StackRadar

MAL-2025-28475

Critical

Advisory

Published 14 Aug 2025In the index since 8 Sept 2026
Severity
Critical
worst across findings
CVSS
9.5
base score, highest
EPSS
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5
of 17,781 indexed, latest versions
Container images
5
deployed by those charts
Fix available
None
affected package

Malicious code in Orchestrator (npm)

Carried by container images the latest versions of 5 of 17,781 indexed charts deploy, on 5 images.

Affected packageAffected versionsFixed inImages
orchestratornpm0.3.7, 0.3.8, 1.0.0no fix listed5
OSV records
MAL-2025-28475

Charts affected

5 by stars
ChartLatestAffected imagesRadar Score
scrapoxywiremindVerified publisher0.3.41 of 1See more

scrapoxy wiremind 0.3.4

1 of the 1 container images this version deploys carry MAL-2025-28475.

Container imageDigestPackageFixed in
wiremind/scrapoxy:lateste7048929a676
orchestrator@0.3.8
no fix listed

Open the chart page →

2,154
clusterplexclusterplexVerified publisher1.1.101 of 3See more

clusterplex clusterplex 1.1.10

1 of the 3 container images this version deploys carry MAL-2025-28475.

Container imageDigestPackageFixed in
ghcr.io/pabloromeo/clusterplex_orchestrator:1.4.160fe80de2d22c
orchestrator@1.0.0
no fix listed

Open the chart page →

3,868
wekan-oldgabisonfire0.1.21 of 1See more

wekan-old gabisonfire 0.1.2

1 of the 1 container images this version deploys carry MAL-2025-28475.

Container imageDigestPackageFixed in
wekanteam/wekan:v4.2268a51f0327df
orchestrator@0.3.7
no fix listed

Open the chart page →

5,941
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry MAL-2025-28475.

Container imageDigestPackageFixed in
ibmcom/microclimate-portal:latested5505e5c7ec
orchestrator@0.3.8
no fix listed

Open the chart page →

57,669
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry MAL-2025-28475.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
orchestrator@0.3.7
no fix listed

Open the chart page →

3,638

Container images carrying it

5 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ibmcom/microclimate-portal:latested5505e5c7ec
orchestrator@0.3.8
no fix listed
1
wekanteam/wekan:v4.2268a51f0327df
orchestrator@0.3.7
no fix listed
1
wiremind/scrapoxy:lateste7048929a676
orchestrator@0.3.8
no fix listed
1
ghcr.io/pabloromeo/clusterplex_orchestrator:1.4.160fe80de2d22c
orchestrator@1.0.0
no fix listed
1
quay.io/wekan/wekan:v5.65cb17600883a3
orchestrator@0.3.7
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.