# Vulnerabilities published in 2025


- [MAL-2025-191487](https://insights.sbomify.com/MAL-2025-191487/): Malicious code in chain-selectors (npm) (malicious package)
- [MAL-2025-191486](https://insights.sbomify.com/MAL-2025-191486/): Malicious code in vitest-environment-jsdom-patched (npm) (malicious package)
- [MAL-2025-191485](https://insights.sbomify.com/MAL-2025-191485/): Malicious code in x402-legacy (npm) (malicious package)
- [MAL-2025-191484](https://insights.sbomify.com/MAL-2025-191484/): Malicious code in browser-client-neptune (npm) (malicious package)
- [MAL-2025-191483](https://insights.sbomify.com/MAL-2025-191483/): Malicious code in hooktest2 (PyPI) (malicious package)
- [MAL-2025-191482](https://insights.sbomify.com/MAL-2025-191482/): Malicious code in wartsila-application-json (npm) (malicious package)
- [MAL-2025-191481](https://insights.sbomify.com/MAL-2025-191481/): Malicious code in br2s-ui-componentlibrary_r2 (npm) (malicious package)
- [MAL-2025-191480](https://insights.sbomify.com/MAL-2025-191480/): Malicious code in accounts-base (npm) (malicious package)
- [MAL-2025-19148](https://insights.sbomify.com/MAL-2025-19148/): Malicious code in echo-qvl-project (npm) (malicious package)
- [MAL-2025-191479](https://insights.sbomify.com/MAL-2025-191479/): Malicious code in chia-gaming-lobby-connection (npm) (malicious package)
- [MAL-2025-191478](https://insights.sbomify.com/MAL-2025-191478/): Malicious code in bitcoin-lib-js (npm) (malicious package)
- [MAL-2025-191477](https://insights.sbomify.com/MAL-2025-191477/): Malicious code in bitcoin-main-lib (npm) (malicious package)
- [MAL-2025-191476](https://insights.sbomify.com/MAL-2025-191476/): Malicious code in atlassian-praz (PyPI) (malicious package)
- [MAL-2025-191475](https://insights.sbomify.com/MAL-2025-191475/): Malicious code in atlassian-exp (PyPI) (malicious package)
- [MAL-2025-191474](https://insights.sbomify.com/MAL-2025-191474/): Malicious code in vite-dynachunk (npm) (malicious package)
- [MAL-2025-191473](https://insights.sbomify.com/MAL-2025-191473/): Malicious code in chai-jsons (npm) (malicious package)
- [MAL-2025-191472](https://insights.sbomify.com/MAL-2025-191472/): Malicious code in chai-auth (npm) (malicious package)
- [MAL-2025-191471](https://insights.sbomify.com/MAL-2025-191471/): Malicious code in ahmed_salem_t (npm) (malicious package)
- [MAL-2025-191470](https://insights.sbomify.com/MAL-2025-191470/): Malicious code in org.mvnpm:posthog-node (Maven) (malicious package)
- [MAL-2025-19147](https://insights.sbomify.com/MAL-2025-19147/): Malicious code in echo-papa-date-ukijk (npm) (malicious package)
- [MAL-2025-191469](https://insights.sbomify.com/MAL-2025-191469/): Malicious code in bip40 (npm) (malicious package)
- [MAL-2025-191468](https://insights.sbomify.com/MAL-2025-191468/): Malicious code in @lokeswari-satyanarayanan/rn-zustand-expo-template (npm) (malicious package)
- [MAL-2025-191467](https://insights.sbomify.com/MAL-2025-191467/): Malicious code in xrpl-api (npm) (malicious package)
- [MAL-2025-191466](https://insights.sbomify.com/MAL-2025-191466/): Malicious code in rpc-validator (npm) (malicious package)
- [MAL-2025-191465](https://insights.sbomify.com/MAL-2025-191465/): Malicious code in mcp-polymarket (npm) (malicious package)
- [MAL-2025-191464](https://insights.sbomify.com/MAL-2025-191464/): Malicious code in mayhem-wma (npm) (malicious package)
- [MAL-2025-191463](https://insights.sbomify.com/MAL-2025-191463/): Malicious code in initial-path (npm) (malicious package)
- [MAL-2025-191462](https://insights.sbomify.com/MAL-2025-191462/): Malicious code in react-svgs-helper (npm) (malicious package)
- [MAL-2025-191461](https://insights.sbomify.com/MAL-2025-191461/): Malicious code in baidu-src-test3 (npm) (malicious package)
- [MAL-2025-191460](https://insights.sbomify.com/MAL-2025-191460/): Malicious code in baidu-src-test (npm) (malicious package)
- [MAL-2025-19146](https://insights.sbomify.com/MAL-2025-19146/): Malicious code in echo-oscar-elderberry-txlke (npm) (malicious package)
- [MAL-2025-191459](https://insights.sbomify.com/MAL-2025-191459/): Malicious code in @vleo-dev/a11y-js-service (npm) (malicious package)
- [MAL-2025-191458](https://insights.sbomify.com/MAL-2025-191458/): Malicious code in @medusajs/medusa-oas-cli (npm) (malicious package)
