# Vulnerabilities published in 2025


- [MAL-2025-192657](https://insights.sbomify.com/MAL-2025-192657/): Malicious code in yt-smm (npm) (malicious package)
- [MAL-2025-192656](https://insights.sbomify.com/MAL-2025-192656/): Malicious code in xvxx (npm) (malicious package)
- [MAL-2025-192655](https://insights.sbomify.com/MAL-2025-192655/): Malicious code in viktorparserctf9 (npm) (malicious package)
- [MAL-2025-192654](https://insights.sbomify.com/MAL-2025-192654/): Malicious code in viktorparserctf8 (npm) (malicious package)
- [MAL-2025-192653](https://insights.sbomify.com/MAL-2025-192653/): Malicious code in viktorparserctf7 (npm) (malicious package)
- [MAL-2025-192652](https://insights.sbomify.com/MAL-2025-192652/): Malicious code in viktorparserctf6 (npm) (malicious package)
- [MAL-2025-192651](https://insights.sbomify.com/MAL-2025-192651/): Malicious code in viktorparserctf5 (npm) (malicious package)
- [MAL-2025-192650](https://insights.sbomify.com/MAL-2025-192650/): Malicious code in viktorparserctf4 (npm) (malicious package)
- [MAL-2025-19265](https://insights.sbomify.com/MAL-2025-19265/): Malicious code in eigenstate-bionics-alphard-hermes (npm) (malicious package)
- [MAL-2025-192649](https://insights.sbomify.com/MAL-2025-192649/): Malicious code in viktorparserctf3 (npm) (malicious package)
- [MAL-2025-192648](https://insights.sbomify.com/MAL-2025-192648/): Malicious code in viktorparserctf2 (npm) (malicious package)
- [MAL-2025-192647](https://insights.sbomify.com/MAL-2025-192647/): Malicious code in viktorparserctf (npm) (malicious package)
- [MAL-2025-192646](https://insights.sbomify.com/MAL-2025-192646/): Malicious code in viktor-xml-parser (npm) (malicious package)
- [MAL-2025-192645](https://insights.sbomify.com/MAL-2025-192645/): Malicious code in vdous (npm) (malicious package)
- [MAL-2025-192644](https://insights.sbomify.com/MAL-2025-192644/): Malicious code in usage-tracker-janus (npm) (malicious package)
- [MAL-2025-192643](https://insights.sbomify.com/MAL-2025-192643/): Malicious code in test-mal-npm-pkg (npm) (malicious package)
- [MAL-2025-192642](https://insights.sbomify.com/MAL-2025-192642/): Malicious code in tailwind-logic (npm) (malicious package)
- [MAL-2025-192641](https://insights.sbomify.com/MAL-2025-192641/): Malicious code in tailwind-color-shine (npm) (malicious package)
- [MAL-2025-192640](https://insights.sbomify.com/MAL-2025-192640/): Malicious code in tailwind-animationbased (npm) (malicious package)
- [MAL-2025-19264](https://insights.sbomify.com/MAL-2025-19264/): Malicious code in ehxjimturwyqnzbk (npm) (malicious package)
- [MAL-2025-192639](https://insights.sbomify.com/MAL-2025-192639/): Malicious code in smm-youtube (npm) (malicious package)
- [MAL-2025-192638](https://insights.sbomify.com/MAL-2025-192638/): Malicious code in qwqwqw (npm) (malicious package)
- [MAL-2025-192637](https://insights.sbomify.com/MAL-2025-192637/): Malicious code in pwnxmljs2 (npm) (malicious package)
- [MAL-2025-192636](https://insights.sbomify.com/MAL-2025-192636/): Malicious code in ppppparserfruit (npm) (malicious package)
- [MAL-2025-192635](https://insights.sbomify.com/MAL-2025-192635/): Malicious code in parashaxmgflhg (npm) (malicious package)
- [MAL-2025-192634](https://insights.sbomify.com/MAL-2025-192634/): Malicious code in okta-mfa-library (npm) (malicious package)
- [MAL-2025-192633](https://insights.sbomify.com/MAL-2025-192633/): Malicious code in hubstyletokens (npm) (malicious package)
- [MAL-2025-192632](https://insights.sbomify.com/MAL-2025-192632/): Malicious code in hubspotter-http (npm) (malicious package)
- [MAL-2025-192631](https://insights.sbomify.com/MAL-2025-192631/): Malicious code in graphlink (npm) (malicious package)
- [MAL-2025-192630](https://insights.sbomify.com/MAL-2025-192630/): Malicious code in foundations-theming-base (npm) (malicious package)
- [MAL-2025-19263](https://insights.sbomify.com/MAL-2025-19263/): Malicious code in ehquvdznyglmrpxb (npm) (malicious package)
- [MAL-2025-192629](https://insights.sbomify.com/MAL-2025-192629/): Malicious code in flagstealerfinal (npm) (malicious package)
- [MAL-2025-192628](https://insights.sbomify.com/MAL-2025-192628/): Malicious code in elf-stats-wintry-chimney-348 (npm) (malicious package)
