Ecosystem	Package	Version

Vulnerabilities

sonatype-2025-004216

sonatype-2025-004216

cookie-validate - Mon Oct 20 2025 [Dropper] [BeaverTail] [Lazarus]

Published Oct 21, 2025

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-191569.json

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	async-chai	2.2.8
npm	async-chai	2.3.0
npm	babel-cli-ganache	2.2.8
npm	babel-ganache	2.2.4
npm	babel-ganache	2.2.6
npm	babel-ganache	2.2.7
npm	chai-async	2.2.6
npm	chai-async	2.2.8
npm	chai-async-flow	2.2.6
npm	chai-await-asserts	2.2.6
npm	chai-await-utils	2.2.6
npm	chai-promise-chain	2.2.6
npm	chai-promise-chain	2.2.8
npm	chai-promise-chain	2.3.2
npm	chai-promise-suite	2.2.6
npm	chai-sync	2.2.4
npm	chai-sync	2.2.6
npm	cookie-validate	2.2.4
npm	cross-session	2.2.8
npm	cross-sessions	2.2.6
npm	cross-sessions	2.2.7
npm	cross-sessions	2.2.8
npm	error-fallback	2.2.8
npm	express-xmlrequest	2.2.8
npm	session-validate	2.2.4
npm	session-validate	2.2.6
npm	sessionfiy	2.2.8
npm	sessionxml	2.2.0
npm	sessionxml	2.2.4

sonatype-2025-004216 | Components Impacted | Sonatype Guide | Sonatype Guide