- [MAL-2025-191457](https://insights.sbomify.com/MAL-2025-191457/): Malicious code in @medusajs/medusa (npm) (malicious package)
- [MAL-2025-191456](https://insights.sbomify.com/MAL-2025-191456/): Malicious code in @medusajs/analytics-posthog (npm) (malicious package)
- [MAL-2025-191455](https://insights.sbomify.com/MAL-2025-191455/): Malicious code in @kong/spec-renderer (npm) (malicious package)
- [MAL-2025-191454](https://insights.sbomify.com/MAL-2025-191454/): Malicious code in @freeday-ai/webchat (npm) (malicious package)
- [MAL-2025-191453](https://insights.sbomify.com/MAL-2025-191453/): Malicious code in @flowfuse/flowfuse (npm) (malicious package)
- [MAL-2025-191452](https://insights.sbomify.com/MAL-2025-191452/): Malicious code in @eventcatalog/generator-asyncapi (npm) (malicious package)
- [MAL-2025-191451](https://insights.sbomify.com/MAL-2025-191451/): Malicious code in @devx-commerce/plugin-discounts (npm) (malicious package)
- [MAL-2025-191450](https://insights.sbomify.com/MAL-2025-191450/): Malicious code in @axinom/mosaic-cli (npm) (malicious package)
- [MAL-2025-19145](https://insights.sbomify.com/MAL-2025-19145/): Malicious code in echo-ncz-project (npm) (malicious package)
- [MAL-2025-191449](https://insights.sbomify.com/MAL-2025-191449/): Malicious code in @accordproject/markdown-cli (npm) (malicious package)
- [MAL-2025-191448](https://insights.sbomify.com/MAL-2025-191448/): Malicious code in vue-browserupdate-nuxt (npm) (malicious package)
- [MAL-2025-191447](https://insights.sbomify.com/MAL-2025-191447/): Malicious code in vf-oss-template (npm) (malicious package)
- [MAL-2025-191446](https://insights.sbomify.com/MAL-2025-191446/): Malicious code in valuedex-sdk (npm) (malicious package)
- [MAL-2025-191445](https://insights.sbomify.com/MAL-2025-191445/): Malicious code in v-plausible (npm) (malicious package)
- [MAL-2025-191444](https://insights.sbomify.com/MAL-2025-191444/): Malicious code in unsearch (npm) (malicious package)
- [MAL-2025-191443](https://insights.sbomify.com/MAL-2025-191443/): Malicious code in uniswap-test-sdk-core (npm) (malicious package)
- [MAL-2025-191442](https://insights.sbomify.com/MAL-2025-191442/): Malicious code in uniswap-smart-order-router (npm) (malicious package)
- [MAL-2025-191441](https://insights.sbomify.com/MAL-2025-191441/): Malicious code in uniswap-router-sdk (npm) (malicious package)
- [MAL-2025-191440](https://insights.sbomify.com/MAL-2025-191440/): Malicious code in unemail (npm) (malicious package)
- [MAL-2025-19144](https://insights.sbomify.com/MAL-2025-19144/): Malicious code in echo-lemon-watermelon-cjktt (npm) (malicious package)
- [MAL-2025-191439](https://insights.sbomify.com/MAL-2025-191439/): Malicious code in unadapter (npm) (malicious package)
- [MAL-2025-191438](https://insights.sbomify.com/MAL-2025-191438/): Malicious code in typeface-antonio-complete (npm) (malicious package)
- [MAL-2025-191437](https://insights.sbomify.com/MAL-2025-191437/): Malicious code in ts-relay-cursor-paging (npm) (malicious package)
- [MAL-2025-191436](https://insights.sbomify.com/MAL-2025-191436/): Malicious code in toonfetch (npm) (malicious package)
- [MAL-2025-191435](https://insights.sbomify.com/MAL-2025-191435/): Malicious code in tiptap-shadcn-vue (npm) (malicious package)
- [MAL-2025-191434](https://insights.sbomify.com/MAL-2025-191434/): Malicious code in test23112222-api (npm) (malicious package)
- [MAL-2025-191433](https://insights.sbomify.com/MAL-2025-191433/): Malicious code in tcsp (npm) (malicious package)
- [MAL-2025-191432](https://insights.sbomify.com/MAL-2025-191432/): Malicious code in tavily-module (npm) (malicious package)
- [MAL-2025-191431](https://insights.sbomify.com/MAL-2025-191431/): Malicious code in sufetch (npm) (malicious package)
- [MAL-2025-191430](https://insights.sbomify.com/MAL-2025-191430/): Malicious code in soneium-acs (npm) (malicious package)
- [MAL-2025-19143](https://insights.sbomify.com/MAL-2025-19143/): Malicious code in echo-kuiper-fkem (npm) (malicious package)
- [MAL-2025-191429](https://insights.sbomify.com/MAL-2025-191429/): Malicious code in solomon-v3-ui-wrapper (npm) (malicious package)
- [MAL-2025-191428](https://insights.sbomify.com/MAL-2025-191428/): Malicious code in solomon-v3-stories (npm) (malicious package)
- [MAL-2025-191427](https://insights.sbomify.com/MAL-2025-191427/): Malicious code in solomon-api-stories (npm) (malicious package)
