StackRadar

MAL-2025-5721

Critical

Advisory

Published 4 Jul 2025In the index since 8 Sept 2026
Severity
Critical
worst across findings
CVSS
9.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
16
of 17,781 indexed, latest versions
Container images
12
deployed by those charts
Fix available
None
affected package

Malicious code in protobufjs-websocket-example (npm)

Carried by container images the latest versions of 16 of 17,781 indexed charts deploy, on 12 images.

Affected packageAffected versionsFixed inImages
protobufjs-websocket-examplenpm1.1.0no fix listed12
OSV records
MAL-2025-5721
Also known as
GHSA-xhhv-q7vx-hqch

Charts affected

16 by stars
ChartLatestAffected imagesRadar Score
Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher1.0.11 of 6See more

Practica_4_Recuperacion_helm mca-03-02-practica4-recuperacion 1.0.1

1 of the 6 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
fjvela/urjc-fjvela-external-service:1.0.1a8ebe5ca13fc
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

19,187
d.vazquezm.2021_helmapphelmVerified publisher1.0.01 of 6See more

d.vazquezm.2021_helm apphelm 1.0.0

1 of the 6 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
davidvmar/urjc-davidvmar-external-service:1.0.02a68e9ac7f09
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

19,745
eoloplannerdfa-amm-eoloplannerVerified publisher0.1.01 of 7See more

eoloplanner dfa-amm-eoloplanner 0.1.0

1 of the 7 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
oscarsotosanchez/weatherservice:v1.0911ec961d10b
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

27,550
eoloplannerdreyg-jescribanob-chart-eoloplanner0.1.01 of 7See more

eoloplanner dreyg-jescribanob-chart-eoloplanner 0.1.0

1 of the 7 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
oscarsotosanchez/weatherservice:v1.0911ec961d10b
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

24,656
eolicplantseolicplantsVerified publisher0.1.01 of 7See more

eolicplants eolicplants 0.1.0

1 of the 7 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
oscarsotosanchez/weatherservice:v1.0911ec961d10b
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

27,291
eoloplanner-mcaeoloplanner-mcaVerified publisher0.1.01 of 7See more

eoloplanner-mca eoloplanner-mca 0.1.0

1 of the 7 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
oscarsotosanchez/weatherservice:v1.0911ec961d10b
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

27,256
online-boutiquekubesphere-testVerified publisher0.1.02 of 11See more

online-boutique kubesphere-test 0.1.0

2 of the 11 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
gcr.io/google-samples/microservices-demo/currencyservice:v0.2.349d458a3650f
protobufjs-websocket-example@1.1.0
no fix listed
gcr.io/google-samples/microservices-demo/paymentservice:v0.2.36eb201217a8f
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

26,018
account-lookup-servicemojaloop13.0.02 of 4See more

account-lookup-service mojaloop 13.0.0

2 of the 4 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
protobufjs-websocket-example@1.1.0
no fix listed
mojaloop/event-sidecar:v11.0.189b8ab71b74b
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

11,695
account-lookup-service-adminmojaloop13.0.02 of 4See more

account-lookup-service-admin mojaloop 13.0.0

2 of the 4 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
protobufjs-websocket-example@1.1.0
no fix listed
mojaloop/event-sidecar:v11.0.189b8ab71b74b
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

11,695
admin-api-svcmojaloop12.0.02 of 4See more

admin-api-svc mojaloop 12.0.0

2 of the 4 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
mojaloop/central-ledger:v13.14.01abc8a7aa71c
protobufjs-websocket-example@1.1.0
no fix listed
mojaloop/event-sidecar:v11.0.189b8ab71b74b
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

12,108
fspiop-transfer-api-svcmojaloop12.0.12 of 3See more

fspiop-transfer-api-svc mojaloop 12.0.1

2 of the 3 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
mojaloop/event-sidecar:v11.0.189b8ab71b74b
protobufjs-websocket-example@1.1.0
no fix listed
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

11,479
mojaloopmojaloop14.0.04 of 6See more

mojaloop mojaloop 14.0.0

4 of the 6 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
protobufjs-websocket-example@1.1.0
no fix listed
mojaloop/central-ledger:v13.14.01abc8a7aa71c
protobufjs-websocket-example@1.1.0
no fix listed
mojaloop/event-sidecar:v11.0.189b8ab71b74b
protobufjs-websocket-example@1.1.0
no fix listed
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

19,226
myappp4-helm0.1.01 of 6See more

myapp p4-helm 0.1.0

1 of the 6 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
fjvela/urjc-fjvela-external-service:1.0.1a8ebe5ca13fc
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

19,720
practica-helmpractica-helm0.1.01 of 7See more

practica-helm practica-helm 0.1.0

1 of the 7 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
slagattollas/weatherservice-practica:latest68e7f56393fc
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

28,484
pachydermstatcan0.5.11 of 4See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
pachyderm/grpc-proxy:0.4.92b27f41d4d02
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

4,967
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry MAL-2025-5721.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
protobufjs-websocket-example@1.1.0
no fix listed

Open the chart page →

22,665

Container images carrying it

12 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
mojaloop/event-sidecar:v11.0.189b8ab71b74b
protobufjs-websocket-example@1.1.0
no fix listed
5
oscarsotosanchez/weatherservice:v1.0911ec961d10b
protobufjs-websocket-example@1.1.0
no fix listed
4
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
protobufjs-websocket-example@1.1.0
no fix listed
3
fjvela/urjc-fjvela-external-service:1.0.1a8ebe5ca13fc
protobufjs-websocket-example@1.1.0
no fix listed
2
mojaloop/central-ledger:v13.14.01abc8a7aa71c
protobufjs-websocket-example@1.1.0
no fix listed
2
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
protobufjs-websocket-example@1.1.0
no fix listed
2
davidvmar/urjc-davidvmar-external-service:1.0.02a68e9ac7f09
protobufjs-websocket-example@1.1.0
no fix listed
1
pachyderm/grpc-proxy:0.4.92b27f41d4d02
protobufjs-websocket-example@1.1.0
no fix listed
1
slagattollas/weatherservice-practica:latest68e7f56393fc
protobufjs-websocket-example@1.1.0
no fix listed
1
temporalio/web:1.14.033cfa863d8ce
protobufjs-websocket-example@1.1.0
no fix listed
1
gcr.io/google-samples/microservices-demo/currencyservice:v0.2.349d458a3650f
protobufjs-websocket-example@1.1.0
no fix listed
1
gcr.io/google-samples/microservices-demo/paymentservice:v0.2.36eb201217a8f
protobufjs-websocket-example@1.1.0
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.