high8.6
CVE-2025-59038
Prebid.js NPM package briefly compromised
Impact
### Impact NPM users of prebid 10.9.2. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet. ### Patches 10.10.0 is solved ### References https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | prebid.js | = 10.9.2 | 10.10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/prebid/Prebid.js/security/advisories/GHSA-jwq7-6j4r-2f92
- https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack
- https://github.com/advisories/GHSA-jwq7-6j4r-2f92
- https://nvd.nist.gov/vuln/detail/CVE-2025-59038
- https://github.com/prebid/Prebid.js/commit/72c7f184028f51ba15cdac744d56590b0f2b1f1e
- https://github.com/prebid/Prebid.js/releases/tag/10.10.0