# Vulnerabilities published in 2025


- [MAL-2025-140454](https://insights.sbomify.com/MAL-2025-140454/): Malicious code in carpo-tool-query-commitizen (npm) (malicious package)
- [MAL-2025-140453](https://insights.sbomify.com/MAL-2025-140453/): Malicious code in carpo-subscription-meteor-bootstrap (npm) (malicious package)
- [MAL-2025-140452](https://insights.sbomify.com/MAL-2025-140452/): Malicious code in carpo-semantic-release-kaus-jovian (npm) (malicious package)
- [MAL-2025-140451](https://insights.sbomify.com/MAL-2025-140451/): Malicious code in carpo-prettier-stylelint-cassini-capella (npm) (malicious package)
- [MAL-2025-140450](https://insights.sbomify.com/MAL-2025-140450/): Malicious code in carpo-npm-jsonp-equinox (npm) (malicious package)
- [MAL-2025-14045](https://insights.sbomify.com/MAL-2025-14045/): Malicious code in active_utils (npm) (malicious package)
- [MAL-2025-140449](https://insights.sbomify.com/MAL-2025-140449/): Malicious code in carpo-mira-restart-cypress (npm) (malicious package)
- [MAL-2025-140448](https://insights.sbomify.com/MAL-2025-140448/): Malicious code in carpo-meteor-nconf-uninstall (npm) (malicious package)
- [MAL-2025-140447](https://insights.sbomify.com/MAL-2025-140447/): Malicious code in carpo-kinetic-capella-helios (npm) (malicious package)
- [MAL-2025-140446](https://insights.sbomify.com/MAL-2025-140446/): Malicious code in carpo-jest-celeste-blaze (npm) (malicious package)
- [MAL-2025-140445](https://insights.sbomify.com/MAL-2025-140445/): Malicious code in carpo-init-stop-terser (npm) (malicious package)
- [MAL-2025-140444](https://insights.sbomify.com/MAL-2025-140444/): Malicious code in carpo-ignite-electron-helios (npm) (malicious package)
- [MAL-2025-140443](https://insights.sbomify.com/MAL-2025-140443/): Malicious code in carpo-hermes-telesto-oauth (npm) (malicious package)
- [MAL-2025-140442](https://insights.sbomify.com/MAL-2025-140442/): Malicious code in carpo-ganymede-yakutsk-lint-staged (npm) (malicious package)
- [MAL-2025-140441](https://insights.sbomify.com/MAL-2025-140441/): Malicious code in carpo-ganymede-kastra-leda (npm) (malicious package)
- [MAL-2025-140440](https://insights.sbomify.com/MAL-2025-140440/): Malicious code in carpo-frontend-callback-gacrux (npm) (malicious package)
- [MAL-2025-14044](https://insights.sbomify.com/MAL-2025-14044/): Malicious code in active_shipping (npm) (malicious package)
- [MAL-2025-140439](https://insights.sbomify.com/MAL-2025-140439/): Malicious code in carpo-elara-non-blocking-upgrade (npm) (malicious package)
- [MAL-2025-140438](https://insights.sbomify.com/MAL-2025-140438/): Malicious code in carpo-docusaurus-run-script-aldebaran (npm) (malicious package)
- [MAL-2025-140437](https://insights.sbomify.com/MAL-2025-140437/): Malicious code in carpo-dione-telesto-rate-limiter (npm) (malicious package)
- [MAL-2025-140436](https://insights.sbomify.com/MAL-2025-140436/): Malicious code in carpo-cors-react-bootstrap-halley (npm) (malicious package)
- [MAL-2025-140435](https://insights.sbomify.com/MAL-2025-140435/): Malicious code in carpo-centauri-commitlint-config-angular-callback (npm) (malicious package)
- [MAL-2025-140434](https://insights.sbomify.com/MAL-2025-140434/): Malicious code in carpo-bunyan-server-electron-builder (npm) (malicious package)
- [MAL-2025-140433](https://insights.sbomify.com/MAL-2025-140433/): Malicious code in carpo-blitz-nightmare-forever (npm) (malicious package)
- [MAL-2025-140432](https://insights.sbomify.com/MAL-2025-140432/): Malicious code in carpo-blaze-dagda-command (npm) (malicious package)
