# Vulnerabilities published in 2025


- [MAL-2025-49066](https://insights.sbomify.com/MAL-2025-49066/): Malicious code in wm-tests-helper (npm) (malicious package)
- [MAL-2025-49065](https://insights.sbomify.com/MAL-2025-49065/): Malicious code in wdr-beam (npm) (malicious package)
- [MAL-2025-49064](https://insights.sbomify.com/MAL-2025-49064/): Malicious code in vuejs-accessibility (npm) (malicious package)
- [MAL-2025-49063](https://insights.sbomify.com/MAL-2025-49063/): Malicious code in ul-inline (npm) (malicious package)
- [MAL-2025-49062](https://insights.sbomify.com/MAL-2025-49062/): Malicious code in ucbuzz-web-common (npm) (malicious package)
- [MAL-2025-49061](https://insights.sbomify.com/MAL-2025-49061/): Malicious code in uach-retrofill (npm) (malicious package)
- [MAL-2025-49060](https://insights.sbomify.com/MAL-2025-49060/): Malicious code in typescript-sort-keys (npm) (malicious package)
- [MAL-2025-4906](https://insights.sbomify.com/MAL-2025-4906/): Malicious code in vue-coreo (npm) (malicious package)
- [MAL-2025-49059](https://insights.sbomify.com/MAL-2025-49059/): Malicious code in typescript-compat (npm) (malicious package)
- [MAL-2025-49058](https://insights.sbomify.com/MAL-2025-49058/): Malicious code in twilio-ts (npm) (malicious package)
- [MAL-2025-49057](https://insights.sbomify.com/MAL-2025-49057/): Malicious code in twilio-react (npm) (malicious package)
- [MAL-2025-49056](https://insights.sbomify.com/MAL-2025-49056/): Malicious code in ts-react-important-stuff (npm) (malicious package)
- [MAL-2025-49055](https://insights.sbomify.com/MAL-2025-49055/): Malicious code in ts-migrate-example (npm) (malicious package)
- [MAL-2025-49054](https://insights.sbomify.com/MAL-2025-49054/): Malicious code in ts-important-stuff (npm) (malicious package)
- [MAL-2025-49053](https://insights.sbomify.com/MAL-2025-49053/): Malicious code in trezor-rollout (npm) (malicious package)
- [MAL-2025-49052](https://insights.sbomify.com/MAL-2025-49052/): Malicious code in transform-strict-mode (npm) (malicious package)
- [MAL-2025-49051](https://insights.sbomify.com/MAL-2025-49051/): Malicious code in transform-react-remove-prop-types (npm) (malicious package)
- [MAL-2025-49050](https://insights.sbomify.com/MAL-2025-49050/): Malicious code in transform-react-jsx-source (npm) (malicious package)
- [MAL-2025-4905](https://insights.sbomify.com/MAL-2025-4905/): Malicious code in vite-plugin-svgn (npm) (malicious package)
- [MAL-2025-49049](https://insights.sbomify.com/MAL-2025-49049/): Malicious code in transform-react-constant-elements (npm) (malicious package)
- [MAL-2025-49048](https://insights.sbomify.com/MAL-2025-49048/): Malicious code in transform-merge-sibling-variables (npm) (malicious package)
- [MAL-2025-49047](https://insights.sbomify.com/MAL-2025-49047/): Malicious code in transform-es2015-modules-commonjs (npm) (malicious package)
- [MAL-2025-49046](https://insights.sbomify.com/MAL-2025-49046/): Malicious code in syntax-dynamic-import (npm) (malicious package)
- [MAL-2025-49045](https://insights.sbomify.com/MAL-2025-49045/): Malicious code in spaintest1 (npm) (malicious package)
- [MAL-2025-49044](https://insights.sbomify.com/MAL-2025-49044/): Malicious code in sort-keys-plus (npm) (malicious package)
- [MAL-2025-49043](https://insights.sbomify.com/MAL-2025-49043/): Malicious code in sort-keys-fix (npm) (malicious package)
- [MAL-2025-49042](https://insights.sbomify.com/MAL-2025-49042/): Malicious code in sort-class-members (npm) (malicious package)
- [MAL-2025-49041](https://insights.sbomify.com/MAL-2025-49041/): Malicious code in skyscanner-with-prettier (npm) (malicious package)
- [MAL-2025-49040](https://insights.sbomify.com/MAL-2025-49040/): Malicious code in simple-import-sort (npm) (malicious package)
- [MAL-2025-4904](https://insights.sbomify.com/MAL-2025-4904/): Malicious code in vite-plugin-purify (npm) (malicious package)
- [MAL-2025-49039](https://insights.sbomify.com/MAL-2025-49039/): Malicious code in rxjs-angular (npm) (malicious package)
- [MAL-2025-49038](https://insights.sbomify.com/MAL-2025-49038/): Malicious code in react-web-api (npm) (malicious package)
- [MAL-2025-49037](https://insights.sbomify.com/MAL-2025-49037/): Malicious code in react-naming-convention (npm) (malicious package)
