# Vulnerabilities published in 2025


- [MAL-2025-191397](https://insights.sbomify.com/MAL-2025-191397/): Malicious code in hyper-fullfacing (npm) (malicious package)
- [MAL-2025-191396](https://insights.sbomify.com/MAL-2025-191396/): Malicious code in gatsby-plugin-antd (npm) (malicious package)
- [MAL-2025-191395](https://insights.sbomify.com/MAL-2025-191395/): Malicious code in eslint-config-kinvey-flex-service (npm) (malicious package)
- [MAL-2025-191394](https://insights.sbomify.com/MAL-2025-191394/): Malicious code in drop-events-on-property-plugin (npm) (malicious package)
- [MAL-2025-191393](https://insights.sbomify.com/MAL-2025-191393/): Malicious code in dialogflow-es (npm) (malicious package)
- [MAL-2025-191392](https://insights.sbomify.com/MAL-2025-191392/): Malicious code in create-silgi (npm) (malicious package)
- [MAL-2025-191391](https://insights.sbomify.com/MAL-2025-191391/): Malicious code in command-irail (npm) (malicious package)
- [MAL-2025-191390](https://insights.sbomify.com/MAL-2025-191390/): Malicious code in ceviz (npm) (malicious package)
- [MAL-2025-19139](https://insights.sbomify.com/MAL-2025-19139/): Malicious code in echo-j04-project (npm) (malicious package)
- [MAL-2025-191389](https://insights.sbomify.com/MAL-2025-191389/): Malicious code in axios-cancelable (npm) (malicious package)
- [MAL-2025-191388](https://insights.sbomify.com/MAL-2025-191388/): Malicious code in @vucod/email (npm) (malicious package)
- [MAL-2025-191387](https://insights.sbomify.com/MAL-2025-191387/): Malicious code in @voiceflow/widget (npm) (malicious package)
- [MAL-2025-191386](https://insights.sbomify.com/MAL-2025-191386/): Malicious code in @voiceflow/voiceflow-types (npm) (malicious package)
- [MAL-2025-191385](https://insights.sbomify.com/MAL-2025-191385/): Malicious code in @voiceflow/voice-types (npm) (malicious package)
- [MAL-2025-191384](https://insights.sbomify.com/MAL-2025-191384/): Malicious code in @voiceflow/vitest-config (npm) (malicious package)
- [MAL-2025-191383](https://insights.sbomify.com/MAL-2025-191383/): Malicious code in @voiceflow/vite-config (npm) (malicious package)
- [MAL-2025-191382](https://insights.sbomify.com/MAL-2025-191382/): Malicious code in @voiceflow/verror (npm) (malicious package)
- [MAL-2025-191381](https://insights.sbomify.com/MAL-2025-191381/): Malicious code in @voiceflow/utils-designer (npm) (malicious package)
- [MAL-2025-191380](https://insights.sbomify.com/MAL-2025-191380/): Malicious code in @voiceflow/tsconfig-paths (npm) (malicious package)
- [MAL-2025-19138](https://insights.sbomify.com/MAL-2025-19138/): Malicious code in echo-india-vxtq (npm) (malicious package)
- [MAL-2025-191379](https://insights.sbomify.com/MAL-2025-191379/): Malicious code in @voiceflow/tsconfig (npm) (malicious package)
- [MAL-2025-191378](https://insights.sbomify.com/MAL-2025-191378/): Malicious code in @voiceflow/test-common (npm) (malicious package)
- [MAL-2025-191377](https://insights.sbomify.com/MAL-2025-191377/): Malicious code in @voiceflow/stylelint-config (npm) (malicious package)
- [MAL-2025-191376](https://insights.sbomify.com/MAL-2025-191376/): Malicious code in @voiceflow/storybook-config (npm) (malicious package)
- [MAL-2025-191375](https://insights.sbomify.com/MAL-2025-191375/): Malicious code in @voiceflow/stitches-react (npm) (malicious package)
