# Vulnerabilities published in 2025 - [MAL-2025-191306](https://insights.sbomify.com/MAL-2025-191306/): Malicious code in @quick-start-soft/quick-markdown-print (npm) (malicious package) - [MAL-2025-191305](https://insights.sbomify.com/MAL-2025-191305/): Malicious code in @productdevbook/ts-i18n (npm) (malicious package) - [MAL-2025-191304](https://insights.sbomify.com/MAL-2025-191304/): Malicious code in @productdevbook/motion (npm) (malicious package) - [MAL-2025-191303](https://insights.sbomify.com/MAL-2025-191303/): Malicious code in @productdevbook/chatwoot (npm) (malicious package) - [MAL-2025-191302](https://insights.sbomify.com/MAL-2025-191302/): Malicious code in @productdevbook/auth (npm) (malicious package) - [MAL-2025-191301](https://insights.sbomify.com/MAL-2025-191301/): Malicious code in @productdevbook/animejs-vue (npm) (malicious package) - [MAL-2025-191300](https://insights.sbomify.com/MAL-2025-191300/): Malicious code in @posthog/zendesk-plugin (npm) (malicious package) - [MAL-2025-19130](https://insights.sbomify.com/MAL-2025-19130/): Malicious code in echo-eiovs-1b87a-crystal-project (npm) (malicious package) - [MAL-2025-1913](https://insights.sbomify.com/MAL-2025-1913/): Malicious code in paypal-expanded-integration-backend-node (npm) (malicious package) - [MAL-2025-191299](https://insights.sbomify.com/MAL-2025-191299/): Malicious code in @posthog/rrweb-replay (npm) (malicious package) - [MAL-2025-191298](https://insights.sbomify.com/MAL-2025-191298/): Malicious code in @posthog/postgres-plugin (npm) (malicious package) - [MAL-2025-191297](https://insights.sbomify.com/MAL-2025-191297/): Malicious code in @posthog/netdata-event-processing (npm) (malicious package) - [MAL-2025-191296](https://insights.sbomify.com/MAL-2025-191296/): Malicious code in @posthog/migrator3000-plugin (npm) (malicious package) - [MAL-2025-191295](https://insights.sbomify.com/MAL-2025-191295/): Malicious code in @posthog/lemon-ui (npm) (malicious package) - [MAL-2025-191294](https://insights.sbomify.com/MAL-2025-191294/): Malicious code in @posthog/laudspeaker-plugin (npm) (malicious package) - [MAL-2025-191293](https://insights.sbomify.com/MAL-2025-191293/): Malicious code in @posthog/intercom-plugin (npm) (malicious package) - [MAL-2025-191292](https://insights.sbomify.com/MAL-2025-191292/): Malicious code in @posthog/icons (npm) (malicious package) - [MAL-2025-191291](https://insights.sbomify.com/MAL-2025-191291/): Malicious code in @posthog/heartbeat-plugin (npm) (malicious package) - [MAL-2025-191290](https://insights.sbomify.com/MAL-2025-191290/): Malicious code in @posthog/filter-out-plugin (npm) (malicious package) - [MAL-2025-19129](https://insights.sbomify.com/MAL-2025-19129/): Malicious code in echo-eae1f-fdmjv-lichen-project (npm) (malicious package) - [MAL-2025-191289](https://insights.sbomify.com/MAL-2025-191289/): Malicious code in @posthog/bitbucket-release-tracker (npm) (malicious package) - [MAL-2025-191288](https://insights.sbomify.com/MAL-2025-191288/): Malicious code in @pergel/nuxt (npm) (malicious package) - [MAL-2025-191287](https://insights.sbomify.com/MAL-2025-191287/): Malicious code in @pergel/module-ui (npm) (malicious package) - [MAL-2025-191286](https://insights.sbomify.com/MAL-2025-191286/): Malicious code in @pergel/module-graphql (npm) (malicious package) - [MAL-2025-191285](https://insights.sbomify.com/MAL-2025-191285/): Malicious code in @pergel/module-box (npm) (malicious package) - [MAL-2025-191284](https://insights.sbomify.com/MAL-2025-191284/): Malicious code in @pergel/cli (npm) (malicious package) - [MAL-2025-191283](https://insights.sbomify.com/MAL-2025-191283/): Malicious code in @oku-ui/visually-hidden (npm) (malicious package) - [MAL-2025-191282](https://insights.sbomify.com/MAL-2025-191282/): Malicious code in @oku-ui/utils (npm) (malicious package) - [MAL-2025-191281](https://insights.sbomify.com/MAL-2025-191281/): Malicious code in @oku-ui/tooltip (npm) (malicious package) - [MAL-2025-191280](https://insights.sbomify.com/MAL-2025-191280/): Malicious code in @oku-ui/toolbar (npm) (malicious package) - [MAL-2025-19128](https://insights.sbomify.com/MAL-2025-19128/): Malicious code in echo-dvo-project (npm) (malicious package) - [MAL-2025-191279](https://insights.sbomify.com/MAL-2025-191279/): Malicious code in @oku-ui/toggle-group (npm) (malicious package) - [MAL-2025-191278](https://insights.sbomify.com/MAL-2025-191278/): Malicious code in @oku-ui/toggle (npm) (malicious package) - [MAL-2025-191277](https://insights.sbomify.com/MAL-2025-191277/): Malicious code in @oku-ui/toast (npm) (malicious package) - [MAL-2025-191276](https://insights.sbomify.com/MAL-2025-191276/): Malicious code in @oku-ui/tabs (npm) (malicious package) - [MAL-2025-191275](https://insights.sbomify.com/MAL-2025-191275/): Malicious code in @oku-ui/switch (npm) (malicious package) - [MAL-2025-191274](https://insights.sbomify.com/MAL-2025-191274/): Malicious code in @oku-ui/slider (npm) (malicious package) - [MAL-2025-191273](https://insights.sbomify.com/MAL-2025-191273/): Malicious code in @oku-ui/separator (npm) (malicious package) - [MAL-2025-191272](https://insights.sbomify.com/MAL-2025-191272/): Malicious code in @oku-ui/scroll-area (npm) (malicious package) - [MAL-2025-191271](https://insights.sbomify.com/MAL-2025-191271/): Malicious code in @oku-ui/roving-focus (npm) (malicious package) - [MAL-2025-191270](https://insights.sbomify.com/MAL-2025-191270/): Malicious code in @oku-ui/radio-group (npm) (malicious package) - [MAL-2025-19127](https://insights.sbomify.com/MAL-2025-19127/): Malicious code in echo-date-pdde (npm) (malicious package) - [MAL-2025-191269](https://insights.sbomify.com/MAL-2025-191269/): Malicious code in @oku-ui/provide (npm) (malicious package) - [MAL-2025-191268](https://insights.sbomify.com/MAL-2025-191268/): Malicious code in @oku-ui/progress (npm) (malicious package) - [MAL-2025-191267](https://insights.sbomify.com/MAL-2025-191267/): Malicious code in @oku-ui/primitives-nuxt (npm) (malicious package) - [MAL-2025-191266](https://insights.sbomify.com/MAL-2025-191266/): Malicious code in @oku-ui/primitive (npm) (malicious package) - [MAL-2025-191265](https://insights.sbomify.com/MAL-2025-191265/): Malicious code in @oku-ui/presence (npm) (malicious package) - [MAL-2025-191264](https://insights.sbomify.com/MAL-2025-191264/): Malicious code in @oku-ui/portal (npm) (malicious package) - [MAL-2025-191263](https://insights.sbomify.com/MAL-2025-191263/): Malicious code in @oku-ui/popper (npm) (malicious package) - [MAL-2025-191262](https://insights.sbomify.com/MAL-2025-191262/): Malicious code in @oku-ui/popover (npm) (malicious package) - [MAL-2025-191261](https://insights.sbomify.com/MAL-2025-191261/): Malicious code in @oku-ui/motion-nuxt (npm) (malicious package) - [MAL-2025-191260](https://insights.sbomify.com/MAL-2025-191260/): Malicious code in @oku-ui/menu (npm) (malicious package) - [MAL-2025-19126](https://insights.sbomify.com/MAL-2025-19126/): Malicious code in echo-d32-project (npm) (malicious package) - [MAL-2025-191259](https://insights.sbomify.com/MAL-2025-191259/): Malicious code in @oku-ui/hover-card (npm) (malicious package) - [MAL-2025-191258](https://insights.sbomify.com/MAL-2025-191258/): Malicious code in @oku-ui/focus-guards (npm) (malicious package) - [MAL-2025-191257](https://insights.sbomify.com/MAL-2025-191257/): Malicious code in @oku-ui/dismissable-layer (npm) (malicious package) - [MAL-2025-191256](https://insights.sbomify.com/MAL-2025-191256/): Malicious code in @oku-ui/direction (npm) (malicious package) - [MAL-2025-191255](https://insights.sbomify.com/MAL-2025-191255/): Malicious code in @oku-ui/dialog (npm) (malicious package) - [MAL-2025-191254](https://insights.sbomify.com/MAL-2025-191254/): Malicious code in @oku-ui/collection (npm) (malicious package) - [MAL-2025-191253](https://insights.sbomify.com/MAL-2025-191253/): Malicious code in @oku-ui/collapsible (npm) (malicious package) - [MAL-2025-191252](https://insights.sbomify.com/MAL-2025-191252/): Malicious code in @oku-ui/checkbox (npm) (malicious package) - [MAL-2025-191251](https://insights.sbomify.com/MAL-2025-191251/): Malicious code in @oku-ui/avatar (npm) (malicious package) - [MAL-2025-191250](https://insights.sbomify.com/MAL-2025-191250/): Malicious code in @oku-ui/aspect-ratio (npm) (malicious package) - [MAL-2025-19125](https://insights.sbomify.com/MAL-2025-19125/): Malicious code in echo-cla-project (npm) (malicious package) - [MAL-2025-191249](https://insights.sbomify.com/MAL-2025-191249/): Malicious code in @oku-ui/arrow (npm) (malicious package) - [MAL-2025-191248](https://insights.sbomify.com/MAL-2025-191248/): Malicious code in @oku-ui/alert-dialog (npm) (malicious package) - [MAL-2025-191247](https://insights.sbomify.com/MAL-2025-191247/): Malicious code in @mizzle-dev/orm (npm) (malicious package) - [MAL-2025-191246](https://insights.sbomify.com/MAL-2025-191246/): Malicious code in @micado-digital/stadtmarketing-kufstein-external (npm) (malicious package) - [MAL-2025-191245](https://insights.sbomify.com/MAL-2025-191245/): Malicious code in @lui-ui/lui-vue (npm) (malicious package) - [MAL-2025-191244](https://insights.sbomify.com/MAL-2025-191244/): Malicious code in @lui-ui/lui-tailwindcss (npm) (malicious package) - [MAL-2025-191243](https://insights.sbomify.com/MAL-2025-191243/): Malicious code in @lui-ui/lui-nuxt (npm) (malicious package) - [MAL-2025-191242](https://insights.sbomify.com/MAL-2025-191242/): Malicious code in @livecms/nuxt-live-edit (npm) (malicious package) - [MAL-2025-191241](https://insights.sbomify.com/MAL-2025-191241/): Malicious code in @livecms/live-edit (npm) (malicious package) - [MAL-2025-191240](https://insights.sbomify.com/MAL-2025-191240/): Malicious code in @kvytech/medusa-plugin-promotion (npm) (malicious package) - [MAL-2025-19124](https://insights.sbomify.com/MAL-2025-19124/): Malicious code in echo-charlie-vanilla-ewgah (npm) (malicious package) - [MAL-2025-191239](https://insights.sbomify.com/MAL-2025-191239/): Malicious code