# Vulnerabilities published in 2025 - [MAL-2025-146395](https://insights.sbomify.com/MAL-2025-146395/): Malicious code in postcss-loader-fork-levels-venus (npm) (malicious package) - [MAL-2025-146394](https://insights.sbomify.com/MAL-2025-146394/): Malicious code in postcss-loader-europa-webdriver-mocha-arcturus (npm) (malicious package) - [MAL-2025-146393](https://insights.sbomify.com/MAL-2025-146393/): Malicious code in postcss-loader-elara-izar-pino-pretty (npm) (malicious package) - [MAL-2025-146392](https://insights.sbomify.com/MAL-2025-146392/): Malicious code in postcss-loader-dotenv-safe-yakutsk-dione (npm) (malicious package) - [MAL-2025-146391](https://insights.sbomify.com/MAL-2025-146391/): Malicious code in postcss-loader-css-minimizer-webpack-plugin-achernar-barnard (npm) (malicious package) - [MAL-2025-146390](https://insights.sbomify.com/MAL-2025-146390/): Malicious code in postcss-loader-commitizen-foundation-xenos (npm) (malicious package) - [MAL-2025-14639](https://insights.sbomify.com/MAL-2025-14639/): Malicious code in api-chatfb (npm) (malicious package) - [MAL-2025-146389](https://insights.sbomify.com/MAL-2025-146389/): Malicious code in postcss-loader-child-process-element-ui-weywot (npm) (malicious package) - [MAL-2025-146388](https://insights.sbomify.com/MAL-2025-146388/): Malicious code in postcss-google-prompts-commitizen (npm) (malicious package) - [MAL-2025-146387](https://insights.sbomify.com/MAL-2025-146387/): Malicious code in postcss-eslint-semantic-ui-metalsmith (npm) (malicious package) - [MAL-2025-146386](https://insights.sbomify.com/MAL-2025-146386/): Malicious code in postcss-deimos-express-fusion (npm) (malicious package) - [MAL-2025-146385](https://insights.sbomify.com/MAL-2025-146385/): Malicious code in postcss-cz-conventional-changelog-nova-element-ui (npm) (malicious package) - [MAL-2025-146384](https://insights.sbomify.com/MAL-2025-146384/): Malicious code in postcss-concurrently-envconfig-meteor (npm) (malicious package) - [MAL-2025-146383](https://insights.sbomify.com/MAL-2025-146383/): Malicious code in postcss-charon-antares-mutation (npm) (malicious package) - [MAL-2025-146382](https://insights.sbomify.com/MAL-2025-146382/): Malicious code in postcss-chalk-cassini-hugo (npm) (malicious package) - [MAL-2025-146381](https://insights.sbomify.com/MAL-2025-146381/): Malicious code in postcss-capella-jabbah-phenomic (npm) (malicious package) - [MAL-2025-146380](https://insights.sbomify.com/MAL-2025-146380/): Malicious code in postcss-await-janus-triton (npm) (malicious package) - [MAL-2025-14638](https://insights.sbomify.com/MAL-2025-14638/): Malicious code in api-chat-fanpage-facebook (npm) (malicious package) - [MAL-2025-146379](https://insights.sbomify.com/MAL-2025-146379/): Malicious code in postcss-atlas-graphql-spectron-webdriver (npm) (malicious package) - [MAL-2025-146378](https://insights.sbomify.com/MAL-2025-146378/): Malicious code in postcss-airbnb-query-start (npm) (malicious package) - [MAL-2025-146377](https://insights.sbomify.com/MAL-2025-146377/): Malicious code in polaris-writable-nova-polaris (npm) (malicious package) - [MAL-2025-146376](https://insights.sbomify.com/MAL-2025-146376/): Malicious code in polaris-weywot-ganymede-start (npm) (malicious package) - [MAL-2025-146375](https://insights.sbomify.com/MAL-2025-146375/): Malicious code in polaris-transform-firebase-quasar (npm) (malicious package) - [MAL-2025-146374](https://insights.sbomify.com/MAL-2025-146374/): Malicious code in polaris-tailwindcss-gravity-geckodriver (npm) (malicious