https://insights.sbomify.com/MAL-2025-148966/): Malicious code in uninstall-protractor-xerxes-galaxy (npm) (malicious package)
- [MAL-2025-148965](https://insights.sbomify.com/MAL-2025-148965/): Malicious code in uninstall-prompts-carpo-auriga (npm) (malicious package)
- [MAL-2025-148964](https://insights.sbomify.com/MAL-2025-148964/): Malicious code in uninstall-perseus-duplex-uninstall (npm) (malicious package)
- [MAL-2025-148963](https://insights.sbomify.com/MAL-2025-148963/): Malicious code in uninstall-octans-procyon-soap (npm) (malicious package)
- [MAL-2025-148962](https://insights.sbomify.com/MAL-2025-148962/): Malicious code in uninstall-magellan-enif-nashira (npm) (malicious package)
- [MAL-2025-148961](https://insights.sbomify.com/MAL-2025-148961/): Malicious code in uninstall-local-meissa-miranda (npm) (malicious package)
- [MAL-2025-148960](https://insights.sbomify.com/MAL-2025-148960/): Malicious code in uninstall-inquirer-vega-graphql (npm) (malicious package)
- [MAL-2025-14896](https://insights.sbomify.com/MAL-2025-14896/): Malicious code in ash-bmadi-535bf-fjord-project (npm) (malicious package)
- [MAL-2025-148959](https://insights.sbomify.com/MAL-2025-148959/): Malicious code in uninstall-html-webpack-plugin-leda-upgrade (npm) (malicious package)
- [MAL-2025-148958](https://insights.sbomify.com/MAL-2025-148958/): Malicious code in uninstall-helios-geckodriver-cressida (npm) (malicious package)
- [MAL-2025-148957](https://insights.sbomify.com/MAL-2025-148957/): Malicious code in uninstall-helios-aldebaran-colors (npm) (malicious package)
- [MAL-2025-148956](https://insights.sbomify.com/MAL-2025-148956/): Malicious code in uninstall-figures-epimetheus-auriga (npm) (malicious package)
- [MAL-2025-148955](https://insights.sbomify.com/MAL-2025-148955/): Malicious code in uninstall-comet-orbit-oauth (npm) (malicious package)
- [MAL-2025-148954](https://insights.sbomify.com/MAL-2025-148954/): Malicious code in uninstall-browserify-ganymede-postcss-loader (npm) (malicious package)
- [MAL-2025-148953](https://insights.sbomify.com/MAL-2025-148953/): Malicious code in uninstall-axios-node-sass-exec (npm) (malicious package)
- [MAL-2025-148952](https://insights.sbomify.com/MAL-2025-148952/): Malicious code in uninstall-apollo-gacrux-dependencies (npm) (malicious package)
- [MAL-2025-148951](https://insights.sbomify.com/MAL-2025-148951/): Malicious code in uninstall-acamar-supervisor-cassini (npm) (malicious package)
- [MAL-2025-148950](https://insights.sbomify.com/MAL-2025-148950/): Malicious code in unchanged_planarian_sapphire-50 (npm) (malicious package)
- [MAL-2025-14895](https://insights.sbomify.com/MAL-2025-14895/): Malicious code in ash-5n1ax-68m0q-cascade-project (npm) (malicious package)
- [MAL-2025-148949](https://insights.sbomify.com/MAL-2025-148949/): Malicious code in umbriel-umbra-centauri-chariklo (npm) (malicious package)
- [MAL-2025-148948](https://insights.sbomify.com/MAL-2025-148948/): Malicious code in umbriel-transform-galaxy-pavo (npm) (malicious package)
- [MAL-2025-148947](https://insights.sbomify.com/MAL-2025-148947/): Malicious code in umbriel-style-loader-commitizen-spectron (npm) (malicious package)
- [MAL-2025-148946](https://insights.sbomify.com/MAL-2025-148946/): Malicious code in umbriel-promise-castor-spectron-webdriver (npm) (malicious package)
- [MAL-2025-148945](https://insights.sbomify.com/MAL-2025-148945/): Malicious code in umbriel-orbit-firebase-vuepress (npm) (malicious package)
- [MAL-2025-148944](https://insights.sbomify.com/MAL-2025-148944/): Malicious code in umbriel-mongodb-pegasus-rocket (npm) (malicious package)
- [MAL-2025-148943](https://insights.sbomify.com/MAL-2025-148943/): Malicious code in umbriel-install-cygnus-markdown (npm) (malicious package)
- [MAL-2025-148942](https://insights.sbomify.com/MAL-2025-148942/): Malicious code in umbriel-indus-cache-prettier-plugin-markdown (npm) (malicious package)
- [MAL-2025-148941](https://insights.sbomify.com/MAL-2025-148941/): Malicious code in umbriel-hyperion-ignite-quasar (npm) (malicious package)
