# Vulnerabilities published in 2025


- [MAL-2025-47626](https://insights.sbomify.com/MAL-2025-47626/): Malicious code in com.unity.demoteam.digital-human (npm) (malicious package)
- [MAL-2025-47625](https://insights.sbomify.com/MAL-2025-47625/): Malicious code in com.unity.dataflowgraph (npm) (malicious package)
- [MAL-2025-47624](https://insights.sbomify.com/MAL-2025-47624/): Malicious code in com.unity.animation.rigging (npm) (malicious package)
- [MAL-2025-47623](https://insights.sbomify.com/MAL-2025-47623/): Malicious code in com.microsoft.mrtk.tts.windows (npm) (malicious package)
- [MAL-2025-47622](https://insights.sbomify.com/MAL-2025-47622/): Malicious code in cloud-pipeline (npm) (malicious package)
- [MAL-2025-47621](https://insights.sbomify.com/MAL-2025-47621/): Malicious code in cds-shared (npm) (malicious package)
- [MAL-2025-47620](https://insights.sbomify.com/MAL-2025-47620/): Malicious code in buuwoej (npm) (malicious package)
- [MAL-2025-4762](https://insights.sbomify.com/MAL-2025-4762/): Malicious code in react-server-dom-fb (npm) (malicious package)
- [MAL-2025-47619](https://insights.sbomify.com/MAL-2025-47619/): Malicious code in browser-direct-import (npm) (malicious package)
- [MAL-2025-47618](https://insights.sbomify.com/MAL-2025-47618/): Malicious code in breeze-plugin-ntuc (npm) (malicious package)
- [MAL-2025-47617](https://insights.sbomify.com/MAL-2025-47617/): Malicious code in breeze-plugin-income-flexitravel (npm) (malicious package)
- [MAL-2025-47616](https://insights.sbomify.com/MAL-2025-47616/): Malicious code in botframework-wechat (npm) (malicious package)
- [MAL-2025-47615](https://insights.sbomify.com/MAL-2025-47615/): Malicious code in boostriomont (npm) (malicious package)
- [MAL-2025-47614](https://insights.sbomify.com/MAL-2025-47614/): Malicious code in betterconsoles0 (npm) (malicious package)
- [MAL-2025-47613](https://insights.sbomify.com/MAL-2025-47613/): Malicious code in babel-ganache (npm) (malicious package)
- [MAL-2025-47612](https://insights.sbomify.com/MAL-2025-47612/): Malicious code in appluidio33 (npm) (malicious package)
- [MAL-2025-47611](https://insights.sbomify.com/MAL-2025-47611/): Malicious code in api-react (npm) (malicious package)
- [MAL-2025-47610](https://insights.sbomify.com/MAL-2025-47610/): Malicious code in ai-communication-app (npm) (malicious package)
- [MAL-2025-4761](https://insights.sbomify.com/MAL-2025-4761/): Malicious code in producao (npm) (malicious package)
- [MAL-2025-47609](https://insights.sbomify.com/MAL-2025-47609/): Malicious code in actix-web (npm) (malicious package)
- [MAL-2025-47608](https://insights.sbomify.com/MAL-2025-47608/): Malicious code in acqui-hero-section (npm) (malicious package)
- [MAL-2025-47607](https://insights.sbomify.com/MAL-2025-47607/): Malicious code in @vietnetco-distribution/internal-sdk (npm) (malicious package)
- [MAL-2025-47606](https://insights.sbomify.com/MAL-2025-47606/): Malicious code in @1nderman/betterconsole (npm) (malicious package)
- [MAL-2025-47605](https://insights.sbomify.com/MAL-2025-47605/): Malicious code in zeitwerk (npm) (malicious package)
- [MAL-2025-47604](https://insights.sbomify.com/MAL-2025-47604/): Malicious code in postmark-mcp (npm) (malicious package)
- [MAL-2025-47603](https://insights.sbomify.com/MAL-2025-47603/): Malicious code in filecoin-checker-shared (npm) (malicious package)
- [MAL-2025-47602](https://insights.sbomify.com/MAL-2025-47602/): Malicious code in vuex-vue3 (npm) (malicious package)
- [MAL-2025-47601](https://insights.sbomify.com/MAL-2025-47601/): Malicious code in vscode-eslint (npm) (malicious package)
- [MAL-2025-47600](https://insights.sbomify.com/MAL-2025-47600/): Malicious code in ten99policy-node (npm) (malicious package)
- [MAL-2025-4760](https://insights.sbomify.com/MAL-2025-4760/): Malicious code in prod-shared (npm) (malicious package)
- [MAL-2025-476](https://insights.sbomify.com/MAL-2025-476/): Malicious code in godaddy-user (npm) (malicious package)
- [MAL-2025-47599](https://insights.sbomify.com/MAL-2025-47599/): Malicious code in stylelint-config-opbox (npm) (malicious package)
- [MAL-2025-47598](https://insights.sbomify.com/MAL-2025-47598/): Malicious code in spayee-micro-frontend (npm) (malicious package)
