# Vulnerabilities published in 2025


- [MAL-2025-143334](https://insights.sbomify.com/MAL-2025-143334/): Malicious code in hermes-xml-auth0-sirius (npm) (malicious package)
- [MAL-2025-143333](https://insights.sbomify.com/MAL-2025-143333/): Malicious code in hermes-wolf-module-halley (npm) (malicious package)
- [MAL-2025-143332](https://insights.sbomify.com/MAL-2025-143332/): Malicious code in hermes-webdriver-manager-janus-hyperion (npm) (malicious package)
- [MAL-2025-143331](https://insights.sbomify.com/MAL-2025-143331/): Malicious code in hermes-webdriver-manager-atlas-unuk (npm) (malicious package)
- [MAL-2025-143330](https://insights.sbomify.com/MAL-2025-143330/): Malicious code in hermes-testcafe-toml-nextjs (npm) (malicious package)
- [MAL-2025-14333](https://insights.sbomify.com/MAL-2025-14333/): Malicious code in almond-nightingale-5bj8 (npm) (malicious package)
- [MAL-2025-143329](https://insights.sbomify.com/MAL-2025-143329/): Malicious code in hermes-superagent-google-koa (npm) (malicious package)
- [MAL-2025-143328](https://insights.sbomify.com/MAL-2025-143328/): Malicious code in hermes-stop-uglify-js-axios (npm) (malicious package)
- [MAL-2025-143327](https://insights.sbomify.com/MAL-2025-143327/): Malicious code in hermes-spica-taurus-json (npm) (malicious package)
- [MAL-2025-143326](https://insights.sbomify.com/MAL-2025-143326/): Malicious code in hermes-sagitta-galaxy-testcafe (npm) (malicious package)
- [MAL-2025-143325](https://insights.sbomify.com/MAL-2025-143325/): Malicious code in hermes-request-antares-less-loader (npm) (malicious package)
- [MAL-2025-143324](https://insights.sbomify.com/MAL-2025-143324/): Malicious code in hermes-relay-mensa-rollup-plugin (npm) (malicious package)
- [MAL-2025-143323](https://insights.sbomify.com/MAL-2025-143323/): Malicious code in hermes-rehype-writable-eleventy (npm) (malicious package)
- [MAL-2025-143322](https://insights.sbomify.com/MAL-2025-143322/): Malicious code in hermes-radiant-lint-staged-sirius (npm) (malicious package)
- [MAL-2025-143321](https://insights.sbomify.com/MAL-2025-143321/): Malicious code in hermes-quark-xanthus-umbra (npm) (malicious package)
- [MAL-2025-143320](https://insights.sbomify.com/MAL-2025-143320/): Malicious code in hermes-publish-socketio-commitizen (npm) (malicious package)
- [MAL-2025-14332](https://insights.sbomify.com/MAL-2025-14332/): Malicious code in almond-lima-w0mk (npm) (malicious package)
- [MAL-2025-143319](https://insights.sbomify.com/MAL-2025-143319/): Malicious code in hermes-publish-husky-ultra (npm) (malicious package)
- [MAL-2025-143318](https://insights.sbomify.com/MAL-2025-143318/): Malicious code in hermes-halley-semantic-release-rigel (npm) (malicious package)
- [MAL-2025-143317](https://insights.sbomify.com/MAL-2025-143317/): Malicious code in hermes-gacrux-meissa-cordelia (npm) (malicious package)
- [MAL-2025-143316](https://insights.sbomify.com/MAL-2025-143316/): Malicious code in hermes-enceladus-commitizen-kaus (npm) (malicious package)
- [MAL-2025-143315](https://insights.sbomify.com/MAL-2025-143315/): Malicious code in hermes-development-virgo-promise (npm) (malicious package)
- [MAL-2025-143314](https://insights.sbomify.com/MAL-2025-143314/): Malicious code in hermes-development-browserify-framework (npm) (malicious package)
- [MAL-2025-143313](https://insights.sbomify.com/MAL-2025-143313/): Malicious code in hermes-css-minimizer-webpack-plugin-local-request (npm) (malicious package)
- [MAL-2025-143312](https://insights.sbomify.com/MAL-2025-143312/): Malicious code in hermes-css-loader-request-restart (npm) (malicious package)
