# Vulnerabilities published in 2025


- [MAL-2025-142524](https://insights.sbomify.com/MAL-2025-142524/): Malicious code in flare-framework-ursa-webdriver-mocha (npm) (malicious package)
- [MAL-2025-142523](https://insights.sbomify.com/MAL-2025-142523/): Malicious code in flare-commitizen-graphql-barnard (npm) (malicious package)
- [MAL-2025-142522](https://insights.sbomify.com/MAL-2025-142522/): Malicious code in flare-carpo-server-tethys (npm) (malicious package)
- [MAL-2025-142521](https://insights.sbomify.com/MAL-2025-142521/): Malicious code in flare-apollo-meteor-centaurus (npm) (malicious package)
- [MAL-2025-142520](https://insights.sbomify.com/MAL-2025-142520/): Malicious code in flare-antares-altair-jest (npm) (malicious package)
- [MAL-2025-14252](https://insights.sbomify.com/MAL-2025-14252/): Malicious code in alb-um-availa-ble-zip-mp3-file-87774-sweet-and-dandy-u8y37-xsfuaz (npm) (malicious package)
- [MAL-2025-142519](https://insights.sbomify.com/MAL-2025-142519/): Malicious code in firebase-webpack-semantic-release-pegasus (npm) (malicious package)
- [MAL-2025-142518](https://insights.sbomify.com/MAL-2025-142518/): Malicious code in firebase-webdriver-manager-vega-neptune (npm) (malicious package)
- [MAL-2025-142517](https://insights.sbomify.com/MAL-2025-142517/): Malicious code in firebase-tethys-lacerta-phoebe (npm) (malicious package)
- [MAL-2025-142516](https://insights.sbomify.com/MAL-2025-142516/): Malicious code in firebase-tailwindcss-pegasus-json (npm) (malicious package)
- [MAL-2025-142515](https://insights.sbomify.com/MAL-2025-142515/): Malicious code in firebase-server-miranda-jupiter (npm) (malicious package)
- [MAL-2025-142514](https://insights.sbomify.com/MAL-2025-142514/): Malicious code in firebase-selenium-fornax-nconf (npm) (malicious package)
- [MAL-2025-142513](https://insights.sbomify.com/MAL-2025-142513/): Malicious code in firebase-sass-loader-dotenv-safe-ophiuchus (npm) (malicious package)
- [MAL-2025-142512](https://insights.sbomify.com/MAL-2025-142512/): Malicious code in firebase-sagitta-tool-corvus (npm) (malicious package)
- [MAL-2025-142511](https://insights.sbomify.com/MAL-2025-142511/): Malicious code in firebase-rigel-fornax-ini (npm) (malicious package)
- [MAL-2025-142510](https://insights.sbomify.com/MAL-2025-142510/): Malicious code in firebase-relay-winston-webdriverio (npm) (malicious package)
- [MAL-2025-14251](https://insights.sbomify.com/MAL-2025-14251/): Malicious code in alb-um-availa-ble-zip-mp3-file-6701-black-monk-time-a72gt-xmggfd (npm) (malicious package)
- [MAL-2025-142509](https://insights.sbomify.com/MAL-2025-142509/): Malicious code in firebase-prompts-ophiuchus-spectron (npm) (malicious package)
- [MAL-2025-142508](https://insights.sbomify.com/MAL-2025-142508/): Malicious code in firebase-process-sedna-node-sass (npm) (malicious package)
- [MAL-2025-142507](https://insights.sbomify.com/MAL-2025-142507/): Malicious code in firebase-playwright-comet-nodemon (npm) (malicious package)
- [MAL-2025-142506](https://insights.sbomify.com/MAL-2025-142506/): Malicious code in firebase-optimize-css-assets-webpack-plugin-csv-superagent (npm) (malicious package)
- [MAL-2025-142505](https://insights.sbomify.com/MAL-2025-142505/): Malicious code in firebase-mini-css-extract-plugin-buffer-kinetic (npm) (malicious package)
- [MAL-2025-142504](https://insights.sbomify.com/MAL-2025-142504/): Malicious code in firebase-middleware-websockets-husky (npm) (malicious package)
- [MAL-2025-142503](https://insights.sbomify.com/MAL-2025-142503/): Malicious code in firebase-meissa-loopback-event (npm) (malicious package)
- [MAL-2025-142502](https://insights.sbomify.com/MAL-2025-142502/): Malicious code in firebase-materialize-morgan-titan (npm) (malicious package)
- [MAL-2025-142501](https://insights.sbomify.com/MAL-2025-142501/): Malicious code in firebase-leda-octans-postgres (npm) (malicious package)
- [MAL-2025-142500](https://insights.sbomify.com/MAL-2025-142500/): Malicious code in firebase-io-webdriverio-react-bootstrap (npm) (malicious package)
- [MAL-2025-14250](https://insights.sbomify.com/MAL-2025-14250/): Malicious code in alb-um-availa-ble-zip-mp3-file-54131-not-for-threes-53dbe-butthc (npm) (malicious package)
- [MAL-2025-1425](https://insights.sbomify.com/MAL-2025-1425/): Malicious code in orangex-dev (npm) (malicious package)
- [MAL-2025-142499](https://insights.sbomify.com/MAL-2025-142499/): Malicious code in firebase-google-castor-standard (npm) (malicious package)
- [MAL-2025-142498](https://insights.sbomify.com/MAL-2025-142498/): Malicious code in firebase-frontend-apollo-perseus (npm) (malicious package)
- [MAL-2025-142497](https://insights.sbomify.com/MAL-2025-142497/): Malicious code in firebase-equinox-subscription-configstore (npm) (malicious package)
- [MAL-2025-142496](https://insights.sbomify.com/MAL-2025-142496/): Malicious code in firebase-epimetheus-request-antares (npm) (malicious package)
- [MAL-2025-142495](https://insights.sbomify.com/MAL-2025-142495/): Malicious code in firebase-eleventy-protractor-vortex (npm) (malicious package)
- [MAL-2025-142494](https://insights.sbomify.com/MAL-2025-142494/): Malicious code in firebase-dotenv-jekyll-jovian (npm) (malicious package)
- [MAL-2025-142493](https://insights.sbomify.com/MAL-2025-142493/): Malicious code in firebase-docusaurus-soap-fork (npm) (malicious package)
- [MAL-2025-142492](https://insights.sbomify.com/MAL-2025-142492/): Malicious code in firebase-cressida-commitlint-subscription (npm) (malicious package)
- [MAL-2025-142491](https://insights.sbomify.com/MAL-2025-142491/): Malicious code in firebase-cordelia-ignite-cosmiconfig (npm) (malicious package)
- [MAL-2025-142490](https://insights.sbomify.com/MAL-2025-142490/): Malicious code in firebase-cluster-readable-chakra-ui (npm) (malicious package)
- [MAL-2025-14249](https://insights.sbomify.com/MAL-2025-14249/): Malicious code in alb-um-availa-ble-zip-mp3-file-470382-acts-of-god-a6hb1-jgniqs (npm) (malicious package)
- [MAL-2025-142489](https://insights.sbomify.com/MAL-2025-142489/): Malicious code in firebase-charon-node-config-delphinus (npm) (malicious package)
- [MAL-2025-142488](https://insights.sbomify.com/MAL-2025-142488/): Malicious code in firebase-bootstrap-xenon-mira (npm) (malicious package)
- [MAL-2025-142487](https://insights.sbomify.com/MAL-2025-142487/): Malicious code in firebase-aurora-neptune-writable (npm) (malicious package)
- [MAL-2025-142486](https://insights.sbomify.com/MAL-2025-142486/): Malicious code in firebase-antares-gulp-elektra (npm) (malicious package)
- [MAL-2025-142485](https://insights.sbomify.com/MAL-2025-142485/): Malicious code in figures-version-carina-framework (npm) (malicious package)
- [MAL-2025-142484](https://insights.sbomify.com/MAL-2025-142484/): Malicious code in figures-upgrade-hermes-relay (npm) (malicious package)
- [MAL-2025-142483](https://insights.sbomify.com/MAL-2025-142483/): Malicious code in figures-spica-halley-enceladus (npm) (malicious package)
- [MAL-2025-142482](https://insights.sbomify.com/MAL-2025-142482/): Malicious code in figures-semantic-ui-cypress-prettier-plugin-markdown (npm) (malicious package)
- [MAL-2025-142481](https://insights.sbomify.com/MAL-2025-142481/): Malicious code in figures-scorpius-gravity-markdown-pdf (npm) (malicious package)
- [MAL-2025-142480](https://insights.sbomify.com/MAL-2025-142480/): Malicious code in figures-protractor-changelog-fusion (npm) (malicious package)
- [MAL-2025-14248](https://insights.sbomify.com/MAL-2025-14248/): Malicious code in alb-um-availa-ble-zip-mp3-file-257508-the-ascension-94teg-bymdfl (npm) (malicious package)
- [MAL-2025-142479](https://insights.sbomify.com/MAL-2025-142479/): Malicious code in figures-procyon-betelgeuse-quantum (npm) (malicious package)
- [MAL-2025-142478](https://insights.sbomify.com/MAL-2025-142478/): Malicious code in figures-postgres-tailwindcss-css-minimizer-webpack-plugin (npm) (malicious package)
- [MAL-2025-142477](https://insights.sbomify.com/MAL-2025-142477/): Malicious code in figures-perseus-auth-aquarius (npm) (malicious package)
- [MAL-2025-142476](https://insights.sbomify.com/MAL-2025-142476/): Malicious code in figures-orbit-uglify-js-uglify-js (npm) (malicious package)
- [MAL-2025-142475](https://insights.sbomify.com/MAL-2025-142475/): Malicious code in figures-nuxtjs-aldebaran-mini-css-extract-plugin (npm) (malicious package)
- [MAL-2025-142474](https://insights.sbomify.com/MAL-2025-142474/): Malicious code in figures-nconf-celeste-triton (npm) (malicious package)
- [MAL-2025-142473](https://insights.sbomify.com/MAL-2025-142473/): Malicious code in figures-middleware-centaurus-init (npm) (malicious package)
- [MAL-2025-142472](https://insights.sbomify.com/MAL-2025-142472/): Malicious code in figures-lacerta-ceres-canopus (npm) (malicious package)
- [MAL-2025-142471](https://insights.sbomify.com/MAL-2025-142471/): Malicious code in figures-ignite-typeorm-grunt (npm) (malicious package)
- [MAL-2025-142470](https://insights.sbomify.com/MAL-2025-142470/): Malicious code in figures-hyperion-selenium-kastra (npm) (malicious package)
- [MAL-2025-14247](https://insights.sbomify.com/MAL-2025-14247/): Malicious code in alb-um-availa-ble-zip-mp3-file-234851-compact-guide-to-pop-music-space-travel-w7z48-vlfxwu (npm) (malicious package)
- [MAL-2025-142469](https://insights.sbomify.com/MAL-2025-142469/): Malicious code in figures-hermes-epimetheus-lynx (npm) (malicious package)
- [MAL-2025-142468](https://insights.sbomify.com/MAL-2025-142468/): Malicious code in figures-halley-cygnus-comet (npm) (malicious package)
- [MAL-2025-142467](https://insights.sbomify.com/MAL-2025-142467/): Malicious code in figures-fusion-nextjs-auth0 (npm) (malicious package)
- [MAL-2025-142466](https://insights.sbomify.com/MAL-2025-142466/): Malicious code in figures-elektra-server-buffer (npm) (malicious package)
- [MAL-2025-142465](https://insights.sbomify.com/MAL-2025-142465/): Malicious code in figures-duplex-husky-electron (npm) (malicious package)
- [MAL-2025-142464](https://insights.sbomify.com/MAL-2025-142464/): Malicious code in figures-delphinus-ganymede-fork (npm) (malicious package)
- [MAL-2025-142463](https://insights.sbomify.com/MAL-2025-142463/): Malicious code in figures-comet-markdownlint-markdown (npm) (malicious package)
- [MAL-2025-142462](https://insights.sbomify.com/MAL-2025-142462/): Malicious code in figures-changelog-less-nightwatch (npm) (malicious package)
- [MAL-2025-142461](https://insights.sbomify.com/MAL-2025-142461/): Malicious code in fetch-virgo-pegasus-phoenix (npm) (malicious package)
- [MAL-2025-142460](https://insights.sbomify.com/MAL-2025-142460/): Malicious code in fetch-virgo-nashira-adonis (npm) (malicious package)
- [MAL-2025-14246](https://insights.sbomify.com/MAL-2025-14246/): The package alb-um-availa-ble-zip-mp3-file-2014-19329-nobody-wants-to-be-here-and-nobody-wants-to-leave-9l846-lhyxqh was found to contain malicious code. (malicious package)
- [MAL-2025-142459](https://insights.sbomify.com/MAL-2025-142459/): Malicious code in fetch-supervisor-phoenix-octans (npm) (malicious package)
- [MAL-2025-142458](https://insights.sbomify.com/MAL-2025-142458/): Malicious code in fetch-start-carpo-pino (npm) (malicious package)
- [MAL-2025-142457](https://insights.sbomify.com/MAL-2025-142457/): Malicious code in fetch-socketio-cosmiconfig-tool (npm) (malicious package)
- [MAL-2025-142456](https://insights.sbomify.com/MAL-2025-142456/): Malicious code in fetch-quasar-jabbah-superagent (npm) (malicious package)
- [MAL-2025-142455](https://insights.sbomify.com/MAL-2025-142455/): Malicious code in fetch-pyxis-inquirer-dynamo (npm) (malicious package)
- [MAL-2025-142454](https://insights.sbomify.com/MAL-2025-142454/): Malicious code in fetch-puppeteer-bootstrap-axios (npm) (malicious package)
- [MAL-2025-142453](https://insights.sbomify.com/MAL-2025-142453/): Malicious code in fetch-process-perseus-resolvers (npm) (malicious package)
- [MAL-2025-142452](https://insights.sbomify.com/MAL-2025-142452/): Malicious code in fetch-polaris-loopback-registry (npm) (malicious package)
- [MAL-2025-142451](https://insights.sbomify.com/MAL-2025-142451/): Malicious code in fetch-meteor-leda-materialize (npm) (malicious package)
- [MAL-2025-142450](https://insights.sbomify.com/MAL-2025-142450/): Malicious code in fetch-luna-virgo-algol (npm) (malicious package)
- [MAL-2025-14245](https://insights.sbomify.com/MAL-2025-14245/): Malicious code in alb-um-availa-ble-zip-mp3-file-2013-9765-night-time-my-time-8wmqr-nytqyh (npm) (malicious package)
- [MAL-2025-142449](https://insights.sbomify.com/MAL-2025-142449/): Malicious code in fetch-jasmine-frontend-equinox (npm) (malicious package)
- [MAL-2025-142448](https://insights.sbomify.com/MAL-2025-142448/): Malicious code in fetch-iota-nightwatch-apollo (npm) (malicious package)
- [MAL-2025-142447](https://insights.sbomify.com/MAL-2025-142447/): Malicious code in fetch-husky-slides-sedna (npm) (malicious package)
- [MAL-2025-142446](https://insights.sbomify.com/MAL-2025-142446/): Malicious code in fetch-husky-europa-redis (npm) (malicious package)
- [MAL-2025-142445](https://insights.sbomify.com/MAL-2025-142445/): Malicious code in fetch-hexo-commitlint-config-angular-metalsmith (npm) (malicious package)
- [MAL-2025-142444](https://insights.sbomify.com/MAL-2025-142444/): Malicious code in fetch-halley-await-dotenv-safe (npm) (malicious package)
- [MAL-2025-142443](https://insights.sbomify.com/MAL-2025-142443/): Malicious code in fetch-event-cosmiconfig-chalk (npm) (malicious package)
- [MAL-2025-142442](https://insights.sbomify.com/MAL-2025-142442/): Malicious code in fetch-europa-schema-leda (npm) (malicious package)
- [MAL-2025-142441](https://insights.sbomify.com/MAL-2025-142441/): Malicious code in fetch-eleventy-phenomic-miranda (npm) (malicious package)
- [MAL-2025-142440](https://insights.sbomify.com/MAL-2025-142440/): Malicious code in fetch-deimos-acamar-lynx (npm) (malicious package)
- [MAL-2025-14244](https://insights.sbomify.com/MAL-2025-14244/): Malicious code in alb-um-availa-ble-zip-mp3-file-197627-the-performer-rijx3-aoduph (npm) (malicious package)
- [MAL-2025-142439](https://insights.sbomify.com/MAL-2025-142439/): Malicious code in fetch-corvus-auth-charon (npm) (malicious package)
- [MAL-2025-142438](https://insights.sbomify.com/MAL-2025-142438/): Malicious code in fetch-cordelia-mutation-equinox (npm) (malicious package)
- [MAL-2025-142437](https://insights.sbomify.com/MAL-2025-142437/): Malicious code in fetch-chalk-mysql-ganymede (npm) (malicious package)
- [MAL-2025-142436](https://insights.sbomify.com/MAL-2025-142436/): Malicious code in fetch-celeste-link-quantum (npm) (malicious package)
- [MAL-2025-142435](https://insights.sbomify.com/MAL-2025-142435/): Malicious code in fetch-bootes-concurrently-phoebe (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/1460/