package) - [MAL-2025-146373](https://insights.sbomify.com/MAL-2025-146373/): Malicious code in polaris-sync-procyon-sagitta (npm) (malicious package) - [MAL-2025-146372](https://insights.sbomify.com/MAL-2025-146372/): Malicious code in polaris-stop-build-async (npm) (malicious package) - [MAL-2025-146371](https://insights.sbomify.com/MAL-2025-146371/): Malicious code in polaris-spectron-webdriver-polaris-rollup-plugin (npm) (malicious package) - [MAL-2025-146370](https://insights.sbomify.com/MAL-2025-146370/): Malicious code in polaris-spectron-webdriver-development-xo (npm) (malicious package) - [MAL-2025-14637](https://insights.sbomify.com/MAL-2025-14637/): Malicious code in api-bot-basil (npm) (malicious package) - [MAL-2025-146369](https://insights.sbomify.com/MAL-2025-146369/): Malicious code in polaris-spawn-ora-perseus (npm) (malicious package) - [MAL-2025-146368](https://insights.sbomify.com/MAL-2025-146368/): Malicious code in polaris-slides-javascript-sagitta (npm) (malicious package) - [MAL-2025-146367](https://insights.sbomify.com/MAL-2025-146367/): Malicious code in polaris-slides-izar-proxima (npm) (malicious package) - [MAL-2025-146366](https://insights.sbomify.com/MAL-2025-146366/): Malicious code in polaris-shelljs-jekyll-sails (npm) (malicious package) - [MAL-2025-146365](https://insights.sbomify.com/MAL-2025-146365/): Malicious code in polaris-scripts-local-grunt (npm) (malicious package) - [MAL-2025-146364](https://insights.sbomify.com/MAL-2025-146364/): Malicious code in polaris-schema-browserify-capella (npm) (malicious package) - [MAL-2025-146363](https://insights.sbomify.com/MAL-2025-146363/): Malicious code in polaris-repository-ignite-configstore (npm) (malicious package) - [MAL-2025-146362](https://insights.sbomify.com/MAL-2025-146362/): Malicious code in polaris-postgres-sirius-ursa (npm) (malicious package) - [MAL-2025-146361](https://insights.sbomify.com/MAL-2025-146361/): Malicious code in polaris-playwright-proxima-stop (npm) (malicious package) - [MAL-2025-146360](https://insights.sbomify.com/MAL-2025-146360/): Malicious code in polaris-playwright-pino-pretty-transform (npm) (malicious package) - [MAL-2025-14636](https://insights.sbomify.com/MAL-2025-14636/): Malicious code in apfinal (npm) (malicious package) - [MAL-2025-146359](https://insights.sbomify.com/MAL-2025-146359/): Malicious code in polaris-phoebe-spectron-webdriver-enif (npm) (malicious package) - [MAL-2025-146358](https://insights.sbomify.com/MAL-2025-146358/): Malicious code in polaris-phoebe-materialize-lynx (npm) (malicious package) - [MAL-2025-146357](https://insights.sbomify.com/MAL-2025-146357/): Malicious code in polaris-nashira-jwt-betelgeuse (npm) (malicious package) - [MAL-2025-146356](https://insights.sbomify.com/MAL-2025-146356/): Malicious code in polaris-module-quito-halley (npm) (malicious package) - [MAL-2025-146355](https://insights.sbomify.com/MAL-2025-146355/): Malicious code in polaris-meteor-babel-install (npm) (malicious package) - [MAL-2025-146354](https://insights.sbomify.com/MAL-2025-146354/): Malicious code in polaris-mdx-pulsar-transport (npm) (malicious package) - [MAL-2025-146353](https://insights.sbomify.com/MAL-2025-146353/): Malicious code in polaris-markdown-titan-spica (npm) (malicious package) - [MAL-2025-146352](https://insights.sbomify.com/MAL-2025-146352/): Malicious code in polaris-karma-hermes-galaxy (npm) (malicious package) - [MAL-2025-146351](https://insights.sbomify.com/MAL-2025-146351/): Malicious code in polaris-juno-bulma-pegasus (npm) (malicious package) - [MAL-2025-146350](https://insights.sbomify.com/MAL-2025-146350/): Malicious code in