# Vulnerabilities published in 2025


- [MAL-2025-41578](https://insights.sbomify.com/MAL-2025-41578/): Malicious code in kicl-gl-provisioningapp-ui (npm) (malicious package)
- [MAL-2025-41577](https://insights.sbomify.com/MAL-2025-41577/): Malicious code in key-transparency (npm) (malicious package)
- [MAL-2025-41576](https://insights.sbomify.com/MAL-2025-41576/): Malicious code in itx-zara-web-common (npm) (malicious package)
- [MAL-2025-41575](https://insights.sbomify.com/MAL-2025-41575/): Malicious code in intel-ai-assistant-ai (npm) (malicious package)
- [MAL-2025-41574](https://insights.sbomify.com/MAL-2025-41574/): Malicious code in int-lib-config (npm) (malicious package)
- [MAL-2025-41573](https://insights.sbomify.com/MAL-2025-41573/): Malicious code in https-proxy-utils (npm) (malicious package)
- [MAL-2025-41572](https://insights.sbomify.com/MAL-2025-41572/): Malicious code in graphkitx (npm) (malicious package)
- [MAL-2025-41571](https://insights.sbomify.com/MAL-2025-41571/): Malicious code in g-profiler (npm) (malicious package)
- [MAL-2025-41570](https://insights.sbomify.com/MAL-2025-41570/): Malicious code in function-string (npm) (malicious package)
- [MAL-2025-4157](https://insights.sbomify.com/MAL-2025-4157/): Malicious code in @rf-auth/rf-auth-react (npm) (malicious package)
- [MAL-2025-41569](https://insights.sbomify.com/MAL-2025-41569/): Malicious code in function-fkag (npm) (malicious package)
- [MAL-2025-41568](https://insights.sbomify.com/MAL-2025-41568/): Malicious code in func-logger (npm) (malicious package)
- [MAL-2025-41567](https://insights.sbomify.com/MAL-2025-41567/): Malicious code in frontend-new (npm) (malicious package)
- [MAL-2025-41566](https://insights.sbomify.com/MAL-2025-41566/): Malicious code in fluxible-router-example (npm) (malicious package)
- [MAL-2025-41565](https://insights.sbomify.com/MAL-2025-41565/): Malicious code in flux-example-todo (npm) (malicious package)
- [MAL-2025-41564](https://insights.sbomify.com/MAL-2025-41564/): Malicious code in flux-example-routing (npm) (malicious package)
- [MAL-2025-41563](https://insights.sbomify.com/MAL-2025-41563/): Malicious code in flatfox-api (npm) (malicious package)
- [MAL-2025-41562](https://insights.sbomify.com/MAL-2025-41562/): Malicious code in financial-utils (npm) (malicious package)
- [MAL-2025-41561](https://insights.sbomify.com/MAL-2025-41561/): Malicious code in etoro-provema (npm) (malicious package)
- [MAL-2025-41560](https://insights.sbomify.com/MAL-2025-41560/): Malicious code in etoro-plaid-widget (npm) (malicious package)
- [MAL-2025-4156](https://insights.sbomify.com/MAL-2025-4156/): Malicious code in @phoenix-common/angular-frontend-library (npm) (malicious package)
- [MAL-2025-41559](https://insights.sbomify.com/MAL-2025-41559/): Malicious code in etoro-cordova-prove-mobileauth (npm) (malicious package)
- [MAL-2025-41558](https://insights.sbomify.com/MAL-2025-41558/): Malicious code in ethrs.js (npm) (malicious package)
- [MAL-2025-41557](https://insights.sbomify.com/MAL-2025-41557/): Malicious code in ethersjs3-wallet (npm) (malicious package)
- [MAL-2025-41556](https://insights.sbomify.com/MAL-2025-41556/): Malicious code in eslint-validation-cli (npm) (malicious package)
- [MAL-2025-41555](https://insights.sbomify.com/MAL-2025-41555/): Malicious code in eslint-ts-view (npm) (malicious package)
- [MAL-2025-41554](https://insights.sbomify.com/MAL-2025-41554/): Malicious code in emittery-up (npm) (malicious package)
- [MAL-2025-41553](https://insights.sbomify.com/MAL-2025-41553/): Malicious code in dsjdsdksfndfdfiodsfdsfd1212 (npm) (malicious package)
- [MAL-2025-41552](https://insights.sbomify.com/MAL-2025-41552/): Malicious code in dependyman (npm) (malicious package)
- [MAL-2025-41551](https://insights.sbomify.com/MAL-2025-41551/): Malicious code in dependsalot (npm) (malicious package)
- [MAL-2025-41550](https://insights.sbomify.com/MAL-2025-41550/): Malicious code in deepseek-r1-webgpu (npm) (malicious package)
- [MAL-2025-4155](https://insights.sbomify.com/MAL-2025-4155/): Malicious code in @motortrend/sonic-api (npm) (malicious package)
- [MAL-2025-41549](https://insights.sbomify.com/MAL-2025-41549/): Malicious code in ddok-escapes (npm) (malicious package)
- [MAL-2025-41548](https://insights.sbomify.com/MAL-2025-41548/): Malicious code in d360-ui (npm) (malicious package)
- [MAL-2025-41547](https://insights.sbomify.com/MAL-2025-41547/): Malicious code in d360-frontend (npm) (malicious package)
- [MAL-2025-41546](https://insights.sbomify.com/MAL-2025-41546/): Malicious code in cyber-chindows (npm) (malicious package)
- [MAL-2025-41545](https://insights.sbomify.com/MAL-2025-41545/): Malicious code in cordova-plugin-zendesk (npm) (malicious package)
- [MAL-2025-41544](https://insights.sbomify.com/MAL-2025-41544/): Malicious code in common-logify (npm) (malicious package)
- [MAL-2025-41543](https://insights.sbomify.com/MAL-2025-41543/): Malicious code in com.db.internetportal.es.olb-crossover-components (npm) (malicious package)
- [MAL-2025-41542](https://insights.sbomify.com/MAL-2025-41542/): Malicious code in cloud-native-ai-pipeline (npm) (malicious package)
- [MAL-2025-41541](https://insights.sbomify.com/MAL-2025-41541/): Malicious code in ciao-webui (npm) (malicious package)
- [MAL-2025-41540](https://insights.sbomify.com/MAL-2025-41540/): Malicious code in c3p-reactnative (npm) (malicious package)
- [MAL-2025-4154](https://insights.sbomify.com/MAL-2025-4154/): Malicious code in @inner-source/ciam-sdk (npm) (malicious package)
- [MAL-2025-41539](https://insights.sbomify.com/MAL-2025-41539/): Malicious code in btrez-logger (npm) (malicious package)
- [MAL-2025-41538](https://insights.sbomify.com/MAL-2025-41538/): Malicious code in bsd-ui-stylekit (npm) (malicious package)
- [MAL-2025-41537](https://insights.sbomify.com/MAL-2025-41537/): Malicious code in botframework-webchat-cldr-data (npm) (malicious package)
- [MAL-2025-41536](https://insights.sbomify.com/MAL-2025-41536/): Malicious code in bind-error (npm) (malicious package)
- [MAL-2025-41535](https://insights.sbomify.com/MAL-2025-41535/): Malicious code in beliya-xhn13 (npm) (malicious package)
- [MAL-2025-41534](https://insights.sbomify.com/MAL-2025-41534/): Malicious code in anti-developer-nghinv235 (npm) (malicious package)
- [MAL-2025-41533](https://insights.sbomify.com/MAL-2025-41533/): Malicious code in allonzydoctor (npm) (malicious package)
- [MAL-2025-41532](https://insights.sbomify.com/MAL-2025-41532/): Malicious code in ajazious261 (npm) (malicious package)
- [MAL-2025-41531](https://insights.sbomify.com/MAL-2025-41531/): Malicious code in adhybridhealthservice-resource-manager (npm) (malicious package)
- [MAL-2025-41530](https://insights.sbomify.com/MAL-2025-41530/): Malicious code in @z3r0whales/testpackagezero (npm) (malicious package)
- [MAL-2025-4153](https://insights.sbomify.com/MAL-2025-4153/): Malicious code in @ids-beta/tooltip (npm) (malicious package)
- [MAL-2025-41529](https://insights.sbomify.com/MAL-2025-41529/): Malicious code in @z3r0whales/comms (npm) (malicious package)
- [MAL-2025-41528](https://insights.sbomify.com/MAL-2025-41528/): Malicious code in @twork-data-services/sme-customer-employee-company (npm) (malicious package)
- [MAL-2025-41527](https://insights.sbomify.com/MAL-2025-41527/): Malicious code in @twork-data-services/sme-company-search (npm) (malicious package)
- [MAL-2025-41526](https://insights.sbomify.com/MAL-2025-41526/): Malicious code in @twork-data-services/sme-agent-company-relation (npm) (malicious package)
- [MAL-2025-41525](https://insights.sbomify.com/MAL-2025-41525/): Malicious code in @twork-data-services/proxy-prime-lite-info (npm) (malicious package)
- [MAL-2025-41524](https://insights.sbomify.com/MAL-2025-41524/): Malicious code in @twork-data-services/proxy-prime-call-get-account-options (npm) (malicious package)
- [MAL-2025-41523](https://insights.sbomify.com/MAL-2025-41523/): Malicious code in @twork-data-services/proxy-prime-api-v6-customer-account-lite-info (npm) (malicious package)
- [MAL-2025-41522](https://insights.sbomify.com/MAL-2025-41522/): Malicious code in @twork-data-services/proxy-prime-api-v2-get-cu-products-info (npm) (malicious package)
- [MAL-2025-41521](https://insights.sbomify.com/MAL-2025-41521/): Malicious code in @twork-data-services/proxy-prime-api-v2-account-get-account-utilization-flag (npm) (malicious package)
- [MAL-2025-41520](https://insights.sbomify.com/MAL-2025-41520/): Malicious code in @twork-data-services/proxy-prime-api-v1-cards-ucid-get-card-otb (npm) (malicious package)
- [MAL-2025-4152](https://insights.sbomify.com/MAL-2025-4152/): Malicious code in @flapp/inventory-management (npm) (malicious package)
- [MAL-2025-41519](https://insights.sbomify.com/MAL-2025-41519/): Malicious code in @twork-data-services/proxy-prime-api-v1-card-ucid-services (npm) (malicious package)
- [MAL-2025-41518](https://insights.sbomify.com/MAL-2025-41518/): Malicious code in @twork-data-services/proxy-prime-api-v1-balances-info (npm) (malicious package)
- [MAL-2025-41517](https://insights.sbomify.com/MAL-2025-41517/): Malicious code in @twork-data-services/proxy-prime-api-v1-accounts-get-programs (npm) (malicious package)
- [MAL-2025-41516](https://insights.sbomify.com/MAL-2025-41516/): Malicious code in @twork-data-services/proxy-prime-api-v1-account-overdraft-info (npm) (malicious package)
- [MAL-2025-41515](https://insights.sbomify.com/MAL-2025-41515/): Malicious code in @twork-data-services/proxy-prime-api-v1-account-getting-services-status (npm) (malicious package)
- [MAL-2025-41514](https://insights.sbomify.com/MAL-2025-41514/): Malicious code in @twork-data-services/proxy-prime-api-v1-account-counters (npm) (malicious package)
- [MAL-2025-41513](https://insights.sbomify.com/MAL-2025-41513/): Malicious code in @twork-data-services/proxy-prime-acc-info (npm) (malicious package)
- [MAL-2025-41512](https://insights.sbomify.com/MAL-2025-41512/): Malicious code in @twork-data-services/proxy-ips-account-account-number-prepaid-card-limits (npm) (malicious package)
- [MAL-2025-41511](https://insights.sbomify.com/MAL-2025-41511/): Malicious code in @twork-data-services/proxy-invest-v2-api-v2-broker-account-customer-info (npm) (malicious package)
- [MAL-2025-41510](https://insights.sbomify.com/MAL-2025-41510/): Malicious code in @twork-data-services/proxy-invest-v2-api-v1-customer-margin-attributes (npm) (malicious package)
- [MAL-2025-4151](https://insights.sbomify.com/MAL-2025-4151/): Malicious code in @enzyme-health/common-models (npm) (malicious package)
- [MAL-2025-41509](https://insights.sbomify.com/MAL-2025-41509/): Malicious code in @twork-data-services/proxy-invest-v2-api-v1-cadb-operations (npm) (malicious package)
- [MAL-2025-41508](https://insights.sbomify.com/MAL-2025-41508/): Malicious code in @twork-data-services/proxy-invest-symbols-list (npm) (malicious package)
- [MAL-2025-41507](https://insights.sbomify.com/MAL-2025-41507/): Malicious code in @twork-data-services/proxy-invest-api-v1-notes (npm) (malicious package)
- [MAL-2025-41506](https://insights.sbomify.com/MAL-2025-41506/): Malicious code in @twork-data-services/proxy-invest-api-v1-futures-info-single (npm) (malicious package)
- [MAL-2025-41505](https://insights.sbomify.com/MAL-2025-41505/): Malicious code in @twork-data-services/proxy-invest-api-v1-customer-stop-orders (npm) (malicious package)
- [MAL-2025-41504](https://insights.sbomify.com/MAL-2025-41504/): Malicious code in @twork-data-services/proxy-invest-api-v1-customer-broker-accounts (npm) (malicious package)
- [MAL-2025-41503](https://insights.sbomify.com/MAL-2025-41503/): Malicious code in @twork-data-services/proxy-get-client-id-by-acc-number (npm) (malicious package)
- [MAL-2025-41502](https://insights.sbomify.com/MAL-2025-41502/): Malicious code in @twork-data-services/proxy-cms-customer-pay-tokens (npm) (malicious package)
- [MAL-2025-41501](https://insights.sbomify.com/MAL-2025-41501/): Malicious code in @twork-data-services/procedure-v2-execute-as-method-request (npm) (malicious package)
- [MAL-2025-41500](https://insights.sbomify.com/MAL-2025-41500/): Malicious code in @twork-data-services/prime-customer-products (npm) (malicious package)
- [MAL-2025-4150](https://insights.sbomify.com/MAL-2025-4150/): Malicious code in @dailyapy-rn/rn-push-provisioning (npm) (malicious package)
- [MAL-2025-415](https://insights.sbomify.com/MAL-2025-415/): Malicious code in coinbase-api-client (npm) (malicious package)
- [MAL-2025-41499](https://insights.sbomify.com/MAL-2025-41499/): Malicious code in @twork-data-services/offers-service-refusals (npm) (malicious package)
- [MAL-2025-41498](https://insights.sbomify.com/MAL-2025-41498/): Malicious code in @twork-data-services/loyalty-program-names (npm) (malicious package)
- [MAL-2025-41497](https://insights.sbomify.com/MAL-2025-41497/): Malicious code in @twork-data-services/invest-box-account (npm) (malicious package)
- [MAL-2025-41496](https://insights.sbomify.com/MAL-2025-41496/): Malicious code in @twork-data-services/customer-storage-api-v5-customer (npm) (malicious package)
- [MAL-2025-41495](https://insights.sbomify.com/MAL-2025-41495/): Malicious code in @twork-data-services/customer-storage-api-v3-customer-timezone (npm) (malicious package)
- [MAL-2025-41494](https://insights.sbomify.com/MAL-2025-41494/): Malicious code in @twork-data-services/customer-storage-api-v3-customer-attribute (npm) (malicious package)
- [MAL-2025-41493](https://insights.sbomify.com/MAL-2025-41493/): Malicious code in @twork-data-services/customer-storage-api-v2-customer-email (npm) (malicious package)
- [MAL-2025-41492](https://insights.sbomify.com/MAL-2025-41492/): Malicious code in @twork-data-services/customer-attribute-api-v3-customer-attribute-by-name (npm) (malicious package)
- [MAL-2025-41491](https://insights.sbomify.com/MAL-2025-41491/): Malicious code in @twork-data-services/customer-api-v2-customer-vip-status (npm) (malicious package)
- [MAL-2025-41490](https://insights.sbomify.com/MAL-2025-41490/): Malicious code in @twork-data-services/currency-config (npm) (malicious package)
- [MAL-2025-4149](https://insights.sbomify.com/MAL-2025-4149/): Malicious code in @ctg-ui/web-shell-express (npm) (malicious package)
- [MAL-2025-41489](https://insights.sbomify.com/MAL-2025-41489/): Malicious code in @twork-data-services/counterfree (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/652/