- [MAL-2025-192627](https://insights.sbomify.com/MAL-2025-192627/): Malicious code in elf-stats-sugarplum-fir-770 (npm) (malicious package)
- [MAL-2025-192626](https://insights.sbomify.com/MAL-2025-192626/): Malicious code in elf-stats-cocoa-workshop-459 (npm) (malicious package)
- [MAL-2025-192625](https://insights.sbomify.com/MAL-2025-192625/): Malicious code in cursorparserfruit (npm) (malicious package)
- [MAL-2025-192624](https://insights.sbomify.com/MAL-2025-192624/): Malicious code in chai-nerd (npm) (malicious package)
- [MAL-2025-192623](https://insights.sbomify.com/MAL-2025-192623/): Malicious code in chai-async (npm) (malicious package)
- [MAL-2025-192622](https://insights.sbomify.com/MAL-2025-192622/): Malicious code in chai-as-awaited (npm) (malicious package)
- [MAL-2025-192621](https://insights.sbomify.com/MAL-2025-192621/): Malicious code in azaza (npm) (malicious package)
- [MAL-2025-192620](https://insights.sbomify.com/MAL-2025-192620/): Malicious code in android_teminator_x (npm) (malicious package)
- [MAL-2025-19262](https://insights.sbomify.com/MAL-2025-19262/): Malicious code in ehouse (npm) (malicious package)
- [MAL-2025-192619](https://insights.sbomify.com/MAL-2025-192619/): Malicious code in adk-github (npm) (malicious package)
- [MAL-2025-192618](https://insights.sbomify.com/MAL-2025-192618/): Malicious code in adk-cli (npm) (malicious package)
- [MAL-2025-192617](https://insights.sbomify.com/MAL-2025-192617/): Malicious code in @xyuxu/i18never (npm) (malicious package)
- [MAL-2025-192616](https://insights.sbomify.com/MAL-2025-192616/): Malicious code in @pluxee-design-system/core (npm) (malicious package)
- [MAL-2025-192615](https://insights.sbomify.com/MAL-2025-192615/): Malicious code in tnactgfds (npm) (malicious package)
- [MAL-2025-192614](https://insights.sbomify.com/MAL-2025-192614/): Malicious code in react-enhanced-glow (npm) (malicious package)
- [MAL-2025-192613](https://insights.sbomify.com/MAL-2025-192613/): Malicious code in my-ctf-package (npm) (malicious package)
- [MAL-2025-192612](https://insights.sbomify.com/MAL-2025-192612/): Malicious code in ctfxmlflgcheck (npm) (malicious package)
- [MAL-2025-192611](https://insights.sbomify.com/MAL-2025-192611/): Malicious code in ctfparsertna (npm) (malicious package)
- [MAL-2025-192610](https://insights.sbomify.com/MAL-2025-192610/): Malicious code in ctfepakageflgs (npm) (malicious package)
- [MAL-2025-19261](https://insights.sbomify.com/MAL-2025-19261/): Malicious code in eh-fiddle (npm) (malicious package)
- [MAL-2025-192609](https://insights.sbomify.com/MAL-2025-192609/): Malicious code in f5rest (PyPI) (malicious package)
- [MAL-2025-192608](https://insights.sbomify.com/MAL-2025-192608/): Malicious code in f5-logger (PyPI) (malicious package)
- [MAL-2025-192607](https://insights.sbomify.com/MAL-2025-192607/): Malicious code in bigip (PyPI) (malicious package)
- [MAL-2025-192606](https://insights.sbomify.com/MAL-2025-192606/): Malicious code in sarumaan_a (npm) (malicious package)
- [MAL-2025-192605](https://insights.sbomify.com/MAL-2025-192605/): Malicious code in trondec (PyPI) (malicious package)
- [MAL-2025-192604](https://insights.sbomify.com/MAL-2025-192604/): Malicious code in xbox-bottomnav (npm) (malicious package)
- [MAL-2025-192603](https://insights.sbomify.com/MAL-2025-192603/): Malicious code in vitor-js (npm) (malicious package)
- [MAL-2025-192602](https://insights.sbomify.com/MAL-2025-192602/): Malicious code in plugin-senna (npm) (malicious package)
- [MAL-2025-192601](https://insights.sbomify.com/MAL-2025-192601/): Malicious code in vscode-azure-mcp-server (npm) (malicious package)
- [MAL-2025-192600](https://insights.sbomify.com/MAL-2025-192600/): Malicious code in tailwind-variables (npm) (malicious package)
- [MAL-2025-19260](https://insights.sbomify.com/MAL-2025-19260/): Malicious code in egudkjkpcrwhlfvy (npm) (malicious package)
- [MAL-2025-1926](https://insights.sbomify.com/MAL-2025-1926/): Malicious code in sdk-coin-cspr (npm) (malicious package)
- [MAL-2025-192599](https://insights.sbomify.com/MAL-2025-192599/): Malicious code in tailwind-stylecss (npm) (malicious package)
- [MAL-2025-192598](https://insights.sbomify.com/MAL-2025-192598/): Malicious code in bigmathlib (npm) (malicious package)
- [MAL-2025-192597](https://insights.sbomify.com/MAL-2025-192597/): Malicious code in raven-hubspot (npm) (malicious package)
- [MAL-2025-192596](https://insights.sbomify.com/MAL-2025-192596/): Malicious code in starling-api (npm) (malicious package)
- [MAL-2025-192595](https://insights.sbomify.com/MAL-2025-192595/): Malicious code in smart-utils-alice (npm) (malicious package)
- [MAL-2025-192594](https://insights.sbomify.com/MAL-2025-192594/): Malicious code in prod-natwest (npm) (malicious package)
- [MAL-2025-192593](https://insights.sbomify.com/MAL-2025-192593/): Malicious code in openhands-frontend (npm) (malicious package)
- [MAL-2025-192592](https://insights.sbomify.com/MAL-2025-192592/): Malicious code in nad-home (npm) (malicious package)
- [MAL-2025-192591](https://insights.sbomify.com/MAL-2025-192591/): Malicious code in i18never (npm) (malicious package)
- [MAL-2025-192590](https://insights.sbomify.com/MAL-2025-192590/): Malicious code in example-vue2-micro (npm) (malicious package)
- [MAL-2025-19259](https://insights.sbomify.com/MAL-2025-19259/): Malicious code in egrader (npm) (malicious package)
- [MAL-2025-192589](https://insights.sbomify.com/MAL-2025-192589/): Malicious code in elf-stats-nutmeg-sleigh-350 (npm) (malicious package)
- [MAL-2025-192588](https://insights.sbomify.com/MAL-2025-192588/): Malicious code in elf-stats-fuzzy-wreath-278 (npm) (malicious package)
- [MAL-2025-192587](https://insights.sbomify.com/MAL-2025-192587/): Malicious code in elf-stats-aurora-cocoa-911 (npm) (malicious package)
- [MAL-2025-192586](https://insights.sbomify.com/MAL-2025-192586/): Malicious code in dubbo-js-private-workspace (npm) (malicious package)
- [MAL-2025-192585](https://insights.sbomify.com/MAL-2025-192585/): Malicious code in betterjsloggin (npm) (malicious package)
- [MAL-2025-192584](https://insights.sbomify.com/MAL-2025-192584/): Malicious code in jsondatatoruby (npm) (malicious package)
- [MAL-2025-192583](https://insights.sbomify.com/MAL-2025-192583/): Malicious code in swissid-common (npm) (malicious package)
- [MAL-2025-192582](https://insights.sbomify.com/MAL-2025-192582/): Malicious code in sds-swissid-common (npm) (malicious package)
- [MAL-2025-192581](https://insights.sbomify.com/MAL-2025-192581/): Malicious code in sds-oauth-client (npm) (malicious package)
- [MAL-2025-192580](https://insights.sbomify.com/MAL-2025-192580/): Malicious code in sds-auth-ui (npm) (malicious package)
- [MAL-2025-19258](https://insights.sbomify.com/MAL-2025-19258/): Malicious code in egov-pep-frontend (npm) (malicious package)
- [MAL-2025-192579](https://insights.sbomify.com/MAL-2025-192579/): Malicious code in smtblib (PyPI) (malicious package)
- [MAL-2025-192578](https://insights.sbomify.com/MAL-2025-192578/): Malicious code in xboxlive-auth (npm) (malicious package)
- [MAL-2025-192577](https://insights.sbomify.com/MAL-2025-192577/): Malicious code in sd-skbms (npm) (malicious package)
- [MAL-2025-192576](https://insights.sbomify.com/MAL-2025-192576/): Malicious code in sd-security (npm) (malicious package)
- [MAL-2025-192575](https://insights.sbomify.com/MAL-2025-192575/): Malicious code in polygon-src (npm) (malicious package)
- [MAL-2025-192574](https://insights.sbomify.com/MAL-2025-192574/): Malicious code in bignumex (npm) (malicious package)
- [MAL-2025-192573](https://insights.sbomify.com/MAL-2025-192573/): Malicious code in @revvity-signals/chemdraw-js (npm) (malicious package)
- [MAL-2025-192572](https://insights.sbomify.com/MAL-2025-192572/): Malicious code in phx-core (npm) (malicious package)
- [MAL-2025-192571](https://insights.sbomify.com/MAL-2025-192571/): Malicious code in paypal-scripts-server-utils (npm) (malicious package)
- [MAL-2025-192570](https://insights.sbomify.com/MAL-2025-192570/): Malicious code in @mohamed1687/iut-encrypt (npm) (malicious package)
- [MAL-2025-19257](https://insights.sbomify.com/MAL-2025-19257/): Malicious code in egnxaqfzbjhdlvkp (npm) (malicious package)
- [MAL-2025-192569](https://insights.sbomify.com/MAL-2025-192569/): Malicious code in @ikarem/telemetry (npm) (malicious package)
- [MAL-2025-192568](https://insights.sbomify.com/MAL-2025-192568/): Malicious code in EffetMer.darkgpt (VSCode) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/903/