CVE-2025-59039: Prebid-universal-creative latest on npm briefly compromised
Impact Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware detailed in the blog post below. This includes the extremely popular jsdelivr hosting of this file. Patches We unpublished the version on npm. Workarounds This has already been unpublished.
Published Sep 11, 2025
Affected packages
prebid-universal-creative
- Ecosystem
- npm
- Affected
- = 1.17.3
- Fixed in
- No patched version yet
- Check
npm ls prebid-universal-creative
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware detailed in the blog post below. This includes the extremely popular jsdelivr hosting of this file.
Patches
We unpublished the version on npm.
Workarounds
This has already been unpublished. See Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 ASAP to avoid similar attacks in the future.
References
https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology