# Vulnerabilities published in 2025


- [MAL-2025-33099](https://insights.sbomify.com/MAL-2025-33099/): Malicious code in shinva (npm) (malicious package)
- [MAL-2025-33098](https://insights.sbomify.com/MAL-2025-33098/): Malicious code in shimmer-ignite-jtc896-project (npm) (malicious package)
- [MAL-2025-33097](https://insights.sbomify.com/MAL-2025-33097/): Malicious code in shihaos (npm) (malicious package)
- [MAL-2025-33096](https://insights.sbomify.com/MAL-2025-33096/): Malicious code in shifat (npm) (malicious package)
- [MAL-2025-33095](https://insights.sbomify.com/MAL-2025-33095/): Malicious code in shield-sdk (npm) (malicious package)
- [MAL-2025-33094](https://insights.sbomify.com/MAL-2025-33094/): Malicious code in sherlock008 (npm) (malicious package)
- [MAL-2025-33093](https://insights.sbomify.com/MAL-2025-33093/): Malicious code in sherlock007 (npm) (malicious package)
- [MAL-2025-33092](https://insights.sbomify.com/MAL-2025-33092/): Malicious code in sherlock-frontier-client (npm) (malicious package)
- [MAL-2025-33091](https://insights.sbomify.com/MAL-2025-33091/): Malicious code in shenjs (npm) (malicious package)
- [MAL-2025-33090](https://insights.sbomify.com/MAL-2025-33090/): Malicious code in shem (npm) (malicious package)
- [MAL-2025-3309](https://insights.sbomify.com/MAL-2025-3309/): Malicious code in @sporta-technology/d11-web-components.bit-theme-wrapper (npm) (malicious package)
- [MAL-2025-33089](https://insights.sbomify.com/MAL-2025-33089/): Malicious code in shellr (npm) (malicious package)
- [MAL-2025-33088](https://insights.sbomify.com/MAL-2025-33088/): Malicious code in shelljs-ursa-vortex-blueshift (npm) (malicious package)
- [MAL-2025-33087](https://insights.sbomify.com/MAL-2025-33087/): Malicious code in shelljs-uglify-js-nova-xml (npm) (malicious package)
- [MAL-2025-33086](https://insights.sbomify.com/MAL-2025-33086/): Malicious code in shelljs-eleventy-fetch-aether (npm) (malicious package)
- [MAL-2025-33085](https://insights.sbomify.com/MAL-2025-33085/): Malicious code in shell-uglify-uglify-fast-grid (npm) (malicious package)
- [MAL-2025-33084](https://insights.sbomify.com/MAL-2025-33084/): Malicious code in shell-uglify-refactor-compile-cold (npm) (malicious package)
- [MAL-2025-33083](https://insights.sbomify.com/MAL-2025-33083/): Malicious code in shell-old-code-module-kappa (npm) (malicious package)
- [MAL-2025-33082](https://insights.sbomify.com/MAL-2025-33082/): Malicious code in shell-jobs (npm) (malicious package)
- [MAL-2025-33081](https://insights.sbomify.com/MAL-2025-33081/): Malicious code in shell-easy-finally-water-epsilon (npm) (malicious package)
- [MAL-2025-33080](https://insights.sbomify.com/MAL-2025-33080/): Malicious code in shelfari (npm) (malicious package)
- [MAL-2025-3308](https://insights.sbomify.com/MAL-2025-3308/): Malicious code in @sporta-technology/d11-web-components.banner (npm) (malicious package)
- [MAL-2025-33079](https://insights.sbomify.com/MAL-2025-33079/): Malicious code in shelder (npm) (malicious package)
- [MAL-2025-33078](https://insights.sbomify.com/MAL-2025-33078/): Malicious code in shein-card-balance-389 (npm) (malicious package)
- [MAL-2025-33077](https://insights.sbomify.com/MAL-2025-33077/): Malicious code in sheduleme (npm) (malicious package)
- [MAL-2025-33076](https://insights.sbomify.com/MAL-2025-33076/): Malicious code in shazamapi-node (npm) (malicious package)
- [MAL-2025-33075](https://insights.sbomify.com/MAL-2025-33075/): Malicious code in shavesink (npm) (malicious package)
- [MAL-2025-33074](https://insights.sbomify.com/MAL-2025-33074/): Malicious code in sharppt (npm) (malicious package)
- [MAL-2025-33073](https://insights.sbomify.com/MAL-2025-33073/): Malicious code in sharpphp (npm) (malicious package)
- [MAL-2025-33072](https://insights.sbomify.com/MAL-2025-33072/): Malicious code in sharma (npm) (malicious package)
- [MAL-2025-33071](https://insights.sbomify.com/MAL-2025-33071/): Malicious code in sharkit (npm) (malicious package)
- [MAL-2025-33070](https://insights.sbomify.com/MAL-2025-33070/): Malicious code in sharkfear (npm) (malicious package)
- [MAL-2025-3307](https://insights.sbomify.com/MAL-2025-3307/): Malicious code in @sporta-technology/d11-web-components.avatar (npm) (malicious package)