- [MAL-2025-191374](https://insights.sbomify.com/MAL-2025-191374/): Malicious code in @voiceflow/slate-serializer (npm) (malicious package)
- [MAL-2025-191373](https://insights.sbomify.com/MAL-2025-191373/): Malicious code in @voiceflow/serverless-plugin-typescript (npm) (malicious package)
- [MAL-2025-191372](https://insights.sbomify.com/MAL-2025-191372/): Malicious code in @voiceflow/semantic-release-config (npm) (malicious package)
- [MAL-2025-191371](https://insights.sbomify.com/MAL-2025-191371/): Malicious code in @voiceflow/secrets-provider (npm) (malicious package)
- [MAL-2025-191370](https://insights.sbomify.com/MAL-2025-191370/): Malicious code in @voiceflow/sdk-runtime (npm) (malicious package)
- [MAL-2025-19137](https://insights.sbomify.com/MAL-2025-19137/): Malicious code in echo-ie1q3-6r82o-bison-project (npm) (malicious package)
- [MAL-2025-191369](https://insights.sbomify.com/MAL-2025-191369/): Malicious code in @voiceflow/runtime-client-js (npm) (malicious package)
- [MAL-2025-191368](https://insights.sbomify.com/MAL-2025-191368/): Malicious code in @voiceflow/runtime (npm) (malicious package)
- [MAL-2025-191367](https://insights.sbomify.com/MAL-2025-191367/): Malicious code in @voiceflow/react-chat (npm) (malicious package)
- [MAL-2025-191366](https://insights.sbomify.com/MAL-2025-191366/): Malicious code in @voiceflow/prettier-config (npm) (malicious package)
- [MAL-2025-191365](https://insights.sbomify.com/MAL-2025-191365/): Malicious code in @voiceflow/pino-pretty (npm) (malicious package)
- [MAL-2025-191364](https://insights.sbomify.com/MAL-2025-191364/): Malicious code in @voiceflow/pino (npm) (malicious package)
- [MAL-2025-191363](https://insights.sbomify.com/MAL-2025-191363/): Malicious code in @voiceflow/openai (npm) (malicious package)
- [MAL-2025-191362](https://insights.sbomify.com/MAL-2025-191362/): Malicious code in @voiceflow/npm-package-json-lint-config (npm) (malicious package)
- [MAL-2025-191361](https://insights.sbomify.com/MAL-2025-191361/): Malicious code in @voiceflow/nestjs-timeout (npm) (malicious package)
- [MAL-2025-191360](https://insights.sbomify.com/MAL-2025-191360/): Malicious code in @voiceflow/nestjs-redis (npm) (malicious package)
- [MAL-2025-19136](https://insights.sbomify.com/MAL-2025-19136/): Malicious code in echo-hxz-project (npm) (malicious package)
- [MAL-2025-191359](https://insights.sbomify.com/MAL-2025-191359/): Malicious code in @voiceflow/nestjs-rate-limit (npm) (malicious package)
- [MAL-2025-191358](https://insights.sbomify.com/MAL-2025-191358/): Malicious code in @voiceflow/nestjs-mongodb (npm) (malicious package)
- [MAL-2025-191357](https://insights.sbomify.com/MAL-2025-191357/): Malicious code in @voiceflow/nestjs-common (npm) (malicious package)
- [MAL-2025-191356](https://insights.sbomify.com/MAL-2025-191356/): Malicious code in @voiceflow/natural-language-commander (npm) (malicious package)
- [MAL-2025-191355](https://insights.sbomify.com/MAL-2025-191355/): Malicious code in @voiceflow/metrics (npm) (malicious package)
- [MAL-2025-191354](https://insights.sbomify.com/MAL-2025-191354/): Malicious code in @voiceflow/logger (npm) (malicious package)
- [MAL-2025-191353](https://insights.sbomify.com/MAL-2025-191353/): Malicious code in @voiceflow/husky-config (npm) (malicious package)
- [MAL-2025-191352](https://insights.sbomify.com/MAL-2025-191352/): Malicious code in @voiceflow/google-types (npm) (malicious package)