polaris-janus-dotenv-dactyl (npm) (malicious package) - [MAL-2025-14635](https://insights.sbomify.com/MAL-2025-14635/): Malicious code in apex-ursa-gatsby-enceladus (npm) (malicious package) - [MAL-2025-146349](https://insights.sbomify.com/MAL-2025-146349/): Malicious code in polaris-jabbah-hermes-css-minimizer-webpack-plugin (npm) (malicious package) - [MAL-2025-146348](https://insights.sbomify.com/MAL-2025-146348/): Malicious code in polaris-inquirer-playwright-vuepress (npm) (malicious package) - [MAL-2025-146347](https://insights.sbomify.com/MAL-2025-146347/): Malicious code in polaris-inquirer-hexo-figures (npm) (malicious package) - [MAL-2025-146346](https://insights.sbomify.com/MAL-2025-146346/): Malicious code in polaris-hexo-process-scorpius (npm) (malicious package) - [MAL-2025-146345](https://insights.sbomify.com/MAL-2025-146345/): Malicious code in polaris-grunt-nightwatch-apex (npm) (malicious package) - [MAL-2025-146344](https://insights.sbomify.com/MAL-2025-146344/): Malicious code in polaris-google-proxima-hercules (npm) (malicious package) - [MAL-2025-146343](https://insights.sbomify.com/MAL-2025-146343/): Malicious code in polaris-galaxy-dione-css-loader (npm) (malicious package) - [MAL-2025-146342](https://insights.sbomify.com/MAL-2025-146342/): Malicious code in polaris-fornax-betelgeuse-element-ui (npm) (malicious package) - [MAL-2025-146341](https://insights.sbomify.com/MAL-2025-146341/): Malicious code in polaris-flare-wezen-dorado (npm) (malicious package) - [MAL-2025-146340](https://insights.sbomify.com/MAL-2025-146340/): Malicious code in polaris-europa-csv-electron-builder (npm) (malicious package) - [MAL-2025-14634](https://insights.sbomify.com/MAL-2025-14634/): Malicious code in apex-promise-transport-commitizen (npm) (malicious package) - [MAL-2025-146339](https://insights.sbomify.com/MAL-2025-146339/): Malicious code in polaris-eslint-bunyan-pegasus (npm) (malicious package) - [MAL-2025-146338](https://insights.sbomify.com/MAL-2025-146338/): Malicious code in polaris-equinox-envconfig-neptune (npm) (malicious package) - [MAL-2025-146337](https://insights.sbomify.com/MAL-2025-146337/): Malicious code in polaris-epimetheus-chariklo-apollo (npm) (malicious package) - [MAL-2025-146336](https://insights.sbomify.com/MAL-2025-146336/): Malicious code in polaris-element-ui-mongodb-lint (npm) (malicious package) - [MAL-2025-146335](https://insights.sbomify.com/MAL-2025-146335/): Malicious code in polaris-development-subscription-eridanus (npm) (malicious package) - [MAL-2025-146334](https://insights.sbomify.com/MAL-2025-146334/): Malicious code in polaris-despina-galaxy-got (npm) (malicious package) - [MAL-2025-146333](https://insights.sbomify.com/MAL-2025-146333/): Malicious code in polaris-csrf-solis-xanthus (npm) (malicious package) - [MAL-2025-146332](https://insights.sbomify.com/MAL-2025-146332/): Malicious code in polaris-cors-oberon-janus (npm) (malicious package) - [MAL-2025-146331](https://insights.sbomify.com/MAL-2025-146331/): Malicious code in polaris-cordelia-jekyll-metalsmith (npm) (malicious package) - [MAL-2025-146330](https://insights.sbomify.com/MAL-2025-146330/): Malicious code in polaris-commitlint-config-angular-gemini-mdx (npm) (malicious package) - [MAL-2025-14633](https://insights.sbomify.com/MAL-2025-14633/): Malicious code in apex-bioinformatics-development-geodynamo (npm) (malicious package) - [MAL-2025-146329](https://insights.sbomify.com/MAL-2025-146329/): Malicious code in polaris-colors-less-titan (npm) (malicious package) - [MAL-2025-146328](https://insights.sbomify.com/MAL-2025-146328/): Malicious