# Vulnerabilities published in 2025


- [MAL-2025-191216](https://insights.sbomify.com/MAL-2025-191216/): Malicious code in @everreal/validate-esmoduleinterop-imports (npm) (malicious package)
- [MAL-2025-191215](https://insights.sbomify.com/MAL-2025-191215/): Malicious code in @everreal/react-charts (npm) (malicious package)
- [MAL-2025-191214](https://insights.sbomify.com/MAL-2025-191214/): Malicious code in @dev-blinq/ui-systems (npm) (malicious package)
- [MAL-2025-191213](https://insights.sbomify.com/MAL-2025-191213/): Malicious code in @dev-blinq/cucumber_client (npm) (malicious package)
- [MAL-2025-191212](https://insights.sbomify.com/MAL-2025-191212/): Malicious code in @dev-blinq/cucumber-js (npm) (malicious package)
- [MAL-2025-191211](https://insights.sbomify.com/MAL-2025-191211/): Malicious code in @dev-blinq/blinqioclient (npm) (malicious package)
- [MAL-2025-191210](https://insights.sbomify.com/MAL-2025-191210/): Malicious code in @dev-blinq/ai-qa-logic (npm) (malicious package)
- [MAL-2025-19121](https://insights.sbomify.com/MAL-2025-19121/): Malicious code in echo-bot-ts-esm (npm) (malicious package)
- [MAL-2025-191209](https://insights.sbomify.com/MAL-2025-191209/): Malicious code in @commute/market-data-chartjs (npm) (malicious package)
- [MAL-2025-191208](https://insights.sbomify.com/MAL-2025-191208/): Malicious code in @commute/market-data (npm) (malicious package)
- [MAL-2025-191207](https://insights.sbomify.com/MAL-2025-191207/): Malicious code in @commute/bloom (npm) (malicious package)
- [MAL-2025-191206](https://insights.sbomify.com/MAL-2025-191206/): Malicious code in @cllbk/ghl (npm) (malicious package)
- [MAL-2025-191205](https://insights.sbomify.com/MAL-2025-191205/): Malicious code in @clausehq/flows-step-taskscreateurl (npm) (malicious package)
- [MAL-2025-191204](https://insights.sbomify.com/MAL-2025-191204/): Malicious code in @clausehq/flows-step-sendgridemail (npm) (malicious package)
- [MAL-2025-191203](https://insights.sbomify.com/MAL-2025-191203/): Malicious code in @clausehq/flows-step-mqtt (npm) (malicious package)
- [MAL-2025-191202](https://insights.sbomify.com/MAL-2025-191202/): Malicious code in @clausehq/flows-step-jsontoxml (npm) (malicious package)
- [MAL-2025-191201](https://insights.sbomify.com/MAL-2025-191201/): Malicious code in @clausehq/flows-step-httprequest (npm) (malicious package)
- [MAL-2025-191200](https://insights.sbomify.com/MAL-2025-191200/): Malicious code in @chtijs/eslint-config (npm) (malicious package)
- [MAL-2025-19120](https://insights.sbomify.com/MAL-2025-19120/): Malicious code in echo-bbqkj-b95az-meadow-project (npm) (malicious package)
- [MAL-2025-1912](https://insights.sbomify.com/MAL-2025-1912/): Malicious code in pattern-picker (npm) (malicious package)
- [MAL-2025-191199](https://insights.sbomify.com/MAL-2025-191199/): Malicious code in @browserbasehq/stagehand-docs (npm) (malicious package)
- [MAL-2025-191198](https://insights.sbomify.com/MAL-2025-191198/): Malicious code in @browserbasehq/stagehand (npm) (malicious package)
- [MAL-2025-191197](https://insights.sbomify.com/MAL-2025-191197/): Malicious code in @browserbasehq/sdk-functions (npm) (malicious package)
- [MAL-2025-191196](https://insights.sbomify.com/MAL-2025-191196/): Malicious code in @browserbasehq/mcp-server-browserbase (npm) (malicious package)
- [MAL-2025-191195](https://insights.sbomify.com/MAL-2025-191195/): Malicious code in @browserbasehq/mcp (npm) (malicious package)
