GitHub Advisoryadvisory · npm

GHSA-m662-56rj-8fmm Prebid-universal-creative latest on npm briefly compromised

CRITICAL Published 2025-09-11 Modified 2025-09-11 Official page ↗
Aliases
CVE-2025-59039
Ecosystem
npm
Packages
prebid-universal-creative
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-506
Reviewed
2025-09-11

Affected packages

• npm prebid-universal-creative: 1.17.3 (no fix yet)

Description

Impact Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware detailed in the blog post below. This includes the extremely popular jsdelivr hosting of this file. Patches We unpublished the version on npm. Workarounds This has already been unpublished. See Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 ASAP to avoid similar attacks in the future. References https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack

Related

Alias · CVE (1)

  • CVE-2025-59039 Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. vulnerability

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References