code in polaris-charon-delphinus-dorado (npm) (malicious package) - [MAL-2025-146327](https://insights.sbomify.com/MAL-2025-146327/): Malicious code in polaris-cache-geckodriver-gravity (npm) (malicious package) - [MAL-2025-146326](https://insights.sbomify.com/MAL-2025-146326/): Malicious code in polaris-betelgeuse-html-webpack-plugin-pm2 (npm) (malicious package) - [MAL-2025-146325](https://insights.sbomify.com/MAL-2025-146325/): Malicious code in polaris-backend-lynx-quark (npm) (malicious package) - [MAL-2025-146324](https://insights.sbomify.com/MAL-2025-146324/): Malicious code in polaris-aurora-mensa-cluster (npm) (malicious package) - [MAL-2025-146323](https://insights.sbomify.com/MAL-2025-146323/): Malicious code in polaris-arcturus-global-warp (npm) (malicious package) - [MAL-2025-146322](https://insights.sbomify.com/MAL-2025-146322/): Malicious code in polaris-aquarius-phoebe-chromedriver (npm) (malicious package) - [MAL-2025-146321](https://insights.sbomify.com/MAL-2025-146321/): Malicious code in polaris-antd-uglify-js-server (npm) (malicious package) - [MAL-2025-146320](https://insights.sbomify.com/MAL-2025-146320/): Malicious code in polaris-alphard-sequelize-atlas (npm) (malicious package) - [MAL-2025-14632](https://insights.sbomify.com/MAL-2025-14632/): Malicious code in apeksha (npm) (malicious package) - [MAL-2025-146319](https://insights.sbomify.com/MAL-2025-146319/): Malicious code in polaris-aether-andromeda-alphard (npm) (malicious package) - [MAL-2025-146318](https://insights.sbomify.com/MAL-2025-146318/): Malicious code in pm2-zenobia-dependencies-phoebe (npm) (malicious package) - [MAL-2025-146317](https://insights.sbomify.com/MAL-2025-146317/): Malicious code in pm2-yakutsk-config-puppeteer (npm) (malicious package) - [MAL-2025-146316](https://insights.sbomify.com/MAL-2025-146316/): Malicious code in pm2-xerxes-luna-nodejs (npm) (malicious package) - [MAL-2025-146315](https://insights.sbomify.com/MAL-2025-146315/): Malicious code in pm2-wezen-jest-acamar (npm) (malicious package) - [MAL-2025-146314](https://insights.sbomify.com/MAL-2025-146314/): Malicious code in pm2-sync-convict-react-bootstrap (npm) (malicious package) - [MAL-2025-146313](https://insights.sbomify.com/MAL-2025-146313/): Malicious code in pm2-sqlite-got-stop (npm) (malicious package) - [MAL-2025-146312](https://insights.sbomify.com/MAL-2025-146312/): Malicious code in pm2-slidev-jasmine-regulus (npm) (malicious package) - [MAL-2025-146311](https://insights.sbomify.com/MAL-2025-146311/): Malicious code in pm2-run-script-eslint-plugin-leda (npm) (malicious package) - [MAL-2025-146310](https://insights.sbomify.com/MAL-2025-146310/): Malicious code in pm2-reveal-md-neptune-dorado (npm) (malicious package) - [MAL-2025-14631](https://insights.sbomify.com/MAL-2025-14631/): Malicious code in ape-staking-public (npm) (malicious package) - [MAL-2025-146309](https://insights.sbomify.com/MAL-2025-146309/): Malicious code in pm2-reveal-md-event-sagitta (npm) (malicious package) - [MAL-2025-146308](https://insights.sbomify.com/MAL-2025-146308/): Malicious code in pm2-registry-kronos-janus (npm) (malicious package) - [MAL-2025-146307](https://insights.sbomify.com/MAL-2025-146307/): Malicious code in pm2-query-mocha-halley (npm) (malicious package) - [MAL-2025-146306](https://insights.sbomify.com/MAL-2025-146306/): Malicious code in pm2-polaris-izar-oberon (npm) (malicious package) - [MAL-2025-146305](https://insights.sbomify.com/MAL-2025-146305/): Malicious code in pm2-pegasus-leda-xerxes (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2025/page/1417/