- [MAL-2025-191194](https://insights.sbomify.com/MAL-2025-191194/): Malicious code in @browserbasehq/director-ai (npm) (malicious package)
- [MAL-2025-191193](https://insights.sbomify.com/MAL-2025-191193/): Malicious code in @browserbasehq/bb9 (npm) (malicious package)
- [MAL-2025-191192](https://insights.sbomify.com/MAL-2025-191192/): Malicious code in @bdkinc/knex-ibmi (npm) (malicious package)
- [MAL-2025-191191](https://insights.sbomify.com/MAL-2025-191191/): Malicious code in @antstackio/shelbysam (npm) (malicious package)
- [MAL-2025-191190](https://insights.sbomify.com/MAL-2025-191190/): Malicious code in @antstackio/json-to-graphql (npm) (malicious package)
- [MAL-2025-19119](https://insights.sbomify.com/MAL-2025-19119/): Malicious code in echo-avy-project (npm) (malicious package)
- [MAL-2025-191189](https://insights.sbomify.com/MAL-2025-191189/): Malicious code in @antstackio/graphql-body-parser (npm) (malicious package)
- [MAL-2025-191188](https://insights.sbomify.com/MAL-2025-191188/): Malicious code in @antstackio/express-graphql-proxy (npm) (malicious package)
- [MAL-2025-191187](https://insights.sbomify.com/MAL-2025-191187/): Malicious code in @antstackio/eslint-config-antstack (npm) (malicious package)
- [MAL-2025-191186](https://insights.sbomify.com/MAL-2025-191186/): Malicious code in @alexcolls/nuxt-ux (npm) (malicious package)
- [MAL-2025-191185](https://insights.sbomify.com/MAL-2025-191185/): Malicious code in @alexcolls/nuxt-socket.io (npm) (malicious package)
- [MAL-2025-191184](https://insights.sbomify.com/MAL-2025-191184/): Malicious code in @alexadark/reusable-functions (npm) (malicious package)
- [MAL-2025-191183](https://insights.sbomify.com/MAL-2025-191183/): Malicious code in @alexadark/gatsby-theme-wordpress-blog (npm) (malicious package)
- [MAL-2025-191182](https://insights.sbomify.com/MAL-2025-191182/): Malicious code in @alexadark/gatsby-theme-events (npm) (malicious package)
- [MAL-2025-191181](https://insights.sbomify.com/MAL-2025-191181/): Malicious code in @alexadark/amadeus-api (npm) (malicious package)
- [MAL-2025-191180](https://insights.sbomify.com/MAL-2025-191180/): Malicious code in @afetcan/storage (npm) (malicious package)
- [MAL-2025-19118](https://insights.sbomify.com/MAL-2025-19118/): Malicious code in echo-apple-ujuj (npm) (malicious package)
- [MAL-2025-191179](https://insights.sbomify.com/MAL-2025-191179/): Malicious code in @afetcan/api (npm) (malicious package)
- [MAL-2025-191178](https://insights.sbomify.com/MAL-2025-191178/): Malicious code in @actbase/native (npm) (malicious package)
- [MAL-2025-191177](https://insights.sbomify.com/MAL-2025-191177/): Malicious code in @accordproject/template-engine (npm) (malicious package)
- [MAL-2025-191176](https://insights.sbomify.com/MAL-2025-191176/): Malicious code in @accordproject/markdown-it-cicero (npm) (malicious package)
- [MAL-2025-191175](https://insights.sbomify.com/MAL-2025-191175/): Malicious code in @accordproject/concerto-types (npm) (malicious package)
- [MAL-2025-191174](https://insights.sbomify.com/MAL-2025-191174/): Malicious code in @accordproject/concerto-metamodel (npm) (malicious package)
- [MAL-2025-191173](https://insights.sbomify.com/MAL-2025-191173/): Malicious code in @accordproject/concerto-linter-default-ruleset (npm) (malicious package)
- [MAL-2025-191172](https://insights.sbomify.com/MAL-2025-191172/): Malicious code in @accordproject/concerto-linter (npm) (malicious package)
