# Vulnerabilities published in 2025


- [MAL-2025-49426](https://insights.sbomify.com/MAL-2025-49426/): Malicious code in notimeoutexploit (npm) (malicious package)
- [MAL-2025-49425](https://insights.sbomify.com/MAL-2025-49425/): Malicious code in megaexploitvorkemol1 (npm) (malicious package)
- [MAL-2025-49424](https://insights.sbomify.com/MAL-2025-49424/): Malicious code in megaexploitvorkemol (npm) (malicious package)
- [MAL-2025-49423](https://insights.sbomify.com/MAL-2025-49423/): Malicious code in megadepsexploit (npm) (malicious package)
- [MAL-2025-49422](https://insights.sbomify.com/MAL-2025-49422/): Malicious code in lui-portal-utilities (npm) (malicious package)
- [MAL-2025-49421](https://insights.sbomify.com/MAL-2025-49421/): Malicious code in lowerx-package2 (npm) (malicious package)
- [MAL-2025-49420](https://insights.sbomify.com/MAL-2025-49420/): Malicious code in logstealer (npm) (malicious package)
- [MAL-2025-4942](https://insights.sbomify.com/MAL-2025-4942/): Malicious code in solanautil (npm) (malicious package)
- [MAL-2025-49419](https://insights.sbomify.com/MAL-2025-49419/): Malicious code in libxmljs2superbank (npm) (malicious package)
- [MAL-2025-49418](https://insights.sbomify.com/MAL-2025-49418/): Malicious code in jjkrtyugh (npm) (malicious package)
- [MAL-2025-49417](https://insights.sbomify.com/MAL-2025-49417/): Malicious code in jenkinslogger (npm) (malicious package)
- [MAL-2025-49416](https://insights.sbomify.com/MAL-2025-49416/): Malicious code in icu-messageformat (npm) (malicious package)
- [MAL-2025-49415](https://insights.sbomify.com/MAL-2025-49415/): Malicious code in gibertserctf7 (npm) (malicious package)
- [MAL-2025-49414](https://insights.sbomify.com/MAL-2025-49414/): Malicious code in gibertserctf6 (npm) (malicious package)
- [MAL-2025-49413](https://insights.sbomify.com/MAL-2025-49413/): Malicious code in gca-package2 (npm) (malicious package)
- [MAL-2025-49412](https://insights.sbomify.com/MAL-2025-49412/): Malicious code in gca-package (npm) (malicious package)
- [MAL-2025-49411](https://insights.sbomify.com/MAL-2025-49411/): Malicious code in fullscriptsexploit (npm) (malicious package)
- [MAL-2025-49410](https://insights.sbomify.com/MAL-2025-49410/): Malicious code in frontend-vue-next (npm) (malicious package)
- [MAL-2025-4941](https://insights.sbomify.com/MAL-2025-4941/): Malicious code in puppeteer-proxy-https (npm) (malicious package)
- [MAL-2025-49409](https://insights.sbomify.com/MAL-2025-49409/): Malicious code in finalmoyloyt4 (npm) (malicious package)
- [MAL-2025-49408](https://insights.sbomify.com/MAL-2025-49408/): Malicious code in finalmoyloyt2 (npm) (malicious package)
- [MAL-2025-49407](https://insights.sbomify.com/MAL-2025-49407/): Malicious code in finalmoyloyt (npm) (malicious package)
- [MAL-2025-49406](https://insights.sbomify.com/MAL-2025-49406/): Malicious code in fastxmlexploit (npm) (malicious package)
- [MAL-2025-49405](https://insights.sbomify.com/MAL-2025-49405/): Malicious code in erbankbackdoor (npm) (malicious package)
- [MAL-2025-49404](https://insights.sbomify.com/MAL-2025-49404/): Malicious code in elf-stats-velvet-fir-824 (npm) (malicious package)
- [MAL-2025-49403](https://insights.sbomify.com/MAL-2025-49403/): Malicious code in elf-stats-storybook-cocoa-790 (npm) (malicious package)
- [MAL-2025-49402](https://insights.sbomify.com/MAL-2025-49402/): Malicious code in elf-stats-northbound-ledger-135 (npm) (malicious package)
- [MAL-2025-49401](https://insights.sbomify.com/MAL-2025-49401/): Malicious code in elf-stats-northbound-candy-916 (npm) (malicious package)
- [MAL-2025-49400](https://insights.sbomify.com/MAL-2025-49400/): Malicious code in capes-ui (npm) (malicious package)
- [MAL-2025-4940](https://insights.sbomify.com/MAL-2025-4940/): Malicious code in puppeteer-proxy-http (npm) (malicious package)
- [MAL-2025-494](https://insights.sbomify.com/MAL-2025-494/): Malicious code in iberia-service (npm) (malicious package)
- [MAL-2025-49399](https://insights.sbomify.com/MAL-2025-49399/): Malicious code in cachelogger (npm) (malicious package)
- [MAL-2025-49398](https://insights.sbomify.com/MAL-2025-49398/): Malicious code in bf-purchases-frontend-web (npm) (malicious package)
- [MAL-2025-49397](https://insights.sbomify.com/MAL-2025-49397/): Malicious code in autonomous-header-package-test (npm) (malicious package)
- [MAL-2025-49396](https://insights.sbomify.com/MAL-2025-49396/): Malicious code in @hemihatchlings/shared (npm) (malicious package)
- [MAL-2025-49395](https://insights.sbomify.com/MAL-2025-49395/): Malicious code in @deputyapp/copilot2 (npm) (malicious package)
- [MAL-2025-49394](https://insights.sbomify.com/MAL-2025-49394/): Malicious code in @anhackle/test (npm) (malicious package)
- [MAL-2025-49393](https://insights.sbomify.com/MAL-2025-49393/): Malicious code in @acitons/artifact (npm) (malicious package)
- [MAL-2025-49392](https://insights.sbomify.com/MAL-2025-49392/): Malicious code in focusync-custom-controls (npm) (malicious package)
- [MAL-2025-49391](https://insights.sbomify.com/MAL-2025-49391/): Malicious code in payouts-report (npm) (malicious package)
- [MAL-2025-49390](https://insights.sbomify.com/MAL-2025-49390/): Malicious code in payments-notifications (npm) (malicious package)
- [MAL-2025-4939](https://insights.sbomify.com/MAL-2025-4939/): Malicious code in iclpacket (npm) (malicious package)
- [MAL-2025-49389](https://insights.sbomify.com/MAL-2025-49389/): Malicious code in globby-legacy (npm) (malicious package)
- [MAL-2025-49388](https://insights.sbomify.com/MAL-2025-49388/): Malicious code in xss-payload-all (npm) (malicious package)
- [MAL-2025-49387](https://insights.sbomify.com/MAL-2025-49387/): Malicious code in xss-payload-7n-ctf (npm) (malicious package)
- [MAL-2025-49386](https://insights.sbomify.com/MAL-2025-49386/): Malicious code in tailwindcss-twflare (npm) (malicious package)
- [MAL-2025-49385](https://insights.sbomify.com/MAL-2025-49385/): Malicious code in tailwindcss-gustify (npm) (malicious package)
- [MAL-2025-49384](https://insights.sbomify.com/MAL-2025-49384/): Malicious code in tailwindcss-aerowind (npm) (malicious package)
- [MAL-2025-49383](https://insights.sbomify.com/MAL-2025-49383/): Malicious code in rce-poc-test-honor-mcp (npm) (malicious package)
- [MAL-2025-49382](https://insights.sbomify.com/MAL-2025-49382/): Malicious code in rce-poc-test-honor-dev (npm) (malicious package)
