# Vulnerabilities published in 2025


- [MAL-2025-141804](https://insights.sbomify.com/MAL-2025-141804/): Malicious code in duplex-browserify-magellan-fork (npm) (malicious package)
- [MAL-2025-141803](https://insights.sbomify.com/MAL-2025-141803/): Malicious code in duplex-babel-npm-jsonp (npm) (malicious package)
- [MAL-2025-141802](https://insights.sbomify.com/MAL-2025-141802/): Malicious code in duplex-andromeda-xanthus-selenium (npm) (malicious package)
- [MAL-2025-141801](https://insights.sbomify.com/MAL-2025-141801/): Malicious code in draco-xerxes-parcel-browserify (npm) (malicious package)
- [MAL-2025-141800](https://insights.sbomify.com/MAL-2025-141800/): Malicious code in draco-webdriver-mocha-writable-jsonp (npm) (malicious package)
- [MAL-2025-14180](https://insights.sbomify.com/MAL-2025-14180/): Malicious code in aion-web3-eth-iban (npm) (malicious package)
- [MAL-2025-1418](https://insights.sbomify.com/MAL-2025-1418/): Malicious code in hashkey-dev (npm) (malicious package)
- [MAL-2025-141799](https://insights.sbomify.com/MAL-2025-141799/): Malicious code in draco-wasat-neptune-shelljs (npm) (malicious package)
- [MAL-2025-141798](https://insights.sbomify.com/MAL-2025-141798/): Malicious code in draco-wasat-miranda-node-sass (npm) (malicious package)
- [MAL-2025-141797](https://insights.sbomify.com/MAL-2025-141797/): Malicious code in draco-tailwindcss-helmet-yakutsk (npm) (malicious package)
- [MAL-2025-141796](https://insights.sbomify.com/MAL-2025-141796/): Malicious code in draco-spectron-webdriver-nashira-eslint-plugin (npm) (malicious package)
- [MAL-2025-141795](https://insights.sbomify.com/MAL-2025-141795/): Malicious code in draco-quark-dione-miranda (npm) (malicious package)
- [MAL-2025-141794](https://insights.sbomify.com/MAL-2025-141794/): Malicious code in draco-jasmine-polaris-impulse (npm) (malicious package)
- [MAL-2025-141793](https://insights.sbomify.com/MAL-2025-141793/): Malicious code in draco-hapi-luna-gravity (npm) (malicious package)
- [MAL-2025-141792](https://insights.sbomify.com/MAL-2025-141792/): Malicious code in draco-eridanus-meteor-forever (npm) (malicious package)
- [MAL-2025-141791](https://insights.sbomify.com/MAL-2025-141791/): Malicious code in draco-cosmos-restart-thuban (npm) (malicious package)
- [MAL-2025-141790](https://insights.sbomify.com/MAL-2025-141790/): Malicious code in draco-callback-gacrux-sirius (npm) (malicious package)
- [MAL-2025-14179](https://insights.sbomify.com/MAL-2025-14179/): Malicious code in ainyahya (npm) (malicious package)
- [MAL-2025-141789](https://insights.sbomify.com/MAL-2025-141789/): Malicious code in draco-auth-resolvers-html-webpack-plugin (npm) (malicious package)
- [MAL-2025-141788](https://insights.sbomify.com/MAL-2025-141788/): Malicious code in draco-apollo-arcturus-luna (npm) (malicious package)
- [MAL-2025-141787](https://insights.sbomify.com/MAL-2025-141787/): Malicious code in draco-altair-repository-kinetic (npm) (malicious package)
- [MAL-2025-141786](https://insights.sbomify.com/MAL-2025-141786/): Malicious code in dotenv-winston-yakutsk-csrf (npm) (malicious package)
- [MAL-2025-141785](https://insights.sbomify.com/MAL-2025-141785/): Malicious code in dotenv-umbra-duplex-proxima (npm) (malicious package)
- [MAL-2025-141784](https://insights.sbomify.com/MAL-2025-141784/): Malicious code in dotenv-solis-hydra-fork (npm) (malicious package)
- [MAL-2025-141783](https://insights.sbomify.com/MAL-2025-141783/): Malicious code in dotenv-safe-zenith-configstore-fetch (npm) (malicious package)
- [MAL-2025-141782](https://insights.sbomify.com/MAL-2025-141782/): Malicious code in dotenv-safe-wezen-loop-restart (npm) (malicious package)
- [MAL-2025-141781](https://insights.sbomify.com/MAL-2025-141781/): Malicious code in dotenv-safe-upgrade-neptune-pyxis (npm) (malicious package)
- [MAL-2025-141780](https://insights.sbomify.com/MAL-2025-141780/): Malicious code in dotenv-safe-ultra-lacerta-cors (npm) (malicious package)
- [MAL-2025-14178](https://insights.sbomify.com/MAL-2025-14178/): Malicious code in aimphone (npm) (malicious package)
- [MAL-2025-141779](https://insights.sbomify.com/MAL-2025-141779/): Malicious code in dotenv-safe-transport-corvus-hydra (npm) (malicious package)
- [MAL-2025-141778](https://insights.sbomify.com/MAL-2025-141778/): Malicious code in dotenv-safe-transport-aether-miranda (npm) (malicious package)
- [MAL-2025-141777](https://insights.sbomify.com/MAL-2025-141777/): Malicious code in dotenv-safe-semantic-ui-corvus-release-it (npm) (malicious package)
- [MAL-2025-141776](https://insights.sbomify.com/MAL-2025-141776/): Malicious code in dotenv-safe-sedna-electron-cors (npm) (malicious package)
- [MAL-2025-141775](https://insights.sbomify.com/MAL-2025-141775/): Malicious code in dotenv-safe-rocket-yildun-electron-builder (npm) (malicious package)
- [MAL-2025-141774](https://insights.sbomify.com/MAL-2025-141774/): Malicious code in dotenv-safe-quito-sagitta-spawn (npm) (malicious package)
- [MAL-2025-141773](https://insights.sbomify.com/MAL-2025-141773/): Malicious code in dotenv-safe-public-puppeteer-publish (npm) (malicious package)
- [MAL-2025-141772](https://insights.sbomify.com/MAL-2025-141772/): Malicious code in dotenv-safe-protractor-bellatrix-janus (npm) (malicious package)
- [MAL-2025-141771](https://insights.sbomify.com/MAL-2025-141771/): Malicious code in dotenv-safe-postgres-perseus-draco (npm) (malicious package)
- [MAL-2025-141770](https://insights.sbomify.com/MAL-2025-141770/): Malicious code in dotenv-safe-postcss-loader-taurus-webpack (npm) (malicious package)
- [MAL-2025-14177](https://insights.sbomify.com/MAL-2025-14177/): Malicious code in aimaze (npm) (malicious package)
- [MAL-2025-141769](https://insights.sbomify.com/MAL-2025-141769/): Malicious code in dotenv-safe-pino-pretty-weywot-jwt (npm) (malicious package)
- [MAL-2025-141768](https://insights.sbomify.com/MAL-2025-141768/): Malicious code in dotenv-safe-parcel-convict-umbriel (npm) (malicious package)
- [MAL-2025-141767](https://insights.sbomify.com/MAL-2025-141767/): Malicious code in dotenv-safe-ophiuchus-transport-carpo (npm) (malicious package)
- [MAL-2025-141766](https://insights.sbomify.com/MAL-2025-141766/): Malicious code in dotenv-safe-npm-json-chromedriver (npm) (malicious package)
- [MAL-2025-141765](https://insights.sbomify.com/MAL-2025-141765/): Malicious code in dotenv-safe-norma-hydra-pulsar (npm) (malicious package)
- [MAL-2025-141764](https://insights.sbomify.com/MAL-2025-141764/): Malicious code in dotenv-safe-non-blocking-bellatrix-proxima (npm) (malicious package)
- [MAL-2025-141763](https://insights.sbomify.com/MAL-2025-141763/): Malicious code in dotenv-safe-nestjs-jest-tool (npm) (malicious package)
- [MAL-2025-141762](https://insights.sbomify.com/MAL-2025-141762/): Malicious code in dotenv-safe-nconf-gemini-vortex (npm) (malicious package)
- [MAL-2025-141761](https://insights.sbomify.com/MAL-2025-141761/): Malicious code in dotenv-safe-mongodb-aldebaran-nashira (npm) (malicious package)
- [MAL-2025-141760](https://insights.sbomify.com/MAL-2025-141760/): Malicious code in dotenv-safe-mini-css-extract-plugin-pm2-buffer (npm) (malicious package)
- [MAL-2025-14176](https://insights.sbomify.com/MAL-2025-14176/): Malicious code in aileron-logger (npm) (malicious package)
- [MAL-2025-141759](https://insights.sbomify.com/MAL-2025-141759/): Malicious code in dotenv-safe-lynx-ursa-restart (npm) (malicious package)