- [MAL-2025-47597](https://insights.sbomify.com/MAL-2025-47597/): Malicious code in sparo-completion-test (npm) (malicious package)
- [MAL-2025-47596](https://insights.sbomify.com/MAL-2025-47596/): Malicious code in sbp_charge_please_web (npm) (malicious package)
- [MAL-2025-47595](https://insights.sbomify.com/MAL-2025-47595/): Malicious code in presto-ui (npm) (malicious package)
- [MAL-2025-47594](https://insights.sbomify.com/MAL-2025-47594/): Malicious code in paypal-postman-lib (npm) (malicious package)
- [MAL-2025-47593](https://insights.sbomify.com/MAL-2025-47593/): Malicious code in package-x (npm) (malicious package)
- [MAL-2025-47592](https://insights.sbomify.com/MAL-2025-47592/): Malicious code in notificare-go-web (npm) (malicious package)
- [MAL-2025-47591](https://insights.sbomify.com/MAL-2025-47591/): Malicious code in new-vitereact (npm) (malicious package)
- [MAL-2025-47590](https://insights.sbomify.com/MAL-2025-47590/): Malicious code in mutual-ssl (npm) (malicious package)
- [MAL-2025-4759](https://insights.sbomify.com/MAL-2025-4759/): Malicious code in prod-interno (npm) (malicious package)
- [MAL-2025-47589](https://insights.sbomify.com/MAL-2025-47589/): Malicious code in merchantauxiliaryserv (npm) (malicious package)
- [MAL-2025-47588](https://insights.sbomify.com/MAL-2025-47588/): Malicious code in logdna-s3 (npm) (malicious package)
- [MAL-2025-47587](https://insights.sbomify.com/MAL-2025-47587/): Malicious code in globalpayments-woocommerce (npm) (malicious package)
- [MAL-2025-47586](https://insights.sbomify.com/MAL-2025-47586/): Malicious code in gd-flag-content (npm) (malicious package)
- [MAL-2025-47585](https://insights.sbomify.com/MAL-2025-47585/): Malicious code in funny-font-wow (npm) (malicious package)
- [MAL-2025-47584](https://insights.sbomify.com/MAL-2025-47584/): Malicious code in dotenv-light (npm) (malicious package)
- [MAL-2025-47583](https://insights.sbomify.com/MAL-2025-47583/): Malicious code in discord-open-source (npm) (malicious package)
- [MAL-2025-47582](https://insights.sbomify.com/MAL-2025-47582/): Malicious code in dex-creator (npm) (malicious package)
- [MAL-2025-47581](https://insights.sbomify.com/MAL-2025-47581/): Malicious code in bgrc (npm) (malicious package)
- [MAL-2025-47580](https://insights.sbomify.com/MAL-2025-47580/): Malicious code in area_cliente_front (npm) (malicious package)
- [MAL-2025-4758](https://insights.sbomify.com/MAL-2025-4758/): Malicious code in prd-utils (npm) (malicious package)
- [MAL-2025-47579](https://insights.sbomify.com/MAL-2025-47579/): Malicious code in altoqitec-login-integrado-react (npm) (malicious package)
- [MAL-2025-47578](https://insights.sbomify.com/MAL-2025-47578/): Malicious code in altoqitec-design-system-react (npm) (malicious package)
- [MAL-2025-47577](https://insights.sbomify.com/MAL-2025-47577/): Malicious code in adobe-alloy-mini-site (npm) (malicious package)
- [MAL-2025-47576](https://insights.sbomify.com/MAL-2025-47576/): Malicious code in adobe-alloy (npm) (malicious package)
- [MAL-2025-47575](https://insights.sbomify.com/MAL-2025-47575/): Malicious code in adco-warp-sdk (npm) (malicious package)
- [MAL-2025-47574](https://insights.sbomify.com/MAL-2025-47574/): Malicious code in @discord-external/activity-iframe-sdk (npm) (malicious package)
- [MAL-2025-47573](https://insights.sbomify.com/MAL-2025-47573/): Malicious code in @covance/cvd3 (npm) (malicious package)
- [MAL-2025-47572](https://insights.sbomify.com/MAL-2025-47572/): Malicious code in bloxypy (PyPI) (malicious package)
- [MAL-2025-47571](https://insights.sbomify.com/MAL-2025-47571/): Malicious code in x402_monorepo (npm) (malicious package)
- [MAL-2025-47570](https://insights.sbomify.com/MAL-2025-47570/): Malicious code in vite-plugin-optichunk (npm) (malicious package)
- [MAL-2025-4757](https://insights.sbomify.com/MAL-2025-4757/): Malicious code in pizza-delivery (npm) (malicious package)
- [MAL-2025-47569](https://insights.sbomify.com/MAL-2025-47569/): Malicious code in truelayer-service (npm) (malicious package)
- [MAL-2025-47568](https://insights.sbomify.com/MAL-2025-47568/): Malicious code in truelayer-assignment (npm) (malicious package)
- [MAL-2025-47567](https://insights.sbomify.com/MAL-2025-47567/): Malicious code in shop-chat-agent (npm) (malicious package)