- [MAL-2025-49381](https://insights.sbomify.com/MAL-2025-49381/): Malicious code in huangming-demo (npm) (malicious package)
- [MAL-2025-49380](https://insights.sbomify.com/MAL-2025-49380/): Malicious code in chai-await-test (npm) (malicious package)
- [MAL-2025-4938](https://insights.sbomify.com/MAL-2025-4938/): Malicious code in husky-es (npm) (malicious package)
- [MAL-2025-49379](https://insights.sbomify.com/MAL-2025-49379/): Malicious code in @chatclub/claude-code (npm) (malicious package)
- [MAL-2025-49378](https://insights.sbomify.com/MAL-2025-49378/): Malicious code in revenuecat-mcp-extension (npm) (malicious package)
- [MAL-2025-49377](https://insights.sbomify.com/MAL-2025-49377/): Malicious code in github.com/boltdb-go/bolt (Git) (malicious package)
- [MAL-2025-49376](https://insights.sbomify.com/MAL-2025-49376/): Malicious code in solara-websocket-dll (npm) (malicious package)
- [MAL-2025-49375](https://insights.sbomify.com/MAL-2025-49375/): Malicious code in rbx-reader-ts (npm) (malicious package)
- [MAL-2025-49374](https://insights.sbomify.com/MAL-2025-49374/): Malicious code in rbx-handler (npm) (malicious package)
- [MAL-2025-49373](https://insights.sbomify.com/MAL-2025-49373/): Malicious code in rbx-api-ts (npm) (malicious package)
- [MAL-2025-49372](https://insights.sbomify.com/MAL-2025-49372/): Malicious code in vite-smart-chunk (npm) (malicious package)
- [MAL-2025-49371](https://insights.sbomify.com/MAL-2025-49371/): Malicious code in tailwindcss-setgrids (npm) (malicious package)
- [MAL-2025-49370](https://insights.sbomify.com/MAL-2025-49370/): Malicious code in tailwindcss-setgrid (npm) (malicious package)
- [MAL-2025-4937](https://insights.sbomify.com/MAL-2025-4937/): Malicious code in hijack_publish (npm) (malicious package)
- [MAL-2025-49369](https://insights.sbomify.com/MAL-2025-49369/): Malicious code in tailwindcss-react-sass (npm) (malicious package)
- [MAL-2025-49368](https://insights.sbomify.com/MAL-2025-49368/): Malicious code in react-tmedia (npm) (malicious package)
- [MAL-2025-49367](https://insights.sbomify.com/MAL-2025-49367/): Malicious code in monobing (npm) (malicious package)
- [MAL-2025-49366](https://insights.sbomify.com/MAL-2025-49366/): Malicious code in mojio-client-lite (npm) (malicious package)
- [MAL-2025-49365](https://insights.sbomify.com/MAL-2025-49365/): Malicious code in dunnhumby-component-library (npm) (malicious package)
- [MAL-2025-49364](https://insights.sbomify.com/MAL-2025-49364/): Malicious code in supply_chain_supplyer (npm) (malicious package)
- [MAL-2025-49363](https://insights.sbomify.com/MAL-2025-49363/): Malicious code in webpack-jsxcompile (npm) (malicious package)
- [MAL-2025-49362](https://insights.sbomify.com/MAL-2025-49362/): Malicious code in snavbox (npm) (malicious package)
- [MAL-2025-49361](https://insights.sbomify.com/MAL-2025-49361/): Malicious code in react-notifications-alert (npm) (malicious package)
- [MAL-2025-49360](https://insights.sbomify.com/MAL-2025-49360/): Malicious code in node-xpnav (npm) (malicious package)
- [MAL-2025-4936](https://insights.sbomify.com/MAL-2025-4936/): Malicious code in bs58-encrypt-utils (npm) (malicious package)
- [MAL-2025-49359](https://insights.sbomify.com/MAL-2025-49359/): Malicious code in jito-prop-exec (npm) (malicious package)