- [MAL-2025-140431](https://insights.sbomify.com/MAL-2025-140431/): Malicious code in carpo-barnard-tethys-halley (npm) (malicious package)
- [MAL-2025-140430](https://insights.sbomify.com/MAL-2025-140430/): Malicious code in carpo-async-ganymede-init (npm) (malicious package)
- [MAL-2025-14043](https://insights.sbomify.com/MAL-2025-14043/): Malicious code in active_fulfillment (npm) (malicious package)
- [MAL-2025-140429](https://insights.sbomify.com/MAL-2025-140429/): Malicious code in carpo-antd-less-zenith (npm) (malicious package)
- [MAL-2025-140428](https://insights.sbomify.com/MAL-2025-140428/): Malicious code in carpo-adonis-draco-process (npm) (malicious package)
- [MAL-2025-140427](https://insights.sbomify.com/MAL-2025-140427/): Malicious code in carina-xml-europa-cz-conventional-changelog (npm) (malicious package)
- [MAL-2025-140426](https://insights.sbomify.com/MAL-2025-140426/): Malicious code in carina-transport-nodejs-sirius (npm) (malicious package)
- [MAL-2025-140425](https://insights.sbomify.com/MAL-2025-140425/): Malicious code in carina-rocket-shelljs-rimraf (npm) (malicious package)
- [MAL-2025-140424](https://insights.sbomify.com/MAL-2025-140424/): Malicious code in carina-reveal-md-adonis-epimetheus (npm) (malicious package)
- [MAL-2025-140423](https://insights.sbomify.com/MAL-2025-140423/): Malicious code in carina-resolvers-jwt-xo (npm) (malicious package)
- [MAL-2025-140422](https://insights.sbomify.com/MAL-2025-140422/): Malicious code in carina-rate-limiter-perseus-sync (npm) (malicious package)
- [MAL-2025-140421](https://insights.sbomify.com/MAL-2025-140421/): Malicious code in carina-postcss-auriga-less (npm) (malicious package)
- [MAL-2025-140420](https://insights.sbomify.com/MAL-2025-140420/): Malicious code in carina-phoebe-materialize-rollup (npm) (malicious package)
- [MAL-2025-14042](https://insights.sbomify.com/MAL-2025-14042/): Malicious code in actions-workflow-tools (npm) (malicious package)
- [MAL-2025-140419](https://insights.sbomify.com/MAL-2025-140419/): Malicious code in carina-passport-dione-pino (npm) (malicious package)
- [MAL-2025-140418](https://insights.sbomify.com/MAL-2025-140418/): Malicious code in carina-odin-loopback-mysql (npm) (malicious package)
- [MAL-2025-140417](https://insights.sbomify.com/MAL-2025-140417/): Malicious code in carina-nodejs-spectron-webdriver-regulus (npm) (malicious package)
- [MAL-2025-140416](https://insights.sbomify.com/MAL-2025-140416/): Malicious code in carina-miranda-init-gatsby (npm) (malicious package)
- [MAL-2025-140415](https://insights.sbomify.com/MAL-2025-140415/): Malicious code in carina-meissa-element-ui-blitz (npm) (malicious package)
- [MAL-2025-140414](https://insights.sbomify.com/MAL-2025-140414/): Malicious code in carina-mdx-xerxes-frontend (npm) (malicious package)
- [MAL-2025-140413](https://insights.sbomify.com/MAL-2025-140413/): Malicious code in carina-loopback-zenith-socketio (npm) (malicious package)
- [MAL-2025-140412](https://insights.sbomify.com/MAL-2025-140412/): Malicious code in carina-less-prettier-changelog (npm) (malicious package)
- [MAL-2025-140411](https://insights.sbomify.com/MAL-2025-140411/): Malicious code in carina-impulse-slidev-comet (npm) (malicious package)
- [MAL-2025-140410](https://insights.sbomify.com/MAL-2025-140410/): Malicious code in carina-grus-farout-antd (npm) (malicious package)
- [MAL-2025-14041](https://insights.sbomify.com/MAL-2025-14041/): Malicious code in actions-utils (npm) (malicious package)
