# Vulnerabilities published in 2025 - [MAL-2025-28405](https://insights.sbomify.com/MAL-2025-28405/): Malicious code in orange-juliet-oscar-xrhtz (npm) (malicious package) - [MAL-2025-28404](https://insights.sbomify.com/MAL-2025-28404/): Malicious code in orange-jbk-project (npm) (malicious package) - [MAL-2025-28403](https://insights.sbomify.com/MAL-2025-28403/): Malicious code in orange-gq1-project (npm) (malicious package) - [MAL-2025-28402](https://insights.sbomify.com/MAL-2025-28402/): Malicious code in orange-golf-strawberry-jxssf (npm) (malicious package) - [MAL-2025-28401](https://insights.sbomify.com/MAL-2025-28401/): Malicious code in orange-golf-omkm (npm) (malicious package) - [MAL-2025-28400](https://insights.sbomify.com/MAL-2025-28400/): Malicious code in orange-golf-mike-qwkwk (npm) (malicious package) - [MAL-2025-2840](https://insights.sbomify.com/MAL-2025-2840/): Malicious code in azbit-main (npm) (malicious package) - [MAL-2025-284](https://insights.sbomify.com/MAL-2025-284/): Malicious code in calypso-jest (npm) (malicious package) - [MAL-2025-28399](https://insights.sbomify.com/MAL-2025-28399/): Malicious code in orange-games-splash (npm) (malicious package) - [MAL-2025-28398](https://insights.sbomify.com/MAL-2025-28398/): Malicious code in orange-foxtrot-lful (npm) (malicious package) - [MAL-2025-28397](https://insights.sbomify.com/MAL-2025-28397/): Malicious code in orange-echo-qkbe (npm) (malicious package) - [MAL-2025-28396](https://insights.sbomify.com/MAL-2025-28396/): Malicious code in orange-echo-papa-bkgwv (npm) (malicious package) - [MAL-2025-28395](https://insights.sbomify.com/MAL-2025-28395/): Malicious code in orange-echo-izdd (npm) (malicious package) - [MAL-2025-28394](https://insights.sbomify.com/MAL-2025-28394/): Malicious code in orange-echo-grmn (npm) (malicious package) - [MAL-2025-28393](https://insights.sbomify.com/MAL-2025-28393/): Malicious code in orange-e2u-project (npm) (malicious package) - [MAL-2025-28392](https://insights.sbomify.com/MAL-2025-28392/): Malicious code in orange-delta-qqwa (npm) (malicious package) - [MAL-2025-28391](https://insights.sbomify.com/MAL-2025-28391/): Malicious code in orange-cherry-vrym (npm) (malicious package) - [MAL-2025-28390](https://insights.sbomify.com/MAL-2025-28390/): Malicious code in orange-cherry-fig-aukxu (npm) (malicious package) - [MAL-2025-2839](https://insights.sbomify.com/MAL-2025-2839/): Malicious code in azbit-internal (npm) (malicious package) - [MAL-2025-28389](https://insights.sbomify.com/MAL-2025-28389/): Malicious code in orange-c2b-project (npm) (malicious package) - [MAL-2025-28388](https://insights.sbomify.com/MAL-2025-28388/): Malicious code in orange-bravo-rroh (npm) (malicious package) - [MAL-2025-28387](https://insights.sbomify.com/MAL-2025-28387/): Malicious code in orange-banana-xray-lihbv (npm) (malicious package) - [MAL-2025-28386](https://insights.sbomify.com/MAL-2025-28386/): Malicious code in orange-banana-victor-fkyxx (npm) (malicious package) - [MAL-2025-28385](https://insights.sbomify.com/MAL-2025-28385/): Malicious code in orange-banana-ugli-aahjr (npm) (malicious package) - [MAL-2025-28384](https://insights.sbomify.com/MAL-2025-28384/): Malicious code in orange-banana-imbt (npm) (malicious package) - [MAL-2025-28383](https://insights.sbomify.com/MAL-2025-28383/): Malicious code in orange-9ql-project (npm) (malicious package) - [MAL-2025-28382](https://insights.sbomify.com/MAL-2025-28382/): Malicious code in orange-91b-project (npm) (malicious package) - [MAL-2025-28381](https://insights.sbomify.com/MAL-2025-28381/): Malicious code in orange-8zg-project (npm) (malicious package) - [MAL-2025-28380](https://insights.sbomify.com/MAL-2025-28380/): Malicious code in orange-8xd-project (npm) (malicious package) - [MAL-2025-2838](https://insights.sbomify.com/MAL-2025-2838/): Malicious code in azbit-dev (npm) (malicious package) - [MAL-2025-28379](https://insights.sbomify.com/MAL-2025-28379/): Malicious code in orange-7oi-project (npm) (malicious package) - [MAL-2025-28378](https://insights.sbomify.com/MAL-2025-28378/): Malicious code in orange-462-project (npm) (malicious package) - [MAL-2025-28377](https://insights.sbomify.com/MAL-2025-28377/): Malicious code in oracle-h5wa9-x4t03-oasis-project (npm) (malicious package) - [MAL-2025-28376](https://insights.sbomify.com/MAL-2025-28376/): Malicious code in oracle-etb4u-oxccq-xenon-project (npm) (malicious package) - [MAL-2025-28375](https://insights.sbomify.com/MAL-2025-28375/): Malicious code in ora-centauri-nconf-venus (npm) (malicious package) - [MAL-2025-28374](https://insights.sbomify.com/MAL-2025-28374/): Malicious code in oqpbkcjedrvlfkwu (npm) (malicious package) - [MAL-2025-28373](https://insights.sbomify.com/MAL-2025-28373/): Malicious code in opusdac (npm) (malicious package) - [MAL-2025-28372](https://insights.sbomify.com/MAL-2025-28372/): Malicious code in optsoft (npm) (malicious package) - [MAL-2025-28371](https://insights.sbomify.com/MAL-2025-28371/): Malicious code in optrun (npm) (malicious package) - [MAL-2025-28370](https://insights.sbomify.com/MAL-2025-28370/): Malicious code in optimystic-hello-world (npm) (malicious package) - [MAL-2025-2837](https://insights.sbomify.com/MAL-2025-2837/): Malicious code in azbit (npm) (malicious package) - [MAL-2025-28369](https://insights.sbomify.com/MAL-2025-28369/): Malicious code in optimize-sudo-spy-omega-error (npm) (malicious package) - [MAL-2025-28368](https://insights.sbomify.com/MAL-2025-28368/): Malicious code in optimize-root-minify-long-grid (npm) (malicious package) - [MAL-2025-28367](https://insights.sbomify.com/MAL-2025-28367/): Malicious code in optimize-css-assets-webpack-plugin-quantum-supervisor-oscillation (npm) (malicious package) - [MAL-2025-28366](https://insights.sbomify.com/MAL-2025-28366/): Malicious code in optimize-css-assets-webpack-plugin-pulsar-inquirer-juno (npm) (malicious package) - [MAL-2025-28365](https://insights.sbomify.com/MAL-2025-28365/): Malicious code in optimize-css-assets-webpack-plugin-odin-slides-izar (npm) (malicious package) - [MAL-2025-28364](https://insights.sbomify.com/MAL-2025-28364/): Malicious code in optimize-css-assets-webpack-plugin-octans-eslint-config-farout (npm) (malicious package) - [MAL-2025-28363](https://insights.sbomify.com/MAL-2025-28363/): Malicious code in optimize-css-assets-webpack-plugin-node-config-europa-native (npm) (malicious package) - [MAL-2025-28362](https://insights.sbomify.com/MAL-2025-28362/): Malicious code in optimium (npm) (malicious package) - [MAL-2025-28361](https://insights.sbomify.com/MAL-2025-28361/): Malicious code in opstools (npm) (malicious package) - [MAL-2025-28360](https://insights.sbomify.com/MAL-2025-28360/): Malicious code in opstarts-ui (npm) (malicious package) - [MAL-2025-2836](https://insights.sbomify.com/MAL-2025-2836/): Malicious code in arkose-labs-react-native-example (npm) (malicious package) - [MAL-2025-28359](https://insights.sbomify.com/MAL-2025-28359/): Malicious code in opsadmin (npm) (malicious package) - [MAL-2025-28358](https://insights.sbomify.com/MAL-2025-28358/): Malicious code in opress (npm) (malicious package) - [MAL-2025-28357](https://insights.sbomify.com/MAL-2025-28357/): Malicious code in opiblog (npm) (malicious package) - [MAL-2025-28356](https://insights.sbomify.com/MAL-2025-28356/): Malicious code in ophiuchus-whitedwarf-janus-proteomics (npm) (malicious package) - [MAL-2025-28355](https://insights.sbomify.com/MAL-2025-28355/): Malicious code in ophiuchus-telesto-local-zenith (npm) (malicious package) - [MAL-2025-28354](https://insights.sbomify.com/MAL-2025-28354/): Malicious code in ophiuchus-phoenix-rimraf-convict (npm) (malicious package) - [MAL-2025-28353](https://insights.sbomify.com/MAL-2025-28353/): Malicious code in ophiuchus-greatfilter-delphinus-ceres (npm) (malicious package) - [MAL-2025-28352](https://insights.sbomify.com/MAL-2025-28352/): Malicious code in ophiuchus-farout-yakutsk-bellatrix (npm) (malicious package) - [MAL-2025-28351](https://insights.sbomify.com/MAL-2025-28351/): Malicious code in ophiuchus-cosmicray-xerxes-eslint-config (npm) (malicious package) - [MAL-2025-28350](https://insights.sbomify.com/MAL-2025-28350/): Malicious code in ophiuchus-comet-wavefunction-event (npm) (malicious package) - [MAL-2025-2835](https://insights.sbomify.com/MAL-2025-2835/): Malicious code in aem-generated-project (npm) (malicious package) - [MAL-2025-28349](https://insights.sbomify.com/MAL-2025-28349/): Malicious code in ophiuchus-backend-perseus-jabbah (npm) (malicious package) - [MAL-2025-28348](https://insights.sbomify.com/MAL-2025-28348/): Malicious code in ophiuchus-aquarius-antd-meissa (npm) (malicious package) - [MAL-2025-28347](https://insights.sbomify.com/MAL-2025-28347/): Malicious code in ophiuchus-algol-troposphere-dendrochronology (npm) (malicious package) - [MAL-2025-28346](https://insights.sbomify.com/MAL-2025-28346/): Malicious code in openzeppelin-solidity-2.3.0 (npm) (malicious package) - [MAL-2025-28345](https://insights.sbomify.com/MAL-2025-28345/): Malicious code in openwow (npm) (malicious package) - [MAL-2025-28344](https://insights.sbomify.com/MAL-2025-28344/): Malicious code in openwom (npm) (malicious package) - [MAL-2025-28343](https://insights.sbomify.com/MAL-2025-28343/): Malicious code in openuax (npm) (malicious package) - [MAL-2025-28342](https://insights.sbomify.com/MAL-2025-28342/): Malicious code in openturf (npm) (malicious package) - [MAL-2025-28341](https://insights.sbomify.com/MAL-2025-28341/): Malicious code in opentree (npm) (malicious package) - [MAL-2025-28340](https://insights.sbomify.com/MAL-2025-28340/): Malicious code in opentelemetry-shopify (npm) (malicious package) - [MAL-2025-2834](https://insights.sbomify.com/MAL-2025-2834/): Malicious code in across-package-test2 (npm) (malicious package) - [MAL-2025-28339](https://insights.sbomify.com/MAL-2025-28339/): Malicious code in opent2t-translator-com-hue-hub (npm) (malicious package) - [MAL-2025-28338](https://insights.sbomify.com/MAL-2025-28338/): Malicious code in opent2t-translator-com-hue-bulb (npm) (malicious package) - [MAL-2025-28337](https://insights.sbomify.com/MAL-2025-28337/): Malicious code in opent2t-onboarding-org-opent2t-onboarding-hue (npm) (malicious package) - [MAL-2025-28336](https://insights.sbomify.com/MAL-2025-28336/): Malicious code in opent2t-onboarding-huehub (npm) (malicious package) - [MAL-2025-28335](https://insights.sbomify.com/MAL-2025-28335/): Malicious code in opensuse-leapyiwusan-sysanal-tune-guide (npm) (malicious package) - [MAL-2025-28334](https://insights.sbomify.com/MAL-2025-28334/): Malicious code in openslava (npm) (malicious package) - [MAL-2025-28333](https://insights.sbomify.com/MAL-2025-28333/): Malicious code in openset (npm) (malicious package) - [MAL-2025-28332](https://insights.sbomify.com/MAL-2025-28332/): Malicious code in opensearch-console-server (npm) (malicious package) - [MAL-2025-28331](https://insights.sbomify.com/MAL-2025-28331/): Malicious code in openseadragon-qtip-annotations (npm) (malicious package) - [MAL-2025-28330](https://insights.sbomify.com/MAL-2025-28330/): Malicious code in openptv (npm) (malicious package) - [MAL-2025-2833](https://insights.sbomify.com/MAL-2025-2833/): Malicious code in @vercel-internals/tsconfig (npm) (malicious package) - [MAL-2025-28329](https://insights.sbomify.com/MAL-2025-28329/): Malicious code in openpom (npm) (malicious package) - [MAL-2025-28328](https://insights.sbomify.com/MAL-2025-28328/): Malicious code in openikt-web (npm) (malicious package) - [MAL-2025-28327](https://insights.sbomify.com/MAL-2025-28327/): Malicious code in openideo (npm) (malicious package) - [MAL-2025-28326](https://insights.sbomify.com/MAL-2025-28326/): Malicious code in openhpmis (npm) (malicious package) - [MAL-2025-28325](https://insights.sbomify.com/MAL-2025-28325/): Malicious code in opengls (npm) (malicious package) - [MAL-2025-28324](https://insights.sbomify.com/MAL-2025-28324/): Malicious code in opengaze (npm) (malicious package) - [MAL-2025-28323](https://insights.sbomify.com/MAL-2025-28323/): Malicious code in openfest (npm) (malicious package) - [MAL-2025-28322](https://insights.sbomify.com/MAL-2025-28322/): Malicious code in openfat (npm) (malicious package) - [MAL-2025-28321](https://insights.sbomify.com/MAL-2025-28321/): Malicious code in openexr (npm) (malicious package) - [MAL-2025-28320](https://insights.sbomify.com/MAL-2025-28320/): Malicious code in openexpo (npm) (malicious package) - [MAL-2025-2832](https://insights.sbomify.com/MAL-2025-2832/): Malicious code in @vercel-internals/constants (npm) (malicious package) - [MAL-2025-28319](https://insights.sbomify.com/MAL-2025-28319/): Malicious code in opencv-compare-image (npm) (malicious package) - [MAL-2025-28318](https://insights.sbomify.com/MAL-2025-28318/): Malicious code in openchile (npm) (malicious package) - [MAL-2025-28317](https://insights.sbomify.com/MAL-2025-28317/): Malicious code in openai-realtime-console-plugin (npm) (malicious package) - [MAL-2025-28316](https://insights.sbomify.com/MAL-2025-28316/): Malicious code in open-xchange-appsuite-help (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2025/page/798/