{"id":"CVE-2025-59039","aliases":["EUVD-2025-27597","GHSA-m662-56rj-8fmm"],"status":"published","title":"Prebid Universal Creative on npm briefly compromised","description":"Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00338,"percentile":0.27546,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-506"],"published":"2025-09-09T22:23:55Z","modified":"2026-06-17T09:45:29Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"prebid-universal-creative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.3"},{"last_affected":"1.17.3"}]}],"versions":["1.17.3"]},{"source":"osv","ecosystem":"npm","package":"prebid-universal-creative","versions":["1.17.3"]}],"products":[{"vendor":"prebid","product":"prebid-universal-creative"}],"references":[{"url":"https://github.com/prebid/prebid-universal-creative/security/advisories/GHSA-m662-56rj-8fmm","tags":["x_refsource_CONFIRM","web"]},{"url":"https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59039","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m662-56rj-8fmm"},{"url":"https://github.com/prebid/prebid-universal-creative","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-59039","title":"Prebid Universal Creative on npm briefly compromised","description":"Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.","status":"published","published":"2025-09-09T22:23:55.551Z","modified":"2025-09-10T18:00:27.573Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-506"],"updated_at":"2026-11-02T14:32:48.167635Z"}],"euvd":[{"id":"EUVD-2025-27597","description":"Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.","status":"published","published":"2025-09-09T22:23:55Z","modified":"2025-09-10T18:00:27Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T20:31:45.093776Z"}],"ghsa":[{"id":"GHSA-m662-56rj-8fmm","title":"Prebid-universal-creative latest on npm briefly compromised","description":"### Impact\nNpm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware detailed in the blog post below. This includes the extremely popular jsdelivr hosting of this file. \n\n### Patches\nWe unpublished the version on npm.\n\n### Workarounds\nThis has already been unpublished. See Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 ASAP to avoid similar attacks in the future.\n\n### References\nhttps://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack","status":"published","published":"2025-09-11T14:24:37Z","modified":"2025-09-11T14:24:38Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-506"],"updated_at":"2026-11-02T14:38:57.074217Z"}],"nvd":[{"id":"CVE-2025-59039","description":"Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.","status":"published","published":"2025-09-09T23:15:37.227Z","modified":"2026-06-17T09:45:29Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-506"],"updated_at":"2026-11-02T14:11:28.834562Z"}],"osv":[{"id":"GHSA-m662-56rj-8fmm","title":"Prebid-universal-creative latest on npm briefly compromised","description":"### Impact\nNpm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware detailed in the blog post below. This includes the extremely popular jsdelivr hosting of this file. \n\n### Patches\nWe unpublished the version on npm.\n\n### Workarounds\nThis has already been unpublished. See Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 ASAP to avoid similar attacks in the future.\n\n### References\nhttps://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack","status":"published","published":"2025-09-11T14:24:37Z","modified":"2025-09-11T14:44:50.514697Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-506"],"updated_at":"2026-11-02T15:46:51.463834Z"}]}}