# Vulnerabilities published in 2025


- [MAL-2025-190857](https://insights.sbomify.com/MAL-2025-190857/): Malicious code in react-native-worklet-functions (npm) (malicious package)
- [MAL-2025-190856](https://insights.sbomify.com/MAL-2025-190856/): Malicious code in poper-react-sdk (npm) (malicious package)
- [MAL-2025-190855](https://insights.sbomify.com/MAL-2025-190855/): Malicious code in orbit-soap (npm) (malicious package)
- [MAL-2025-190854](https://insights.sbomify.com/MAL-2025-190854/): Malicious code in orbit-boxicons (npm) (malicious package)
- [MAL-2025-190853](https://insights.sbomify.com/MAL-2025-190853/): Malicious code in open2internet (npm) (malicious package)
- [MAL-2025-190852](https://insights.sbomify.com/MAL-2025-190852/): Malicious code in n8n-nodes-tmdb (npm) (malicious package)
- [MAL-2025-190851](https://insights.sbomify.com/MAL-2025-190851/): Malicious code in medusa-plugin-zalopay (npm) (malicious package)
- [MAL-2025-190850](https://insights.sbomify.com/MAL-2025-190850/): Malicious code in medusa-plugin-momo (npm) (malicious package)
- [MAL-2025-19085](https://insights.sbomify.com/MAL-2025-19085/): Malicious code in earth-wind-fork-orchestrate-notify (npm) (malicious package)
- [MAL-2025-190849](https://insights.sbomify.com/MAL-2025-190849/): Malicious code in medusa-plugin-announcement (npm) (malicious package)
- [MAL-2025-190848](https://insights.sbomify.com/MAL-2025-190848/): Malicious code in lite-serper-mcp-server (npm) (malicious package)
- [MAL-2025-190847](https://insights.sbomify.com/MAL-2025-190847/): Malicious code in jan-browser (npm) (malicious package)
- [MAL-2025-190846](https://insights.sbomify.com/MAL-2025-190846/): Malicious code in go-template (npm) (malicious package)
- [MAL-2025-190845](https://insights.sbomify.com/MAL-2025-190845/): Malicious code in github-action-for-generator (npm) (malicious package)
- [MAL-2025-190844](https://insights.sbomify.com/MAL-2025-190844/): Malicious code in gate-evm-tools-test (npm) (malicious package)
- [MAL-2025-190843](https://insights.sbomify.com/MAL-2025-190843/): Malicious code in gate-evm-check-code2 (npm) (malicious package)
- [MAL-2025-190842](https://insights.sbomify.com/MAL-2025-190842/): Malicious code in expo-audio-session (npm) (malicious package)
- [MAL-2025-190841](https://insights.sbomify.com/MAL-2025-190841/): Malicious code in evm-checkcode-cli (npm) (malicious package)
- [MAL-2025-190840](https://insights.sbomify.com/MAL-2025-190840/): Malicious code in esbuild-plugin-eta (npm) (malicious package)
- [MAL-2025-19084](https://insights.sbomify.com/MAL-2025-19084/): Malicious code in earth-grid-bad-visualize-warn (npm) (malicious package)
- [MAL-2025-190839](https://insights.sbomify.com/MAL-2025-190839/): Malicious code in create-hardhat3-app (npm) (malicious package)
- [MAL-2025-190838](https://insights.sbomify.com/MAL-2025-190838/): Malicious code in cpu-instructions (npm) (malicious package)
- [MAL-2025-190837](https://insights.sbomify.com/MAL-2025-190837/): Malicious code in claude-token-updater (npm) (malicious package)
- [MAL-2025-190836](https://insights.sbomify.com/MAL-2025-190836/): Malicious code in capacitor-plugin-purchase (npm) (malicious package)
- [MAL-2025-190835](https://insights.sbomify.com/MAL-2025-190835/): Malicious code in capacitor-plugin-apptrackingios (npm) (malicious package)
- [MAL-2025-190834](https://insights.sbomify.com/MAL-2025-190834/): Malicious code in calc-loan-interest (npm) (malicious package)
- [MAL-2025-190833](https://insights.sbomify.com/MAL-2025-190833/): Malicious code in bytecode-checker-cli (npm) (malicious package)
- [MAL-2025-190832](https://insights.sbomify.com/MAL-2025-190832/): Malicious code in axios-builder (npm) (malicious package)
- [MAL-2025-190831](https://insights.sbomify.com/MAL-2025-190831/): Malicious code in asyncapi-preview (npm) (malicious package)
- [MAL-2025-190830](https://insights.sbomify.com/MAL-2025-190830/): Malicious code in @zapier/ai-actions (npm) (malicious package)
- [MAL-2025-19083](https://insights.sbomify.com/MAL-2025-19083/): Malicious code in earth-beta-scale-meta-cold (npm) (malicious package)
- [MAL-2025-190829](https://insights.sbomify.com/MAL-2025-190829/): Malicious code in @trigo/hapi-auth-signedlink (npm) (malicious package)
- [MAL-2025-190828](https://insights.sbomify.com/MAL-2025-190828/): Malicious code in @trigo/atrix-pubsub (npm) (malicious package)
- [MAL-2025-190827](https://insights.sbomify.com/MAL-2025-190827/): Malicious code in @strapbuild/react-native-perspective-image-cropper-poojan31 (npm) (malicious package)
- [MAL-2025-190826](https://insights.sbomify.com/MAL-2025-190826/): Malicious code in @strapbuild/react-native-perspective-image-cropper-2 (npm) (malicious package)
- [MAL-2025-190825](https://insights.sbomify.com/MAL-2025-190825/): Malicious code in @strapbuild/react-native-date-time-picker (npm) (malicious package)
- [MAL-2025-190824](https://insights.sbomify.com/MAL-2025-190824/): Malicious code in @quick-start-soft/quick-task-refine (npm) (malicious package)
- [MAL-2025-190823](https://insights.sbomify.com/MAL-2025-190823/): Malicious code in @quick-start-soft/quick-markdown-image (npm) (malicious package)
- [MAL-2025-190822](https://insights.sbomify.com/MAL-2025-190822/): Malicious code in @quick-start-soft/quick-markdown-compose (npm) (malicious package)
- [MAL-2025-190821](https://insights.sbomify.com/MAL-2025-190821/): Malicious code in @quick-start-soft/quick-markdown (npm) (malicious package)
- [MAL-2025-190820](https://insights.sbomify.com/MAL-2025-190820/): Malicious code in @quick-start-soft/quick-git-clean-markdown (npm) (malicious package)
- [MAL-2025-19082](https://insights.sbomify.com/MAL-2025-19082/): Malicious code in earhorn (npm) (malicious package)
- [MAL-2025-190819](https://insights.sbomify.com/MAL-2025-190819/): Malicious code in @quick-start-soft/quick-document-translator (npm) (malicious package)
- [MAL-2025-190818](https://insights.sbomify.com/MAL-2025-190818/): Malicious code in @markvivanco/app-version-checker (npm) (malicious package)
- [MAL-2025-190817](https://insights.sbomify.com/MAL-2025-190817/): Malicious code in @louisle2/cortex-js (npm) (malicious package)
- [MAL-2025-190816](https://insights.sbomify.com/MAL-2025-190816/): Malicious code in @kvytech/medusa-plugin-newsletter (npm) (malicious package)
- [MAL-2025-190815](https://insights.sbomify.com/MAL-2025-190815/): Malicious code in @ensdomains/web3modal (npm) (malicious package)
- [MAL-2025-190814](https://insights.sbomify.com/MAL-2025-190814/): Malicious code in @ensdomains/unruggable-gateways (npm) (malicious package)
- [MAL-2025-190813](https://insights.sbomify.com/MAL-2025-190813/): Malicious code in @ensdomains/ui (npm) (malicious package)
- [MAL-2025-190812](https://insights.sbomify.com/MAL-2025-190812/): Malicious code in @ensdomains/subdomain-registrar (npm) (malicious package)
