Ecosystem	Package	Version

Vulnerabilities

sonatype-2025-004333

sonatype-2025-004333

Malicious Packages - Wed Oct 29 2025 [Dropper] [BeaverTail] [InvisibleFerret] [Lazarus]

Published Oct 29, 2025

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-191566.json

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	async-chai	2.2.8
npm	async-chai	2.3.0
npm	babel-cli-ganache	2.2.8
npm	babel-ganache	2.2.4
npm	babel-ganache	2.2.6
npm	babel-ganache	2.2.7
npm	chai-async	2.2.6
npm	chai-async	2.2.8
npm	chai-async-chain	2.4.1
npm	chai-async-chains	2.4.2
npm	chai-async-flow	2.2.6
npm	chai-await-asserts	2.2.6
npm	chai-await-chain	2.4.2
npm	chai-await-chain	2.4.3
npm	chai-await-test	2.4.1
npm	chai-await-utils	2.2.6
npm	chai-chain-async	2.4.3
npm	chai-chains-async	2.4.3
npm	chai-promise-chain	2.2.6
npm	chai-promise-chain	2.2.8
npm	chai-promise-chain	2.3.2
npm	chai-promise-chain	2.4.1
npm	chai-promise-suite	2.2.6
npm	chai-promised-chain	2.4.2
npm	chai-promised-chains	2.4.2
npm	chai-promised-expect	2.4.1
npm	chai-proxy	2.4.2
npm	chai-sync	2.2.4
npm	chai-sync	2.2.6
npm	cookie-validate	2.2.4
npm	cross-session	2.2.8
npm	cross-sessions	2.2.6
npm	cross-sessions	2.2.7
npm	cross-sessions	2.2.8
npm	cross-sessions	2.4.1
npm	error-fallback	2.2.8
npm	error-fallback	2.4.2
npm	express-xmlrequest	2.2.8
npm	fileupload-core	2.4.3
npm	fileupload-util	2.4.3
npm	fileuploadcore	2.4.3
npm	parse-session	2.4.1
npm	session-expire	2.4.1
npm	session-parse	2.4.1
npm	session-validate	2.2.4
npm	session-validate	2.2.6
npm	sessionfiy	2.2.8
npm	sessionxml	2.2.0
npm	sessionxml	2.2.4

sonatype-2025-004333 | Components Impacted | Sonatype Guide | Sonatype Guide