# Vulnerabilities published in 2025


- [MAL-2025-192477](https://insights.sbomify.com/MAL-2025-192477/): Malicious code in elf-stats-candystriped-star-592 (npm) (malicious package)
- [MAL-2025-192476](https://insights.sbomify.com/MAL-2025-192476/): Malicious code in elf-stats-candystriped-muffin-773 (npm) (malicious package)
- [MAL-2025-192475](https://insights.sbomify.com/MAL-2025-192475/): Malicious code in elf-stats-candystriped-cookiejar-799 (npm) (malicious package)
- [MAL-2025-192474](https://insights.sbomify.com/MAL-2025-192474/): Malicious code in elf-stats-candystriped-bauble-740 (npm) (malicious package)
- [MAL-2025-192473](https://insights.sbomify.com/MAL-2025-192473/): Malicious code in elf-stats-candlelit-train-228 (npm) (malicious package)
- [MAL-2025-192472](https://insights.sbomify.com/MAL-2025-192472/): Malicious code in elf-stats-candlelit-nutcracker-184 (npm) (malicious package)
- [MAL-2025-192471](https://insights.sbomify.com/MAL-2025-192471/): Malicious code in elf-stats-aurora-sparkler-752 (npm) (malicious package)
- [MAL-2025-192470](https://insights.sbomify.com/MAL-2025-192470/): Malicious code in elf-stats-aurora-sleigh-694 (npm) (malicious package)
- [MAL-2025-19247](https://insights.sbomify.com/MAL-2025-19247/): Malicious code in eggcoin (npm) (malicious package)
- [MAL-2025-192469](https://insights.sbomify.com/MAL-2025-192469/): Malicious code in elf-stats (npm) (malicious package)
- [MAL-2025-192468](https://insights.sbomify.com/MAL-2025-192468/): Malicious code in yzip (PyPI) (malicious package)
- [MAL-2025-192467](https://insights.sbomify.com/MAL-2025-192467/): Malicious code in gxzip (PyPI) (malicious package)
- [MAL-2025-192466](https://insights.sbomify.com/MAL-2025-192466/): Malicious code in tnaxmlparserctf (npm) (malicious package)
- [MAL-2025-192465](https://insights.sbomify.com/MAL-2025-192465/): Malicious code in tnaparserxml (npm) (malicious package)
- [MAL-2025-192464](https://insights.sbomify.com/MAL-2025-192464/): Malicious code in ofjaaah12 (npm) (malicious package)
- [MAL-2025-192463](https://insights.sbomify.com/MAL-2025-192463/): Malicious code in libxmlussr (npm) (malicious package)
- [MAL-2025-192462](https://insights.sbomify.com/MAL-2025-192462/): Malicious code in libxmlpupupu (npm) (malicious package)
- [MAL-2025-192461](https://insights.sbomify.com/MAL-2025-192461/): Malicious code in libxmljsololos (npm) (malicious package)
- [MAL-2025-192460](https://insights.sbomify.com/MAL-2025-192460/): Malicious code in libxmljsololo4 (npm) (malicious package)
- [MAL-2025-19246](https://insights.sbomify.com/MAL-2025-19246/): Malicious code in egg-plugin-knex (npm) (malicious package)
- [MAL-2025-192459](https://insights.sbomify.com/MAL-2025-192459/): Malicious code in libxmljsololo3 (npm) (malicious package)
- [MAL-2025-192458](https://insights.sbomify.com/MAL-2025-192458/): Malicious code in libxmljsololo (npm) (malicious package)
- [MAL-2025-192457](https://insights.sbomify.com/MAL-2025-192457/): Malicious code in libxmljs2var234 (npm) (malicious package)
- [MAL-2025-192456](https://insights.sbomify.com/MAL-2025-192456/): Malicious code in libxmljs10 (npm) (malicious package)
- [MAL-2025-192455](https://insights.sbomify.com/MAL-2025-192455/): Malicious code in libxmlhere (npm) (malicious package)