- [MAL-2025-49358](https://insights.sbomify.com/MAL-2025-49358/): Malicious code in bcryptjs-node-js (npm) (malicious package)
- [MAL-2025-49357](https://insights.sbomify.com/MAL-2025-49357/): Malicious code in bcryptjs-node (npm) (malicious package)
- [MAL-2025-49356](https://insights.sbomify.com/MAL-2025-49356/): Malicious code in aes-valid-ipherv (npm) (malicious package)
- [MAL-2025-49355](https://insights.sbomify.com/MAL-2025-49355/): Malicious code in @bbkkfkk/pre (npm) (malicious package)
- [MAL-2025-49354](https://insights.sbomify.com/MAL-2025-49354/): Malicious code in tailwind-fa-bridge (npm) (malicious package)
- [MAL-2025-49353](https://insights.sbomify.com/MAL-2025-49353/): Malicious code in jsonretype (npm) (malicious package)
- [MAL-2025-49352](https://insights.sbomify.com/MAL-2025-49352/): Malicious code in react-paypal-braintree-demo (npm) (malicious package)
- [MAL-2025-49351](https://insights.sbomify.com/MAL-2025-49351/): Malicious code in @isv-occ-payment/occ-payment-service (npm) (malicious package)
- [MAL-2025-49350](https://insights.sbomify.com/MAL-2025-49350/): `replit_ruspty` was removed from crates.io for malicious code (malicious package)
- [MAL-2025-4935](https://insights.sbomify.com/MAL-2025-4935/): Malicious code in test-victim (npm) (malicious package)
- [MAL-2025-49349](https://insights.sbomify.com/MAL-2025-49349/): Malicious code in pkg-with-optional (npm) (malicious package)
- [MAL-2025-49348](https://insights.sbomify.com/MAL-2025-49348/): Malicious code in antora-navigator-extension (npm) (malicious package)
- [MAL-2025-49347](https://insights.sbomify.com/MAL-2025-49347/): Malicious code in lowerx-package (npm) (malicious package)
- [MAL-2025-49346](https://insights.sbomify.com/MAL-2025-49346/): Malicious code in kb-rnd-package (npm) (malicious package)
- [MAL-2025-49345](https://insights.sbomify.com/MAL-2025-49345/): Malicious code in kb-first-package (npm) (malicious package)
- [MAL-2025-49344](https://insights.sbomify.com/MAL-2025-49344/): Malicious code in reservas-hilton (npm) (malicious package)
- [MAL-2025-49343](https://insights.sbomify.com/MAL-2025-49343/): Malicious code in pil2-compiler (npm) (malicious package)
- [MAL-2025-49342](https://insights.sbomify.com/MAL-2025-49342/): Malicious code in pc-experience-fe-components (npm) (malicious package)
- [MAL-2025-49341](https://insights.sbomify.com/MAL-2025-49341/): Malicious code in mercury-composable (npm) (malicious package)
- [MAL-2025-49340](https://insights.sbomify.com/MAL-2025-49340/): Malicious code in loaders-fbo.gov (npm) (malicious package)
- [MAL-2025-4934](https://insights.sbomify.com/MAL-2025-4934/): Malicious code in zora-utils-core (npm) (malicious package)
- [MAL-2025-49339](https://insights.sbomify.com/MAL-2025-49339/): Malicious code in experience-manager-apis (npm) (malicious package)
- [MAL-2025-49338](https://insights.sbomify.com/MAL-2025-49338/): Malicious code in dowload_ebok_teufelsbotschaft_osterreich_krimi_meierhofers_se_by_lisa_gallauner_07297 (npm) (malicious package)
- [MAL-2025-49337](https://insights.sbomify.com/MAL-2025-49337/): Malicious code in dowload_ebok_spia_nella_rete_by_riccardo_meggiato_h35d1 (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/565/