# Vulnerabilities published in 2025 - [MAL-2025-46996](https://insights.sbomify.com/MAL-2025-46996/): Malicious code in marvelapp (npm) (malicious package) - [MAL-2025-46995](https://insights.sbomify.com/MAL-2025-46995/): Malicious code in aledade-org (npm) (malicious package) - [MAL-2025-46994](https://insights.sbomify.com/MAL-2025-46994/): Malicious code in duckdb (npm) (malicious package) - [MAL-2025-46993](https://insights.sbomify.com/MAL-2025-46993/): Malicious code in @duckdb/node-bindings (npm) (malicious package) - [MAL-2025-46992](https://insights.sbomify.com/MAL-2025-46992/): Malicious code in @duckdb/node-api (npm) (malicious package) - [MAL-2025-46991](https://insights.sbomify.com/MAL-2025-46991/): Malicious code in @duckdb/duckdb-wasm (npm) (malicious package) - [MAL-2025-46990](https://insights.sbomify.com/MAL-2025-46990/): Malicious code in prebid.js (npm) (malicious package) - [MAL-2025-46989](https://insights.sbomify.com/MAL-2025-46989/): Malicious code in ifood-faster-remote-config (npm) (malicious package) - [MAL-2025-46988](https://insights.sbomify.com/MAL-2025-46988/): Malicious code in com.revenuecat.purchases-unity (npm) (malicious package) - [MAL-2025-46987](https://insights.sbomify.com/MAL-2025-46987/): Malicious code in arm-package-deploymentscripts-2019-10-preview (npm) (malicious package) - [MAL-2025-46986](https://insights.sbomify.com/MAL-2025-46986/): Malicious code in mcp-server-everything (npm) (malicious package) - [MAL-2025-46985](https://insights.sbomify.com/MAL-2025-46985/): Malicious code in color (npm) (malicious package) - [MAL-2025-46984](https://insights.sbomify.com/MAL-2025-46984/): Malicious code in proto-tinker-wc (npm) (malicious package) - [MAL-2025-46983](https://insights.sbomify.com/MAL-2025-46983/): Malicious code in wrap-ansi (npm) (malicious package) - [MAL-2025-46982](https://insights.sbomify.com/MAL-2025-46982/): Malicious code in supports-hyperlinks (npm) (malicious package) - [MAL-2025-46981](https://insights.sbomify.com/MAL-2025-46981/): Malicious code in supports-color (npm) (malicious package) - [MAL-2025-46980](https://insights.sbomify.com/MAL-2025-46980/): Malicious code in strip-ansi (npm) (malicious package) - [MAL-2025-46979](https://insights.sbomify.com/MAL-2025-46979/): Malicious code in slice-ansi (npm) (malicious package) - [MAL-2025-46978](https://insights.sbomify.com/MAL-2025-46978/): Malicious code in simple-swizzle (npm) (malicious package) - [MAL-2025-46977](https://insights.sbomify.com/MAL-2025-46977/): Malicious code in is-arrayish (npm) (malicious package) - [MAL-2025-46976](https://insights.sbomify.com/MAL-2025-46976/): Malicious code in has-ansi (npm) (malicious package) - [MAL-2025-46975](https://insights.sbomify.com/MAL-2025-46975/): Malicious code in error-ex (npm) (malicious package) - [MAL-2025-46974](https://insights.sbomify.com/MAL-2025-46974/): Malicious code in debug (npm) (malicious package) - [MAL-2025-46973](https://insights.sbomify.com/MAL-2025-46973/): Malicious code in color-string (npm) (malicious package) - [MAL-2025-46972](https://insights.sbomify.com/MAL-2025-46972/): Malicious code in color-name (npm) (malicious package) - [MAL-2025-46971](https://insights.sbomify.com/MAL-2025-46971/): Malicious code in color-convert (npm) (malicious package) - [MAL-2025-46970](https://insights.sbomify.com/MAL-2025-46970/): Malicious code in chalk-template (npm) (malicious package) - [MAL-2025-4697](https://insights.sbomify.com/MAL-2025-4697/): Malicious code in dc-spectrum-v3-core (npm) (malicious package) - [MAL-2025-46969](https://insights.sbomify.com/MAL-2025-46969/): Malicious code in chalk (npm) (malicious package) - [MAL-2025-46968](https://insights.sbomify.com/MAL-2025-46968/): Malicious code in backslash (npm) (malicious package) - [MAL-2025-46967](https://insights.sbomify.com/MAL-2025-46967/): Malicious code in ansi-styles (npm) (malicious package) - [MAL-2025-46966](https://insights.sbomify.com/MAL-2025-46966/): Malicious code in ansi-regex (npm) (malicious package) - [MAL-2025-46965](https://insights.sbomify.com/MAL-2025-46965/): Malicious code in windbeam_api (RubyGems) (malicious package) - [MAL-2025-46964](https://insights.sbomify.com/MAL-2025-46964/): Malicious code in turboghas-client (RubyGems) (malicious package) - [MAL-2025-46963](https://insights.sbomify.com/MAL-2025-46963/): Malicious code in s4-client (RubyGems) (malicious package) - [MAL-2025-46962](https://insights.sbomify.com/MAL-2025-46962/): Malicious code in proto-registry-metadata-migrator-api (RubyGems) (malicious package) - [MAL-2025-46961](https://insights.sbomify.com/MAL-2025-46961/): Malicious code in prose_diff (RubyGems) (malicious package) - [MAL-2025-46960](https://insights.sbomify.com/MAL-2025-46960/): Malicious code in octolytics (RubyGems) (malicious package) - [MAL-2025-4696](https://insights.sbomify.com/MAL-2025-4696/): Malicious code in tradingv-scraper (npm) (malicious package) - [MAL-2025-46959](https://insights.sbomify.com/MAL-2025-46959/): Malicious code in mvnd (RubyGems) (malicious package) - [MAL-2025-46958](https://insights.sbomify.com/MAL-2025-46958/): Malicious code in monolith-twirp-webhooks-core (RubyGems) (malicious package) - [MAL-2025-46957](https://insights.sbomify.com/MAL-2025-46957/): Malicious code in monolith-twirp-pipelinemonitor-monitoring (RubyGems) (malicious package) - [MAL-2025-46956](https://insights.sbomify.com/MAL-2025-46956/): Malicious code in monolith-twirp-pages-pagesdfsapi (RubyGems) (malicious package) - [MAL-2025-46955](https://insights.sbomify.com/MAL-2025-46955/): Malicious code in monolith-twirp-pages-pagesdeployerapi (RubyGems) (malicious package) - [MAL-2025-46954](https://insights.sbomify.com/MAL-2025-46954/): Malicious code in monolith-twirp-octoshift-imports (RubyGems) (malicious package) - [MAL-2025-46953](https://insights.sbomify.com/MAL-2025-46953/): Malicious code in monolith-twirp-modelsgateway-access (RubyGems) (malicious package) - [MAL-2025-46952](https://insights.sbomify.com/MAL-2025-46952/): Malicious code in monolith-twirp-kredz-core (RubyGems) (malicious package) - [MAL-2025-46951](https://insights.sbomify.com/MAL-2025-46951/): Malicious code in monolith-twirp-git_src_migrator-migrations (RubyGems) (malicious package) - [MAL-2025-46950](https://insights.sbomify.com/MAL-2025-46950/): Malicious code in monolith-twirp-features-groups (RubyGems) (malicious package) - [MAL-2025-4695](https://insights.sbomify.com/MAL-2025-4695/): Malicious code in system-health-sync-api (npm) (malicious package) - [MAL-2025-46949](https://insights.sbomify.com/MAL-2025-46949/): Malicious code in monolith-twirp-features-featuresync (RubyGems) (malicious package) - [MAL-2025-46948](https://insights.sbomify.com/MAL-2025-46948/): Malicious code in monolith-twirp-features-actors (RubyGems) (malicious