- [MAL-2025-141758](https://insights.sbomify.com/MAL-2025-141758/): Malicious code in dotenv-safe-lint-standard-stream (npm) (malicious package)
- [MAL-2025-141757](https://insights.sbomify.com/MAL-2025-141757/): Malicious code in dotenv-safe-kronos-aurora-build (npm) (malicious package)
- [MAL-2025-141756](https://insights.sbomify.com/MAL-2025-141756/): Malicious code in dotenv-safe-izar-gatsby-dotenv-parse-variables (npm) (malicious package)
- [MAL-2025-141755](https://insights.sbomify.com/MAL-2025-141755/): Malicious code in dotenv-safe-hyperion-karma-stream (npm) (malicious package)
- [MAL-2025-141754](https://insights.sbomify.com/MAL-2025-141754/): Malicious code in dotenv-safe-hermes-config-stop (npm) (malicious package)
- [MAL-2025-141753](https://insights.sbomify.com/MAL-2025-141753/): Malicious code in dotenv-safe-global-jsonp-centaurus (npm) (malicious package)
- [MAL-2025-141752](https://insights.sbomify.com/MAL-2025-141752/): Malicious code in dotenv-safe-gemini-spica-materialize (npm) (malicious package)
- [MAL-2025-141751](https://insights.sbomify.com/MAL-2025-141751/): Malicious code in dotenv-safe-elektra-build-octans (npm) (malicious package)
- [MAL-2025-141750](https://insights.sbomify.com/MAL-2025-141750/): Malicious code in dotenv-safe-dynamo-proxima-async (npm) (malicious package)
- [MAL-2025-14175](https://insights.sbomify.com/MAL-2025-14175/): Malicious code in aigamnds (npm) (malicious package)
- [MAL-2025-141749](https://insights.sbomify.com/MAL-2025-141749/): Malicious code in dotenv-safe-dotenv-safe-proxima-juno (npm) (malicious package)
- [MAL-2025-141748](https://insights.sbomify.com/MAL-2025-141748/): Malicious code in dotenv-safe-development-command-non-blocking (npm) (malicious package)
- [MAL-2025-141747](https://insights.sbomify.com/MAL-2025-141747/): Malicious code in dotenv-safe-dactyl-mira-karma (npm) (malicious package)
- [MAL-2025-141746](https://insights.sbomify.com/MAL-2025-141746/): Malicious code in dotenv-safe-cluster-hermes-sqlite (npm) (malicious package)
- [MAL-2025-141745](https://insights.sbomify.com/MAL-2025-141745/): Malicious code in dotenv-safe-bunyan-private-umbra (npm) (malicious package)
- [MAL-2025-141744](https://insights.sbomify.com/MAL-2025-141744/): Malicious code in dotenv-safe-astro-supervisor-blitz (npm) (malicious package)
- [MAL-2025-141743](https://insights.sbomify.com/MAL-2025-141743/): Malicious code in dotenv-safe-astro-sirius-sedna (npm) (malicious package)
- [MAL-2025-141742](https://insights.sbomify.com/MAL-2025-141742/): Malicious code in dotenv-proxima-reveal-md-avior (npm) (malicious package)
- [MAL-2025-141741](https://insights.sbomify.com/MAL-2025-141741/): Malicious code in dotenv-prettier-stylelint-fomalhaut-heka (npm) (malicious package)
- [MAL-2025-141740](https://insights.sbomify.com/MAL-2025-141740/): Malicious code in dotenv-parse-variables-yonder-readable-vega (npm) (malicious package)
- [MAL-2025-14174](https://insights.sbomify.com/MAL-2025-14174/): Malicious code in aid-mercury (npm) (malicious package)
- [MAL-2025-141739](https://insights.sbomify.com/MAL-2025-141739/): Malicious code in dotenv-parse-variables-yonder-flare-indus (npm) (malicious package)
- [MAL-2025-141738](https://insights.sbomify.com/MAL-2025-141738/): Malicious code in dotenv-parse-variables-yakutsk-farout-slides (npm) (malicious package)
- [MAL-2025-141737](https://insights.sbomify.com/MAL-2025-141737/): Malicious code in dotenv-parse-variables-vuetify-winston-sass-loader (npm) (malicious package)
- [MAL-2025-141736](https://insights.sbomify.com/MAL-2025-141736/): Malicious code in dotenv-parse-variables-rehype-webpack-dependencies (npm) (malicious package)
