GitHub Advisoryadvisory · npm
GHSA-jwq7-6j4r-2f92 Prebid.js NPM package briefly compromised
HIGH
Official page ↗
- Aliases
- CVE-2025-59038
- Ecosystem
- npm
- Packages
- prebid.js
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Weaknesses
- CWE-506
- Reviewed
- 2025-09-11
Affected packages
• npm prebid.js: >= 10.9.2, < 10.10.0 → fixed in 10.10.0
Description
Impact
NPM users of prebid 10.9.2. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet.
Patches
10.10.0 is solved
References
https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack
Related
Alias · CVE (1)
- CVE-2025-59038 Prebid.js is a free and open source library for publishers to quickly implement header bidding. vulnerability
Weakness · CWE (1)
- CWE-506 Embedded Malicious Code weakness
References
- https://github.com/prebid/Prebid.js/security/advisories/GHSA-jwq7-6j4r-2f92 web
- https://nvd.nist.gov/vuln/detail/CVE-2025-59038 advisory
- https://github.com/prebid/Prebid.js/commit/72c7f184028f51ba15cdac744d56590b0f2b1f1e web
- https://github.com/prebid/Prebid.js package
- https://github.com/prebid/Prebid.js/releases/tag/10.10.0 web
- https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack web