# Vulnerabilities published in 2025


- [MAL-2025-48526](https://insights.sbomify.com/MAL-2025-48526/): Malicious code in taxify-work-profile (npm) (malicious package)
- [MAL-2025-48525](https://insights.sbomify.com/MAL-2025-48525/): Malicious code in user-trace-fingerprint (npm) (malicious package)
- [MAL-2025-48524](https://insights.sbomify.com/MAL-2025-48524/): Malicious code in tailwind-setting (npm) (malicious package)
- [MAL-2025-48523](https://insights.sbomify.com/MAL-2025-48523/): Malicious code in multi-cloud-data-migrator (npm) (malicious package)
- [MAL-2025-48522](https://insights.sbomify.com/MAL-2025-48522/): Malicious code in stram-log (npm) (malicious package)
- [MAL-2025-48521](https://insights.sbomify.com/MAL-2025-48521/): Malicious code in hari-zzz (npm) (malicious package)
- [MAL-2025-48520](https://insights.sbomify.com/MAL-2025-48520/): Malicious code in gridmancer (npm) (malicious package)
- [MAL-2025-4852](https://insights.sbomify.com/MAL-2025-4852/): Malicious code in meteor-react-component (npm) (malicious package)
- [MAL-2025-48519](https://insights.sbomify.com/MAL-2025-48519/): Malicious code in gets-random-datas (npm) (malicious package)
- [MAL-2025-48518](https://insights.sbomify.com/MAL-2025-48518/): Malicious code in dist-decoder (npm) (malicious package)
- [MAL-2025-48517](https://insights.sbomify.com/MAL-2025-48517/): Malicious code in @odoreltd/osiris-api (npm) (malicious package)
- [MAL-2025-48516](https://insights.sbomify.com/MAL-2025-48516/): Malicious code in yugabyte_cloud (npm) (malicious package)
- [MAL-2025-48515](https://insights.sbomify.com/MAL-2025-48515/): Malicious code in web-palette-react (npm) (malicious package)
- [MAL-2025-48514](https://insights.sbomify.com/MAL-2025-48514/): Malicious code in ui-library_mercadolibre (npm) (malicious package)
- [MAL-2025-48513](https://insights.sbomify.com/MAL-2025-48513/): Malicious code in tombac (npm) (malicious package)
- [MAL-2025-48512](https://insights.sbomify.com/MAL-2025-48512/): Malicious code in tjt-podlet-frontpage (npm) (malicious package)
- [MAL-2025-48511](https://insights.sbomify.com/MAL-2025-48511/): Malicious code in test-postinstall-package-for-ctf-nfrejnfvjenjner (npm) (malicious package)
- [MAL-2025-48510](https://insights.sbomify.com/MAL-2025-48510/): Malicious code in src_module_index_ts (npm) (malicious package)
- [MAL-2025-4851](https://insights.sbomify.com/MAL-2025-4851/): Malicious code in mediaserv-paypal (npm) (malicious package)
- [MAL-2025-48509](https://insights.sbomify.com/MAL-2025-48509/): Malicious code in src_index_ts (npm) (malicious package)
- [MAL-2025-48508](https://insights.sbomify.com/MAL-2025-48508/): Malicious code in src_components_ibtdetail_index_tsx (npm) (malicious package)
- [MAL-2025-48507](https://insights.sbomify.com/MAL-2025-48507/): Malicious code in spot-electron-sdk (npm) (malicious package)
- [MAL-2025-48506](https://insights.sbomify.com/MAL-2025-48506/): Malicious code in simmons (npm) (malicious package)
- [MAL-2025-48505](https://insights.sbomify.com/MAL-2025-48505/): Malicious code in sb_wm_integrator (npm) (malicious package)
- [MAL-2025-48504](https://insights.sbomify.com/MAL-2025-48504/): Malicious code in rootsid (npm) (malicious package)
- [MAL-2025-48503](https://insights.sbomify.com/MAL-2025-48503/): Malicious code in phlex-core-ui (npm) (malicious package)
- [MAL-2025-48502](https://insights.sbomify.com/MAL-2025-48502/): Malicious code in package-g (npm) (malicious package)
- [MAL-2025-48501](https://insights.sbomify.com/MAL-2025-48501/): Malicious code in metronome-utils (npm) (malicious package)
- [MAL-2025-48500](https://insights.sbomify.com/MAL-2025-48500/): Malicious code in internal-native-buy (npm) (malicious package)
- [MAL-2025-4850](https://insights.sbomify.com/MAL-2025-4850/): Malicious code in media-recorder-polyfill (npm) (malicious package)
- [MAL-2025-485](https://insights.sbomify.com/MAL-2025-485/): Malicious code in iberia-api-client (npm) (malicious package)
- [MAL-2025-48499](https://insights.sbomify.com/MAL-2025-48499/): Malicious code in internal-forc (npm) (malicious package)
- [MAL-2025-48498](https://insights.sbomify.com/MAL-2025-48498/): Malicious code in internal-config (npm) (malicious package)