in @kvytech/habbit-e2e-test (npm) (malicious package) - [MAL-2025-191238](https://insights.sbomify.com/MAL-2025-191238/): Malicious code in @jayeshsadhwani/telemetry-sdk (npm) (malicious package) - [MAL-2025-191237](https://insights.sbomify.com/MAL-2025-191237/): Malicious code in @ifings/metatron3 (npm) (malicious package) - [MAL-2025-191236](https://insights.sbomify.com/MAL-2025-191236/): Malicious code in @ifings/design-system (npm) (malicious package) - [MAL-2025-191235](https://insights.sbomify.com/MAL-2025-191235/): Malicious code in @ifelsedeveloper/protocol-contracts-svm-idl (npm) (malicious package) - [MAL-2025-191234](https://insights.sbomify.com/MAL-2025-191234/): Malicious code in @hyperlook/telemetry-sdk (npm) (malicious package) - [MAL-2025-191233](https://insights.sbomify.com/MAL-2025-191233/): Malicious code in @huntersofbook/ui (npm) (malicious package) - [MAL-2025-191232](https://insights.sbomify.com/MAL-2025-191232/): Malicious code in @huntersofbook/i18n (npm) (malicious package) - [MAL-2025-191231](https://insights.sbomify.com/MAL-2025-191231/): Malicious code in @huntersofbook/form-naiveui (npm) (malicious package) - [MAL-2025-191230](https://insights.sbomify.com/MAL-2025-191230/): Malicious code in @huntersofbook/core-nuxt (npm) (malicious package) - [MAL-2025-19123](https://insights.sbomify.com/MAL-2025-19123/): Malicious code in echo-bravo-smxd (npm) (malicious package) - [MAL-2025-191229](https://insights.sbomify.com/MAL-2025-191229/): Malicious code in @huntersofbook/core (npm) (malicious package) - [MAL-2025-191228](https://insights.sbomify.com/MAL-2025-191228/): Malicious code in @huntersofbook/auth-vue (npm) (malicious package) - [MAL-2025-191227](https://insights.sbomify.com/MAL-2025-191227/): Malicious code in @hover-design/react (npm) (malicious package) - [MAL-2025-191226](https://insights.sbomify.com/MAL-2025-191226/): Malicious code in @hover-design/core (npm) (malicious package) - [MAL-2025-191225](https://insights.sbomify.com/MAL-2025-191225/): Malicious code in @hapheus/n8n-nodes-pgp (npm) (malicious package) - [MAL-2025-191224](https://insights.sbomify.com/MAL-2025-191224/): Malicious code in @fishingbooker/react-swiper (npm) (malicious package) - [MAL-2025-191223](https://insights.sbomify.com/MAL-2025-191223/): Malicious code in @fishingbooker/react-raty (npm) (malicious package) - [MAL-2025-191222](https://insights.sbomify.com/MAL-2025-191222/): Malicious code in @fishingbooker/react-pagination (npm) (malicious package) - [MAL-2025-191221](https://insights.sbomify.com/MAL-2025-191221/): Malicious code in @fishingbooker/react-loader (npm) (malicious package) - [MAL-2025-191220](https://insights.sbomify.com/MAL-2025-191220/): Malicious code in @fishingbooker/browser-sync-plugin (npm) (malicious package) - [MAL-2025-19122](https://insights.sbomify.com/MAL-2025-19122/): Malicious code in echo-bravo-rdlp (npm) (malicious package) - [MAL-2025-191219](https://insights.sbomify.com/MAL-2025-191219/): Malicious code in @faq-component/react (npm) (malicious package) - [MAL-2025-191218](https://insights.sbomify.com/MAL-2025-191218/): Malicious code in @faq-component/core (npm) (malicious package) - [MAL-2025-191217](https://insights.sbomify.com/MAL-2025-191217/): Malicious code in @everreal/web-analytics (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2025/page/918/