- [MAL-2025-33069](https://insights.sbomify.com/MAL-2025-33069/): Malicious code in sharepe (npm) (malicious package)
- [MAL-2025-33068](https://insights.sbomify.com/MAL-2025-33068/): Malicious code in shareout (npm) (malicious package)
- [MAL-2025-33067](https://insights.sbomify.com/MAL-2025-33067/): Malicious code in sharenix (npm) (malicious package)
- [MAL-2025-33066](https://insights.sbomify.com/MAL-2025-33066/): Malicious code in sharejss (npm) (malicious package)
- [MAL-2025-33065](https://insights.sbomify.com/MAL-2025-33065/): Malicious code in shared_ui_components (npm) (malicious package)
- [MAL-2025-33064](https://insights.sbomify.com/MAL-2025-33064/): Malicious code in shared-styling (npm) (malicious package)
- [MAL-2025-33063](https://insights.sbomify.com/MAL-2025-33063/): Malicious code in shared-nav-ia-region-americas (npm) (malicious package)
- [MAL-2025-33062](https://insights.sbomify.com/MAL-2025-33062/): Malicious code in shapplib (npm) (malicious package)
- [MAL-2025-33061](https://insights.sbomify.com/MAL-2025-33061/): Malicious code in shanty (npm) (malicious package)
- [MAL-2025-33060](https://insights.sbomify.com/MAL-2025-33060/): Malicious code in shanejp777-frame-print (npm) (malicious package)
- [MAL-2025-3306](https://insights.sbomify.com/MAL-2025-3306/): Malicious code in @sporta-technology/d11-web-components.accordion (npm) (malicious package)
- [MAL-2025-33059](https://insights.sbomify.com/MAL-2025-33059/): Malicious code in shanaz (npm) (malicious package)
- [MAL-2025-33058](https://insights.sbomify.com/MAL-2025-33058/): Malicious code in shamash (npm) (malicious package)
- [MAL-2025-33057](https://insights.sbomify.com/MAL-2025-33057/): Malicious code in shallong (npm) (malicious package)
- [MAL-2025-33056](https://insights.sbomify.com/MAL-2025-33056/): Malicious code in shalk (npm) (malicious package)
- [MAL-2025-33055](https://insights.sbomify.com/MAL-2025-33055/): Malicious code in shaheer2002-todolist-2 (npm) (malicious package)
- [MAL-2025-33054](https://insights.sbomify.com/MAL-2025-33054/): Malicious code in shadydev (npm) (malicious package)
- [MAL-2025-33053](https://insights.sbomify.com/MAL-2025-33053/): Malicious code in shack-yurt-pmr5 (npm) (malicious package)
- [MAL-2025-33052](https://insights.sbomify.com/MAL-2025-33052/): Malicious code in shack-xylophone-yag8 (npm) (malicious package)
- [MAL-2025-33051](https://insights.sbomify.com/MAL-2025-33051/): Malicious code in shack-pulsar-yitx (npm) (malicious package)
- [MAL-2025-33050](https://insights.sbomify.com/MAL-2025-33050/): Malicious code in shack-observatory-mv7m (npm) (malicious package)
- [MAL-2025-3305](https://insights.sbomify.com/MAL-2025-3305/): Malicious code in @sas-dvr/ltjs-sasicu (npm) (malicious package)
- [MAL-2025-33049](https://insights.sbomify.com/MAL-2025-33049/): Malicious code in shack-maple-h5xi (npm) (malicious package)
- [MAL-2025-33048](https://insights.sbomify.com/MAL-2025-33048/): Malicious code in shack-falcon-fwnm (npm) (malicious package)
- [MAL-2025-33047](https://insights.sbomify.com/MAL-2025-33047/): Malicious code in shack-comet-9me2 (npm) (malicious package)
- [MAL-2025-33046](https://insights.sbomify.com/MAL-2025-33046/): Malicious code in shabuside-mimi (npm) (malicious package)
- [MAL-2025-33045](https://insights.sbomify.com/MAL-2025-33045/): Malicious code in sha256-validation (npm) (malicious package)
- [MAL-2025-33044](https://insights.sbomify.com/MAL-2025-33044/): Malicious code in sha256-cbc (npm) (malicious package)
- [MAL-2025-33043](https://insights.sbomify.com/MAL-2025-33043/): Malicious code in sh-utils (npm) (malicious package)
- [MAL-2025-33042](https://insights.sbomify.com/MAL-2025-33042/): Malicious code in sgyums (npm) (malicious package)
- [MAL-2025-33041](https://insights.sbomify.com/MAL-2025-33041/): Malicious code in sgmulford (npm) (malicious package)
- [MAL-2025-33040](https://insights.sbomify.com/MAL-2025-33040/): Malicious code in sglk-dev-tools (npm) (malicious package)
- [MAL-2025-3304](https://insights.sbomify.com/MAL-2025-3304/): Malicious code in @sas-dvr/ltjs-commons (npm) (malicious package)