- [MAL-2025-49036](https://insights.sbomify.com/MAL-2025-49036/): Malicious code in react-important-stuff (npm) (malicious package)
- [MAL-2025-49035](https://insights.sbomify.com/MAL-2025-49035/): Malicious code in react-async-component-lifecycle-hooks (npm) (malicious package)
- [MAL-2025-49034](https://insights.sbomify.com/MAL-2025-49034/): Malicious code in preferred-import (npm) (malicious package)
- [MAL-2025-49033](https://insights.sbomify.com/MAL-2025-49033/): Malicious code in prefer-object-spread (npm) (malicious package)
- [MAL-2025-49032](https://insights.sbomify.com/MAL-2025-49032/): Malicious code in prefer-arrow (npm) (malicious package)
- [MAL-2025-49031](https://insights.sbomify.com/MAL-2025-49031/): Malicious code in powerbi-visuals-sunburst (npm) (malicious package)
- [MAL-2025-49030](https://insights.sbomify.com/MAL-2025-49030/): Malicious code in polyfill-regenerator (npm) (malicious package)
- [MAL-2025-4903](https://insights.sbomify.com/MAL-2025-4903/): Malicious code in ve-vores (npm) (malicious package)
- [MAL-2025-49029](https://insights.sbomify.com/MAL-2025-49029/): Malicious code in pensions-portals-fe (npm) (malicious package)
- [MAL-2025-49028](https://insights.sbomify.com/MAL-2025-49028/): Malicious code in only-warn (npm) (malicious package)
- [MAL-2025-49027](https://insights.sbomify.com/MAL-2025-49027/): Malicious code in no-unsupported-browser-features (npm) (malicious package)
- [MAL-2025-49026](https://insights.sbomify.com/MAL-2025-49026/): Malicious code in no-only-tests (npm) (malicious package)
- [MAL-2025-49025](https://insights.sbomify.com/MAL-2025-49025/): Malicious code in no-floating-promise (npm) (malicious package)
- [MAL-2025-49024](https://insights.sbomify.com/MAL-2025-49024/): Malicious code in named-asset-import (npm) (malicious package)
- [MAL-2025-49023](https://insights.sbomify.com/MAL-2025-49023/): Malicious code in mourner (npm) (malicious package)
- [MAL-2025-49022](https://insights.sbomify.com/MAL-2025-49022/): Malicious code in mocha-no-only (npm) (malicious package)
- [MAL-2025-49021](https://insights.sbomify.com/MAL-2025-49021/): Malicious code in minify-dead-code-elimination (npm) (malicious package)
- [MAL-2025-49020](https://insights.sbomify.com/MAL-2025-49020/): Malicious code in lion-based-ui-labs (npm) (malicious package)
- [MAL-2025-4902](https://insights.sbomify.com/MAL-2025-4902/): Malicious code in ve-cores (npm) (malicious package)
- [MAL-2025-49019](https://insights.sbomify.com/MAL-2025-49019/): Malicious code in lion-based-ui (npm) (malicious package)
- [MAL-2025-49018](https://insights.sbomify.com/MAL-2025-49018/): Malicious code in lfs-ui (npm) (malicious package)
- [MAL-2025-49017](https://insights.sbomify.com/MAL-2025-49017/): Malicious code in labelbox-custom-ui (npm) (malicious package)
- [MAL-2025-49016](https://insights.sbomify.com/MAL-2025-49016/): Malicious code in jsx-a11y (npm) (malicious package)
- [MAL-2025-49015](https://insights.sbomify.com/MAL-2025-49015/): Malicious code in jira-ticket-todo-comment (npm) (malicious package)
- [MAL-2025-49014](https://insights.sbomify.com/MAL-2025-49014/): Malicious code in jfrog-npm-actions-example (npm) (malicious package)
- [MAL-2025-49013](https://insights.sbomify.com/MAL-2025-49013/): Malicious code in jest-hoist (npm) (malicious package)
- [MAL-2025-49012](https://insights.sbomify.com/MAL-2025-49012/): Malicious code in iot-cardboard-js (npm) (malicious package)
- [MAL-2025-49011](https://insights.sbomify.com/MAL-2025-49011/): Malicious code in inline-react-svg (npm) (malicious package)
- [MAL-2025-49010](https://insights.sbomify.com/MAL-2025-49010/): Malicious code in ing-web-es (npm) (malicious package)
- [MAL-2025-4901](https://insights.sbomify.com/MAL-2025-4901/): Malicious code in uvicorn (npm) (malicious package)
- [MAL-2025-49009](https://insights.sbomify.com/MAL-2025-49009/): Malicious code in important-stuff (npm) (malicious package)
- [MAL-2025-49008](https://insights.sbomify.com/MAL-2025-49008/): Malicious code in google-cloud-functions-framework (npm) (malicious package)
- [MAL-2025-49007](https://insights.sbomify.com/MAL-2025-49007/): Malicious code in ft-flow (npm) (malicious package)
- [MAL-2025-49006](https://insights.sbomify.com/MAL-2025-49006/): Malicious code in flowtype-errors (npm) (malicious package)
