CVE-2025-59039: 
JavaScript vulnerability analysis and mitigation

CVE-2025-59039 affects Prebid Universal Creative (PUC), a JavaScript API for rendering multiple formats. The vulnerability was discovered and disclosed on September 9, 2025, impacting version 1.17.3 and the 'latest' version of PUC. The issue involved crypto-related malware that was briefly present in these versions, including the widely-used jsdelivr hosting of the file (GitHub Advisory).

The vulnerability was introduced through a supply chain attack where malicious actors gained control of the npm package publishing credentials. The compromised package contained cryptocurrency-stealing malware. The vulnerability has been assigned a CVSS 4.0 Base Score of 9.3 (CRITICAL) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The vulnerability is classified under CWE-506 (Embedded Malicious Code) (GitHub Advisory, Sonatype Blog).

The impact of this vulnerability is severe due to PUC's widespread use through jsdelivr hosting. The malicious code was specifically designed for cryptocurrency theft, putting downstream applications and their users at immediate risk. The compromised package could potentially lead to theft of API keys, tokens, and sensitive credentials, establishment of persistent backdoors, and broader system infiltration (Sonatype Blog).

The maintainers have unpublished version 1.17.3 from npm. Users are advised to transition to version 1.17.2 immediately to avoid similar attacks. Additionally, users should refer to Prebid.js 9 release notes for guidance on moving away from the deprecated workflow of using PUC or pointing to a dynamic version (GitHub Advisory).

The security community has recognized this as part of a broader pattern of sophisticated supply chain attacks targeting popular open source packages. Security researchers at Sonatype have identified this as part of a larger campaign affecting multiple npm packages, highlighting the increasing trend of attackers targeting under-resourced but widely-used open source projects (Sonatype Blog).