- [MAL-2025-33039](https://insights.sbomify.com/MAL-2025-33039/): Malicious code in sgiuteg (npm) (malicious package)
- [MAL-2025-33038](https://insights.sbomify.com/MAL-2025-33038/): Malicious code in sgetris (npm) (malicious package)
- [MAL-2025-33037](https://insights.sbomify.com/MAL-2025-33037/): Malicious code in sfrewe23 (npm) (malicious package)
- [MAL-2025-33036](https://insights.sbomify.com/MAL-2025-33036/): Malicious code in sfi-service-ppn (npm) (malicious package)
- [MAL-2025-33035](https://insights.sbomify.com/MAL-2025-33035/): Malicious code in sfhbxpcjwmzriody (npm) (malicious package)
- [MAL-2025-33034](https://insights.sbomify.com/MAL-2025-33034/): Malicious code in sfgitdemo (npm) (malicious package)
- [MAL-2025-33033](https://insights.sbomify.com/MAL-2025-33033/): Malicious code in sffood (npm) (malicious package)
- [MAL-2025-33032](https://insights.sbomify.com/MAL-2025-33032/): Malicious code in sfcc-sdapi (npm) (malicious package)
- [MAL-2025-33031](https://insights.sbomify.com/MAL-2025-33031/): Malicious code in SexyJS (npm) (malicious package)
- [MAL-2025-33030](https://insights.sbomify.com/MAL-2025-33030/): Malicious code in sewing-kit-plugin-quilt (npm) (malicious package)
- [MAL-2025-3303](https://insights.sbomify.com/MAL-2025-3303/): Malicious code in @sas-dvr/internal-va-react-core (npm) (malicious package)
- [MAL-2025-33029](https://insights.sbomify.com/MAL-2025-33029/): Malicious code in sew23 (npm) (malicious package)
- [MAL-2025-33028](https://insights.sbomify.com/MAL-2025-33028/): Malicious code in setupvps (npm) (malicious package)
- [MAL-2025-33027](https://insights.sbomify.com/MAL-2025-33027/): Malicious code in setup-jsonnet (npm) (malicious package)
- [MAL-2025-33026](https://insights.sbomify.com/MAL-2025-33026/): Malicious code in setup-grunt (npm) (malicious package)
- [MAL-2025-33025](https://insights.sbomify.com/MAL-2025-33025/): Malicious code in setup-foreman (npm) (malicious package)
- [MAL-2025-33024](https://insights.sbomify.com/MAL-2025-33024/): Malicious code in setup-docker (npm) (malicious package)
- [MAL-2025-33023](https://insights.sbomify.com/MAL-2025-33023/): Malicious code in settingsjs (npm) (malicious package)
- [MAL-2025-33022](https://insights.sbomify.com/MAL-2025-33022/): Malicious code in setihome (npm) (malicious package)
- [MAL-2025-33021](https://insights.sbomify.com/MAL-2025-33021/): Malicious code in setidane-tea (npm) (malicious package)
- [MAL-2025-33020](https://insights.sbomify.com/MAL-2025-33020/): Malicious code in sethelper (npm) (malicious package)
- [MAL-2025-3302](https://insights.sbomify.com/MAL-2025-3302/): Malicious code in @saferpay/prettier-config (npm) (malicious package)
- [MAL-2025-33019](https://insights.sbomify.com/MAL-2025-33019/): Malicious code in setheight (npm) (malicious package)
- [MAL-2025-33018](https://insights.sbomify.com/MAL-2025-33018/): Malicious code in setare (npm) (malicious package)
- [MAL-2025-33017](https://insights.sbomify.com/MAL-2025-33017/): Malicious code in set-object-path (npm) (malicious package)
- [MAL-2025-33016](https://insights.sbomify.com/MAL-2025-33016/): Malicious code in set-content-type (npm) (malicious package)
- [MAL-2025-33015](https://insights.sbomify.com/MAL-2025-33015/): Malicious code in session-jmodule (npm) (malicious package)
- [MAL-2025-33014](https://insights.sbomify.com/MAL-2025-33014/): Malicious code in servicestack (npm) (malicious package)
- [MAL-2025-33013](https://insights.sbomify.com/MAL-2025-33013/): Malicious code in servicescore (npm) (malicious package)
- [MAL-2025-33012](https://insights.sbomify.com/MAL-2025-33012/): Malicious code in service-stack (npm) (malicious package)
- [MAL-2025-33011](https://insights.sbomify.com/MAL-2025-33011/): Malicious code in service-edge (npm) (malicious package)
- [MAL-2025-33010](https://insights.sbomify.com/MAL-2025-33010/): Malicious code in service-content-consumers (npm) (malicious package)
- [MAL-2025-3301](https://insights.sbomify.com/MAL-2025-3301/): Malicious code in @medibank-lib/medi-analytics (npm) (malicious package)
- [MAL-2025-33009](https://insights.sbomify.com/MAL-2025-33009/): Malicious code in serverless-slack-app (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/746/