Ecosystem	Package	Version

Vulnerabilities

sonatype-2025-007257

sonatype-2025-007257

Malicious Packages - Mon Nov 24 2025 [Dropper] [Lazarus]

Published Nov 25, 2025

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-192803.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-192807.json

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	assert-json-not	2.3.5
npm	auth-handler	1.0.0
npm	auth-handler	2.5.8
npm	chai-as-sorted	2.3.10
npm	chai-as-sorted	2.3.11
npm	chai-as-sorted	2.3.8
npm	chai-as-tested	2.3.8
npm	chai-async-chain	2.4.1
npm	chai-async-chains	2.4.2
npm	chai-await-chain	2.4.2
npm	chai-await-chain	2.4.3
npm	chai-await-test	2.4.1
npm	chai-chain-async	2.4.3
npm	chai-chains-async	2.4.3
npm	chai-promise-chain	2.4.1
npm	chai-promised-chain	2.4.2
npm	chai-promised-chains	2.4.2
npm	chai-promised-expect	2.4.1
npm	chai-proxy	2.4.2
npm	cookie-breaker	1.1.0
npm	cross-sessions	2.4.1
npm	database-mongoose-kit	2.1.0
npm	error-fallback	2.4.2
npm	fileupload-core	2.4.3
npm	fileupload-util	2.4.3
npm	fileuploadcore	2.4.3
npm	init-router	2.0.1
npm	initial-path21	3.3.9
npm	json-panels	2.3.8
npm	loger-parser	2.3.6
npm	parse-session	2.4.1
npm	react-flex-tools	2.0.1
npm	session-expire	2.4.1
npm	session-keeper	2.4.5
npm	session-keeper	2.5.5
npm	session-parer	2.3.8
npm	session-parse	2.4.1
npm	smart-parser	2.0.1

sonatype-2025-007257 | Components Impacted | Sonatype Guide | Sonatype Guide