# Vulnerabilities published in 2025 - [MAL-2025-40046](https://insights.sbomify.com/MAL-2025-40046/): Malicious code in xylophone-icicle-rxq484-project (npm) (malicious package) - [MAL-2025-40045](https://insights.sbomify.com/MAL-2025-40045/): Malicious code in xylophone-iceberg-pvw669-project (npm) (malicious package) - [MAL-2025-40044](https://insights.sbomify.com/MAL-2025-40044/): Malicious code in xylophone-i1ejc-v5paf-paradise-project (npm) (malicious package) - [MAL-2025-40043](https://insights.sbomify.com/MAL-2025-40043/): Malicious code in xylophone-hk8vp-dh7w4-keystone-project (npm) (malicious package) - [MAL-2025-40042](https://insights.sbomify.com/MAL-2025-40042/): Malicious code in xylophone-harbor-ybx713-project (npm) (malicious package) - [MAL-2025-40041](https://insights.sbomify.com/MAL-2025-40041/): Malicious code in xylophone-glade-wav991-project (npm) (malicious package) - [MAL-2025-40040](https://insights.sbomify.com/MAL-2025-40040/): Malicious code in xylophone-glacier-hup490-project (npm) (malicious package) - [MAL-2025-4004](https://insights.sbomify.com/MAL-2025-4004/): Malicious code in ing-lib-hybrid-advice (npm) (malicious package) - [MAL-2025-40039](https://insights.sbomify.com/MAL-2025-40039/): Malicious code in xylophone-fir-wctn (npm) (malicious package) - [MAL-2025-40038](https://insights.sbomify.com/MAL-2025-40038/): Malicious code in xylophone-fern-ats232-project (npm) (malicious package) - [MAL-2025-40037](https://insights.sbomify.com/MAL-2025-40037/): Malicious code in xylophone-falcon-gxi313-project (npm) (malicious package) - [MAL-2025-40036](https://insights.sbomify.com/MAL-2025-40036/): Malicious code in xylophone-everest-jjh399-project (npm) (malicious package) - [MAL-2025-40035](https://insights.sbomify.com/MAL-2025-40035/): Malicious code in xylophone-dragon-aai930-project (npm) (malicious package) - [MAL-2025-40034](https://insights.sbomify.com/MAL-2025-40034/): Malicious code in xylophone-desert-nun094-project (npm) (malicious package) - [MAL-2025-40033](https://insights.sbomify.com/MAL-2025-40033/): Malicious code in xylophone-brook-uti375-project (npm) (malicious package) - [MAL-2025-40032](https://insights.sbomify.com/MAL-2025-40032/): Malicious code in xylophone-blossom-owg756-project (npm) (malicious package) - [MAL-2025-40031](https://insights.sbomify.com/MAL-2025-40031/): Malicious code in xylophone-bamboo-yua432-project (npm) (malicious package) - [MAL-2025-40030](https://insights.sbomify.com/MAL-2025-40030/): Malicious code in xylophone-aa5b0-k5qpo-obsidian-project (npm) (malicious package) - [MAL-2025-4003](https://insights.sbomify.com/MAL-2025-4003/): Malicious code in ing-it-web (npm) (malicious package) - [MAL-2025-40029](https://insights.sbomify.com/MAL-2025-40029/): Malicious code in xylophone-5x0y9-ynf2p-wander-project (npm) (malicious package) - [MAL-2025-40028](https://insights.sbomify.com/MAL-2025-40028/): Malicious code in xyatwbkqghlznemj (npm) (malicious package) - [MAL-2025-40027](https://insights.sbomify.com/MAL-2025-40027/): Malicious code in xxssblog (npm) (malicious package) - [MAL-2025-40026](https://insights.sbomify.com/MAL-2025-40026/): Malicious code in xwusanjiu-dangan-vol8 (npm) (malicious package) - [MAL-2025-40025](https://insights.sbomify.com/MAL-2025-40025/): Malicious