package) - [MAL-2025-46947](https://insights.sbomify.com/MAL-2025-46947/): Malicious code in monolith-twirp-examples-octocat (RubyGems) (malicious package) - [MAL-2025-46946](https://insights.sbomify.com/MAL-2025-46946/): Malicious code in turboscan-client (RubyGems) (malicious package) - [MAL-2025-46945](https://insights.sbomify.com/MAL-2025-46945/): Malicious code in treelights-client (RubyGems) (malicious package) - [MAL-2025-46944](https://insights.sbomify.com/MAL-2025-46944/): Malicious code in spokes-proto (RubyGems) (malicious package) - [MAL-2025-46943](https://insights.sbomify.com/MAL-2025-46943/): Malicious code in service-catalog-client (RubyGems) (malicious package) - [MAL-2025-46942](https://insights.sbomify.com/MAL-2025-46942/): Malicious code in secret-scanning-proto (RubyGems) (malicious package) - [MAL-2025-46941](https://insights.sbomify.com/MAL-2025-46941/): Malicious code in proto-trust-metadata-api (RubyGems) (malicious package) - [MAL-2025-46940](https://insights.sbomify.com/MAL-2025-46940/): Malicious code in proto-education-web (RubyGems) (malicious package) - [MAL-2025-4694](https://insights.sbomify.com/MAL-2025-4694/): Malicious code in some-private-package (npm) (malicious package) - [MAL-2025-46939](https://insights.sbomify.com/MAL-2025-46939/): Malicious code in proto-dependabot-api (RubyGems) (malicious package) - [MAL-2025-46938](https://insights.sbomify.com/MAL-2025-46938/): Malicious code in monolith-twirp-webhooksubscriptions-subscriptions (RubyGems) (malicious package) - [MAL-2025-46937](https://insights.sbomify.com/MAL-2025-46937/): Malicious code in monolith-twirp-support-helphub (RubyGems) (malicious package) - [MAL-2025-46936](https://insights.sbomify.com/MAL-2025-46936/): Malicious code in monolith-twirp-spokesd-core (RubyGems) (malicious package) - [MAL-2025-46935](https://insights.sbomify.com/MAL-2025-46935/): Malicious code in monolith-twirp-packageregistry-auditlog (RubyGems) (malicious package) - [MAL-2025-46934](https://insights.sbomify.com/MAL-2025-46934/): Malicious code in monolith-twirp-odometer-core (RubyGems) (malicious package) - [MAL-2025-46933](https://insights.sbomify.com/MAL-2025-46933/): Malicious code in monolith-twirp-modelsgateway-telemetry (RubyGems) (malicious package) - [MAL-2025-46932](https://insights.sbomify.com/MAL-2025-46932/): Malicious code in monolith-twirp-merge-queue-go-mergequeueservice (RubyGems) (malicious package) - [MAL-2025-46931](https://insights.sbomify.com/MAL-2025-46931/): Malicious code in monolith-twirp-merge-queue-go-mergequeuemonolith (RubyGems) (malicious package) - [MAL-2025-46930](https://insights.sbomify.com/MAL-2025-46930/): Malicious code in monolith-twirp-mailreplies-replies (RubyGems) (malicious package) - [MAL-2025-4693](https://insights.sbomify.com/MAL-2025-4693/): Malicious code in service-config-provider (npm) (malicious package) - [MAL-2025-46929](https://insights.sbomify.com/MAL-2025-46929/): Malicious code in monolith-twirp-github-repositories (RubyGems) (malicious package) - [MAL-2025-46928](https://insights.sbomify.com/MAL-2025-46928/): Malicious code in monolith-twirp-git_src_migrator-monolith (RubyGems) (malicious package) - [MAL-2025-46927](https://insights.sbomify.com/MAL-2025-46927/): Malicious code in monolith-twirp-features-featureflaghub (RubyGems) (malicious package) - [MAL-2025-46926](https://insights.sbomify.com/MAL-2025-46926/): Malicious code in github_chatops_extensions (RubyGems) (malicious package) - [MAL-2025-46925](https://insights.sbomify.com/MAL-2025-46925/): Malicious code in authzd-client (RubyGems) (malicious package) - [MAL-2025-46924](https://insights.sbomify.com/MAL-2025-46924/): Malicious code in advisory_db_toolkit (RubyGems) (malicious package) - [MAL-2025-46923](https://insights.sbomify.com/MAL-2025-46923/): Malicious code in flow-security-cart (npm) (malicious package) - [MAL-2025-46922](https://insights.sbomify.com/MAL-2025-46922/): Malicious code in spamurai-dev-kit (RubyGems) (malicious package) - [MAL-2025-46921](https://insights.sbomify.com/MAL-2025-46921/): Malicious code in sarif (RubyGems) (malicious package) - [MAL-2025-46920](https://insights.sbomify.com/MAL-2025-46920/): Malicious code in proto-registry-metadata-api (RubyGems) (malicious package) - [MAL-2025-4692](https://insights.sbomify.com/MAL-2025-4692/): Malicious code in portfolio-config-manager-mongo (npm) (malicious package) - [MAL-2025-46919](https://insights.sbomify.com/MAL-2025-46919/): Malicious code in proto-dependency-graph-api (RubyGems) (malicious package) - [MAL-2025-46918](https://insights.sbomify.com/MAL-2025-46918/): Malicious code in monolith-twirp-trusttiers-trusttier (RubyGems) (malicious package) - [MAL-2025-46917](https://insights.sbomify.com/MAL-2025-46917/): Malicious code in monolith-twirp-snippy-snippy (RubyGems) (malicious package) - [MAL-2025-46916](https://insights.sbomify.com/MAL-2025-46916/): Malicious code in monolith-twirp-registrymetadata-core (RubyGems) (malicious package) - [MAL-2025-46915](https://insights.sbomify.com/MAL-2025-46915/): Malicious code in monolith-twirp-proxima-enterprisemanagement (RubyGems) (malicious package) - [MAL-2025-46914](https://insights.sbomify.com/MAL-2025-46914/): Malicious code in monolith-twirp-octoshift-migrations (RubyGems) (malicious package) - [MAL-2025-46913](https://insights.sbomify.com/MAL-2025-46913/): Malicious code in monolith-twirp-notifications-notifyd (RubyGems) (malicious package) - [MAL-2025-46912](https://insights.sbomify.com/MAL-2025-46912/): Malicious code in monolith-twirp-features-core (RubyGems) (malicious package) - [MAL-2025-46911](https://insights.sbomify.com/MAL-2025-46911/): Malicious code in github-proto-repositories (RubyGems) (malicious package) - [MAL-2025-46910](https://insights.sbomify.com/MAL-2025-46910/): Malicious code in github-orca (RubyGems) (malicious package) - [MAL-2025-4691](https://insights.sbomify.com/MAL-2025-4691/): Malicious code in ownersv2-obfuscator (npm) (malicious package) - [MAL-2025-46909](https://insights.sbomify.com/MAL-2025-46909/): Malicious code in github-kv (RubyGems) (malicious package) - [MAL-2025-46908](https://insights.sbomify.com/MAL-2025-46908/): Malicious code in github-kredz (RubyGems) (malicious package) - [MAL-2025-46907](https://insights.sbomify.com/MAL-2025-46907/): Malicious code in feature-flags-client (RubyGems) (malicious package) - [MAL-2025-46906](https://insights.sbomify.com/MAL-2025-46906/): Malicious code in egress (RubyGems) (malicious package) - [MAL-2025-46905](https://insights.sbomify.com/MAL-2025-46905/): Malicious code in driftwood-client (RubyGems) (malicious package) - [MAL-2025-46904](https://insights.sbomify.com/MAL-2025-46904/): Malicious code in diff-analysis (RubyGems) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2025/page/592/