- [MAL-2025-48497](https://insights.sbomify.com/MAL-2025-48497/): Malicious code in humansdotai-humans-client (npm) (malicious package)
- [MAL-2025-48496](https://insights.sbomify.com/MAL-2025-48496/): Malicious code in hex-stablecoin (npm) (malicious package)
- [MAL-2025-48495](https://insights.sbomify.com/MAL-2025-48495/): Malicious code in gardr-finn-js (npm) (malicious package)
- [MAL-2025-48494](https://insights.sbomify.com/MAL-2025-48494/): Malicious code in gardr-finn (npm) (malicious package)
- [MAL-2025-48493](https://insights.sbomify.com/MAL-2025-48493/): Malicious code in eero_blog (npm) (malicious package)
- [MAL-2025-48492](https://insights.sbomify.com/MAL-2025-48492/): Malicious code in ec-component-loader (npm) (malicious package)
- [MAL-2025-48491](https://insights.sbomify.com/MAL-2025-48491/): Malicious code in doppler-sdk (npm) (malicious package)
- [MAL-2025-48490](https://insights.sbomify.com/MAL-2025-48490/): Malicious code in didirce (npm) (malicious package)
- [MAL-2025-4849](https://insights.sbomify.com/MAL-2025-4849/): Malicious code in lubridate (npm) (malicious package)
- [MAL-2025-48489](https://insights.sbomify.com/MAL-2025-48489/): Malicious code in css-platform-js (npm) (malicious package)
- [MAL-2025-48488](https://insights.sbomify.com/MAL-2025-48488/): Malicious code in codegrid-js (npm) (malicious package)
- [MAL-2025-48487](https://insights.sbomify.com/MAL-2025-48487/): Malicious code in class-scheduling (npm) (malicious package)
- [MAL-2025-48486](https://insights.sbomify.com/MAL-2025-48486/): Malicious code in circleci-docs (npm) (malicious package)
- [MAL-2025-48485](https://insights.sbomify.com/MAL-2025-48485/): Malicious code in ccs-platform-js (npm) (malicious package)
- [MAL-2025-48484](https://insights.sbomify.com/MAL-2025-48484/): Malicious code in ccs-platform (npm) (malicious package)
- [MAL-2025-48483](https://insights.sbomify.com/MAL-2025-48483/): Malicious code in arno-baidu-test (npm) (malicious package)
- [MAL-2025-48482](https://insights.sbomify.com/MAL-2025-48482/): Malicious code in aptos-protos (npm) (malicious package)
- [MAL-2025-48481](https://insights.sbomify.com/MAL-2025-48481/): Malicious code in api_halodoc (npm) (malicious package)
- [MAL-2025-48480](https://insights.sbomify.com/MAL-2025-48480/): Malicious code in alef-frontend (npm) (malicious package)
- [MAL-2025-4848](https://insights.sbomify.com/MAL-2025-4848/): Malicious code in listenv (npm) (malicious package)
- [MAL-2025-48479](https://insights.sbomify.com/MAL-2025-48479/): Malicious code in ai-protocol (npm) (malicious package)
- [MAL-2025-48478](https://insights.sbomify.com/MAL-2025-48478/): Malicious code in ab-testing-for-wp (npm) (malicious package)
- [MAL-2025-48477](https://insights.sbomify.com/MAL-2025-48477/): Malicious code in ab-test-wordpress (npm) (malicious package)
- [MAL-2025-48476](https://insights.sbomify.com/MAL-2025-48476/): Malicious code in @wen-community/wen-new-standard (npm) (malicious package)
- [MAL-2025-48475](https://insights.sbomify.com/MAL-2025-48475/): Malicious code in @vscode-bicep-ui/components (npm) (malicious package)
- [MAL-2025-48474](https://insights.sbomify.com/MAL-2025-48474/): Malicious code in @upside/flex-common-typescript-lib (npm) (malicious package)
- [MAL-2025-48473](https://insights.sbomify.com/MAL-2025-48473/): Malicious code in @undress-ai/best-undress-ai (npm) (malicious package)
- [MAL-2025-48472](https://insights.sbomify.com/MAL-2025-48472/): Malicious code in @taskrabbit/meadow-web (npm) (malicious package)
- [MAL-2025-48471](https://insights.sbomify.com/MAL-2025-48471/): Malicious code in @sudt-faucet/commons (npm) (malicious package)
- [MAL-2025-48470](https://insights.sbomify.com/MAL-2025-48470/): Malicious code in @nunes_nunes/loader-base (npm) (malicious package)
- [MAL-2025-4847](https://insights.sbomify.com/MAL-2025-4847/): Malicious code in libxslt1-dev (npm) (malicious package)
- [MAL-2025-48469](https://insights.sbomify.com/MAL-2025-48469/): Malicious code in @naviance/translation-client (npm) (malicious package)
- [MAL-2025-48468](https://insights.sbomify.com/MAL-2025-48468/): Malicious code in @institute-of-data-management/n11-chatbot (npm) (malicious package)
- [MAL-2025-48467](https://insights.sbomify.com/MAL-2025-48467/): Malicious code in @hotels-at-home/hah-fe-core (npm) (malicious package)
