# Vulnerabilities published in 2025 - [MAL-2025-48977](https://insights.sbomify.com/MAL-2025-48977/): Malicious code in airbnb-base-typescript-prettier (npm) (malicious package) - [MAL-2025-48976](https://insights.sbomify.com/MAL-2025-48976/): Malicious code in airbnb-base-hf (npm) (malicious package) - [MAL-2025-48975](https://insights.sbomify.com/MAL-2025-48975/): Malicious code in airbnb-babel (npm) (malicious package) - [MAL-2025-48974](https://insights.sbomify.com/MAL-2025-48974/): Malicious code in aikido-module (npm) (malicious package) - [MAL-2025-48973](https://insights.sbomify.com/MAL-2025-48973/): Malicious code in add-shopify-header (npm) (malicious package) - [MAL-2025-48972](https://insights.sbomify.com/MAL-2025-48972/): Malicious code in acme-package (npm) (malicious package) - [MAL-2025-48971](https://insights.sbomify.com/MAL-2025-48971/): Malicious code in @msdyn365-commerce-marketplace/tax-registration-numbers (npm) (malicious package) - [MAL-2025-48970](https://insights.sbomify.com/MAL-2025-48970/): Malicious code in @msdyn365-commerce-marketplace/address-extensions (npm) (malicious package) - [MAL-2025-4897](https://insights.sbomify.com/MAL-2025-4897/): Malicious code in transaction-data-generation (npm) (malicious package) - [MAL-2025-48969](https://insights.sbomify.com/MAL-2025-48969/): Malicious code in @i22-td-smarthome/component-library (npm) (malicious package) - [MAL-2025-48968](https://insights.sbomify.com/MAL-2025-48968/): Malicious code in @gitlab-test/yarn-v4 (npm) (malicious package) - [MAL-2025-48967](https://insights.sbomify.com/MAL-2025-48967/): Malicious code in @gitlab-test/pnpm-v9 (npm) (malicious package) - [MAL-2025-48966](https://insights.sbomify.com/MAL-2025-48966/): Malicious code in @gitlab-test/npm-v10 (npm) (malicious package) - [MAL-2025-48965](https://insights.sbomify.com/MAL-2025-48965/): Malicious code in @gitlab-test/bun-v1 (npm) (malicious package) - [MAL-2025-48964](https://insights.sbomify.com/MAL-2025-48964/): Malicious code in @gitlab-lsp/workflow-api (npm) (malicious package) - [MAL-2025-48963](https://insights.sbomify.com/MAL-2025-48963/): Malicious code in @gitlab-lsp/pkg-2 (npm) (malicious package) - [MAL-2025-48962](https://insights.sbomify.com/MAL-2025-48962/): Malicious code in @gitlab-lsp/pkg-1 (npm) (malicious package) - [MAL-2025-48961](https://insights.sbomify.com/MAL-2025-48961/): Malicious code in @decentraland-gatsby/intl (npm) (malicious package) - [MAL-2025-48960](https://insights.sbomify.com/MAL-2025-48960/): Malicious code in @apache-netbeans/netbeans-antora-ui (npm) (malicious package) - [MAL-2025-4896](https://insights.sbomify.com/MAL-2025-4896/): Malicious code in tim-website (npm) (malicious package) - [MAL-2025-48959](https://insights.sbomify.com/MAL-2025-48959/): Malicious code in @apache-felix/felix-antora-ui (npm) (malicious package) - [MAL-2025-48958](https://insights.sbomify.com/MAL-2025-48958/): Malicious code in @aio-commerce-sdk/config-vitest (npm) (malicious package) - [MAL-2025-48957](https://insights.sbomify.com/MAL-2025-48957/): Malicious code in @aio-commerce-sdk/config-typescript (npm) (malicious package) - [MAL-2025-48956](https://insights.sbomify.com/MAL-2025-48956/): Malicious code in @aio-commerce-sdk/config-typedoc (npm) (malicious package) - [MAL-2025-48955](https://insights.sbomify.com/MAL-2025-48955/): Malicious code in @aio-commerce-sdk/config-tsdown (npm) (malicious package) - [MAL-2025-48954](https://insights.sbomify.com/MAL-2025-48954/): Malicious code in @acme-types/acme-package (npm) (malicious package) - [MAL-2025-48953](https://insights.sbomify.com/MAL-2025-48953/): Malicious code in ect-987654-ctf (npm) (malicious package) - [MAL-2025-48952](https://insights.sbomify.com/MAL-2025-48952/): Malicious code in ect-987654 (npm) (malicious package) - [MAL-2025-48951](https://insights.sbomify.com/MAL-2025-48951/): Malicious code in xdater (npm) (malicious package) - [MAL-2025-48950](https://insights.sbomify.com/MAL-2025-48950/): Malicious code in terminal-kleur (npm) (malicious package) - [MAL-2025-4895](https://insights.sbomify.com/MAL-2025-4895/): Malicious code in throttling-proxy (npm) (malicious package) - [MAL-2025-48949](https://insights.sbomify.com/MAL-2025-48949/): Malicious code in test771 (npm) (malicious