- [MAL-2025-140409](https://insights.sbomify.com/MAL-2025-140409/): Malicious code in carina-eslint-plugin-async-mui (npm) (malicious package)
- [MAL-2025-140408](https://insights.sbomify.com/MAL-2025-140408/): Malicious code in carina-draco-install-convict (npm) (malicious package)
- [MAL-2025-140407](https://insights.sbomify.com/MAL-2025-140407/): Malicious code in carina-docusaurus-non-blocking-rigel (npm) (malicious package)
- [MAL-2025-140406](https://insights.sbomify.com/MAL-2025-140406/): Malicious code in carina-chalk-init-astro (npm) (malicious package)
- [MAL-2025-140405](https://insights.sbomify.com/MAL-2025-140405/): Malicious code in carina-centaurus-blaze-terser-webpack-plugin (npm) (malicious package)
- [MAL-2025-140404](https://insights.sbomify.com/MAL-2025-140404/): Malicious code in carina-arcturus-standard-umbriel (npm) (malicious package)
- [MAL-2025-140403](https://insights.sbomify.com/MAL-2025-140403/): Malicious code in carina-antares-rimraf-sedna (npm) (malicious package)
- [MAL-2025-140402](https://insights.sbomify.com/MAL-2025-140402/): Malicious code in careful_wren_blush-12 (npm) (malicious package)
- [MAL-2025-140401](https://insights.sbomify.com/MAL-2025-140401/): Malicious code in capella-zephyr-public-cluster (npm) (malicious package)
- [MAL-2025-140400](https://insights.sbomify.com/MAL-2025-140400/): Malicious code in capella-wolf-testcafe-epimetheus (npm) (malicious package)
- [MAL-2025-14040](https://insights.sbomify.com/MAL-2025-14040/): Malicious code in actionkid (npm) (malicious package)
- [MAL-2025-1404](https://insights.sbomify.com/MAL-2025-1404/): Malicious code in coinw (npm) (malicious package)
- [MAL-2025-140399](https://insights.sbomify.com/MAL-2025-140399/): Malicious code in capella-webpack-octans-postgres (npm) (malicious package)
- [MAL-2025-140398](https://insights.sbomify.com/MAL-2025-140398/): Malicious code in capella-virgo-neptune-eslint (npm) (malicious package)
- [MAL-2025-140397](https://insights.sbomify.com/MAL-2025-140397/): Malicious code in capella-sails-barnard-flare (npm) (malicious package)
- [MAL-2025-140396](https://insights.sbomify.com/MAL-2025-140396/): Malicious code in capella-rocket-io-betelgeuse (npm) (malicious package)
- [MAL-2025-140395](https://insights.sbomify.com/MAL-2025-140395/): Malicious code in capella-restart-javascript-prettier (npm) (malicious package)
- [MAL-2025-140394](https://insights.sbomify.com/MAL-2025-140394/): Malicious code in capella-phoebe-vega-release-it (npm) (malicious package)
- [MAL-2025-140393](https://insights.sbomify.com/MAL-2025-140393/): Malicious code in capella-perseus-callisto-janus (npm) (malicious package)
- [MAL-2025-140392](https://insights.sbomify.com/MAL-2025-140392/): Malicious code in capella-meissa-chakra-ui-aldebaran (npm) (malicious package)
- [MAL-2025-140391](https://insights.sbomify.com/MAL-2025-140391/): Malicious code in capella-materialize-uglify-js-webdriverio (npm) (malicious package)
- [MAL-2025-140390](https://insights.sbomify.com/MAL-2025-140390/): Malicious code in capella-kaus-global-restart (npm) (malicious package)
- [MAL-2025-14039](https://insights.sbomify.com/MAL-2025-14039/): Malicious code in actionaid (npm) (malicious package)
- [MAL-2025-140389](https://insights.sbomify.com/MAL-2025-140389/): Malicious code in capella-hexo-subscription-private (npm) (malicious package)
- [MAL-2025-140388](https://insights.sbomify.com/MAL-2025-140388/): Malicious code in capella-got-norma-postcss (npm) (malicious package)