- [MAL-2025-48466](https://insights.sbomify.com/MAL-2025-48466/): Malicious code in @gtpn/eslint-config-progressive (npm) (malicious package)
- [MAL-2025-48465](https://insights.sbomify.com/MAL-2025-48465/): Malicious code in @gala-analytics/core (npm) (malicious package)
- [MAL-2025-48464](https://insights.sbomify.com/MAL-2025-48464/): Malicious code in @custom-widget/sdk (npm) (malicious package)
- [MAL-2025-48463](https://insights.sbomify.com/MAL-2025-48463/): Malicious code in shopifyql-parser (npm) (malicious package)
- [MAL-2025-48462](https://insights.sbomify.com/MAL-2025-48462/): Malicious code in saifulhhacker.site-test (npm) (malicious package)
- [MAL-2025-48461](https://insights.sbomify.com/MAL-2025-48461/): Malicious code in @shopify.com/shopifyql-parser (npm) (malicious package)
- [MAL-2025-48460](https://insights.sbomify.com/MAL-2025-48460/): Malicious code in moloch (npm) (malicious package)
- [MAL-2025-4846](https://insights.sbomify.com/MAL-2025-4846/): Malicious code in libxml2-dev (npm) (malicious package)
- [MAL-2025-48459](https://insights.sbomify.com/MAL-2025-48459/): Malicious code in iwf-ant-design-draggable-modal (npm) (malicious package)
- [MAL-2025-48458](https://insights.sbomify.com/MAL-2025-48458/): Malicious code in src_plugin_index_ts (npm) (malicious package)
- [MAL-2025-48457](https://insights.sbomify.com/MAL-2025-48457/): Malicious code in src_dev-tool_index_ts (npm) (malicious package)
- [MAL-2025-48456](https://insights.sbomify.com/MAL-2025-48456/): Malicious code in src_core-instance_index_ts (npm) (malicious package)
- [MAL-2025-48455](https://insights.sbomify.com/MAL-2025-48455/): Malicious code in src_bootstrap_index_ts (npm) (malicious package)
- [MAL-2025-48454](https://insights.sbomify.com/MAL-2025-48454/): Malicious code in rainbowkit-next-app (npm) (malicious package)
- [MAL-2025-48453](https://insights.sbomify.com/MAL-2025-48453/): Malicious code in src_pages_list_index_tsx (npm) (malicious package)
- [MAL-2025-48452](https://insights.sbomify.com/MAL-2025-48452/): Malicious code in src_components_qcreport_index_tsx (npm) (malicious package)
- [MAL-2025-48451](https://insights.sbomify.com/MAL-2025-48451/): Malicious code in helosifjowe2342 (npm) (malicious package)
- [MAL-2025-48450](https://insights.sbomify.com/MAL-2025-48450/): Malicious code in cp2-shared-components (npm) (malicious package)
- [MAL-2025-4845](https://insights.sbomify.com/MAL-2025-4845/): Malicious code in libssl-dev (npm) (malicious package)
- [MAL-2025-48449](https://insights.sbomify.com/MAL-2025-48449/): Malicious code in monzo-com (npm) (malicious package)
- [MAL-2025-48448](https://insights.sbomify.com/MAL-2025-48448/): Malicious code in isg-iwp-web-client (npm) (malicious package)
- [MAL-2025-48447](https://insights.sbomify.com/MAL-2025-48447/): Malicious code in deere-ui-svg-to-react (npm) (malicious package)
- [MAL-2025-48446](https://insights.sbomify.com/MAL-2025-48446/): Malicious code in deere-ui-namespace (npm) (malicious package)
- [MAL-2025-48445](https://insights.sbomify.com/MAL-2025-48445/): Malicious code in deere-ui-cache (npm) (malicious package)
- [MAL-2025-48444](https://insights.sbomify.com/MAL-2025-48444/): Malicious code in deere-ui-analytics-events (npm) (malicious package)
- [MAL-2025-48443](https://insights.sbomify.com/MAL-2025-48443/): Malicious code in deere-ui (npm) (malicious package)
- [MAL-2025-48442](https://insights.sbomify.com/MAL-2025-48442/): Malicious code in ynab_api (npm) (malicious package)
- [MAL-2025-48441](https://insights.sbomify.com/MAL-2025-48441/): Malicious code in webpack-loadcss (npm) (malicious package)
- [MAL-2025-48440](https://insights.sbomify.com/MAL-2025-48440/): Malicious code in usage-tracker-secured (npm) (malicious package)
- [MAL-2025-4844](https://insights.sbomify.com/MAL-2025-4844/): Malicious code in libp11 (npm) (malicious package)
- [MAL-2025-48439](https://insights.sbomify.com/MAL-2025-48439/): Malicious code in swagger-express-cli (npm) (malicious package)
- [MAL-2025-48438](https://insights.sbomify.com/MAL-2025-48438/): Malicious code in n8n-nodes-phoai-ultimate-tools (npm) (malicious package)
- [MAL-2025-48437](https://insights.sbomify.com/MAL-2025-48437/): Malicious code in hyperion-react-native (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/575/