- [MAL-2025-191171](https://insights.sbomify.com/MAL-2025-191171/): Malicious code in @accordproject/concerto-analysis (npm) (malicious package)
- [MAL-2025-191170](https://insights.sbomify.com/MAL-2025-191170/): Malicious code in TretinV3.forts-api-extention (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2025-19117](https://insights.sbomify.com/MAL-2025-19117/): Malicious code in echo-6bf-project (npm) (malicious package)
- [MAL-2025-191169](https://insights.sbomify.com/MAL-2025-191169/): Malicious code in srcery-colors.srcery-colors (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2025-191168](https://insights.sbomify.com/MAL-2025-191168/): Malicious code in sissel.shopify-liquid (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2025-191167](https://insights.sbomify.com/MAL-2025-191167/): Malicious code in SIRILMP.dark-theme-sm (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2025-191166](https://insights.sbomify.com/MAL-2025-191166/): Malicious code in l-igh-t.vscode-theme-seti-folder (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2025-191165](https://insights.sbomify.com/MAL-2025-191165/): Malicious code in kleinesfilmroellchen.serenity-dsl-syntaxhighlight (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2025-191164](https://insights.sbomify.com/MAL-2025-191164/): Malicious code in JScearcy.rust-doc-viewer (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2025-191163](https://insights.sbomify.com/MAL-2025-191163/): Malicious code in jeronimoekerdt.color-picker-universal (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2025-191162](https://insights.sbomify.com/MAL-2025-191162/): Malicious code in grrrck.positron-plus-1-e (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2025-191161](https://insights.sbomify.com/MAL-2025-191161/): Malicious code in ginfuru.better-nunjucks (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2025-191160](https://insights.sbomify.com/MAL-2025-191160/): Malicious code in ellacrity.recoil (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2025-19116](https://insights.sbomify.com/MAL-2025-19116/): Malicious code in echo-66viv-y325p-plume-project (npm) (malicious package)
- [MAL-2025-191159](https://insights.sbomify.com/MAL-2025-191159/): Malicious code in codejoy.codejoy-vscode-extension (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2025-191158](https://insights.sbomify.com/MAL-2025-191158/): Malicious code in CodeInKlingon.git-worktree-menu (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2025-191157](https://insights.sbomify.com/MAL-2025-191157/): Malicious code in cline-ai-main.cline-ai-agent (VSCode) (malicious package)
- [MAL-2025-191156](https://insights.sbomify.com/MAL-2025-191156/): Malicious code in zuper-sdk (npm) (malicious package)
- [MAL-2025-191155](https://insights.sbomify.com/MAL-2025-191155/): Malicious code in wenk (npm) (malicious package)
- [MAL-2025-191154](https://insights.sbomify.com/MAL-2025-191154/): Malicious code in webpack-loader-httpfile (npm) (malicious package)
- [MAL-2025-191153](https://insights.sbomify.com/MAL-2025-191153/): Malicious code in web-types-htmx (npm) (malicious package)
- [MAL-2025-191152](https://insights.sbomify.com/MAL-2025-191152/): Malicious code in wallet-type (npm) (malicious package)
- [MAL-2025-191151](https://insights.sbomify.com/MAL-2025-191151/): Malicious code in wallet-evm (npm) (malicious package)