- [MAL-2025-192454](https://insights.sbomify.com/MAL-2025-192454/): Malicious code in libxmlfinal5 (npm) (malicious package)
- [MAL-2025-192453](https://insights.sbomify.com/MAL-2025-192453/): Malicious code in libxmlfinal4 (npm) (malicious package)
- [MAL-2025-192452](https://insights.sbomify.com/MAL-2025-192452/): Malicious code in libxmlfinal3 (npm) (malicious package)
- [MAL-2025-192451](https://insights.sbomify.com/MAL-2025-192451/): Malicious code in libxmlfinal (npm) (malicious package)
- [MAL-2025-192450](https://insights.sbomify.com/MAL-2025-192450/): Malicious code in fadafas3 (npm) (malicious package)
- [MAL-2025-19245](https://insights.sbomify.com/MAL-2025-19245/): Malicious code in egg-arbitrary (npm) (malicious package)
- [MAL-2025-192449](https://insights.sbomify.com/MAL-2025-192449/): Malicious code in elf-stats-sugarplum-mitten-141 (npm) (malicious package)
- [MAL-2025-192448](https://insights.sbomify.com/MAL-2025-192448/): Malicious code in elf-stats-sparkly-snowglobe-243 (npm) (malicious package)
- [MAL-2025-192447](https://insights.sbomify.com/MAL-2025-192447/): Malicious code in elf-stats-snowy-toolkit-186 (npm) (malicious package)
- [MAL-2025-192446](https://insights.sbomify.com/MAL-2025-192446/): Malicious code in elf-stats-silvered-wishlist-243 (npm) (malicious package)
- [MAL-2025-192445](https://insights.sbomify.com/MAL-2025-192445/): Malicious code in elf-stats-silvered-mailbag-755 (npm) (malicious package)
- [MAL-2025-192444](https://insights.sbomify.com/MAL-2025-192444/): Malicious code in elf-stats-merry-icicle-449 (npm) (malicious package)
- [MAL-2025-192443](https://insights.sbomify.com/MAL-2025-192443/): Malicious code in elf-stats-jolly-hammer-980 (npm) (malicious package)
- [MAL-2025-192442](https://insights.sbomify.com/MAL-2025-192442/): Malicious code in elf-stats-ember-stockpile-448 (npm) (malicious package)
- [MAL-2025-192441](https://insights.sbomify.com/MAL-2025-192441/): Malicious code in elf-stats-cosy-garland-592 (npm) (malicious package)
- [MAL-2025-192440](https://insights.sbomify.com/MAL-2025-192440/): Malicious code in elf-stats-candystriped-snowglobe-426 (npm) (malicious package)
- [MAL-2025-19244](https://insights.sbomify.com/MAL-2025-19244/): Malicious code in eganglia (npm) (malicious package)
- [MAL-2025-192439](https://insights.sbomify.com/MAL-2025-192439/): Malicious code in asdfgh3 (npm) (malicious package)
- [MAL-2025-192438](https://insights.sbomify.com/MAL-2025-192438/): Malicious code in synium (PyPI) (malicious package)
- [MAL-2025-192437](https://insights.sbomify.com/MAL-2025-192437/): Malicious code in netbenchkit (PyPI) (malicious package)
- [MAL-2025-192436](https://insights.sbomify.com/MAL-2025-192436/): Malicious code in jsonschema-utf8 (PyPI) (malicious package)
- [MAL-2025-192435](https://insights.sbomify.com/MAL-2025-192435/): Malicious code in loguru-utf8 (PyPI) (malicious package)
- [MAL-2025-192434](https://insights.sbomify.com/MAL-2025-192434/): Malicious code in @cheqplease/structured-logger (npm) (malicious package)
- [MAL-2025-192433](https://insights.sbomify.com/MAL-2025-192433/): Malicious code in mws-common-ui (npm) (malicious package)
- [MAL-2025-192432](https://insights.sbomify.com/MAL-2025-192432/): Malicious code in kzip (PyPI) (malicious package)
