# Vulnerabilities published in 2025


- [MAL-2025-190947](https://insights.sbomify.com/MAL-2025-190947/): Malicious code in @posthog/plugin-server (npm) (malicious package)
- [MAL-2025-190946](https://insights.sbomify.com/MAL-2025-190946/): Malicious code in @posthog/drop-events-on-property-plugin (npm) (malicious package)
- [MAL-2025-190945](https://insights.sbomify.com/MAL-2025-190945/): Malicious code in @posthog/clickhouse (npm) (malicious package)
- [MAL-2025-190944](https://insights.sbomify.com/MAL-2025-190944/): Malicious code in wellness-expert-ng-gallery (npm) (malicious package)
- [MAL-2025-190943](https://insights.sbomify.com/MAL-2025-190943/): Malicious code in web-scraper-mcp (npm) (malicious package)
- [MAL-2025-190942](https://insights.sbomify.com/MAL-2025-190942/): Malicious code in valid-south-african-id (npm) (malicious package)
- [MAL-2025-190941](https://insights.sbomify.com/MAL-2025-190941/): Malicious code in use-unsaved-changes (npm) (malicious package)
- [MAL-2025-190940](https://insights.sbomify.com/MAL-2025-190940/): Malicious code in url-encode-decode (npm) (malicious package)
- [MAL-2025-19094](https://insights.sbomify.com/MAL-2025-19094/): Malicious code in easydraft (npm) (malicious package)
- [MAL-2025-190939](https://insights.sbomify.com/MAL-2025-190939/): Malicious code in upload-to-play-store (npm) (malicious package)
- [MAL-2025-190938](https://insights.sbomify.com/MAL-2025-190938/): Malicious code in uplandui (npm) (malicious package)
- [MAL-2025-190937](https://insights.sbomify.com/MAL-2025-190937/): Malicious code in undefsafe-typed (npm) (malicious package)
- [MAL-2025-190936](https://insights.sbomify.com/MAL-2025-190936/): Malicious code in typefence (npm) (malicious package)
- [MAL-2025-190935](https://insights.sbomify.com/MAL-2025-190935/): Malicious code in @ensdomains/op-resolver-contracts (npm) (malicious package)
- [MAL-2025-190934](https://insights.sbomify.com/MAL-2025-190934/): Malicious code in @ensdomains/ensjs-react (npm) (malicious package)
- [MAL-2025-190933](https://insights.sbomify.com/MAL-2025-190933/): Malicious code in @ensdomains/ensjs (npm) (malicious package)
- [MAL-2025-190932](https://insights.sbomify.com/MAL-2025-190932/): Malicious code in @ensdomains/ens-test-env (npm) (malicious package)
- [MAL-2025-190931](https://insights.sbomify.com/MAL-2025-190931/): Malicious code in @ensdomains/ens-contracts (npm) (malicious package)
- [MAL-2025-190930](https://insights.sbomify.com/MAL-2025-190930/): Malicious code in @ensdomains/durin (npm) (malicious package)
- [MAL-2025-19093](https://insights.sbomify.com/MAL-2025-19093/): Malicious code in easycrm (npm) (malicious package)
- [MAL-2025-190929](https://insights.sbomify.com/MAL-2025-190929/): Malicious code in @ensdomains/ccip-read-cf-worker (npm) (malicious package)
- [MAL-2025-190928](https://insights.sbomify.com/MAL-2025-190928/): Malicious code in zapier-platform-legacy-scripting-runner (npm) (malicious package)
- [MAL-2025-190927](https://insights.sbomify.com/MAL-2025-190927/): Malicious code in web-types-lit (npm) (malicious package)
- [MAL-2025-190926](https://insights.sbomify.com/MAL-2025-190926/): Malicious code in posthog-react-native (npm) (malicious package)
- [MAL-2025-190925](https://insights.sbomify.com/MAL-2025-190925/): Malicious code in posthog-node (npm) (malicious package)
- [MAL-2025-190924](https://insights.sbomify.com/MAL-2025-190924/): Malicious code in posthog-docusaurus (npm) (malicious package)
- [MAL-2025-190923](https://insights.sbomify.com/MAL-2025-190923/): Malicious code in mcp-use (npm) (malicious package)
- [MAL-2025-190922](https://insights.sbomify.com/MAL-2025-190922/): Malicious code in create-mcp-use-app (npm) (malicious package)
- [MAL-2025-190921](https://insights.sbomify.com/MAL-2025-190921/): Malicious code in capacitor-voice-recorder-wav (npm) (malicious package)
- [MAL-2025-190920](https://insights.sbomify.com/MAL-2025-190920/): Malicious code in @zapier/stubtree (npm) (malicious package)
- [MAL-2025-19092](https://insights.sbomify.com/MAL-2025-19092/): Malicious code in easybuy (npm) (malicious package)
- [MAL-2025-190919](https://insights.sbomify.com/MAL-2025-190919/): Malicious code in @zapier/spectral-api-ruleset (npm) (malicious package)
- [MAL-2025-190918](https://insights.sbomify.com/MAL-2025-190918/): Malicious code in @zapier/mcp-integration (npm) (malicious package)
- [MAL-2025-190917](https://insights.sbomify.com/MAL-2025-190917/): Malicious code in @zapier/ai-actions-react (npm) (malicious package)
- [MAL-2025-190916](https://insights.sbomify.com/MAL-2025-190916/): Malicious code in @tezign/html-webpack-plugin (npm) (malicious package)
- [MAL-2025-190915](https://insights.sbomify.com/MAL-2025-190915/): Malicious code in @seung-ju/react-native-action-sheet (npm) (malicious package)
- [MAL-2025-190914](https://insights.sbomify.com/MAL-2025-190914/): Malicious code in @sauravthakur/corplib (npm) (malicious package)
- [MAL-2025-190913](https://insights.sbomify.com/MAL-2025-190913/): Malicious code in @postman/wdio-junit-reporter (npm) (malicious package)
- [MAL-2025-190912](https://insights.sbomify.com/MAL-2025-190912/): Malicious code in @postman/wdio-allure-reporter (npm) (malicious package)
- [MAL-2025-190911](https://insights.sbomify.com/MAL-2025-190911/): Malicious code in @postman/secret-scanner-wasm (npm) (malicious package)
- [MAL-2025-190910](https://insights.sbomify.com/MAL-2025-190910/): Malicious code in @postman/pretty-ms (npm) (malicious package)
- [MAL-2025-19091](https://insights.sbomify.com/MAL-2025-19091/): Malicious code in easy-zero-gamma-promise-deploy (npm) (malicious package)
- [MAL-2025-190909](https://insights.sbomify.com/MAL-2025-190909/): Malicious code in @postman/postman-mcp-server (npm) (malicious package)
- [MAL-2025-190908](https://insights.sbomify.com/MAL-2025-190908/): Malicious code in @postman/postman-mcp-cli (npm) (malicious package)
- [MAL-2025-190907](https://insights.sbomify.com/MAL-2025-190907/): Malicious code in @postman/postman-collection-fork (npm) (malicious package)
- [MAL-2025-190906](https://insights.sbomify.com/MAL-2025-190906/): Malicious code in @postman/pm-bin-windows-x64 (npm) (malicious package)
- [MAL-2025-190905](https://insights.sbomify.com/MAL-2025-190905/): Malicious code in @postman/pm-bin-macos-x64 (npm) (malicious package)
- [MAL-2025-190904](https://insights.sbomify.com/MAL-2025-190904/): Malicious code in @postman/pm-bin-macos-arm64 (npm) (malicious package)
- [MAL-2025-190903](https://insights.sbomify.com/MAL-2025-190903/): Malicious code in @postman/pm-bin-linux-x64 (npm) (malicious package)
- [MAL-2025-190902](https://insights.sbomify.com/MAL-2025-190902/): Malicious code in @postman/mcp-ui-client (npm) (malicious package)
- [MAL-2025-190901](https://insights.sbomify.com/MAL-2025-190901/): Malicious code in @postman/final-node-keytar (npm) (malicious package)
- [MAL-2025-190900](https://insights.sbomify.com/MAL-2025-190900/): Malicious code in @posthog/wizard (npm) (malicious package)
- [MAL-2025-19090](https://insights.sbomify.com/MAL-2025-19090/): Malicious code in easy-wallet (npm) (malicious package)
- [MAL-2025-1909](https://insights.sbomify.com/MAL-2025-1909/): Malicious code in orderly-js-sdk-cra-template (npm) (malicious package)
- [MAL-2025-190899](https://insights.sbomify.com/MAL-2025-190899/): Malicious code in @posthog/web-dev-server (npm) (malicious package)
- [MAL-2025-190898](https://insights.sbomify.com/MAL-2025-190898/): Malicious code in @posthog/variance-plugin (npm) (malicious package)
- [MAL-2025-190897](https://insights.sbomify.com/MAL-2025-190897/): Malicious code in @posthog/url-normalizer-plugin (npm) (malicious package)
- [MAL-2025-190896](https://insights.sbomify.com/MAL-2025-190896/): Malicious code in @posthog/twitter-followers-plugin (npm) (malicious package)
- [MAL-2025-190895](https://insights.sbomify.com/MAL-2025-190895/): Malicious code in @posthog/twilio-plugin (npm) (malicious package)
- [MAL-2025-190894](https://insights.sbomify.com/MAL-2025-190894/): Malicious code in @posthog/taxonomy-plugin (npm) (malicious package)
- [MAL-2025-190893](https://insights.sbomify.com/MAL-2025-190893/): Malicious code in @posthog/snowflake-export-plugin (npm) (malicious package)
- [MAL-2025-190892](https://insights.sbomify.com/MAL-2025-190892/): Malicious code in @posthog/sendgrid-plugin (npm) (malicious package)
- [MAL-2025-190891](https://insights.sbomify.com/MAL-2025-190891/): Malicious code in @posthog/rrweb-player (npm) (malicious package)
- [MAL-2025-190890](https://insights.sbomify.com/MAL-2025-190890/): Malicious code in @posthog/react-rrweb-player (npm) (malicious package)
- [MAL-2025-19089](https://insights.sbomify.com/MAL-2025-19089/): Malicious code in easy-visualize-decode-phi-meta (npm) (malicious package)
- [MAL-2025-190889](https://insights.sbomify.com/MAL-2025-190889/): Malicious code in @posthog/plugin-unduplicates (npm) (malicious package)
- [MAL-2025-190888](https://insights.sbomify.com/MAL-2025-190888/): Malicious code in @posthog/pagerduty-plugin (npm) (malicious package)
- [MAL-2025-190887](https://insights.sbomify.com/MAL-2025-190887/): Malicious code in @posthog/nextjs-config (npm) (malicious package)
- [MAL-2025-190886](https://insights.sbomify.com/MAL-2025-190886/): Malicious code in @posthog/nextjs (npm) (malicious package)
- [MAL-2025-190885](https://insights.sbomify.com/MAL-2025-190885/): Malicious code in @posthog/maxmind-plugin (npm) (malicious package)
- [MAL-2025-190884](https://insights.sbomify.com/MAL-2025-190884/): Malicious code in @posthog/kinesis-plugin (npm) (malicious package)
- [MAL-2025-190883](https://insights.sbomify.com/MAL-2025-190883/): Malicious code in @posthog/ingestion-alert-plugin (npm) (malicious package)
- [MAL-2025-190882](https://insights.sbomify.com/MAL-2025-190882/): Malicious code in @posthog/hedgehog-mode (npm) (malicious package)
- [MAL-2025-190881](https://insights.sbomify.com/MAL-2025-190881/): Malicious code in @posthog/gitub-star-sync-plugin (npm) (malicious package)
- [MAL-2025-190880](https://insights.sbomify.com/MAL-2025-190880/): Malicious code in @posthog/github-release-tracking-plugin (npm) (malicious package)
