CVE-2025-59038: Prebid.js NPM package briefly compromised
Impact NPM users of prebid 10.9.2. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet.
Patches 10.10.0 is solved
References https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack
Other sources
Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet. Version 10.10.0 fixes the issue. As a workaround, it is also possible to downgrade to 10.9.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/prebid.jsto a version that resolves this vulnerability.Fixed in 10.10.0 - Upgrade
Upgrade
prebid (Prebid.js) NPM packageto a version that resolves this vulnerability.Fixed in 10.10.0 - Upgrade
Upgrade
prebid (Prebid.js) NPM packageto a version that resolves this vulnerability.Fixed in 10.9.1 - Compensating control
For NPM users who used prebid 10.9.2, assume brief compromise and investigate the site for unauthorized crypto-transaction redirection to the attacker’s wallet; monitor and block outbound crypto transaction flows from the site while you verify integrity.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59038?
CVE-2025-59038 is considered a high severity vulnerability due to the risk of redirecting crypto transactions.
How do I fix CVE-2025-59038?
To remediate CVE-2025-59038, you should upgrade Prebid.js to version 10.10.0 or higher.
Which versions of Prebid.js are affected by CVE-2025-59038?
CVE-2025-59038 affects Prebid.js version 10.9.2 and all versions prior to 10.10.0.
What type of attack is associated with CVE-2025-59038?
CVE-2025-59038 involves a malware campaign that redirects cryptocurrency transactions to an attacker’s wallet.
Are there any known exploits for CVE-2025-59038?
Reports indicate that CVE-2025-59038 has been briefly exploited in the wild during the malware campaign.