- [MAL-2025-191150](https://insights.sbomify.com/MAL-2025-191150/): Malicious code in victoriaxoaquyet-wallet-core (npm) (malicious package)
- [MAL-2025-19115](https://insights.sbomify.com/MAL-2025-19115/): Malicious code in echo-5sp2s-tkxhc-aurora-project (npm) (malicious package)
- [MAL-2025-191149](https://insights.sbomify.com/MAL-2025-191149/): Malicious code in victoria-wallet-validator (npm) (malicious package)
- [MAL-2025-191148](https://insights.sbomify.com/MAL-2025-191148/): Malicious code in victoria-wallet-utils (npm) (malicious package)
- [MAL-2025-191147](https://insights.sbomify.com/MAL-2025-191147/): Malicious code in victoria-wallet-type (npm) (malicious package)
- [MAL-2025-191146](https://insights.sbomify.com/MAL-2025-191146/): Malicious code in victoria-wallet-core (npm) (malicious package)
- [MAL-2025-191145](https://insights.sbomify.com/MAL-2025-191145/): Malicious code in victoria-wallet-constants (npm) (malicious package)
- [MAL-2025-191144](https://insights.sbomify.com/MAL-2025-191144/): Malicious code in react-native-jam-icons (npm) (malicious package)
- [MAL-2025-191143](https://insights.sbomify.com/MAL-2025-191143/): Malicious code in react-favic (npm) (malicious package)
- [MAL-2025-191142](https://insights.sbomify.com/MAL-2025-191142/): Malicious code in react-data-to-export (npm) (malicious package)
- [MAL-2025-191141](https://insights.sbomify.com/MAL-2025-191141/): Malicious code in puny-req (npm) (malicious package)
- [MAL-2025-191140](https://insights.sbomify.com/MAL-2025-191140/): Malicious code in piclite (npm) (malicious package)
- [MAL-2025-19114](https://insights.sbomify.com/MAL-2025-19114/): Malicious code in ecg-js-banners (npm) (malicious package)
- [MAL-2025-191139](https://insights.sbomify.com/MAL-2025-191139/): Malicious code in pergeltest (npm) (malicious package)
- [MAL-2025-191138](https://insights.sbomify.com/MAL-2025-191138/): Malicious code in pergel (npm) (malicious package)
- [MAL-2025-191137](https://insights.sbomify.com/MAL-2025-191137/): Malicious code in okta-react-router-6 (npm) (malicious package)
- [MAL-2025-191136](https://insights.sbomify.com/MAL-2025-191136/): Malicious code in obj-to-css (npm) (malicious package)
- [MAL-2025-191135](https://insights.sbomify.com/MAL-2025-191135/): Malicious code in normal-store (npm) (malicious package)
- [MAL-2025-191134](https://insights.sbomify.com/MAL-2025-191134/): Malicious code in nitroping (npm) (malicious package)
- [MAL-2025-191133](https://insights.sbomify.com/MAL-2025-191133/): Malicious code in nitrodeploy (npm) (malicious package)
- [MAL-2025-191132](https://insights.sbomify.com/MAL-2025-191132/): Malicious code in nitro-kutu (npm) (malicious package)
- [MAL-2025-191131](https://insights.sbomify.com/MAL-2025-191131/): Malicious code in nitro-graphql (npm) (malicious package)
- [MAL-2025-191130](https://insights.sbomify.com/MAL-2025-191130/): Malicious code in ngx-wooapi (npm) (malicious package)
- [MAL-2025-19113](https://insights.sbomify.com/MAL-2025-19113/): Malicious code in eceqoq (npm) (malicious package)
- [MAL-2025-191129](https://insights.sbomify.com/MAL-2025-191129/): Malicious code in ngx-useful-swiper-prosenjit (npm) (malicious package)
- [MAL-2025-191128](https://insights.sbomify.com/MAL-2025-191128/): Malicious code in medusa-plugin-logs (npm) (malicious package)
- [MAL-2025-191127](https://insights.sbomify.com/MAL-2025-191127/): Malicious code in m25-transaction-utils (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/919/