- [MAL-2025-19088](https://insights.sbomify.com/MAL-2025-19088/): Malicious code in easy-key-key-web-omega (npm) (malicious package)
- [MAL-2025-190879](https://insights.sbomify.com/MAL-2025-190879/): Malicious code in @posthog/geoip-plugin (npm) (malicious package)
- [MAL-2025-190878](https://insights.sbomify.com/MAL-2025-190878/): Malicious code in @posthog/first-time-event-tracker (npm) (malicious package)
- [MAL-2025-190877](https://insights.sbomify.com/MAL-2025-190877/): Malicious code in @posthog/event-sequence-timer-plugin (npm) (malicious package)
- [MAL-2025-190876](https://insights.sbomify.com/MAL-2025-190876/): Malicious code in @posthog/databricks-plugin (npm) (malicious package)
- [MAL-2025-190875](https://insights.sbomify.com/MAL-2025-190875/): Malicious code in @posthog/customerio-plugin (npm) (malicious package)
- [MAL-2025-190874](https://insights.sbomify.com/MAL-2025-190874/): Malicious code in @posthog/currency-normalization-plugin (npm) (malicious package)
- [MAL-2025-190873](https://insights.sbomify.com/MAL-2025-190873/): Malicious code in @posthog/automatic-cohorts-plugin (npm) (malicious package)
- [MAL-2025-190872](https://insights.sbomify.com/MAL-2025-190872/): Malicious code in @mparpaillon/page (npm) (malicious package)
- [MAL-2025-190871](https://insights.sbomify.com/MAL-2025-190871/): Malicious code in @mparpaillon/imagesloaded (npm) (malicious package)
- [MAL-2025-190870](https://insights.sbomify.com/MAL-2025-190870/): Malicious code in @mparpaillon/connector-parse (npm) (malicious package)
- [MAL-2025-19087](https://insights.sbomify.com/MAL-2025-19087/): Malicious code in easy-encode-notify-emulate-cache (npm) (malicious package)
- [MAL-2025-190869](https://insights.sbomify.com/MAL-2025-190869/): Malicious code in @mcp-use/mcp-use (npm) (malicious package)
- [MAL-2025-190868](https://insights.sbomify.com/MAL-2025-190868/): Malicious code in @mcp-use/inspector (npm) (malicious package)
- [MAL-2025-190867](https://insights.sbomify.com/MAL-2025-190867/): Malicious code in @mcp-use/cli (npm) (malicious package)
- [MAL-2025-190866](https://insights.sbomify.com/MAL-2025-190866/): Malicious code in @ensdomains/buffer (npm) (malicious package)
- [MAL-2025-190865](https://insights.sbomify.com/MAL-2025-190865/): Malicious code in @darwinex/react-custom-scrollbars (npm) (malicious package)
- [MAL-2025-190864](https://insights.sbomify.com/MAL-2025-190864/): Malicious code in ra-data-firebase (npm) (malicious package)
- [MAL-2025-190863](https://insights.sbomify.com/MAL-2025-190863/): Malicious code in @asyncapi/studio (npm) (malicious package)
- [MAL-2025-190862](https://insights.sbomify.com/MAL-2025-190862/): Malicious code in zuper-stream (npm) (malicious package)
- [MAL-2025-190861](https://insights.sbomify.com/MAL-2025-190861/): Malicious code in zapier-scripts (npm) (malicious package)
- [MAL-2025-190860](https://insights.sbomify.com/MAL-2025-190860/): Malicious code in test-foundry-app (npm) (malicious package)
- [MAL-2025-19086](https://insights.sbomify.com/MAL-2025-19086/): Malicious code in easy-boolean-mock-proxy-stack (npm) (malicious package)
- [MAL-2025-190859](https://insights.sbomify.com/MAL-2025-190859/): Malicious code in scgs-capacitor-subscribe (npm) (malicious package)
- [MAL-2025-190858](https://insights.sbomify.com/MAL-2025-190858/): Malicious code in rollup-plugin-httpfile (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/922/