MAL-2025-47026

    Dashboard / Malicious Package / MAL-2025-47026

    MAL-2025-47026

    Published: 11 Sept 2025Last Modified: 26 Sept 2025

    Summary: Malicious code in prebid (npm)

    Details: Source: google-open-source-security (14e7380eb0ee7e6be1b7896f1a961c6f7282199fcce42017c4003fc73695ee52) This package was compromised and malicious code added as part of a phishing campaign.

    References: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised, https://www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/, https://snyk.io/blog/npm-supply-chain-attack-via-open-source-maintainer-compromise/, https://socket.dev/blog/duckdb-npm-account-compromised-in-continuing-supply-chain-attack, https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack

    Affected packages

    Package

    Name: prebid

    Purl: pkg:npm/prebid

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    10.9.2
    10.9.1
    MAL-2025-47026 | CVE-DB