Ecosystem	Package	Version

Vulnerabilities

sonatype-2025-004438

sonatype-2025-004438

Malicious Packages - Tue Nov 04 2025 [Dropper][Lazarus]

Published Nov 5, 2025

https://help.sonatype.com/en/sonatype-malware-data.html

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	align-configer	3.4.2
npm	align-configer	3.4.3
npm	aligned-array	3.4.3
npm	aligned-array	3.4.4
npm	aligntype	3.3.8
npm	aligntype	3.3.9
npm	aligntypeer	3.3.9
npm	aligntyper	3.3.9
npm	chai-as-prompt	1.2.7
npm	chai-as-prop	1.1.7
npm	chai-as-prop	5.1.7
npm	chai-as-sorted	2.3.10
npm	chai-as-sorted	2.3.11
npm	chai-as-sorted	2.3.8
npm	chai-as-sync	1.1.7
npm	chai-as-tested	2.3.8
npm	chai-async	1.1.7
npm	chai-async-chain	2.4.1
npm	chai-async-chains	2.4.2
npm	chai-auth	5.1.0
npm	chai-await-chain	2.4.2
npm	chai-await-chain	2.4.3
npm	chai-await-test	0.0.1-security
npm	chai-await-test	2.2.6
npm	chai-await-test	2.2.8
npm	chai-await-test	2.3.0
npm	chai-await-test	2.3.2
npm	chai-await-test	2.3.4
npm	chai-await-test	2.3.6
npm	chai-await-test	2.3.7
npm	chai-await-test	2.3.8
npm	chai-await-test	2.4.1
npm	chai-bin	1.1.7
npm	chai-chain-async	2.4.3
npm	chai-chains-async	2.4.3
npm	chai-conf	1.1.7
npm	chai-dev	1.1.9
npm	chai-grab	1.1.7
npm	chai-iotype	1.1.7
npm	chai-jsons	3.3.7
npm	chai-jsons	3.3.8
npm	chai-mui	1.1.9
npm	chai-nerd	1.1.7
npm	chai-pack	1.1.7
npm	chai-pack	1.1.9
npm	chai-pack	5.1.0
npm	chai-patch	1.1.7
npm	chai-patch	1.1.9
npm	chai-promise-chain	2.4.1
npm	chai-promised-chain	2.4.2

sonatype-2025-004438 | Components Impacted | Sonatype Guide | Sonatype Guide