- [MAL-2025-49005](https://insights.sbomify.com/MAL-2025-49005/): Malicious code in firefly-utilities-js (npm) (malicious package)
- [MAL-2025-49004](https://insights.sbomify.com/MAL-2025-49004/): Malicious code in firefly-sdk-js (npm) (malicious package)
- [MAL-2025-49003](https://insights.sbomify.com/MAL-2025-49003/): Malicious code in filename-rules (npm) (malicious package)
- [MAL-2025-49002](https://insights.sbomify.com/MAL-2025-49002/): Malicious code in faltest (npm) (malicious package)
- [MAL-2025-49001](https://insights.sbomify.com/MAL-2025-49001/): Malicious code in external-helpers (npm) (malicious package)
- [MAL-2025-49000](https://insights.sbomify.com/MAL-2025-49000/): Malicious code in express-redact (npm) (malicious package)
- [MAL-2025-4900](https://insights.sbomify.com/MAL-2025-4900/): Malicious code in undetected-chromedriver (npm) (malicious package)
- [MAL-2025-490](https://insights.sbomify.com/MAL-2025-490/): Malicious code in iberia-connect (npm) (malicious package)
- [MAL-2025-49](https://insights.sbomify.com/MAL-2025-49/): Malicious code in ilovenyxxbait (PyPI) (malicious package)
- [MAL-2025-48999](https://insights.sbomify.com/MAL-2025-48999/): Malicious code in eslint-plugin-custom-eslint-rules (npm) (malicious package)
- [MAL-2025-48998](https://insights.sbomify.com/MAL-2025-48998/): Malicious code in eslint-plugin-cli-microsoft365 (npm) (malicious package)
- [MAL-2025-48997](https://insights.sbomify.com/MAL-2025-48997/): Malicious code in eslint-github-bot (npm) (malicious package)
- [MAL-2025-48996](https://insights.sbomify.com/MAL-2025-48996/): Malicious code in eslint-disable-next-line (npm) (malicious package)
- [MAL-2025-48995](https://insights.sbomify.com/MAL-2025-48995/): Malicious code in elemefe (npm) (malicious package)
- [MAL-2025-48994](https://insights.sbomify.com/MAL-2025-48994/): Malicious code in durablefunctionsmonitor.react (npm) (malicious package)
- [MAL-2025-48993](https://insights.sbomify.com/MAL-2025-48993/): Malicious code in durablefunctionsmonitor-vscodeext (npm) (malicious package)
- [MAL-2025-48992](https://insights.sbomify.com/MAL-2025-48992/): Malicious code in durablefunctionsmonitor (npm) (malicious package)
- [MAL-2025-48991](https://insights.sbomify.com/MAL-2025-48991/): Malicious code in crowdstrike (npm) (malicious package)
- [MAL-2025-48990](https://insights.sbomify.com/MAL-2025-48990/): Malicious code in chai-friendly (npm) (malicious package)
- [MAL-2025-4899](https://insights.sbomify.com/MAL-2025-4899/): Malicious code in uiframebox (npm) (malicious package)
- [MAL-2025-48989](https://insights.sbomify.com/MAL-2025-48989/): Malicious code in bernie-plugin-l10n (npm) (malicious package)
- [MAL-2025-48988](https://insights.sbomify.com/MAL-2025-48988/): Malicious code in bernie-plugin-datadog-rum (npm) (malicious package)
- [MAL-2025-48987](https://insights.sbomify.com/MAL-2025-48987/): Malicious code in bernie-core (npm) (malicious package)
- [MAL-2025-48986](https://insights.sbomify.com/MAL-2025-48986/): Malicious code in audio-game (npm) (malicious package)
- [MAL-2025-48985](https://insights.sbomify.com/MAL-2025-48985/): Malicious code in artifactregistry-login (npm) (malicious package)
- [MAL-2025-48984](https://insights.sbomify.com/MAL-2025-48984/): Malicious code in annotate-pure-calls (npm) (malicious package)
- [MAL-2025-48983](https://insights.sbomify.com/MAL-2025-48983/): Malicious code in ais-sn-components (npm) (malicious package)
- [MAL-2025-48982](https://insights.sbomify.com/MAL-2025-48982/): Malicious code in airbnb-types (npm) (malicious package)
- [MAL-2025-48981](https://insights.sbomify.com/MAL-2025-48981/): Malicious code in airbnb-scraper (npm) (malicious package)
- [MAL-2025-48980](https://insights.sbomify.com/MAL-2025-48980/): Malicious code in airbnb-opentracing-javascript (npm) (malicious package)
- [MAL-2025-4898](https://insights.sbomify.com/MAL-2025-4898/): Malicious code in typeface-myriad-pro (npm) (malicious package)
- [MAL-2025-48979](https://insights.sbomify.com/MAL-2025-48979/): Malicious code in airbnb-calendar (npm) (malicious package)
- [MAL-2025-48978](https://insights.sbomify.com/MAL-2025-48978/): Malicious code in airbnb-bev (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/569/