- [MAL-2025-47566](https://insights.sbomify.com/MAL-2025-47566/): Malicious code in postman-json (npm) (malicious package)
- [MAL-2025-47565](https://insights.sbomify.com/MAL-2025-47565/): Malicious code in postman-converters (npm) (malicious package)
- [MAL-2025-47564](https://insights.sbomify.com/MAL-2025-47564/): Malicious code in notmall (npm) (malicious package)
- [MAL-2025-47563](https://insights.sbomify.com/MAL-2025-47563/): Malicious code in next-optimized-image (npm) (malicious package)
- [MAL-2025-47562](https://insights.sbomify.com/MAL-2025-47562/): Malicious code in my-test-module-first-vespero1017-santiago (npm) (malicious package)
- [MAL-2025-47561](https://insights.sbomify.com/MAL-2025-47561/): Malicious code in internallib_v715 (npm) (malicious package)
- [MAL-2025-47560](https://insights.sbomify.com/MAL-2025-47560/): Malicious code in internallib_v714 (npm) (malicious package)
- [MAL-2025-4756](https://insights.sbomify.com/MAL-2025-4756/): Malicious code in pages-admin (npm) (malicious package)
- [MAL-2025-47559](https://insights.sbomify.com/MAL-2025-47559/): Malicious code in internallib_v606 (npm) (malicious package)
- [MAL-2025-47558](https://insights.sbomify.com/MAL-2025-47558/): Malicious code in internallib_v354 (npm) (malicious package)
- [MAL-2025-47557](https://insights.sbomify.com/MAL-2025-47557/): Malicious code in internallib_v249 (npm) (malicious package)
- [MAL-2025-47556](https://insights.sbomify.com/MAL-2025-47556/): Malicious code in giffgaff-status (npm) (malicious package)
- [MAL-2025-47555](https://insights.sbomify.com/MAL-2025-47555/): Malicious code in giffgaff-help-site (npm) (malicious package)
- [MAL-2025-47554](https://insights.sbomify.com/MAL-2025-47554/): Malicious code in finos-legend (npm) (malicious package)
- [MAL-2025-47553](https://insights.sbomify.com/MAL-2025-47553/): Malicious code in envs-loader (npm) (malicious package)
- [MAL-2025-47552](https://insights.sbomify.com/MAL-2025-47552/): Malicious code in dotenvx-config (npm) (malicious package)
- [MAL-2025-47551](https://insights.sbomify.com/MAL-2025-47551/): Malicious code in data-transaction-generates (npm) (malicious package)
- [MAL-2025-47550](https://insights.sbomify.com/MAL-2025-47550/): Malicious code in com.venly.sdk (npm) (malicious package)
- [MAL-2025-4755](https://insights.sbomify.com/MAL-2025-4755/): Malicious code in npm-events-package (npm) (malicious package)
- [MAL-2025-47549](https://insights.sbomify.com/MAL-2025-47549/): Malicious code in checkout-sheet-kit-react-native (npm) (malicious package)
- [MAL-2025-47548](https://insights.sbomify.com/MAL-2025-47548/): Malicious code in @sev-ui-verse/workflow-context (npm) (malicious package)
- [MAL-2025-47547](https://insights.sbomify.com/MAL-2025-47547/): Malicious code in @sev-ui-verse/ta-product-models (npm) (malicious package)
- [MAL-2025-47546](https://insights.sbomify.com/MAL-2025-47546/): Malicious code in @sev-ui-verse/snackbar (npm) (malicious package)
- [MAL-2025-47545](https://insights.sbomify.com/MAL-2025-47545/): Malicious code in @sev-ui-verse/react-query-utils (npm) (malicious package)
- [MAL-2025-47544](https://insights.sbomify.com/MAL-2025-47544/): Malicious code in @sev-ui-verse/react-query-client (npm) (malicious package)
- [MAL-2025-47543](https://insights.sbomify.com/MAL-2025-47543/): Malicious code in @sev-ui-verse/providers (npm) (malicious package)
- [MAL-2025-47542](https://insights.sbomify.com/MAL-2025-47542/): Malicious code in @sev-ui-verse/logger (npm) (malicious package)
- [MAL-2025-47541](https://insights.sbomify.com/MAL-2025-47541/): Malicious code in @sev-ui-verse/local-storage (npm) (malicious package)
- [MAL-2025-47540](https://insights.sbomify.com/MAL-2025-47540/): Malicious code in @sev-ui-verse/invoice-models (npm) (malicious package)
- [MAL-2025-4754](https://insights.sbomify.com/MAL-2025-4754/): Malicious code in nginx-internal (npm) (malicious package)
- [MAL-2025-47539](https://insights.sbomify.com/MAL-2025-47539/): Malicious code in @sev-ui-verse/i18next-config (npm) (malicious package)
- [MAL-2025-47538](https://insights.sbomify.com/MAL-2025-47538/): Malicious code in @sev-ui-verse/hooks-and-helpers (npm) (malicious package)
- [MAL-2025-47537](https://insights.sbomify.com/MAL-2025-47537/): Malicious code in @sev-ui-verse/form-validators (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/585/