- [MAL-2025-191351](https://insights.sbomify.com/MAL-2025-191351/): Malicious code in @voiceflow/google-dfes-types (npm) (malicious package)
- [MAL-2025-191350](https://insights.sbomify.com/MAL-2025-191350/): Malicious code in @voiceflow/git-branch-check (npm) (malicious package)
- [MAL-2025-19135](https://insights.sbomify.com/MAL-2025-19135/): Malicious code in echo-hotel-quue (npm) (malicious package)
- [MAL-2025-191349](https://insights.sbomify.com/MAL-2025-191349/): Malicious code in @voiceflow/general-types (npm) (malicious package)
- [MAL-2025-191348](https://insights.sbomify.com/MAL-2025-191348/): Malicious code in @voiceflow/fetch (npm) (malicious package)
- [MAL-2025-191347](https://insights.sbomify.com/MAL-2025-191347/): Malicious code in @voiceflow/exception (npm) (malicious package)
- [MAL-2025-191346](https://insights.sbomify.com/MAL-2025-191346/): Malicious code in @voiceflow/eslint-plugin (npm) (malicious package)
- [MAL-2025-191345](https://insights.sbomify.com/MAL-2025-191345/): Malicious code in @voiceflow/eslint-config (npm) (malicious package)
- [MAL-2025-191344](https://insights.sbomify.com/MAL-2025-191344/): Malicious code in @voiceflow/encryption (npm) (malicious package)
- [MAL-2025-191343](https://insights.sbomify.com/MAL-2025-191343/): Malicious code in @voiceflow/dtos-interact (npm) (malicious package)
- [MAL-2025-191342](https://insights.sbomify.com/MAL-2025-191342/): Malicious code in @voiceflow/dependency-cruiser-config (npm) (malicious package)
- [MAL-2025-191341](https://insights.sbomify.com/MAL-2025-191341/): Malicious code in @voiceflow/default-prompt-wrappers (npm) (malicious package)
- [MAL-2025-191340](https://insights.sbomify.com/MAL-2025-191340/): Malicious code in @voiceflow/common (npm) (malicious package)
- [MAL-2025-19134](https://insights.sbomify.com/MAL-2025-19134/): Malicious code in echo-grape-lima-peoin (npm) (malicious package)
- [MAL-2025-191339](https://insights.sbomify.com/MAL-2025-191339/): Malicious code in @voiceflow/commitlint-config (npm) (malicious package)
- [MAL-2025-191338](https://insights.sbomify.com/MAL-2025-191338/): Malicious code in @voiceflow/circleci-config-sdk-orb-import (npm) (malicious package)
- [MAL-2025-191337](https://insights.sbomify.com/MAL-2025-191337/): Malicious code in @voiceflow/chat-types (npm) (malicious package)
- [MAL-2025-191336](https://insights.sbomify.com/MAL-2025-191336/): Malicious code in @voiceflow/body-parser (npm) (malicious package)
- [MAL-2025-191335](https://insights.sbomify.com/MAL-2025-191335/): Malicious code in @voiceflow/base-types (npm) (malicious package)
- [MAL-2025-191334](https://insights.sbomify.com/MAL-2025-191334/): Malicious code in @voiceflow/backend-utils (npm) (malicious package)
- [MAL-2025-191333](https://insights.sbomify.com/MAL-2025-191333/): Malicious code in @voiceflow/api-sdk (npm) (malicious package)
- [MAL-2025-191332](https://insights.sbomify.com/MAL-2025-191332/): Malicious code in @voiceflow/anthropic (npm) (malicious package)
- [MAL-2025-191331](https://insights.sbomify.com/MAL-2025-191331/): Malicious code in @voiceflow/alexa-types (npm) (malicious package)
- [MAL-2025-191330](https://insights.sbomify.com/MAL-2025-191330/): Malicious code in @vishadtyagi/full-year-calendar (npm) (malicious package)
- [MAL-2025-19133](https://insights.sbomify.com/MAL-2025-19133/): Malicious code in echo-g1l-project (npm) (malicious package)
- [MAL-2025-191329](https://insights.sbomify.com/MAL-2025-191329/): Malicious code in @viapip/eslint-config (npm) (malicious package)
- [MAL-2025-191328](https://insights.sbomify.com/MAL-2025-191328/): Malicious code in @trpc-rate-limiter/hono (npm) (malicious package)
- [MAL-2025-191327](https://insights.sbomify.com/MAL-2025-191327/): Malicious code in @trpc-rate-limiter/cloudflare (npm) (malicious package)
- [MAL-2025-191326](https://insights.sbomify.com/MAL-2025-191326/): Malicious code in @trackstar/test-package (npm) (malicious package)
- [MAL-2025-191325](https://insights.sbomify.com/MAL-2025-191325/): Malicious code in @trackstar/test-angular-package (npm) (malicious package)
- [MAL-2025-191324](https://insights.sbomify.com/MAL-2025-191324/): Malicious code in @trackstar/react-trackstar-link-upgrade (npm) (malicious package)
- [MAL-2025-191323](https://insights.sbomify.com/MAL-2025-191323/): Malicious code in @trackstar/react-trackstar-link (npm) (malicious package)
- [MAL-2025-191322](https://insights.sbomify.com/MAL-2025-191322/): Malicious code in @trackstar/angular-trackstar-link (npm) (malicious package)
- [MAL-2025-191321](https://insights.sbomify.com/MAL-2025-191321/): Malicious code in @sme-ui/aoma-vevasound-metadata-lib (npm) (malicious package)
- [MAL-2025-191320](https://insights.sbomify.com/MAL-2025-191320/): Malicious code in @silgi/yoga (npm) (malicious package)
- [MAL-2025-19132](https://insights.sbomify.com/MAL-2025-19132/): Malicious code in echo-fzg-project (npm) (malicious package)
- [MAL-2025-191319](https://insights.sbomify.com/MAL-2025-191319/): Malicious code in @silgi/scalar (npm) (malicious package)
- [MAL-2025-191318](https://insights.sbomify.com/MAL-2025-191318/): Malicious code in @silgi/ratelimit (npm) (malicious package)
- [MAL-2025-191317](https://insights.sbomify.com/MAL-2025-191317/): Malicious code in @silgi/permission (npm) (malicious package)
- [MAL-2025-191316](https://insights.sbomify.com/MAL-2025-191316/): Malicious code in @silgi/openapi (npm) (malicious package)
- [MAL-2025-191315](https://insights.sbomify.com/MAL-2025-191315/): Malicious code in @silgi/module-builder (npm) (malicious package)
- [MAL-2025-191314](https://insights.sbomify.com/MAL-2025-191314/): Malicious code in @silgi/graphql (npm) (malicious package)
- [MAL-2025-191313](https://insights.sbomify.com/MAL-2025-191313/): Malicious code in @silgi/ecosystem (npm) (malicious package)
- [MAL-2025-191312](https://insights.sbomify.com/MAL-2025-191312/): Malicious code in @silgi/drizzle (npm) (malicious package)
- [MAL-2025-191311](https://insights.sbomify.com/MAL-2025-191311/): Malicious code in @silgi/better-auth (npm) (malicious package)
- [MAL-2025-191310](https://insights.sbomify.com/MAL-2025-191310/): Malicious code in @sameepsi/sor2 (npm) (malicious package)
- [MAL-2025-19131](https://insights.sbomify.com/MAL-2025-19131/): Malicious code in echo-elderberry-ppxh (npm) (malicious package)
- [MAL-2025-191309](https://insights.sbomify.com/MAL-2025-191309/): Malicious code in @sameepsi/sor (npm) (malicious package)
- [MAL-2025-191308](https://insights.sbomify.com/MAL-2025-191308/): Malicious code in @quick-start-soft/quick-remove-image-background (npm) (malicious package)
- [MAL-2025-191307](https://insights.sbomify.com/MAL-2025-191307/): Malicious code in @quick-start-soft/quick-markdown-translator (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/917/