Prebid Universal Creative on npm briefly compromised
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-506.
Summary
Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| prebid | prebid-universal-creative | = 1.17.3 | — | No fix listed | CNA |
| — | prebid-universal-creative (npm) | — | — | No fix listed | GHSA-m662-56rj-8fmm |
- prebid-universal-creative Vendorprebid Affected = 1.17.3 Fixed in — No fix listed CNA
- prebid-universal-creative (npm) Vendor— Affected — Fixed in — No fix listed GHSA-m662-56rj-8fmm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59039
- 2026-10-03 Alias added: GHSA-m662-56rj-8fmm
References
More prebid vulnerabilities
- TI-2026-39547 prebid-server's request forgery vulnerability allows for possible host environment data extraction CVSS 3.1CRITICAL 10.0
- TI-2026-39546 Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction CVSS 3.1CRITICAL 10.0
- TI-2025-36680 Prebid.js NPM package briefly compromised CVSS 4.0HIGH 8.6
Sources
- CVE-2025-59039 · CVE Program
- CVE-2025-59039 · NVD
- FIRST EPSS
- GHSA-m662-56rj-8fmm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences