# Vulnerabilities published in 2025 - [MAL-2025-38878](https://insights.sbomify.com/MAL-2025-38878/): Malicious code in watermelon-vanilla-zorw (npm) (malicious package) - [MAL-2025-38877](https://insights.sbomify.com/MAL-2025-38877/): Malicious code in watermelon-vanilla-hotel-mrnkc (npm) (malicious package) - [MAL-2025-38876](https://insights.sbomify.com/MAL-2025-38876/): Malicious code in watermelon-uniform-xk4i (npm) (malicious package) - [MAL-2025-38875](https://insights.sbomify.com/MAL-2025-38875/): Malicious code in watermelon-tg5-project (npm) (malicious package) - [MAL-2025-38874](https://insights.sbomify.com/MAL-2025-38874/): Malicious code in watermelon-tango-foxtrot-aedcd (npm) (malicious package) - [MAL-2025-38873](https://insights.sbomify.com/MAL-2025-38873/): Malicious code in watermelon-t9k-project (npm) (malicious package) - [MAL-2025-38872](https://insights.sbomify.com/MAL-2025-38872/): Malicious code in watermelon-sig-project (npm) (malicious package) - [MAL-2025-38871](https://insights.sbomify.com/MAL-2025-38871/): Malicious code in watermelon-redwood-nioz (npm) (malicious package) - [MAL-2025-38870](https://insights.sbomify.com/MAL-2025-38870/): Malicious code in watermelon-papa-rjtb (npm) (malicious package) - [MAL-2025-3887](https://insights.sbomify.com/MAL-2025-3887/): Malicious code in feed-testing-utils (npm) (malicious package) - [MAL-2025-38869](https://insights.sbomify.com/MAL-2025-38869/): Malicious code in watermelon-oscar-jhii (npm) (malicious package) - [MAL-2025-38868](https://insights.sbomify.com/MAL-2025-38868/): Malicious code in watermelon-orange-ewaj (npm) (malicious package) - [MAL-2025-38867](https://insights.sbomify.com/MAL-2025-38867/): Malicious code in watermelon-orange-banana-bvwhi (npm) (malicious package) - [MAL-2025-38866](https://insights.sbomify.com/MAL-2025-38866/): Malicious code in watermelon-nutmeg-3bx9 (npm) (malicious package) - [MAL-2025-38865](https://insights.sbomify.com/MAL-2025-38865/): Malicious code in watermelon-november-zumw (npm) (malicious package) - [MAL-2025-38864](https://insights.sbomify.com/MAL-2025-38864/): Malicious code in watermelon-november-victor-rffbi (npm) (malicious package) - [MAL-2025-38863](https://insights.sbomify.com/MAL-2025-38863/): Malicious code in watermelon-november-ehrr (npm) (malicious package) - [MAL-2025-38862](https://insights.sbomify.com/MAL-2025-38862/): Malicious code in watermelon-kilo-pyxs (npm) (malicious package) - [MAL-2025-38861](https://insights.sbomify.com/MAL-2025-38861/): Malicious code in watermelon-i7k-project (npm) (malicious package) - [MAL-2025-38860](https://insights.sbomify.com/MAL-2025-38860/): Malicious code in watermelon-hotel-papa-qeplf (npm) (malicious package) - [MAL-2025-3886](https://insights.sbomify.com/MAL-2025-3886/): Malicious code in fb-error (npm) (malicious package) - [MAL-2025-38859](https://insights.sbomify.com/MAL-2025-38859/): Malicious code in watermelon-hmz-project (npm) (malicious package) - [MAL-2025-38858](https://insights.sbomify.com/MAL-2025-38858/): Malicious code in watermelon-grape-vurv (npm) (malicious package) - [MAL-2025-38857](https://insights.sbomify.com/MAL-2025-38857/): Malicious code in watermelon-g5m-project (npm) (malicious package) - [MAL-2025-38856](https://insights.sbomify.com/MAL-2025-38856/): Malicious code in watermelon-foxtrot-bajk (npm) (malicious package) - [MAL-2025-38855](https://insights.sbomify.com/MAL-2025-38855/): Malicious code in watermelon-eo9-project (npm) (malicious package) - [MAL-2025-38854](https://insights.sbomify.com/MAL-2025-38854/): Malicious code in watermelon-d4e-project (npm) (malicious package) - [MAL-2025-38853](https://insights.sbomify.com/MAL-2025-38853/): Malicious code in watermelon-conifer-hubu (npm) (malicious package) - [MAL-2025-38852](https://insights.sbomify.com/MAL-2025-38852/): Malicious code in watermelon-cherry-uxcq (npm) (malicious package) - [MAL-2025-38851](https://insights.sbomify.com/MAL-2025-38851/): Malicious code in watermelon-bww-project (npm) (malicious package) - [MAL-2025-38850](https://insights.sbomify.com/MAL-2025-38850/): Malicious code in watermelon-banana-oscar-otvit (npm) (malicious package) - [MAL-2025-3885](https://insights.sbomify.com/MAL-2025-3885/): Malicious code in etherbundle (npm) (malicious package) - [MAL-2025-38849](https://insights.sbomify.com/MAL-2025-38849/): Malicious code in watermelon-b4z-project (npm) (malicious package) - [MAL-2025-38848](https://insights.sbomify.com/MAL-2025-38848/): Malicious code in watermelon-apple-fubm (npm) (malicious package) - [MAL-2025-38847](https://insights.sbomify.com/MAL-2025-38847/): Malicious code in watermelon-almond-gf7n (npm) (malicious package) - [MAL-2025-38846](https://insights.sbomify.com/MAL-2025-38846/): Malicious code in watermelon-a3x-project (npm) (malicious package) - [MAL-2025-38845](https://insights.sbomify.com/MAL-2025-38845/): Malicious code in watermelon-5si-project (npm) (malicious package) - [MAL-2025-38844](https://insights.sbomify.com/MAL-2025-38844/): Malicious code in watermelon-57m-project (npm) (malicious package) - [MAL-2025-38843](https://insights.sbomify.com/MAL-2025-38843/): Malicious code in watermelon-32q-project (npm) (malicious package) - [MAL-2025-38842](https://insights.sbomify.com/MAL-2025-38842/): Malicious code in watermelon-2yv-project (npm) (malicious package) - [MAL-2025-38841](https://insights.sbomify.com/MAL-2025-38841/): Malicious code in watermelon-1pt-project (npm) (malicious package) - [MAL-2025-38840](https://insights.sbomify.com/MAL-2025-38840/): Malicious code in watermelon-0q8-project (npm) (malicious package) - [MAL-2025-3884](https://insights.sbomify.com/MAL-2025-3884/): Malicious code in ephoto-api-faris (npm) (malicious package) - [MAL-2025-38839](https://insights.sbomify.com/MAL-2025-38839/): Malicious code in waterfall-zephyr-yaq820-project (npm) (malicious package) - [MAL-2025-38838](https://insights.sbomify.com/MAL-2025-38838/): Malicious code in waterfall-yucca-fww745-project (npm) (malicious package) - [MAL-2025-38837](https://insights.sbomify.com/MAL-2025-38837/): Malicious code in waterfall-xylophone-ezx711-project (npm) (malicious package) - [MAL-2025-38836](https://insights.sbomify.com/MAL-2025-38836/): Malicious code in waterfall-vulture-ajq357-project (npm) (malicious package) - [MAL-2025-38835](https://insights.sbomify.com/MAL-2025-38835/): Malicious code in waterfall-tiger-lcy744-project (npm) (malicious package) - [MAL-2025-38834](https://insights.sbomify.com/MAL-2025-38834/): Malicious code in waterfall-thunder-zaw298-project (npm) (malicious package) - [MAL-2025-38833](https://insights.sbomify.com/MAL-2025-38833/): Malicious code in waterfall-sunset-vqy611-project (npm) (malicious package) - [MAL-2025-38832](https://insights.sbomify.com/MAL-2025-38832/): Malicious code in waterfall-spruce-sov598-project (npm) (malicious package) - [MAL-2025-38831](https://insights.sbomify.com/MAL-2025-38831/): Malicious code in waterfall-reef-aal428-project (npm) (malicious package) - [MAL-2025-38830](https://insights.sbomify.com/MAL-2025-38830/): Malicious code in waterfall-quill-wbc663-project (npm) (malicious package) - [MAL-2025-3883](https://insights.sbomify.com/MAL-2025-3883/): Malicious code in driver-app-server (npm) (malicious package) - [MAL-2025-38829](https://insights.sbomify.com/MAL-2025-38829/): Malicious code in waterfall-peony-sqm222-project (npm) (malicious package) - [MAL-2025-38828](https://insights.sbomify.com/MAL-2025-38828/): Malicious code in waterfall-ocean-mpt094-project (npm) (malicious package) - [MAL-2025-38827](https://insights.sbomify.com/MAL-2025-38827/): Malicious code in waterfall-nugget-mrm611-project (npm) (malicious package) - [MAL-2025-38826](https://insights.sbomify.com/MAL-2025-38826/): Malicious code in waterfall-nimbus-bst529-project (npm) (malicious package) - [MAL-2025-38825](https://insights.sbomify.com/MAL-2025-38825/): Malicious code in waterfall-koala-jjr057-project (npm) (malicious package) - [MAL-2025-38824](https://insights.sbomify.com/MAL-2025-38824/): Malicious code in waterfall-kite-ieq692-project (npm) (malicious package) - [MAL-2025-38823](https://insights.sbomify.com/MAL-2025-38823/): Malicious code in waterfall-kelp-vku005-project (npm) (malicious package) - [MAL-2025-38822](https://insights.sbomify.com/MAL-2025-38822/): Malicious code in waterfall-kelp-tjt400-project (npm) (malicious package) - [MAL-2025-38821](https://insights.sbomify.com/MAL-2025-38821/): Malicious code in waterfall-jungle-par221-project (npm) (malicious package) - [MAL-2025-38820](https://insights.sbomify.com/MAL-2025-38820/): Malicious code in waterfall-jasmine-ufw145-project (npm) (malicious package) - [MAL-2025-3882](https://insights.sbomify.com/MAL-2025-3882/): Malicious code in dotenv-sdk (npm) (malicious package) - [MAL-2025-38819](https://insights.sbomify.com/MAL-2025-38819/): Malicious code in waterfall-iguana-qfk696-project (npm) (malicious package) - [MAL-2025-38818](https://insights.sbomify.com/MAL-2025-38818/): Malicious code in waterfall-iguana-htu323-project (npm) (malicious package) - [MAL-2025-38817](https://insights.sbomify.com/MAL-2025-38817/): Malicious code in waterfall-icicle-drv312-project (npm) (malicious package) - [MAL-2025-38816](https://insights.sbomify.com/MAL-2025-38816/): Malicious code in waterfall-iceberg-ixu008-project (npm) (malicious package) - [MAL-2025-38815](https://insights.sbomify.com/MAL-2025-38815/): Malicious code in waterfall-honey-mvl598-project (npm) (malicious package) - [MAL-2025-38814](https://insights.sbomify.com/MAL-2025-38814/): Malicious code in waterfall-harbor-xkl008-project (npm) (malicious package) - [MAL-2025-38813](https://insights.sbomify.com/MAL-2025-38813/): Malicious code in waterfall-frost-trg280-project (npm) (malicious package) - [MAL-2025-38812](https://insights.sbomify.com/MAL-2025-38812/): Malicious code in waterfall-fjord-cyf003-project (npm) (malicious package) - [MAL-2025-38811](https://insights.sbomify.com/MAL-2025-38811/): Malicious code in waterfall-fern-xfp240-project (npm) (malicious package) - [MAL-2025-38810](https://insights.sbomify.com/MAL-2025-38810/): Malicious code in waterfall-elephant-nao511-project (npm) (malicious package) - [MAL-2025-3881](https://insights.sbomify.com/MAL-2025-3881/): Malicious code in date-min (npm) (malicious package) - [MAL-2025-38809](https://insights.sbomify.com/MAL-2025-38809/): Malicious code in waterfall-crystal-ejr244-project (npm) (malicious package) - [MAL-2025-38808](https://insights.sbomify.com/MAL-2025-38808/): Malicious code in waterfall-coral-tqt630-project (npm) (malicious package) - [MAL-2025-38807](https://insights.sbomify.com/MAL-2025-38807/): Malicious code in waterfall-cascade-nlo372-project (npm) (malicious package) - [MAL-2025-38806](https://insights.sbomify.com/MAL-2025-38806/): Malicious code in waterfall-butterfly-etn446-project (npm) (malicious package) - [MAL-2025-38805](https://insights.sbomify.com/MAL-2025-38805/): Malicious code in water-tree-info-good-xml (npm) (malicious package) - [MAL-2025-38804](https://insights.sbomify.com/MAL-2025-38804/): Malicious code in water-omicron-socket-phi-zeta (npm) (malicious package) - [MAL-2025-38803](https://insights.sbomify.com/MAL-2025-38803/): Malicious code in watch-history-kcl (npm) (malicious package) - [MAL-2025-38802](https://insights.sbomify.com/MAL-2025-38802/): Malicious code in watch-array (npm) (malicious package) - [MAL-2025-38801](https://insights.sbomify.com/MAL-2025-38801/): Malicious code in washinton (npm) (malicious package) - [MAL-2025-38800](https://insights.sbomify.com/MAL-2025-38800/): Malicious code in waseemdemo (npm) (malicious package) - [MAL-2025-3880](https://insights.sbomify.com/MAL-2025-3880/): Malicious code in cube-sign-cli (npm) (malicious package) - [MAL-2025-388](https://insights.sbomify.com/MAL-2025-388/): Malicious code in apple-cache (npm) (malicious package) - [MAL-2025-38799](https://insights.sbomify.com/MAL-2025-38799/): Malicious code in wasat-quantum-computing-tectonic-less-loader (npm) (malicious package) - [MAL-2025-38798](https://insights.sbomify.com/MAL-2025-38798/): Malicious code in wasat-concurrently-delphinus-auriga (npm) (malicious package) - [MAL-2025-38797](https://insights.sbomify.com/MAL-2025-38797/): Malicious code in wasat-cladistics-astrometry-carpo (npm) (malicious package) - [MAL-2025-38796](https://insights.sbomify.com/MAL-2025-38796/): Malicious code in wasat-chakra-ui-neuromorphic-volcanology (npm) (malicious package) - [MAL-2025-38795](https://insights.sbomify.com/MAL-2025-38795/): Malicious code in wasat-castor-toml-elektra (npm) (malicious package) - [MAL-2025-38794](https://insights.sbomify.com/MAL-2025-38794/): Malicious code in wasabi-whiskey-1aqk (npm) (malicious package) - [MAL-2025-38793](https://insights.sbomify.com/MAL-2025-38793/): Malicious code in wasabi-tangerine-a94m (npm) (malicious package) - [MAL-2025-38792](https://insights.sbomify.com/MAL-2025-38792/): Malicious code in wasabi-papaya-dy32 (npm) (malicious package) - [MAL-2025-38791](https://insights.sbomify.com/MAL-2025-38791/): Malicious code in wasabi-november-jo1d (npm) (malicious package) - [MAL-2025-38790](https://insights.sbomify.com/MAL-2025-38790/): Malicious code in wasabi-jalapeno-4ze2 (npm) (malicious package) - [MAL-2025-3879](https://insights.sbomify.com/MAL-2025-3879/): Malicious code in convera (npm) (malicious package) - [MAL-2025-38789](https://insights.sbomify.com/MAL-2025-38789/): Malicious code in wasabi-flare-ju03 (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2025/page/682/