# Vulnerabilities published in 2025


- [MAL-2025-41306](https://insights.sbomify.com/MAL-2025-41306/): Malicious code in mayfly-risk (npm) (malicious package)
- [MAL-2025-41305](https://insights.sbomify.com/MAL-2025-41305/): Malicious code in list-agent (npm) (malicious package)
- [MAL-2025-41304](https://insights.sbomify.com/MAL-2025-41304/): Malicious code in knowpro-test (npm) (malicious package)
- [MAL-2025-41303](https://insights.sbomify.com/MAL-2025-41303/): Malicious code in knowpro (npm) (malicious package)
- [MAL-2025-41302](https://insights.sbomify.com/MAL-2025-41302/): Malicious code in knowledge-processor (npm) (malicious package)
- [MAL-2025-41301](https://insights.sbomify.com/MAL-2025-41301/): Malicious code in invalid-polyfill-missing (npm) (malicious package)
- [MAL-2025-41300](https://insights.sbomify.com/MAL-2025-41300/): Malicious code in invalid-polyfill-boundary (npm) (malicious package)
- [MAL-2025-4130](https://insights.sbomify.com/MAL-2025-4130/): Malicious code in selfbott-rpc (npm) (malicious package)
- [MAL-2025-413](https://insights.sbomify.com/MAL-2025-413/): Malicious code in coinbase-admin (npm) (malicious package)
- [MAL-2025-41299](https://insights.sbomify.com/MAL-2025-41299/): Malicious code in invalid-polyfill-boolean (npm) (malicious package)
- [MAL-2025-41298](https://insights.sbomify.com/MAL-2025-41298/): Malicious code in image-memory (npm) (malicious package)
- [MAL-2025-41297](https://insights.sbomify.com/MAL-2025-41297/): Malicious code in image-agent (npm) (malicious package)
- [MAL-2025-41296](https://insights.sbomify.com/MAL-2025-41296/): Malicious code in heft-web-rig-library-tutorial (npm) (malicious package)
- [MAL-2025-41295](https://insights.sbomify.com/MAL-2025-41295/): Malicious code in heft-storybook-react-tutorial (npm) (malicious package)
- [MAL-2025-41294](https://insights.sbomify.com/MAL-2025-41294/): Malicious code in heft-parameter-plugin (npm) (malicious package)
- [MAL-2025-41293](https://insights.sbomify.com/MAL-2025-41293/): Malicious code in heft-minimal-rig-test (npm) (malicious package)
- [MAL-2025-41292](https://insights.sbomify.com/MAL-2025-41292/): Malicious code in heft-example-plugin-02 (npm) (malicious package)
- [MAL-2025-41291](https://insights.sbomify.com/MAL-2025-41291/): Malicious code in heft-example-plugin-01 (npm) (malicious package)
- [MAL-2025-41290](https://insights.sbomify.com/MAL-2025-41290/): Malicious code in heft-example-lifecycle-plugin (npm) (malicious package)
- [MAL-2025-4129](https://insights.sbomify.com/MAL-2025-4129/): Malicious code in selfbot-v2 (npm) (malicious package)
- [MAL-2025-41289](https://insights.sbomify.com/MAL-2025-41289/): Malicious code in health-cards-validation-sdk (npm) (malicious package)
- [MAL-2025-41288](https://insights.sbomify.com/MAL-2025-41288/): Malicious code in examples-lib (npm) (malicious package)
- [MAL-2025-41287](https://insights.sbomify.com/MAL-2025-41287/): Malicious code in eslint-oldest (npm) (malicious package)
- [MAL-2025-41286](https://insights.sbomify.com/MAL-2025-41286/): Malicious code in eslint-9 (npm) (malicious package)
- [MAL-2025-41285](https://insights.sbomify.com/MAL-2025-41285/): Malicious code in eslint-8.23 (npm) (malicious package)
- [MAL-2025-41284](https://insights.sbomify.com/MAL-2025-41284/): Malicious code in eslint-8 (npm) (malicious package)
- [MAL-2025-41283](https://insights.sbomify.com/MAL-2025-41283/): Malicious code in doc-plugin-rush-stack (npm) (malicious package)
- [MAL-2025-41282](https://insights.sbomify.com/MAL-2025-41282/): Malicious code in azure-ai-foundry (npm) (malicious package)
- [MAL-2025-41281](https://insights.sbomify.com/MAL-2025-41281/): Malicious code in axe-core-scanner (npm) (malicious package)
- [MAL-2025-41280](https://insights.sbomify.com/MAL-2025-41280/): Malicious code in api-extractor-lib4-test (npm) (malicious package)
- [MAL-2025-4128](https://insights.sbomify.com/MAL-2025-4128/): Malicious code in selfbot-v1 (npm) (malicious package)
- [MAL-2025-41279](https://insights.sbomify.com/MAL-2025-41279/): Malicious code in android-mobile-agent (npm) (malicious package)
- [MAL-2025-41278](https://insights.sbomify.com/MAL-2025-41278/): Malicious code in agent-dispatcher (npm) (malicious package)