package) - [MAL-2025-48948](https://insights.sbomify.com/MAL-2025-48948/): Malicious code in haedal-vaults-sdk (npm) (malicious package) - [MAL-2025-48947](https://insights.sbomify.com/MAL-2025-48947/): Malicious code in geopost-web-component (npm) (malicious package) - [MAL-2025-48946](https://insights.sbomify.com/MAL-2025-48946/): Malicious code in @eqder/bird (npm) (malicious package) - [MAL-2025-48945](https://insights.sbomify.com/MAL-2025-48945/): Malicious code in terrastruct-d2-bin-win32-x64 (npm) (malicious package) - [MAL-2025-48944](https://insights.sbomify.com/MAL-2025-48944/): Malicious code in new-wwe-immortals-h-ack-working-2023-march (npm) (malicious package) - [MAL-2025-48943](https://insights.sbomify.com/MAL-2025-48943/): Malicious code in new-tiktok-h-ack-working-2023-march (npm) (malicious package) - [MAL-2025-48942](https://insights.sbomify.com/MAL-2025-48942/): Malicious code in new-pubg-mobile-h-ack-working-2023-march (npm) (malicious package) - [MAL-2025-48941](https://insights.sbomify.com/MAL-2025-48941/): Malicious code in new-fifa-mobile-h-ack-working-2023-march (npm) (malicious package) - [MAL-2025-48940](https://insights.sbomify.com/MAL-2025-48940/): Malicious code in new-cod-mobile-h-ack-working-2023-march (npm) (malicious package) - [MAL-2025-4894](https://insights.sbomify.com/MAL-2025-4894/): Malicious code in tedious-types (npm) (malicious package) - [MAL-2025-48939](https://insights.sbomify.com/MAL-2025-48939/): Malicious code in types-lodash.es (npm) (malicious package) - [MAL-2025-48938](https://insights.sbomify.com/MAL-2025-48938/): Malicious code in testing-react-dom (npm) (malicious package) - [MAL-2025-48937](https://insights.sbomify.com/MAL-2025-48937/): Malicious code in tailwindcss-setanimation (npm) (malicious package) - [MAL-2025-48936](https://insights.sbomify.com/MAL-2025-48936/): Malicious code in tailwind-merge-setting (npm) (malicious package) - [MAL-2025-48935](https://insights.sbomify.com/MAL-2025-48935/): Malicious code in shopify-ruby (npm) (malicious package) - [MAL-2025-48934](https://insights.sbomify.com/MAL-2025-48934/): Malicious code in shopify-logistics (npm) (malicious package) - [MAL-2025-48933](https://insights.sbomify.com/MAL-2025-48933/): Malicious code in react-ipack (npm) (malicious package) - [MAL-2025-48932](https://insights.sbomify.com/MAL-2025-48932/): Malicious code in jito-shred-propo-excutor (npm) (malicious package) - [MAL-2025-48931](https://insights.sbomify.com/MAL-2025-48931/): Malicious code in internallib_v799 (npm) (malicious package) - [MAL-2025-48930](https://insights.sbomify.com/MAL-2025-48930/): Malicious code in internallib_v691 (npm) (malicious package) - [MAL-2025-4893](https://insights.sbomify.com/MAL-2025-4893/): Malicious code in talkingagent (npm) (malicious package) - [MAL-2025-48929](https://insights.sbomify.com/MAL-2025-48929/): Malicious code in graphnet (npm) (malicious package) - [MAL-2025-48928](https://insights.sbomify.com/MAL-2025-48928/): Malicious code in fzreo-trading-sdk (npm) (malicious package) - [MAL-2025-48927](https://insights.sbomify.com/MAL-2025-48927/): Malicious code in func-analysist (npm) (malicious package) - [MAL-2025-48926](https://insights.sbomify.com/MAL-2025-48926/): Malicious code in four-sdk-aes-ipheriv (npm) (malicious package) - [MAL-2025-48925](https://insights.sbomify.com/MAL-2025-48925/): Malicious code in ews-paze-toolkit (npm) (malicious package) - [MAL-2025-48924](https://insights.sbomify.com/MAL-2025-48924/): Malicious code in energy-portal (npm) (malicious package) - [MAL-2025-48923](https://insights.sbomify.com/MAL-2025-48923/): Malicious code in arno-baidu2-test (npm) (malicious package) - [MAL-2025-48922](https://insights.sbomify.com/MAL-2025-48922/): Malicious code in @jameson777/mytest8 (npm) (malicious package) - [MAL-2025-48921](https://insights.sbomify.com/MAL-2025-48921/): Malicious code in @jameson777/mytest7 (npm) (malicious package) - [MAL-2025-48920](https://insights.sbomify.com/MAL-2025-48920/): Malicious code in @jameson777/mytest6 (npm) (malicious package) - [MAL-2025-4892](https://insights.sbomify.com/MAL-2025-4892/): Malicious code in svelte-local-storage (npm) (malicious package) - [MAL-2025-48919](https://insights.sbomify.com/MAL-2025-48919/): Malicious code in @jameson777/mytest5 (npm) (malicious