MAL-2025-47027

    Dashboard / Malicious Package / MAL-2025-47027

    MAL-2025-47027

    Published: 11 Sept 2025Last Modified: 11 Sept 2025

    Summary: Malicious code in prebid-universal-creative (npm)

    Details: Source: google-open-source-security (28a458913f2a945444606a3dd030b993b23a6388274a01a2ecdea26478e1b1d9) This package was compromised and malicious code added as part of a phishing campaign.

    References: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised, https://www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/, https://snyk.io/blog/npm-supply-chain-attack-via-open-source-maintainer-compromise/

    Affected packages

    Package

    Name: prebid-universal-creative

    Purl: pkg:npm/prebid-universal-creative

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.17.3