- [MAL-2025-143311](https://insights.sbomify.com/MAL-2025-143311/): Malicious code in hermes-cross-env-quasar-duplex (npm) (malicious package)
- [MAL-2025-143310](https://insights.sbomify.com/MAL-2025-143310/): Malicious code in hermes-configstore-eslint-plugin-express (npm) (malicious package)
- [MAL-2025-14331](https://insights.sbomify.com/MAL-2025-14331/): Malicious code in almond-kale-ywzb (npm) (malicious package)
- [MAL-2025-143309](https://insights.sbomify.com/MAL-2025-143309/): Malicious code in hermes-concurrently-hermes-subscription (npm) (malicious package)
- [MAL-2025-143308](https://insights.sbomify.com/MAL-2025-143308/): Malicious code in hermes-chromedriver-registry-websockets (npm) (malicious package)
- [MAL-2025-143307](https://insights.sbomify.com/MAL-2025-143307/): Malicious code in hermes-child-process-event-firebase (npm) (malicious package)
- [MAL-2025-143306](https://insights.sbomify.com/MAL-2025-143306/): Malicious code in hermes-chakra-ui-phenomic-mdx (npm) (malicious package)
- [MAL-2025-143305](https://insights.sbomify.com/MAL-2025-143305/): Malicious code in hermes-ceres-bellatrix-astro (npm) (malicious package)
- [MAL-2025-143304](https://insights.sbomify.com/MAL-2025-143304/): Malicious code in hermes-castor-pm2-celeste (npm) (malicious package)
- [MAL-2025-143303](https://insights.sbomify.com/MAL-2025-143303/): Malicious code in hermes-callback-equinox-magellan (npm) (malicious package)
- [MAL-2025-143302](https://insights.sbomify.com/MAL-2025-143302/): Malicious code in hermes-backend-aether-aurora (npm) (malicious package)
- [MAL-2025-143301](https://insights.sbomify.com/MAL-2025-143301/): Malicious code in hermes-apollo-gacrux-eleventy (npm) (malicious package)
- [MAL-2025-143300](https://insights.sbomify.com/MAL-2025-143300/): Malicious code in hermes-apex-css-minimizer-webpack-plugin-phoebe (npm) (malicious package)
- [MAL-2025-14330](https://insights.sbomify.com/MAL-2025-14330/): Malicious code in almond-jalapeno-0efa (npm) (malicious package)
- [MAL-2025-1433](https://insights.sbomify.com/MAL-2025-1433/): Malicious code in p2pb2b-test (npm) (malicious package)
- [MAL-2025-143299](https://insights.sbomify.com/MAL-2025-143299/): Malicious code in hermes-antd-local-scorpius (npm) (malicious package)
- [MAL-2025-143298](https://insights.sbomify.com/MAL-2025-143298/): Malicious code in hermes-aether-castor-europa (npm) (malicious package)
- [MAL-2025-143297](https://insights.sbomify.com/MAL-2025-143297/): Malicious code in hermes-acamar-pino-pretty-nodemon (npm) (malicious package)
- [MAL-2025-143296](https://insights.sbomify.com/MAL-2025-143296/): Malicious code in hercules-shelljs-xerxes-janus (npm) (malicious package)
- [MAL-2025-143295](https://insights.sbomify.com/MAL-2025-143295/): Malicious code in hercules-server-airbnb-css-loader (npm) (malicious package)
- [MAL-2025-143294](https://insights.sbomify.com/MAL-2025-143294/): Malicious code in hercules-server-achernar-hugo (npm) (malicious package)
- [MAL-2025-143293](https://insights.sbomify.com/MAL-2025-143293/): Malicious code in hercules-readable-xenon-karma (npm) (malicious package)
- [MAL-2025-143292](https://insights.sbomify.com/MAL-2025-143292/): Malicious code in hercules-protractor-heka-optimize-css-assets-webpack-plugin (npm) (malicious package)
- [MAL-2025-143291](https://insights.sbomify.com/MAL-2025-143291/): Malicious code in hercules-private-mocha-vuetify (npm) (malicious package)
- [MAL-2025-143290](https://insights.sbomify.com/MAL-2025-143290/): Malicious code in hercules-nextjs-zephyr-install (npm) (malicious package)