- [MAL-2025-190811](https://insights.sbomify.com/MAL-2025-190811/): Malicious code in @ensdomains/server-analytics (npm) (malicious package)
- [MAL-2025-190810](https://insights.sbomify.com/MAL-2025-190810/): Malicious code in @ensdomains/renewal (npm) (malicious package)
- [MAL-2025-19081](https://insights.sbomify.com/MAL-2025-19081/): Malicious code in eaoneuq1 (npm) (malicious package)
- [MAL-2025-190809](https://insights.sbomify.com/MAL-2025-190809/): Malicious code in @ensdomains/react-ens-address (npm) (malicious package)
- [MAL-2025-190808](https://insights.sbomify.com/MAL-2025-190808/): Malicious code in @ensdomains/offchain-resolver-contracts (npm) (malicious package)
- [MAL-2025-190807](https://insights.sbomify.com/MAL-2025-190807/): Malicious code in @ensdomains/name-wrapper (npm) (malicious package)
- [MAL-2025-190806](https://insights.sbomify.com/MAL-2025-190806/): Malicious code in @ensdomains/mock (npm) (malicious package)
- [MAL-2025-190805](https://insights.sbomify.com/MAL-2025-190805/): Malicious code in @ensdomains/ens-archived-contracts (npm) (malicious package)
- [MAL-2025-190804](https://insights.sbomify.com/MAL-2025-190804/): Malicious code in @ensdomains/dnssec-oracle-anchors (npm) (malicious package)
- [MAL-2025-190803](https://insights.sbomify.com/MAL-2025-190803/): Malicious code in @ensdomains/cypress-metamask (npm) (malicious package)
- [MAL-2025-190802](https://insights.sbomify.com/MAL-2025-190802/): Malicious code in @caretive/caret-cli (npm) (malicious package)
- [MAL-2025-190801](https://insights.sbomify.com/MAL-2025-190801/): Malicious code in @asyncapi/server-api (npm) (malicious package)
- [MAL-2025-190800](https://insights.sbomify.com/MAL-2025-190800/): Malicious code in @asyncapi/php-template (npm) (malicious package)
- [MAL-2025-19080](https://insights.sbomify.com/MAL-2025-19080/): Malicious code in eamcet (npm) (malicious package)
- [MAL-2025-1908](https://insights.sbomify.com/MAL-2025-1908/): Malicious code in okt-scripts (npm) (malicious package)
- [MAL-2025-190799](https://insights.sbomify.com/MAL-2025-190799/): Malicious code in @asyncapi/keeper (npm) (malicious package)
- [MAL-2025-190798](https://insights.sbomify.com/MAL-2025-190798/): Malicious code in @asyncapi/edavisualiser (npm) (malicious package)
- [MAL-2025-190797](https://insights.sbomify.com/MAL-2025-190797/): Malicious code in @asyncapi/dotnet-rabbitmq-template (npm) (malicious package)
- [MAL-2025-190796](https://insights.sbomify.com/MAL-2025-190796/): Malicious code in @actbase/react-native-simple-video (npm) (malicious package)
- [MAL-2025-190795](https://insights.sbomify.com/MAL-2025-190795/): Malicious code in @actbase/react-native-kakao-navi (npm) (malicious package)
- [MAL-2025-190794](https://insights.sbomify.com/MAL-2025-190794/): Malicious code in @actbase/react-native-kakao-channel (npm) (malicious package)
- [MAL-2025-190793](https://insights.sbomify.com/MAL-2025-190793/): Malicious code in @actbase/react-native-devtools (npm) (malicious package)
- [MAL-2025-190792](https://insights.sbomify.com/MAL-2025-190792/): Malicious code in @actbase/react-native-actionsheet (npm) (malicious package)
- [MAL-2025-190791](https://insights.sbomify.com/MAL-2025-190791/): Malicious code in @actbase/react-kakaosdk (npm) (malicious package)