code in xwusanjiu-dangan-vol7 (npm) (malicious package) - [MAL-2025-40024](https://insights.sbomify.com/MAL-2025-40024/): Malicious code in xwusanjiu-dangan-vol6 (npm) (malicious package) - [MAL-2025-40023](https://insights.sbomify.com/MAL-2025-40023/): Malicious code in xwusanjiu-dangan-vol5 (npm) (malicious package) - [MAL-2025-40022](https://insights.sbomify.com/MAL-2025-40022/): Malicious code in xwusanjiu-dangan-vol4 (npm) (malicious package) - [MAL-2025-40021](https://insights.sbomify.com/MAL-2025-40021/): Malicious code in xwqkgamldejucpnk (npm) (malicious package) - [MAL-2025-40020](https://insights.sbomify.com/MAL-2025-40020/): Malicious code in xwkfecdisltbrhmj (npm) (malicious package) - [MAL-2025-4002](https://insights.sbomify.com/MAL-2025-4002/): Malicious code in ing-feat-transaction (npm) (malicious package) - [MAL-2025-40019](https://insights.sbomify.com/MAL-2025-40019/): Malicious code in xwfcsgnhjqioedap (npm) (malicious package) - [MAL-2025-40018](https://insights.sbomify.com/MAL-2025-40018/): Malicious code in xwenkend (npm) (malicious package) - [MAL-2025-40017](https://insights.sbomify.com/MAL-2025-40017/): Malicious code in xweibophp (npm) (malicious package) - [MAL-2025-40016](https://insights.sbomify.com/MAL-2025-40016/): Malicious code in xwdyoajlimnrcevk (npm) (malicious package) - [MAL-2025-40015](https://insights.sbomify.com/MAL-2025-40015/): Malicious code in xwdupfstoqceagrm (npm) (malicious package) - [MAL-2025-40014](https://insights.sbomify.com/MAL-2025-40014/): Malicious code in xutrdabzpgyqlnwe (npm) (malicious package) - [MAL-2025-40013](https://insights.sbomify.com/MAL-2025-40013/): Malicious code in xurbansimsx2025 (npm) (malicious package) - [MAL-2025-40012](https://insights.sbomify.com/MAL-2025-40012/): Malicious code in xurbansimsx (npm) (malicious package) - [MAL-2025-40011](https://insights.sbomify.com/MAL-2025-40011/): Malicious code in xuntar (npm) (malicious package) - [MAL-2025-40010](https://insights.sbomify.com/MAL-2025-40010/): Malicious code in xunboge-geshengxue (npm) (malicious package) - [MAL-2025-4001](https://insights.sbomify.com/MAL-2025-4001/): Malicious code in ing-feat-payment-request (npm) (malicious package) - [MAL-2025-40009](https://insights.sbomify.com/MAL-2025-40009/): Malicious code in xuicom (npm) (malicious package) - [MAL-2025-40008](https://insights.sbomify.com/MAL-2025-40008/): Malicious code in xuexing-yuxingzuo-volo (npm) (malicious package) - [MAL-2025-40007](https://insights.sbomify.com/MAL-2025-40007/): Malicious code in xuexing-yuxingzuo-volb (npm) (malicious package) - [MAL-2025-40006](https://insights.sbomify.com/MAL-2025-40006/): Malicious code in xuexing-yuxingzuo-volab (npm) (malicious package) - [MAL-2025-40005](https://insights.sbomify.com/MAL-2025-40005/): Malicious code in xuexing-yuxingzuo-vola (npm) (malicious package) - [MAL-2025-40004](https://insights.sbomify.com/MAL-2025-40004/): Malicious code in xuexing-xingzuo-shengxiao-quanjiemi (npm) (malicious package) - [MAL-2025-40003](https://insights.sbomify.com/MAL-2025-40003/): Malicious code in xuehui-taluode-shiliu-tangke (npm) (malicious package) - [MAL-2025-40002](https://insights.sbomify.com/MAL-2025-40002/): Malicious code in xuanxue-jinnang-xingmingpian (npm) (malicious package) - [MAL-2025-40001](https://insights.sbomify.com/MAL-2025-40001/): Malicious code in xturebase (npm) (malicious package) - [MAL-2025-40000](https://insights.sbomify.com/MAL-2025-40000/): Malicious code in xtjecifpdbkwqrnm (npm) (malicious package) - [MAL-2025-4000](https://insights.sbomify.com/MAL-2025-4000/): Malicious code in ing-feat-order-overview (npm) (malicious package) - [MAL-2025-400](https://insights.sbomify.com/MAL-2025-400/): Malicious code in bookingcom-cloud (npm) (malicious package) - [MAL-2025-40](https://insights.sbomify.com/MAL-2025-40/): Malicious code in solana-stable-web-huks (npm) (malicious package) - [MAL-2025-4](https://insights.sbomify.com/MAL-2025-4/): Malicious code in safe-react-components (npm) (malicious package) - [MAL-2025-39999](https://insights.sbomify.com/MAL-2025-39999/): Malicious code in xtate-services (npm) (malicious package) - [MAL-2025-39998](https://insights.sbomify.com/MAL-2025-39998/): Malicious code in xtaodriblmwqfcyk (npm) (malicious package) - [MAL-2025-39997](https://insights.sbomify.com/MAL-2025-39997/): Malicious code in xsuagjbezhpfoqkm (npm) (malicious package) - [MAL-2025-39996](https://insights.sbomify.com/MAL-2025-39996/): Malicious code in xslasa20-poly1305-encoding (npm) (malicious package) - [MAL-2025-39995](https://insights.sbomify.com/MAL-2025-39995/): Malicious code in xsfateszt (npm) (malicious package) - [MAL-2025-39994](https://insights.sbomify.com/MAL-2025-39994/): Malicious code in xsalefter (npm) (malicious package) - [MAL-2025-39993](https://insights.sbomify.com/MAL-2025-39993/): Malicious code in xs-js-ipld-dag-cbor (npm) (malicious package) - [MAL-2025-39992](https://insights.sbomify.com/MAL-2025-39992/): Malicious code in xrqascuvhdmbyonk (npm) (malicious package) - [MAL-2025-39991](https://insights.sbomify.com/MAL-2025-39991/): Malicious code in xrhjnvfekzalmuty (npm) (malicious package) - [MAL-2025-39990](https://insights.sbomify.com/MAL-2025-39990/): Malicious code in xrec-service-common (npm) (malicious package) - [MAL-2025-3999](https://insights.sbomify.com/MAL-2025-3999/): Malicious code in ing-feat-loans-simulator (npm) (malicious package) - [MAL-2025-39989](https://insights.sbomify.com/MAL-2025-39989/): Malicious code in xrec-base-dao-mongoose (npm) (malicious package) - [MAL-2025-39988](https://insights.sbomify.com/MAL-2025-39988/): Malicious code in xrcctrl (npm) (malicious package) - [MAL-2025-39987](https://insights.sbomify.com/MAL-2025-39987/): Malicious code in xray-zv2-project (npm) (malicious package) - [MAL-2025-39986](https://insights.sbomify.com/MAL-2025-39986/): Malicious code in xray-zulu-w6is (npm) (malicious package) - [MAL-2025-39985](https://insights.sbomify.com/MAL-2025-39985/): Malicious code in xray-zulu-adyf (npm) (malicious package) - [MAL-2025-39984](https://insights.sbomify.com/MAL-2025-39984/): Malicious code in xray-yankee-6x6p (npm) (malicious package) - [MAL-2025-39983](https://insights.sbomify.com/MAL-2025-39983/): Malicious code in xray-yam-mjce (npm) (malicious package) - [MAL-2025-39982](https://insights.sbomify.com/MAL-2025-39982/): Malicious code in xray-y0w-project (npm) (malicious package) - [MAL-2025-39981](https://insights.sbomify.com/MAL-2025-39981/): Malicious code in xray-xigua-strf (npm) (malicious package) - [MAL-2025-39980](https://insights.sbomify.com/MAL-2025-39980/): Malicious code in xray-whiskey-tpif (npm) (malicious package) - [MAL-2025-3998](https://insights.sbomify.com/MAL-2025-3998/): Malicious code in ing-feat-external-agreement (npm) (malicious package) - [MAL-2025-39979](https://insights.sbomify.com/MAL-2025-39979/): Malicious code in xray-violet-5k98 (npm) (malicious package) - [MAL-2025-39978](https://insights.sbomify.com/MAL-2025-39978/): Malicious code in xray-victor-zpmo (npm) (malicious package) - [MAL-2025-39977](https://insights.sbomify.com/MAL-2025-39977/): Malicious code in xray-viaduct-s4mo (npm) (malicious package) - [MAL-2025-39976](https://insights.sbomify.com/MAL-2025-39976/): Malicious code in xray-uniform-juliet-fufts (npm) (malicious package) - [MAL-2025-39975](https://insights.sbomify.com/MAL-2025-39975/): Malicious code in xray-umbrella-i2cl (npm) (malicious package) - [MAL-2025-39974](https://insights.sbomify.com/MAL-2025-39974/): Malicious code in xray-ugli-victor-lujew (npm) (malicious package) - [MAL-2025-39973](https://insights.sbomify.com/MAL-2025-39973/): Malicious code in xray-tango-fig-zeumy (npm) (malicious package) - [MAL-2025-39972](https://insights.sbomify.com/MAL-2025-39972/): Malicious code in xray-tangerine-zulu-jxles (npm) (malicious package) - [MAL-2025-39971](https://insights.sbomify.com/MAL-2025-39971/): Malicious code in xray-tangerine-ewpt (npm) (malicious package) - [MAL-2025-39970](https://insights.sbomify.com/MAL-2025-39970/): Malicious code in xray-t8u-project (npm) (malicious package) - [MAL-2025-3997](https://insights.sbomify.com/MAL-2025-3997/): Malicious code in img_sharp_wasm64 (npm) (malicious package) - [MAL-2025-39969](https://insights.sbomify.com/MAL-2025-39969/): Malicious code in xray-sierra-ubgv (npm) (malicious package) - [MAL-2025-39968](https://insights.sbomify.com/MAL-2025-39968/): Malicious code in xray-sierra-fyfv (npm) (malicious package) - [MAL-2025-39967](https://insights.sbomify.com/MAL-2025-39967/): Malicious code in xray-raspberry-romeo-tlwxv (npm) (malicious package) - [MAL-2025-39966](https://insights.sbomify.com/MAL-2025-39966/): Malicious code in xray-pif-project (npm) (malicious package) - [MAL-2025-39965](https://insights.sbomify.com/MAL-2025-39965/): Malicious code in xray-papaya-waun (npm) (malicious package) - [MAL-2025-39964](https://insights.sbomify.com/MAL-2025-39964/): Malicious code in xray-papa-ezvp (npm) (malicious package) - [MAL-2025-39963](https://insights.sbomify.com/MAL-2025-39963/): Malicious code in xray-ot6-project (npm) (malicious package) - [MAL-2025-39962](https://insights.sbomify.com/MAL-2025-39962/): Malicious code in xray-oscar-tango-leygy (npm) (malicious package) - [MAL-2025-39961](https://insights.sbomify.com/MAL-2025-39961/): Malicious code in xray-ool-project (npm) (malicious package) - [MAL-2025-39960](https://insights.sbomify.com/MAL-2025-39960/): Malicious code in xray-maple-mqni (npm) (malicious package) - [MAL-2025-3996](https://insights.sbomify.com/MAL-2025-3996/): Malicious code in hakai-xss (npm) (malicious package) - [MAL-2025-39959](https://insights.sbomify.com/MAL-2025-39959/): Malicious code in xray-mango-ksvg (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2025/page/669/