- [MAL-2025-14329](https://insights.sbomify.com/MAL-2025-14329/): Malicious code in almanan (npm) (malicious package)
- [MAL-2025-143289](https://insights.sbomify.com/MAL-2025-143289/): Malicious code in hercules-meteor-sync-semantic-ui (npm) (malicious package)
- [MAL-2025-143288](https://insights.sbomify.com/MAL-2025-143288/): Malicious code in hercules-less-elektra-hugo (npm) (malicious package)
- [MAL-2025-143287](https://insights.sbomify.com/MAL-2025-143287/): Malicious code in hercules-impulse-bootes-hercules (npm) (malicious package)
- [MAL-2025-143286](https://insights.sbomify.com/MAL-2025-143286/): Malicious code in hercules-husky-blaze-equinox (npm) (malicious package)
- [MAL-2025-143285](https://insights.sbomify.com/MAL-2025-143285/): Malicious code in hercules-husky-ariel-version (npm) (malicious package)
- [MAL-2025-143284](https://insights.sbomify.com/MAL-2025-143284/): Malicious code in hercules-ganymede-geckodriver-spawn (npm) (malicious package)
- [MAL-2025-143283](https://insights.sbomify.com/MAL-2025-143283/): Malicious code in hercules-forever-commitlint-publish (npm) (malicious package)
- [MAL-2025-143282](https://insights.sbomify.com/MAL-2025-143282/): Malicious code in hercules-fomalhaut-chai-geckodriver (npm) (malicious package)
- [MAL-2025-143281](https://insights.sbomify.com/MAL-2025-143281/): Malicious code in hercules-event-octans-avior (npm) (malicious package)
- [MAL-2025-143280](https://insights.sbomify.com/MAL-2025-143280/): Malicious code in hercules-electron-builder-testcafe-iota (npm) (malicious package)
- [MAL-2025-14328](https://insights.sbomify.com/MAL-2025-14328/): Malicious code in allthejs (npm) (malicious package)
- [MAL-2025-143279](https://insights.sbomify.com/MAL-2025-143279/): Malicious code in hercules-docusaurus-css-minimizer-webpack-plugin-upgrade (npm) (malicious package)
- [MAL-2025-143278](https://insights.sbomify.com/MAL-2025-143278/): Malicious code in hercules-convict-indus-flare (npm) (malicious package)
- [MAL-2025-143277](https://insights.sbomify.com/MAL-2025-143277/): Malicious code in hercules-configstore-telesto-vulcan (npm) (malicious package)
- [MAL-2025-143276](https://insights.sbomify.com/MAL-2025-143276/): Malicious code in hercules-commitlint-config-angular-neptune-blaze (npm) (malicious package)
- [MAL-2025-143275](https://insights.sbomify.com/MAL-2025-143275/): Malicious code in hercules-command-spawn-hapi (npm) (malicious package)
- [MAL-2025-143274](https://insights.sbomify.com/MAL-2025-143274/): Malicious code in hercules-ceres-jest-callback (npm) (malicious package)
- [MAL-2025-143273](https://insights.sbomify.com/MAL-2025-143273/): Malicious code in hercules-betelgeuse-sedna-izar (npm) (malicious package)
- [MAL-2025-143272](https://insights.sbomify.com/MAL-2025-143272/): Malicious code in hercules-betelgeuse-build-release-it (npm) (malicious package)
- [MAL-2025-143271](https://insights.sbomify.com/MAL-2025-143271/): Malicious code in hercules-bellatrix-electron-quantum (npm) (malicious package)
- [MAL-2025-143270](https://insights.sbomify.com/MAL-2025-143270/): Malicious code in hercules-async-sync-less-loader (npm) (malicious package)
- [MAL-2025-14327](https://insights.sbomify.com/MAL-2025-14327/): Malicious code in alloydemo (npm) (malicious package)
- [MAL-2025-143269](https://insights.sbomify.com/MAL-2025-143269/): Malicious code in hercules-andromeda-cors-aether (npm) (malicious package)
- [MAL-2025-143268](https://insights.sbomify.com/MAL-2025-143268/): Malicious code in helmet-zenobia-jest-slidev (npm) (malicious package)