- [MAL-2025-190790](https://insights.sbomify.com/MAL-2025-190790/): Malicious code in @actbase/react-absolute (npm) (malicious package)
- [MAL-2025-19079](https://insights.sbomify.com/MAL-2025-19079/): Malicious code in ealert (npm) (malicious package)
- [MAL-2025-190789](https://insights.sbomify.com/MAL-2025-190789/): Malicious code in zuper-cli (npm) (malicious package)
- [MAL-2025-190788](https://insights.sbomify.com/MAL-2025-190788/): Malicious code in zapier-async-storage (npm) (malicious package)
- [MAL-2025-190787](https://insights.sbomify.com/MAL-2025-190787/): Malicious code in vite-plugin-httpfile (npm) (malicious package)
- [MAL-2025-190786](https://insights.sbomify.com/MAL-2025-190786/): Malicious code in typeorm-orbit (npm) (malicious package)
- [MAL-2025-190785](https://insights.sbomify.com/MAL-2025-190785/): Malicious code in token.js-fork (npm) (malicious package)
- [MAL-2025-190784](https://insights.sbomify.com/MAL-2025-190784/): Malicious code in test-hardhat-app (npm) (malicious package)
- [MAL-2025-190783](https://insights.sbomify.com/MAL-2025-190783/): Malicious code in skills-use (npm) (malicious package)
- [MAL-2025-190782](https://insights.sbomify.com/MAL-2025-190782/): Malicious code in shinhan-limit-scrap (npm) (malicious package)
- [MAL-2025-190781](https://insights.sbomify.com/MAL-2025-190781/): Malicious code in scgsffcreator (npm) (malicious package)
- [MAL-2025-190780](https://insights.sbomify.com/MAL-2025-190780/): Malicious code in redux-router-kit (npm) (malicious package)
- [MAL-2025-19078](https://insights.sbomify.com/MAL-2025-19078/): Malicious code in eagle-zenith-cev632-project (npm) (malicious package)
- [MAL-2025-190779](https://insights.sbomify.com/MAL-2025-190779/): Malicious code in react-native-use-modal (npm) (malicious package)
- [MAL-2025-190778](https://insights.sbomify.com/MAL-2025-190778/): Malicious code in posthog-plugin-hello-world (npm) (malicious package)
- [MAL-2025-190777](https://insights.sbomify.com/MAL-2025-190777/): Malicious code in orbit-nebula-editor (npm) (malicious package)
- [MAL-2025-190776](https://insights.sbomify.com/MAL-2025-190776/): Malicious code in medusa-plugin-product-reviews-kvy (npm) (malicious package)
- [MAL-2025-190775](https://insights.sbomify.com/MAL-2025-190775/): Malicious code in manual-billing-system-miniapp-api (npm) (malicious package)
- [MAL-2025-190774](https://insights.sbomify.com/MAL-2025-190774/): Malicious code in korea-administrative-area-geo-json-util (npm) (malicious package)
- [MAL-2025-190773](https://insights.sbomify.com/MAL-2025-190773/): Malicious code in iron-shield-miniapp (npm) (malicious package)
- [MAL-2025-190772](https://insights.sbomify.com/MAL-2025-190772/): Malicious code in eslint-config-zeallat-base (npm) (malicious package)
- [MAL-2025-190771](https://insights.sbomify.com/MAL-2025-190771/): Malicious code in esbuild-plugin-httpfile (npm) (malicious package)
- [MAL-2025-190770](https://insights.sbomify.com/MAL-2025-190770/): Malicious code in dotnet-template (npm) (malicious package)
- [MAL-2025-19077](https://insights.sbomify.com/MAL-2025-19077/): Malicious code in eagle-whirlpool-mph288-project (npm) (malicious package)
- [MAL-2025-190769](https://insights.sbomify.com/MAL-2025-190769/): Malicious code in discord-bot-server (npm) (malicious package)
- [MAL-2025-190768](https://insights.sbomify.com/MAL-2025-190768/): Malicious code in devstart-cli (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/923/