CVE-2025-59039CWE-506

Prebid Universal Creative on npm briefly compromised

Critical · published September 9, 2025

CVSS v4.0
9.3
EPSS
0%
Percentile
25.6
In the wild
Unconfirmed
What it is

Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00335 · 25.6th percentile
Weakness
CWE-506 · Embedded Malicious Code
Published
2025-09-09T22:23Z
EPSS history
Timeline
  • 09 SEP 22:23Z
    Prebid Universal Creative on npm briefly compromised
    cvelistv5