- [MAL-2025-143267](https://insights.sbomify.com/MAL-2025-143267/): Malicious code in helmet-vuetify-testcafe-foundation (npm) (malicious package)
- [MAL-2025-143266](https://insights.sbomify.com/MAL-2025-143266/): Malicious code in helmet-uglify-js-slides-link (npm) (malicious package)
- [MAL-2025-143265](https://insights.sbomify.com/MAL-2025-143265/): Malicious code in helmet-taurus-json-alphard (npm) (malicious package)
- [MAL-2025-143264](https://insights.sbomify.com/MAL-2025-143264/): Malicious code in helmet-spectron-ophiuchus-lint-staged (npm) (malicious package)
- [MAL-2025-143263](https://insights.sbomify.com/MAL-2025-143263/): Malicious code in helmet-slidev-bellatrix-babel (npm) (malicious package)
- [MAL-2025-143262](https://insights.sbomify.com/MAL-2025-143262/): Malicious code in helmet-rollup-plugin-odin-pino-pretty (npm) (malicious package)
- [MAL-2025-143261](https://insights.sbomify.com/MAL-2025-143261/): Malicious code in helmet-rate-limiter-superagent-umbra (npm) (malicious package)
- [MAL-2025-143260](https://insights.sbomify.com/MAL-2025-143260/): Malicious code in helmet-public-odin-commitlint (npm) (malicious package)
- [MAL-2025-14326](https://insights.sbomify.com/MAL-2025-14326/): Malicious code in alloy-widget-npm (npm) (malicious package)
- [MAL-2025-143259](https://insights.sbomify.com/MAL-2025-143259/): Malicious code in helmet-postgres-semantic-ui-frontend (npm) (malicious package)
- [MAL-2025-143258](https://insights.sbomify.com/MAL-2025-143258/): Malicious code in helmet-native-quito-capella (npm) (malicious package)
- [MAL-2025-143257](https://insights.sbomify.com/MAL-2025-143257/): Malicious code in helmet-nashira-carina-parcel (npm) (malicious package)
- [MAL-2025-143256](https://insights.sbomify.com/MAL-2025-143256/): Malicious code in helmet-mysql-auriga-elektra (npm) (malicious package)
- [MAL-2025-143255](https://insights.sbomify.com/MAL-2025-143255/): Malicious code in helmet-mui-eslint-plugin-webdriver-mocha (npm) (malicious package)
- [MAL-2025-143254](https://insights.sbomify.com/MAL-2025-143254/): Malicious code in helmet-miranda-halley-colors (npm) (malicious package)
- [MAL-2025-143253](https://insights.sbomify.com/MAL-2025-143253/): Malicious code in helmet-fetch-forever-registry (npm) (malicious package)
- [MAL-2025-143252](https://insights.sbomify.com/MAL-2025-143252/): Malicious code in helmet-enif-gridsome-hercules (npm) (malicious package)
- [MAL-2025-143251](https://insights.sbomify.com/MAL-2025-143251/): Malicious code in helmet-eleventy-eclipse-slidev (npm) (malicious package)
- [MAL-2025-143250](https://insights.sbomify.com/MAL-2025-143250/): Malicious code in helmet-deimos-enceladus-atlas (npm) (malicious package)
- [MAL-2025-14325](https://insights.sbomify.com/MAL-2025-14325/): Malicious code in alloglot (npm) (malicious package)
- [MAL-2025-143249](https://insights.sbomify.com/MAL-2025-143249/): Malicious code in helmet-dactyl-flare-uglify-js (npm) (malicious package)
- [MAL-2025-143248](https://insights.sbomify.com/MAL-2025-143248/): Malicious code in helmet-cordelia-enceladus-terser (npm) (malicious package)
- [MAL-2025-143247](https://insights.sbomify.com/MAL-2025-143247/): Malicious code in helmet-convict-mongoose-cz-conventional-changelog (npm) (malicious package)
- [MAL-2025-143246](https://insights.sbomify.com/MAL-2025-143246/): Malicious code in helmet-cache-galaxy-alphard (npm) (malicious package)
- [MAL-2025-143245](https://insights.sbomify.com/MAL-2025-143245/): Malicious code in helmet-blaze-eridanus-galaxy (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/1451/