- [MAL-2025-41277](https://insights.sbomify.com/MAL-2025-41277/): Malicious code in donuts.node (npm) (malicious package)
- [MAL-2025-41276](https://insights.sbomify.com/MAL-2025-41276/): Malicious code in cookie.gulp (npm) (malicious package)
- [MAL-2025-41275](https://insights.sbomify.com/MAL-2025-41275/): Malicious code in tanstack-virtual-core (npm) (malicious package)
- [MAL-2025-41274](https://insights.sbomify.com/MAL-2025-41274/): Malicious code in nextjs14-approuter (npm) (malicious package)
- [MAL-2025-41273](https://insights.sbomify.com/MAL-2025-41273/): Malicious code in parabol-client (npm) (malicious package)
- [MAL-2025-41272](https://insights.sbomify.com/MAL-2025-41272/): Malicious code in tombac-icons (npm) (malicious package)
- [MAL-2025-41271](https://insights.sbomify.com/MAL-2025-41271/): Malicious code in apollo-ms (npm) (malicious package)
- [MAL-2025-41270](https://insights.sbomify.com/MAL-2025-41270/): Malicious code in react-markdown-v7 (npm) (malicious package)
- [MAL-2025-4127](https://insights.sbomify.com/MAL-2025-4127/): Malicious code in selfbot-test-2 (npm) (malicious package)
- [MAL-2025-41269](https://insights.sbomify.com/MAL-2025-41269/): Malicious code in @listr1/prompt-adapter-inquirer (npm) (malicious package)
- [MAL-2025-41268](https://insights.sbomify.com/MAL-2025-41268/): Malicious code in api-react125 (npm) (malicious package)
- [MAL-2025-41267](https://insights.sbomify.com/MAL-2025-41267/): Malicious code in api-react12 (npm) (malicious package)
- [MAL-2025-41266](https://insights.sbomify.com/MAL-2025-41266/): Malicious code in google-library (npm) (malicious package)
- [MAL-2025-41265](https://insights.sbomify.com/MAL-2025-41265/): Malicious code in @google_cloud/common (npm) (malicious package)
- [MAL-2025-41264](https://insights.sbomify.com/MAL-2025-41264/): Malicious code in sdp-transform-writer (npm) (malicious package)
- [MAL-2025-41263](https://insights.sbomify.com/MAL-2025-41263/): Malicious code in sdp-transform-parser (npm) (malicious package)
- [MAL-2025-41262](https://insights.sbomify.com/MAL-2025-41262/): Malicious code in fb_helpers (npm) (malicious package)
- [MAL-2025-41261](https://insights.sbomify.com/MAL-2025-41261/): Malicious code in chartsmaan (npm) (malicious package)
- [MAL-2025-41260](https://insights.sbomify.com/MAL-2025-41260/): Malicious code in catflix (npm) (malicious package)
- [MAL-2025-4126](https://insights.sbomify.com/MAL-2025-4126/): Malicious code in selfbot-rpc (npm) (malicious package)
- [MAL-2025-41259](https://insights.sbomify.com/MAL-2025-41259/): Malicious code in amp-metrics (npm) (malicious package)
- [MAL-2025-41258](https://insights.sbomify.com/MAL-2025-41258/): Malicious code in @bitkub-next-frontend-v2/app-bitkub-next (npm) (malicious package)
- [MAL-2025-41257](https://insights.sbomify.com/MAL-2025-41257/): Malicious code in @uit-spritesmith/webpack (npm) (malicious package)
- [MAL-2025-41256](https://insights.sbomify.com/MAL-2025-41256/): Malicious code in other-external (npm) (malicious package)
- [MAL-2025-41255](https://insights.sbomify.com/MAL-2025-41255/): Malicious code in ai-agent-email (npm) (malicious package)
- [MAL-2025-41254](https://insights.sbomify.com/MAL-2025-41254/): Malicious code in orion-ui (npm) (malicious package)
- [MAL-2025-41253](https://insights.sbomify.com/MAL-2025-41253/): Malicious code in @navify-platform/error (npm) (malicious package)
- [MAL-2025-41252](https://insights.sbomify.com/MAL-2025-41252/): Malicious code in @navify-platform/url (npm) (malicious package)
- [MAL-2025-41251](https://insights.sbomify.com/MAL-2025-41251/): Malicious code in @navify-platform/idle (npm) (malicious package)
- [MAL-2025-41250](https://insights.sbomify.com/MAL-2025-41250/): Malicious code in @navify-platform/i18n (npm) (malicious package)
- [MAL-2025-4125](https://insights.sbomify.com/MAL-2025-4125/): Malicious code in sdkss (npm) (malicious package)
- [MAL-2025-41249](https://insights.sbomify.com/MAL-2025-41249/): Malicious code in mv-hosp (npm) (malicious package)
- [MAL-2025-41248](https://insights.sbomify.com/MAL-2025-41248/): Malicious code in monitor-package (npm) (malicious package)
- [MAL-2025-41247](https://insights.sbomify.com/MAL-2025-41247/): Malicious code in grok-sdk (npm) (malicious package)
- [MAL-2025-41246](https://insights.sbomify.com/MAL-2025-41246/): Malicious code in solana-fb (npm) (malicious package)
- [MAL-2025-41245](https://insights.sbomify.com/MAL-2025-41245/): Malicious code in @cf.cplace.platform/forms (npm) (malicious package)
- [MAL-2025-41244](https://insights.sbomify.com/MAL-2025-41244/): Malicious code in hey-message-content (npm) (malicious package)
- [MAL-2025-41243](https://insights.sbomify.com/MAL-2025-41243/): Malicious code in zze2 (npm) (malicious package)
- [MAL-2025-41242](https://insights.sbomify.com/MAL-2025-41242/): Malicious code in zzcnativeapi (npm) (malicious package)
- [MAL-2025-41241](https://insights.sbomify.com/MAL-2025-41241/): Malicious code in zyonite (npm) (malicious package)
- [MAL-2025-41240](https://insights.sbomify.com/MAL-2025-41240/): Malicious code in zygupdwvlxtbjmfk (npm) (malicious package)
- [MAL-2025-4124](https://insights.sbomify.com/MAL-2025-4124/): Malicious code in scarce (npm) (malicious package)
- [MAL-2025-41239](https://insights.sbomify.com/MAL-2025-41239/): Malicious code in zycommon-web (npm) (malicious package)
- [MAL-2025-41238](https://insights.sbomify.com/MAL-2025-41238/): Malicious code in zxxmsbgl (npm) (malicious package)
- [MAL-2025-41237](https://insights.sbomify.com/MAL-2025-41237/): Malicious code in zxsfqviceptrnhyb (npm) (malicious package)
- [MAL-2025-41236](https://insights.sbomify.com/MAL-2025-41236/): Malicious code in zxcqweasd (npm) (malicious package)
- [MAL-2025-41235](https://insights.sbomify.com/MAL-2025-41235/): Malicious code in zx3rt (npm) (malicious package)
- [MAL-2025-41234](https://insights.sbomify.com/MAL-2025-41234/): Malicious code in zvxgithub (npm) (malicious package)
- [MAL-2025-41233](https://insights.sbomify.com/MAL-2025-41233/): Malicious code in zviewer (npm) (malicious package)
- [MAL-2025-41232](https://insights.sbomify.com/MAL-2025-41232/): Malicious code in zvcore (npm) (malicious package)
- [MAL-2025-41231](https://insights.sbomify.com/MAL-2025-41231/): Malicious code in zuywgxsdpkfkqban (npm) (malicious package)
- [MAL-2025-41230](https://insights.sbomify.com/MAL-2025-41230/): Malicious code in zulu-zs4-project (npm) (malicious package)
- [MAL-2025-4123](https://insights.sbomify.com/MAL-2025-4123/): Malicious code in save-me-pls (npm) (malicious package)
- [MAL-2025-41229](https://insights.sbomify.com/MAL-2025-41229/): Malicious code in zulu-ziggurat-3wg4 (npm) (malicious package)
- [MAL-2025-41228](https://insights.sbomify.com/MAL-2025-41228/): Malicious code in zulu-yankee-echo-lxbas (npm) (malicious package)
- [MAL-2025-41227](https://insights.sbomify.com/MAL-2025-41227/): Malicious code in zulu-xray-lzmk (npm) (malicious package)
- [MAL-2025-41226](https://insights.sbomify.com/MAL-2025-41226/): Malicious code in zulu-xigua-charlie-xnvvt (npm) (malicious package)
- [MAL-2025-41225](https://insights.sbomify.com/MAL-2025-41225/): Malicious code in zulu-x19-project (npm) (malicious package)
- [MAL-2025-41224](https://insights.sbomify.com/MAL-2025-41224/): Malicious code in zulu-wxu-project (npm) (malicious package)
- [MAL-2025-41223](https://insights.sbomify.com/MAL-2025-41223/): Malicious code in zulu-ww9-project (npm) (malicious package)
- [MAL-2025-41222](https://insights.sbomify.com/MAL-2025-41222/): Malicious code in zulu-wpl-project (npm) (malicious package)
- [MAL-2025-41221](https://insights.sbomify.com/MAL-2025-41221/): Malicious code in zulu-windmill-o3ly (npm) (malicious package)
- [MAL-2025-41220](https://insights.sbomify.com/MAL-2025-41220/): Malicious code in zulu-wdm-project (npm) (malicious package)
- [MAL-2025-4122](https://insights.sbomify.com/MAL-2025-4122/): Malicious code in rpc-selffbottt (npm) (malicious package)
- [MAL-2025-41219](https://insights.sbomify.com/MAL-2025-41219/): Malicious code in zulu-ugli-jstd (npm) (malicious package)
- [MAL-2025-41218](https://insights.sbomify.com/MAL-2025-41218/): Malicious code in zulu-tango-bpwe (npm) (malicious package)
- [MAL-2025-41217](https://insights.sbomify.com/MAL-2025-41217/): Malicious code in zulu-tangerine-november-hfycq (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/655/