- [MAL-2025-192431](https://insights.sbomify.com/MAL-2025-192431/): Malicious code in ctosec-appsec-wb-xray-adapters (PyPI) (malicious package)
- [MAL-2025-192430](https://insights.sbomify.com/MAL-2025-192430/): Malicious code in bigpyx (PyPI) (malicious package)
- [MAL-2025-19243](https://insights.sbomify.com/MAL-2025-19243/): Malicious code in eflectron (npm) (malicious package)
- [MAL-2025-192429](https://insights.sbomify.com/MAL-2025-192429/): Malicious code in yunxohang3 (npm) (malicious package)
- [MAL-2025-192428](https://insights.sbomify.com/MAL-2025-192428/): Malicious code in yunxoahng2 (npm) (malicious package)
- [MAL-2025-192427](https://insights.sbomify.com/MAL-2025-192427/): Malicious code in libxmlussr1 (npm) (malicious package)
- [MAL-2025-192426](https://insights.sbomify.com/MAL-2025-192426/): Malicious code in libxmljsololo2 (npm) (malicious package)
- [MAL-2025-192425](https://insights.sbomify.com/MAL-2025-192425/): Malicious code in libxmlfinal2 (npm) (malicious package)
- [MAL-2025-192424](https://insights.sbomify.com/MAL-2025-192424/): Malicious code in baidu-oscp (npm) (malicious package)
- [MAL-2025-192423](https://insights.sbomify.com/MAL-2025-192423/): Malicious code in vue2-amis-custom-widget-pro (npm) (malicious package)
- [MAL-2025-192422](https://insights.sbomify.com/MAL-2025-192422/): Malicious code in real-time-tweet-streamer (npm) (malicious package)
- [MAL-2025-192421](https://insights.sbomify.com/MAL-2025-192421/): Malicious code in vue2-amis-custom-widget123 (npm) (malicious package)
- [MAL-2025-192420](https://insights.sbomify.com/MAL-2025-192420/): Malicious code in near-fast-auth-signer (npm) (malicious package)
- [MAL-2025-19242](https://insights.sbomify.com/MAL-2025-19242/): Malicious code in efidiario (npm) (malicious package)
- [MAL-2025-192419](https://insights.sbomify.com/MAL-2025-192419/): Malicious code in wasm-bindgen (npm) (malicious package)
- [MAL-2025-192418](https://insights.sbomify.com/MAL-2025-192418/): Malicious code in sfdc-abstract-legend (npm) (malicious package)
- [MAL-2025-192417](https://insights.sbomify.com/MAL-2025-192417/): Malicious code in rum-events-format (npm) (malicious package)
- [MAL-2025-192416](https://insights.sbomify.com/MAL-2025-192416/): Malicious code in pymongo (npm) (malicious package)
- [MAL-2025-192415](https://insights.sbomify.com/MAL-2025-192415/): Malicious code in portal-lim (npm) (malicious package)
- [MAL-2025-192414](https://insights.sbomify.com/MAL-2025-192414/): Malicious code in mongo-decimal (npm) (malicious package)
- [MAL-2025-192413](https://insights.sbomify.com/MAL-2025-192413/): Malicious code in modules-runtime (npm) (malicious package)
- [MAL-2025-192412](https://insights.sbomify.com/MAL-2025-192412/): Malicious code in meteor-developer-oauth (npm) (malicious package)
- [MAL-2025-192411](https://insights.sbomify.com/MAL-2025-192411/): Malicious code in fastavro (npm) (malicious package)
- [MAL-2025-192410](https://insights.sbomify.com/MAL-2025-192410/): Malicious code in facts-base (npm) (malicious package)
- [MAL-2025-19241](https://insights.sbomify.com/MAL-2025-19241/): Malicious code in eficsi (npm) (malicious package)
