Ecosystem	Package	Version

Vulnerabilities

sonatype-2025-004516

sonatype-2025-004516

Malicious Packages - Mon Nov 10 2025 [Dropper] [Lazarus]

Published Nov 10, 2025

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-190495.json

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	bcryptjs-node-js	3.3.6
npm	chai-async-promised	3.3.5
npm	chai-async-test	3.3.5
npm	chai-async-tests	3.3.5
npm	chai-await-promised	3.3.5
npm	chai-promised-async	3.3.5
npm	chai-promised-await	3.3.5
npm	chai-promised-cli	3.3.5
npm	chai-test-async	3.3.5
npm	chai-test-await	3.3.5
npm	chai-tests-async	3.3.5
npm	chai-tests-await	3.3.5
npm	chain-test-async	0.0.1-security
npm	chain-test-async	3.3.5
npm	dotenv-embed	3.3.5
npm	dotenv-embedded	3.3.5
npm	dotenv-expanded	3.3.5
npm	dotenv-extend	3.3.5
npm	dotenv-intend	3.3.5
npm	dotenv-intended	3.3.5
npm	dotenv-mono-cli	3.3.5
npm	dotenv-nodejs	3.3.5
npm	dotenv-plugin	3.3.5
npm	validator-node	3.3.4

sonatype-2025-004516 | Components Impacted | Sonatype Guide | Sonatype Guide