- [MAL-2025-140387](https://insights.sbomify.com/MAL-2025-140387/): Malicious code in capella-google-titan-kastra (npm) (malicious package)
- [MAL-2025-140386](https://insights.sbomify.com/MAL-2025-140386/): Malicious code in capella-duplex-upgrade-oauth (npm) (malicious package)
- [MAL-2025-140385](https://insights.sbomify.com/MAL-2025-140385/): Malicious code in capella-docusaurus-zenith-ophiuchus (npm) (malicious package)
- [MAL-2025-140384](https://insights.sbomify.com/MAL-2025-140384/): Malicious code in capella-css-minimizer-webpack-plugin-csv-meteor (npm) (malicious package)
- [MAL-2025-140383](https://insights.sbomify.com/MAL-2025-140383/): Malicious code in capella-corvus-hercules-figures (npm) (malicious package)
- [MAL-2025-140382](https://insights.sbomify.com/MAL-2025-140382/): Malicious code in capella-concurrently-odin-changelog (npm) (malicious package)
- [MAL-2025-140381](https://insights.sbomify.com/MAL-2025-140381/): Malicious code in capella-changelog-cressida-jabbah (npm) (malicious package)
- [MAL-2025-140380](https://insights.sbomify.com/MAL-2025-140380/): Malicious code in capella-buffer-cypress-electron (npm) (malicious package)
- [MAL-2025-14038](https://insights.sbomify.com/MAL-2025-14038/): Malicious code in acte.js (npm) (malicious package)
- [MAL-2025-140379](https://insights.sbomify.com/MAL-2025-140379/): Malicious code in capella-axios-build-ophiuchus (npm) (malicious package)
- [MAL-2025-140378](https://insights.sbomify.com/MAL-2025-140378/): Malicious code in capella-aether-hugo-command (npm) (malicious package)
- [MAL-2025-140377](https://insights.sbomify.com/MAL-2025-140377/): Malicious code in canopus-xanadu-markdownlint-non-blocking (npm) (malicious package)
- [MAL-2025-140376](https://insights.sbomify.com/MAL-2025-140376/): Malicious code in canopus-writable-acamar-sirius (npm) (malicious package)
- [MAL-2025-140375](https://insights.sbomify.com/MAL-2025-140375/): Malicious code in canopus-vortex-fornax-warp (npm) (malicious package)
- [MAL-2025-140374](https://insights.sbomify.com/MAL-2025-140374/): Malicious code in canopus-spawn-quito-cassini (npm) (malicious package)
- [MAL-2025-140373](https://insights.sbomify.com/MAL-2025-140373/): Malicious code in canopus-scorpius-kastra-avior (npm) (malicious package)
- [MAL-2025-140372](https://insights.sbomify.com/MAL-2025-140372/): Malicious code in canopus-rollup-semantic-ui-heka (npm) (malicious package)
- [MAL-2025-140371](https://insights.sbomify.com/MAL-2025-140371/): Malicious code in canopus-publish-hyperion-release-it (npm) (malicious package)
- [MAL-2025-140370](https://insights.sbomify.com/MAL-2025-140370/): Malicious code in canopus-proxima-yaml-puppeteer (npm) (malicious package)
- [MAL-2025-14037](https://insights.sbomify.com/MAL-2025-14037/): Malicious code in actaeon (npm) (malicious package)
- [MAL-2025-140369](https://insights.sbomify.com/MAL-2025-140369/): Malicious code in canopus-proxima-orbit-query (npm) (malicious package)
- [MAL-2025-140368](https://insights.sbomify.com/MAL-2025-140368/): Malicious code in canopus-phoebe-electron-builder-meissa (npm) (malicious package)
- [MAL-2025-140367](https://insights.sbomify.com/MAL-2025-140367/): Malicious code in canopus-pavo-hexo-metalsmith (npm) (malicious package)
- [MAL-2025-140366](https://insights.sbomify.com/MAL-2025-140366/): Malicious code in canopus-nova-dotenv-umbriel (npm) (malicious package)
- [MAL-2025-140365](https://insights.sbomify.com/MAL-2025-140365/): Malicious code in canopus-nextjs-cz-conventional-changelog-dotenv-safe (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/1483/