package) - [MAL-2025-48918](https://insights.sbomify.com/MAL-2025-48918/): Malicious code in @jameson777/mytest4 (npm) (malicious package) - [MAL-2025-48917](https://insights.sbomify.com/MAL-2025-48917/): Malicious code in @jameson777/mytest3 (npm) (malicious package) - [MAL-2025-48916](https://insights.sbomify.com/MAL-2025-48916/): Malicious code in @jameson777/mytest2 (npm) (malicious package) - [MAL-2025-48915](https://insights.sbomify.com/MAL-2025-48915/): Malicious code in vite-plugin-es6-compat (npm) (malicious package) - [MAL-2025-48914](https://insights.sbomify.com/MAL-2025-48914/): Malicious code in vite-manual-chunker (npm) (malicious package) - [MAL-2025-48913](https://insights.sbomify.com/MAL-2025-48913/): Malicious code in sreadmin-base (npm) (malicious package) - [MAL-2025-48912](https://insights.sbomify.com/MAL-2025-48912/): Malicious code in agentmono (npm) (malicious package) - [MAL-2025-48911](https://insights.sbomify.com/MAL-2025-48911/): Malicious code in yuzo (PyPI) (malicious package) - [MAL-2025-48910](https://insights.sbomify.com/MAL-2025-48910/): Malicious code in web3eth (PyPI) (malicious package) - [MAL-2025-4891](https://insights.sbomify.com/MAL-2025-4891/): Malicious code in stylelint-fix (npm) (malicious package) - [MAL-2025-48909](https://insights.sbomify.com/MAL-2025-48909/): Malicious code in trstk (PyPI) (malicious package) - [MAL-2025-48908](https://insights.sbomify.com/MAL-2025-48908/): Malicious code in tronlastpy (PyPI) (malicious package) - [MAL-2025-48907](https://insights.sbomify.com/MAL-2025-48907/): Malicious code in tronlast (PyPI) (malicious package) - [MAL-2025-48906](https://insights.sbomify.com/MAL-2025-48906/): Malicious code in tronkeeppy (PyPI) (malicious package) - [MAL-2025-48905](https://insights.sbomify.com/MAL-2025-48905/): Malicious code in tronkeep (PyPI) (malicious package) - [MAL-2025-48904](https://insights.sbomify.com/MAL-2025-48904/): Malicious code in tronhexpy (PyPI) (malicious package) - [MAL-2025-48903](https://insights.sbomify.com/MAL-2025-48903/): Malicious code in tronhex (PyPI) (malicious package) - [MAL-2025-48902](https://insights.sbomify.com/MAL-2025-48902/): Malicious code in testpackageclaim (PyPI) (malicious package) - [MAL-2025-48901](https://insights.sbomify.com/MAL-2025-48901/): Malicious code in testpackage-hello (PyPI) (malicious package) - [MAL-2025-48900](https://insights.sbomify.com/MAL-2025-48900/): Malicious code in test422 (PyPI) (malicious package) - [MAL-2025-4890](https://insights.sbomify.com/MAL-2025-4890/): Malicious code in statsmodels (npm) (malicious package) - [MAL-2025-489](https://insights.sbomify.com/MAL-2025-489/): Malicious code in iberia-cloud (npm) (malicious package) - [MAL-2025-48899](https://insights.sbomify.com/MAL-2025-48899/): Malicious code in test421 (PyPI) (malicious package) - [MAL-2025-48898](https://insights.sbomify.com/MAL-2025-48898/): Malicious code in suyo (PyPI) (malicious package) - [MAL-2025-48897](https://insights.sbomify.com/MAL-2025-48897/): Malicious code in request-unitest (PyPI) (malicious package) - [MAL-2025-48896](https://insights.sbomify.com/MAL-2025-48896/): Malicious code in regixtest (PyPI) (malicious package) - [MAL-2025-48895](https://insights.sbomify.com/MAL-2025-48895/): Malicious code in netkit-lite (PyPI) (malicious package) - [MAL-2025-48894](https://insights.sbomify.com/MAL-2025-48894/): Malicious code in my-test-packagexx (PyPI) (malicious package) - [MAL-2025-48893](https://insights.sbomify.com/MAL-2025-48893/): Malicious code in image2hex (PyPI) (malicious package) - [MAL-2025-48892](https://insights.sbomify.com/MAL-2025-48892/): Malicious code in hackerone-app-sdk (PyPI) (malicious package) - [MAL-2025-48891](https://insights.sbomify.com/MAL-2025-48891/): Malicious code in final-osint (PyPI) (malicious package) - [MAL-2025-48890](https://insights.sbomify.com/MAL-2025-48890/): Malicious code in emoted (PyPI) (malicious package) - [MAL-2025-4889](https://insights.sbomify.com/MAL-2025-4889/): Malicious code in springboot-md (npm) (malicious package) - [MAL-2025-48889](https://insights.sbomify.com/MAL-2025-48889/): Malicious code in cugraph-service-server (PyPI) (malicious package) - [MAL-2025-48888](https://insights.sbomify.com/MAL-2025-48888/): Malicious code in consolergbcolor (PyPI) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2025/page/570/