- [MAL-2025-148940](https://insights.sbomify.com/MAL-2025-148940/): Malicious code in umbriel-fornax-antd-gatsby (npm) (malicious package)
- [MAL-2025-14894](https://insights.sbomify.com/MAL-2025-14894/): Malicious code in ash-5grfr-jsbt8-crystal-project (npm) (malicious package)
- [MAL-2025-148939](https://insights.sbomify.com/MAL-2025-148939/): Malicious code in umbriel-equinox-corvus-public (npm) (malicious package)
- [MAL-2025-148938](https://insights.sbomify.com/MAL-2025-148938/): Malicious code in umbriel-dactyl-solis-publish (npm) (malicious package)
- [MAL-2025-148937](https://insights.sbomify.com/MAL-2025-148937/): Malicious code in umbriel-colors-vulcan-global (npm) (malicious package)
- [MAL-2025-148936](https://insights.sbomify.com/MAL-2025-148936/): Malicious code in umbriel-chai-celeste-registry (npm) (malicious package)
- [MAL-2025-148935](https://insights.sbomify.com/MAL-2025-148935/): Malicious code in umbra-yaml-castor-axios (npm) (malicious package)
- [MAL-2025-148934](https://insights.sbomify.com/MAL-2025-148934/): Malicious code in umbra-sirius-scorpius-module (npm) (malicious package)
- [MAL-2025-148933](https://insights.sbomify.com/MAL-2025-148933/): Malicious code in umbra-react-bootstrap-meissa-regulus (npm) (malicious package)
- [MAL-2025-148932](https://insights.sbomify.com/MAL-2025-148932/): Malicious code in umbra-phenomic-electron-builder-eslint (npm) (malicious package)
- [MAL-2025-148931](https://insights.sbomify.com/MAL-2025-148931/): Malicious code in umbra-package-phoebe-version (npm) (malicious package)
- [MAL-2025-148930](https://insights.sbomify.com/MAL-2025-148930/): Malicious code in umbra-optimize-css-assets-webpack-plugin-radiant-publish (npm) (malicious package)
- [MAL-2025-14893](https://insights.sbomify.com/MAL-2025-14893/): Malicious code in ash-1fcz8-nntfy-paradise-project (npm) (malicious package)
- [MAL-2025-148929](https://insights.sbomify.com/MAL-2025-148929/): Malicious code in umbra-octans-soap-jekyll (npm) (malicious package)
- [MAL-2025-148928](https://insights.sbomify.com/MAL-2025-148928/): Malicious code in umbra-npm-jovian-local (npm) (malicious package)
- [MAL-2025-148927](https://insights.sbomify.com/MAL-2025-148927/): Malicious code in umbra-nodejs-nestjs-node-config (npm) (malicious package)
- [MAL-2025-148926](https://insights.sbomify.com/MAL-2025-148926/): Malicious code in umbra-nebula-metalsmith-gatsby (npm) (malicious package)
- [MAL-2025-148925](https://insights.sbomify.com/MAL-2025-148925/): Malicious code in umbra-mutation-morgan-async (npm) (malicious package)
- [MAL-2025-148924](https://insights.sbomify.com/MAL-2025-148924/): Malicious code in umbra-module-json-link (npm) (malicious package)
- [MAL-2025-148923](https://insights.sbomify.com/MAL-2025-148923/): Malicious code in umbra-metalsmith-hermes-perseus (npm) (malicious package)
- [MAL-2025-148922](https://insights.sbomify.com/MAL-2025-148922/): Malicious code in umbra-meissa-yaml-radiant (npm) (malicious package)
- [MAL-2025-148921](https://insights.sbomify.com/MAL-2025-148921/): Malicious code in umbra-meissa-mongoose-flare (npm) (malicious package)
- [MAL-2025-148920](https://insights.sbomify.com/MAL-2025-148920/): Malicious code in umbra-mdx-algol-webdriver-mocha (npm) (malicious package)
- [MAL-2025-14892](https://insights.sbomify.com/MAL-2025-14892/): Malicious code in asghar (npm) (malicious package)
- [MAL-2025-148919](https://insights.sbomify.com/MAL-2025-148919/): Malicious code in umbra-fomalhaut-cypress-bootstrap (npm) (malicious package)
- [MAL-2025-148918](https://insights.sbomify.com/MAL-2025-148918/): Malicious code in umbra-eslint-config-elektra-postgres (npm) (malicious package)
- [MAL-2025-148917](https://insights.sbomify.com/MAL-2025-148917/): Malicious code in umbra-enif-node-sass-html-webpack-plugin (npm) (malicious package)
- [MAL-2025-148916](https://insights.sbomify.com/MAL-2025-148916/): Malicious code in umbra-cors-electron-oauth (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/1388/