prebid-universal-creative 1.17.3
This package version has been yanked.
Yanked package versions cannot be used or downloaded from npm.
Prebid-universal-creative latest on npm briefly compromised
critical severity CVE-2025-59039= 1.17.3
Impact
Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware detailed in the blog post below. This includes the extremely popular jsdelivr hosting of this file.
Patches
We unpublished the version on npm.
Workarounds
This has already been unpublished. See Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 ASAP to avoid similar attacks in the future.
References
https://www.sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack
No license issues detected.
This package version has a license in the source code.