- [MAL-2025-192409](https://insights.sbomify.com/MAL-2025-192409/): Malicious code in ecmascript-runtime-client (npm) (malicious package)
- [MAL-2025-192408](https://insights.sbomify.com/MAL-2025-192408/): Malicious code in ddp-common (npm) (malicious package)
- [MAL-2025-192407](https://insights.sbomify.com/MAL-2025-192407/): Malicious code in datadog-checks-downloader (npm) (malicious package)
- [MAL-2025-192406](https://insights.sbomify.com/MAL-2025-192406/): Malicious code in datadog-checks-dependency-provider (npm) (malicious package)
- [MAL-2025-192405](https://insights.sbomify.com/MAL-2025-192405/): Malicious code in confluent-kafka (npm) (malicious package)
- [MAL-2025-192404](https://insights.sbomify.com/MAL-2025-192404/): Malicious code in callback-hook (npm) (malicious package)
- [MAL-2025-192403](https://insights.sbomify.com/MAL-2025-192403/): Malicious code in allow-deny (npm) (malicious package)
- [MAL-2025-192402](https://insights.sbomify.com/MAL-2025-192402/): Malicious code in wartsila-text-csv (npm) (malicious package)
- [MAL-2025-192401](https://insights.sbomify.com/MAL-2025-192401/): Malicious code in serval-integrations-common-frontend (npm) (malicious package)
- [MAL-2025-192400](https://insights.sbomify.com/MAL-2025-192400/): Malicious code in node-calculator-0d96 (npm) (malicious package)
- [MAL-2025-19240](https://insights.sbomify.com/MAL-2025-19240/): Malicious code in efficiant (npm) (malicious package)
- [MAL-2025-1924](https://insights.sbomify.com/MAL-2025-1924/): Malicious code in sdk-coin-btg (npm) (malicious package)
- [MAL-2025-192399](https://insights.sbomify.com/MAL-2025-192399/): Malicious code in malicius-pdf (npm) (malicious package)
- [MAL-2025-192398](https://insights.sbomify.com/MAL-2025-192398/): Malicious code in database-mongoose-kit (npm) (malicious package)
- [MAL-2025-192397](https://insights.sbomify.com/MAL-2025-192397/): Malicious code in @onlytoodles/crypto-jsa (npm) (malicious package)
- [MAL-2025-192396](https://insights.sbomify.com/MAL-2025-192396/): Malicious code in helloharry123c (PyPI) (malicious package)
- [MAL-2025-192395](https://insights.sbomify.com/MAL-2025-192395/): Malicious code in libxmlrussia (npm) (malicious package)
- [MAL-2025-192394](https://insights.sbomify.com/MAL-2025-192394/): Malicious code in libxmlussr2 (npm) (malicious package)
- [MAL-2025-192393](https://insights.sbomify.com/MAL-2025-192393/): Malicious code in ctosec-appsec-wb-xray-adapter (PyPI) (malicious package)
- [MAL-2025-192392](https://insights.sbomify.com/MAL-2025-192392/): Malicious code in ajenti-plugin-testing-pyld (PyPI) (malicious package)
- [MAL-2025-192391](https://insights.sbomify.com/MAL-2025-192391/): Malicious code in bignum (PyPI) (malicious package)
- [MAL-2025-192390](https://insights.sbomify.com/MAL-2025-192390/): Malicious code in libxmljs2woter (npm) (malicious package)
- [MAL-2025-19239](https://insights.sbomify.com/MAL-2025-19239/): Malicious code in efctqraxspudovmk (npm) (malicious package)
- [MAL-2025-192389](https://insights.sbomify.com/MAL-2025-192389/): Malicious code in libxmljs2qwerty (npm) (malicious package)
- [MAL-2025-192388](https://insights.sbomify.com/MAL-2025-192388/): Malicious code in libxmljs2varaboba (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/905/