- [MAL-2025-191426](https://insights.sbomify.com/MAL-2025-191426/): Malicious code in simplejsonform (npm) (malicious package)
- [MAL-2025-191425](https://insights.sbomify.com/MAL-2025-191425/): Malicious code in silgi (npm) (malicious package)
- [MAL-2025-191424](https://insights.sbomify.com/MAL-2025-191424/): Malicious code in shell-exec (npm) (malicious package)
- [MAL-2025-191423](https://insights.sbomify.com/MAL-2025-191423/): Malicious code in shelf-jwt-sessions (npm) (malicious package)
- [MAL-2025-191422](https://insights.sbomify.com/MAL-2025-191422/): Malicious code in selenium-session-client (npm) (malicious package)
- [MAL-2025-191421](https://insights.sbomify.com/MAL-2025-191421/): Malicious code in selenium-session (npm) (malicious package)
- [MAL-2025-191420](https://insights.sbomify.com/MAL-2025-191420/): Malicious code in schob (npm) (malicious package)
- [MAL-2025-19142](https://insights.sbomify.com/MAL-2025-19142/): Malicious code in echo-kiwi-osoy (npm) (malicious package)
- [MAL-2025-191419](https://insights.sbomify.com/MAL-2025-191419/): Malicious code in samesame (npm) (malicious package)
- [MAL-2025-191418](https://insights.sbomify.com/MAL-2025-191418/): Malicious code in revenuecat (npm) (malicious package)
- [MAL-2025-191417](https://insights.sbomify.com/MAL-2025-191417/): Malicious code in rediff-viewer (npm) (malicious package)
- [MAL-2025-191416](https://insights.sbomify.com/MAL-2025-191416/): Malicious code in rediff (npm) (malicious package)
- [MAL-2025-191415](https://insights.sbomify.com/MAL-2025-191415/): Malicious code in react-scrambled-text (npm) (malicious package)
- [MAL-2025-191414](https://insights.sbomify.com/MAL-2025-191414/): Malicious code in react-packery-component (npm) (malicious package)
- [MAL-2025-191413](https://insights.sbomify.com/MAL-2025-191413/): Malicious code in ra-auth-firebase (npm) (malicious package)
- [MAL-2025-191412](https://insights.sbomify.com/MAL-2025-191412/): Malicious code in quickswap-v2-sdk (npm) (malicious package)
- [MAL-2025-191411](https://insights.sbomify.com/MAL-2025-191411/): Malicious code in quickswap-token-lists (npm) (malicious package)
- [MAL-2025-191410](https://insights.sbomify.com/MAL-2025-191410/): Malicious code in quickswap-smart-order-router (npm) (malicious package)
- [MAL-2025-19141](https://insights.sbomify.com/MAL-2025-19141/): Malicious code in echo-kilo-dxld (npm) (malicious package)
- [MAL-2025-191409](https://insights.sbomify.com/MAL-2025-191409/): Malicious code in quickswap-sdk (npm) (malicious package)
- [MAL-2025-191408](https://insights.sbomify.com/MAL-2025-191408/): Malicious code in quickswap-router-sdk (npm) (malicious package)
- [MAL-2025-191407](https://insights.sbomify.com/MAL-2025-191407/): Malicious code in quickswap-default-token-list (npm) (malicious package)
- [MAL-2025-191406](https://insights.sbomify.com/MAL-2025-191406/): Malicious code in quickswap-default-staking-list-address (npm) (malicious package)
- [MAL-2025-191405](https://insights.sbomify.com/MAL-2025-191405/): Malicious code in quickswap-default-staking-list (npm) (malicious package)
- [MAL-2025-191404](https://insights.sbomify.com/MAL-2025-191404/): Malicious code in quickswap-ads-list (npm) (malicious package)
- [MAL-2025-191403](https://insights.sbomify.com/MAL-2025-191403/): Malicious code in prompt-eng-server (npm) (malicious package)
- [MAL-2025-191402](https://insights.sbomify.com/MAL-2025-191402/): Malicious code in posthog-js (npm) (malicious package)
- [MAL-2025-191401](https://insights.sbomify.com/MAL-2025-191401/): Malicious code in pkg-readme (npm) (malicious package)
- [MAL-2025-191400](https://insights.sbomify.com/MAL-2025-191400/): Malicious code in nuxt-keycloak (npm) (malicious package)
- [MAL-2025-19140](https://insights.sbomify.com/MAL-2025-19140/): Malicious code in echo-jlsqe-4gcp4-zephyr-project (npm) (malicious package)
- [MAL-2025-1914](https://insights.sbomify.com/MAL-2025-1914/): Malicious code in pie-monorepo (npm) (malicious package)
- [MAL-2025-191399](https://insights.sbomify.com/MAL-2025-191399/): Malicious code in n8n-nodes-viral-app (npm) (malicious package)
- [MAL-2025-191398](https://insights.sbomify.com/MAL-2025-191398/): Malicious code in my-saeed-lib (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/916/