- [MAL-2025-141735](https://insights.sbomify.com/MAL-2025-141735/): Malicious code in dotenv-parse-variables-readable-dactyl-dorado (npm) (malicious package)
- [MAL-2025-141734](https://insights.sbomify.com/MAL-2025-141734/): Malicious code in dotenv-parse-variables-proxima-mongodb-got (npm) (malicious package)
- [MAL-2025-141733](https://insights.sbomify.com/MAL-2025-141733/): Malicious code in dotenv-parse-variables-proxima-markdownlint-meteor (npm) (malicious package)
- [MAL-2025-141732](https://insights.sbomify.com/MAL-2025-141732/): Malicious code in dotenv-parse-variables-postgres-cz-conventional-changelog-transport (npm) (malicious package)
- [MAL-2025-141731](https://insights.sbomify.com/MAL-2025-141731/): Malicious code in dotenv-parse-variables-phoebe-procyon-graphql (npm) (malicious package)
- [MAL-2025-141730](https://insights.sbomify.com/MAL-2025-141730/): Malicious code in dotenv-parse-variables-orbit-relay-dotenv-safe (npm) (malicious package)
- [MAL-2025-14173](https://insights.sbomify.com/MAL-2025-14173/): Malicious code in aicsd-web-ui (npm) (malicious package)
- [MAL-2025-141729](https://insights.sbomify.com/MAL-2025-141729/): Malicious code in dotenv-parse-variables-ora-aquarius-markdown (npm) (malicious package)
- [MAL-2025-141728](https://insights.sbomify.com/MAL-2025-141728/): Malicious code in dotenv-parse-variables-nightmare-aether-run-script (npm) (malicious package)
- [MAL-2025-141727](https://insights.sbomify.com/MAL-2025-141727/): Malicious code in dotenv-parse-variables-nashira-hapi-iota (npm) (malicious package)
- [MAL-2025-141726](https://insights.sbomify.com/MAL-2025-141726/): Malicious code in dotenv-parse-variables-module-oauth-magellan (npm) (malicious package)
- [MAL-2025-141725](https://insights.sbomify.com/MAL-2025-141725/): Malicious code in dotenv-parse-variables-meteor-gridsome-eleventy (npm) (malicious package)
- [MAL-2025-141724](https://insights.sbomify.com/MAL-2025-141724/): Malicious code in dotenv-parse-variables-jwt-soap-metalsmith (npm) (malicious package)
- [MAL-2025-141723](https://insights.sbomify.com/MAL-2025-141723/): Malicious code in dotenv-parse-variables-gridsome-alphard-draco (npm) (malicious package)
- [MAL-2025-141722](https://insights.sbomify.com/MAL-2025-141722/): Malicious code in dotenv-parse-variables-got-hermes-octans (npm) (malicious package)
- [MAL-2025-141721](https://insights.sbomify.com/MAL-2025-141721/): Malicious code in dotenv-parse-variables-google-react-bootstrap-castor (npm) (malicious package)
- [MAL-2025-141720](https://insights.sbomify.com/MAL-2025-141720/): Malicious code in dotenv-parse-variables-eris-xenon-postcss (npm) (malicious package)
- [MAL-2025-14172](https://insights.sbomify.com/MAL-2025-14172/): Malicious code in ahmed88521n786-todo-list (npm) (malicious package)
- [MAL-2025-141719](https://insights.sbomify.com/MAL-2025-141719/): Malicious code in dotenv-parse-variables-electron-builder-rocket-run-script (npm) (malicious package)
- [MAL-2025-141718](https://insights.sbomify.com/MAL-2025-141718/): Malicious code in dotenv-parse-variables-dotenv-safe-algol-framework (npm) (malicious package)
- [MAL-2025-141717](https://insights.sbomify.com/MAL-2025-141717/): Malicious code in dotenv-parse-variables-despina-helios-venus (npm) (malicious package)
- [MAL-2025-141716](https://insights.sbomify.com/MAL-2025-141716/): Malicious code in dotenv-parse-variables-deneb-lyra-repository (npm) (malicious package)
- [MAL-2025-141715](https://insights.sbomify.com/MAL-2025-141715/): Malicious code in dotenv-parse-variables-dactyl-hermes-spinner (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/1468/