github - ghsa-m662-56rj-8fmm

GHSA-M662-56RJ-8FMM

Vulnerability from github – Published: 2025-09-11 14:24 – Updated: 2025-09-11 14:24

Summary

Prebid-universal-creative latest on npm briefly compromised

Details

Impact

Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware detailed in the blog post below. This includes the extremely popular jsdelivr hosting of this file.

Patches

We unpublished the version on npm.

Workarounds

This has already been unpublished. See Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 ASAP to avoid similar attacks in the future.

References

https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack

Severity ?

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "prebid-universal-creative"
      },
      "versions": [
        "1.17.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-59039"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-506"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-11T14:24:37Z",
    "nvd_published_at": "2025-09-09T23:15:37Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nNpm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware detailed in the blog post below. This includes the extremely popular jsdelivr hosting of this file. \n\n### Patches\nWe unpublished the version on npm.\n\n### Workarounds\nThis has already been unpublished. See Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 ASAP to avoid similar attacks in the future.\n\n### References\nhttps://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack",
  "id": "GHSA-m662-56rj-8fmm",
  "modified": "2025-09-11T14:24:37Z",
  "published": "2025-09-11T14:24:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/prebid/prebid-universal-creative/security/advisories/GHSA-m662-56rj-8fmm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59039"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/prebid/prebid-universal-creative"
    },
    {
      "type": "WEB",
      "url": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Prebid-universal-creative latest on npm briefly compromised"
}

CVE-2025-59039 (GCVE-0-2025-59039)

Vulnerability from cvelistv5 – Published: 2025-09-09 22:23 – Updated: 2025-09-10 18:00

Summary

Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.

Severity ?

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-506 - Embedded Malicious Code

Assigner

GitHub_M

References

URL

Tags

	https://github.com/prebid/prebid-universal-creati…	x_refsource_CONFIRM
	https://www.sonatype.com/blog/npm-chalk-and-debug…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	prebid	prebid-universal-creative	Affected: = 1.17.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59039",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-10T17:47:53.143510Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-10T18:00:27.573Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "prebid-universal-creative",
          "vendor": "prebid",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.17.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-506",
              "description": "CWE-506: Embedded Malicious Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-09T22:23:55.551Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/prebid/prebid-universal-creative/security/advisories/GHSA-m662-56rj-8fmm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/prebid/prebid-universal-creative/security/advisories/GHSA-m662-56rj-8fmm"
        },
        {
          "name": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack"
        }
      ],
      "source": {
        "advisory": "GHSA-m662-56rj-8fmm",
        "discovery": "UNKNOWN"
      },
      "title": "Prebid Universal Creative on npm briefly compromised"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-59039",
    "datePublished": "2025-09-09T22:23:55.551Z",
    "dateReserved": "2025-09-08T16:19:26.171Z",
    "dateUpdated": "2025-09-10T18:00:27.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-M662-56RJ-8FMM

Impact

Patches

Workarounds

References

CVE-2025-59039 (GCVE-0-2025-59039)

Tags

Sightings

Nomenclature