# Vulnerabilities published in 2025


- [MAL-2025-41488](https://insights.sbomify.com/MAL-2025-41488/): Malicious code in @twork-data-services/condition-group (npm) (malicious package)
- [MAL-2025-41487](https://insights.sbomify.com/MAL-2025-41487/): Malicious code in @twork-data-services/compnay-api-v1-company-rosbank-cib (npm) (malicious package)
- [MAL-2025-41486](https://insights.sbomify.com/MAL-2025-41486/): Malicious code in @twork-data-services/company-tariff-partnum (npm) (malicious package)
- [MAL-2025-41485](https://insights.sbomify.com/MAL-2025-41485/): Malicious code in @twork-data-services/company-tariff-info (npm) (malicious package)
- [MAL-2025-41484](https://insights.sbomify.com/MAL-2025-41484/): Malicious code in @twork-data-services/company-sms-phones (npm) (malicious package)
- [MAL-2025-41483](https://insights.sbomify.com/MAL-2025-41483/): Malicious code in @twork-data-services/company-package-counters (npm) (malicious package)
- [MAL-2025-41482](https://insights.sbomify.com/MAL-2025-41482/): Malicious code in @twork-data-services/company-overdraft (npm) (malicious package)
- [MAL-2025-41481](https://insights.sbomify.com/MAL-2025-41481/): Malicious code in @twork-data-services/company-options (npm) (malicious package)
- [MAL-2025-41480](https://insights.sbomify.com/MAL-2025-41480/): Malicious code in @twork-data-services/company-notes (npm) (malicious package)
- [MAL-2025-4148](https://insights.sbomify.com/MAL-2025-4148/): Malicious code in @confluent-cfet-medusa/dataset-designer (npm) (malicious package)
- [MAL-2025-41479](https://insights.sbomify.com/MAL-2025-41479/): Malicious code in @twork-data-services/company-employee-company (npm) (malicious package)
- [MAL-2025-41478](https://insights.sbomify.com/MAL-2025-41478/): Malicious code in @twork-data-services/company-employee (npm) (malicious package)
- [MAL-2025-41477](https://insights.sbomify.com/MAL-2025-41477/): Malicious code in @twork-data-services/company-delayed-tariff-change (npm) (malicious package)
- [MAL-2025-41476](https://insights.sbomify.com/MAL-2025-41476/): Malicious code in @twork-data-services/company-counters (npm) (malicious package)
- [MAL-2025-41475](https://insights.sbomify.com/MAL-2025-41475/): Malicious code in @twork-data-services/company-attributes (npm) (malicious package)
- [MAL-2025-41474](https://insights.sbomify.com/MAL-2025-41474/): Malicious code in @twork-data-services/company-accounts (npm) (malicious package)
- [MAL-2025-41473](https://insights.sbomify.com/MAL-2025-41473/): Malicious code in @twork-data-services/company (npm) (malicious package)
- [MAL-2025-41472](https://insights.sbomify.com/MAL-2025-41472/): Malicious code in @twork-data-services/communication-api-v4-communication-voice (npm) (malicious package)
- [MAL-2025-41471](https://insights.sbomify.com/MAL-2025-41471/): Malicious code in @twork-data-services/communication-api-v4-communication-customer-id (npm) (malicious package)
- [MAL-2025-41470](https://insights.sbomify.com/MAL-2025-41470/): Malicious code in @twork-data-services/communication-api-v4-communication-chat (npm) (malicious package)
- [MAL-2025-4147](https://insights.sbomify.com/MAL-2025-4147/): Malicious code in @character-tech/common (npm) (malicious package)
- [MAL-2025-41469](https://insights.sbomify.com/MAL-2025-41469/): Malicious code in @twork-data-services/checking-account-option-statuses (npm) (malicious package)
- [MAL-2025-41468](https://insights.sbomify.com/MAL-2025-41468/): Malicious code in @twork-data-services/cashout-tier-settings-v2 (npm) (malicious package)
- [MAL-2025-41467](https://insights.sbomify.com/MAL-2025-41467/): Malicious code in @twork-data-services/cashout-tier-settings (npm) (malicious package)
- [MAL-2025-41466](https://insights.sbomify.com/MAL-2025-41466/): Malicious code in @twork-data-services/business-products (npm) (malicious package)
- [MAL-2025-41465](https://insights.sbomify.com/MAL-2025-41465/): Malicious code in @twork-data-services/broker-account-tariff (npm) (malicious package)
- [MAL-2025-41464](https://insights.sbomify.com/MAL-2025-41464/): Malicious code in @twork-data-services/aggregator-sme-task-info (npm) (malicious package)
- [MAL-2025-41463](https://insights.sbomify.com/MAL-2025-41463/): Malicious code in @twork-data-services/aggregator-sme-meet-reversal-main (npm) (malicious package)
- [MAL-2025-41462](https://insights.sbomify.com/MAL-2025-41462/): Malicious code in @twork-data-services/aggregator-sme-group-queues (npm) (malicious package)
- [MAL-2025-41461](https://insights.sbomify.com/MAL-2025-41461/): Malicious code in @twork-data-services/aggregator-sme-company-signers-role-filter (npm) (malicious package)
- [MAL-2025-41460](https://insights.sbomify.com/MAL-2025-41460/): Malicious code in @twork-data-services/aggregator-account-get-otb-by-account (npm) (malicious package)
- [MAL-2025-4146](https://insights.sbomify.com/MAL-2025-4146/): Malicious code in @character-tech/client-common (npm) (malicious package)
- [MAL-2025-41459](https://insights.sbomify.com/MAL-2025-41459/): Malicious code in @twork-data-services/accounts-grpc-internal-hidden-ui-objects (npm) (malicious package)
- [MAL-2025-41458](https://insights.sbomify.com/MAL-2025-41458/): Malicious code in @sfdc-www-emu/locale (npm) (malicious package)
- [MAL-2025-41457](https://insights.sbomify.com/MAL-2025-41457/): Malicious code in @sfdc-www-emu/clientlibs-web-components (npm) (malicious package)
- [MAL-2025-41456](https://insights.sbomify.com/MAL-2025-41456/): Malicious code in @revizor/strategy-size (npm) (malicious package)
- [MAL-2025-41455](https://insights.sbomify.com/MAL-2025-41455/): Malicious code in @revizor/reporter-gitlab (npm) (malicious package)
- [MAL-2025-41454](https://insights.sbomify.com/MAL-2025-41454/): Malicious code in @revizor/reporter-console (npm) (malicious package)
- [MAL-2025-41453](https://insights.sbomify.com/MAL-2025-41453/): Malicious code in @revizor/client (npm) (malicious package)
- [MAL-2025-41452](https://insights.sbomify.com/MAL-2025-41452/): Malicious code in @revizor/adapter-packages-size (npm) (malicious package)
- [MAL-2025-41451](https://insights.sbomify.com/MAL-2025-41451/): Malicious code in @metadata-ipfs/validate-hash (npm) (malicious package)
- [MAL-2025-41450](https://insights.sbomify.com/MAL-2025-41450/): Malicious code in @metadata-ipfs/bonk.fun-ipfs (npm) (malicious package)
- [MAL-2025-4145](https://insights.sbomify.com/MAL-2025-4145/): Malicious code in @bmwfedev/playwright-helpers (npm) (malicious package)
- [MAL-2025-41449](https://insights.sbomify.com/MAL-2025-41449/): Malicious code in @itx-community/itxaicomp (npm) (malicious package)
- [MAL-2025-41448](https://insights.sbomify.com/MAL-2025-41448/): Malicious code in @h1shiny/buildtools (npm) (malicious package)
- [MAL-2025-41447](https://insights.sbomify.com/MAL-2025-41447/): Malicious code in unescaped (npm) (malicious package)
- [MAL-2025-41446](https://insights.sbomify.com/MAL-2025-41446/): Malicious code in gx-ui-common (npm) (malicious package)
- [MAL-2025-41445](https://insights.sbomify.com/MAL-2025-41445/): Malicious code in appdg (npm) (malicious package)
- [MAL-2025-41444](https://insights.sbomify.com/MAL-2025-41444/): Malicious code in blank-hacker (npm) (malicious package)
- [MAL-2025-41443](https://insights.sbomify.com/MAL-2025-41443/): Malicious code in nx (npm) (malicious package)
- [MAL-2025-41442](https://insights.sbomify.com/MAL-2025-41442/): Malicious code in @nx/workspace (npm) (malicious package)
- [MAL-2025-41441](https://insights.sbomify.com/MAL-2025-41441/): Malicious code in @nx/node (npm) (malicious package)
- [MAL-2025-4144](https://insights.sbomify.com/MAL-2025-4144/): Malicious code in whatsapp-flows-endpoint (npm) (malicious package)
- [MAL-2025-41439](https://insights.sbomify.com/MAL-2025-41439/): Malicious code in @nx/js (npm) (malicious package)
- [MAL-2025-41438](https://insights.sbomify.com/MAL-2025-41438/): Malicious code in @nx/eslint (npm) (malicious package)
- [MAL-2025-41437](https://insights.sbomify.com/MAL-2025-41437/): Malicious code in @nx/enterprise-cloud (npm) (malicious package)
- [MAL-2025-41436](https://insights.sbomify.com/MAL-2025-41436/): Malicious code in @nx/devkit (npm) (malicious package)
- [MAL-2025-41435](https://insights.sbomify.com/MAL-2025-41435/): Malicious code in initialtestingdonotpull1235 (PyPI) (malicious package)
- [MAL-2025-41434](https://insights.sbomify.com/MAL-2025-41434/): Malicious code in uitk_i18n (npm) (malicious package)
- [MAL-2025-41433](https://insights.sbomify.com/MAL-2025-41433/): Malicious code in uitk_hb_button (npm) (malicious package)
- [MAL-2025-41432](https://insights.sbomify.com/MAL-2025-41432/): Malicious code in rncalltestapp (npm) (malicious package)
- [MAL-2025-41431](https://insights.sbomify.com/MAL-2025-41431/): Malicious code in my-first-npm-package-1337 (npm) (malicious package)
- [MAL-2025-41430](https://insights.sbomify.com/MAL-2025-41430/): Malicious code in epc-ui-tour (npm) (malicious package)
- [MAL-2025-4143](https://insights.sbomify.com/MAL-2025-4143/): Malicious code in web3walletconnet (npm) (malicious package)
- [MAL-2025-41429](https://insights.sbomify.com/MAL-2025-41429/): Malicious code in dyff-plugin (npm) (malicious package)
- [MAL-2025-41428](https://insights.sbomify.com/MAL-2025-41428/): Malicious code in depconfusioncheckdontuse (npm) (malicious package)
- [MAL-2025-41427](https://insights.sbomify.com/MAL-2025-41427/): Malicious code in @navancorp/ta-travel (npm) (malicious package)
- [MAL-2025-41426](https://insights.sbomify.com/MAL-2025-41426/): Malicious code in @navancorp/icons (npm) (malicious package)
- [MAL-2025-41425](https://insights.sbomify.com/MAL-2025-41425/): Malicious code in @navancorp/fe-analytics (npm) (malicious package)
- [MAL-2025-41424](https://insights.sbomify.com/MAL-2025-41424/): Malicious code in @navancorp/core (npm) (malicious package)
- [MAL-2025-41423](https://insights.sbomify.com/MAL-2025-41423/): Malicious code in @navancorp/angular-web-components (npm) (malicious package)
- [MAL-2025-41422](https://insights.sbomify.com/MAL-2025-41422/): Malicious code in cal-pretty-console (npm) (malicious package)
- [MAL-2025-41421](https://insights.sbomify.com/MAL-2025-41421/): Malicious code in k7eel2-ss (PyPI) (malicious package)
- [MAL-2025-41420](https://insights.sbomify.com/MAL-2025-41420/): Malicious code in website-memory (npm) (malicious package)
- [MAL-2025-4142](https://insights.sbomify.com/MAL-2025-4142/): Malicious code in web3walletconnect (npm) (malicious package)
- [MAL-2025-41419](https://insights.sbomify.com/MAL-2025-41419/): Malicious code in uprove-node-reference (npm) (malicious package)
- [MAL-2025-41418](https://insights.sbomify.com/MAL-2025-41418/): Malicious code in umaaas-api (npm) (malicious package)
- [MAL-2025-41417](https://insights.sbomify.com/MAL-2025-41417/): Malicious code in udg-uc-sdk-pds (npm) (malicious package)
- [MAL-2025-41416](https://insights.sbomify.com/MAL-2025-41416/): Malicious code in typescript-5.1 (npm) (malicious package)
- [MAL-2025-41415](https://insights.sbomify.com/MAL-2025-41415/): Malicious code in typescript-5.0 (npm) (malicious package)
- [MAL-2025-41414](https://insights.sbomify.com/MAL-2025-41414/): Malicious code in typescript-4.9 (npm) (malicious package)
- [MAL-2025-41413](https://insights.sbomify.com/MAL-2025-41413/): Malicious code in typescript-4.8 (npm) (malicious package)
- [MAL-2025-41412](https://insights.sbomify.com/MAL-2025-41412/): Malicious code in tileuploader (npm) (malicious package)
- [MAL-2025-41411](https://insights.sbomify.com/MAL-2025-41411/): Malicious code in tfb_urm (npm) (malicious package)
- [MAL-2025-41410](https://insights.sbomify.com/MAL-2025-41410/): Malicious code in testnpm369420 (npm) (malicious package)
- [MAL-2025-4141](https://insights.sbomify.com/MAL-2025-4141/): Malicious code in web3ether.js (npm) (malicious package)
- [MAL-2025-41409](https://insights.sbomify.com/MAL-2025-41409/): Malicious code in terminal-suggest (npm) (malicious package)
- [MAL-2025-41408](https://insights.sbomify.com/MAL-2025-41408/): Malicious code in symphony-fairvis (npm) (malicious package)
- [MAL-2025-41407](https://insights.sbomify.com/MAL-2025-41407/): Malicious code in spelunker-agent (npm) (malicious package)
- [MAL-2025-41406](https://insights.sbomify.com/MAL-2025-41406/): Malicious code in server_msg (npm) (malicious package)
- [MAL-2025-41405](https://insights.sbomify.com/MAL-2025-41405/): Malicious code in react-event-tracker1 (npm) (malicious package)
- [MAL-2025-41404](https://insights.sbomify.com/MAL-2025-41404/): Malicious code in react-event-tracker-dpdpoc (npm) (malicious package)
- [MAL-2025-41403](https://insights.sbomify.com/MAL-2025-41403/): Malicious code in r00tsid1 (npm) (malicious package)
- [MAL-2025-41402](https://insights.sbomify.com/MAL-2025-41402/): Malicious code in r00tsid (npm) (malicious package)
- [MAL-2025-41401](https://insights.sbomify.com/MAL-2025-41401/): Malicious code in ptv_uxreadspropvt (npm) (malicious package)
- [MAL-2025-41400](https://insights.sbomify.com/MAL-2025-41400/): Malicious code in portin (npm) (malicious package)
- [MAL-2025-4140](https://insights.sbomify.com/MAL-2025-4140/): Malicious code in web3automation (npm) (malicious package)
- [MAL-2025-414](https://insights.sbomify.com/MAL-2025-414/): Malicious code in coinbase-analytics (npm) (malicious package)
- [MAL-2025-41399](https://insights.sbomify.com/MAL-2025-41399/): Malicious code in package-level-3 (npm) (malicious package)
- [MAL-2025-41398](https://insights.sbomify.com/MAL-2025-41398/): Malicious code in ng-tds (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/653/