Ecosystem	Package	Version

Vulnerabilities

sonatype-2025-007267

sonatype-2025-007267

Malicious Packages - Tue Nov 25 2025 [Credential Info Stealer]

Published Nov 25, 2025

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-191467.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-192375.json

CVSS ScoreHigh

7.1

Ecosystem	Package	Version


npm	dise-pkt	1.0.2
npm	flip-prx	1.0.2
npm	four-sdk-aes-ipheriv	1.0.0
npm	four-sdk-aes-ipheriv	1.0.1
npm	mayhem-wma	1.0.1
npm	mcp-polymarket	0.5.2
npm	mcp-polymarket	0.5.3
npm	portal-aes	1.3.3
npm	portal-lim	1.3.4
npm	portal-lime	2.1.3
npm	portal-lise	2.1.4
npm	tensor-fi-utils-core	0.0.1-security
npm	tensor-fi-utils-core	1.0.0
npm	tensor-fi-utils-core	1.0.1
npm	tensor-fi-utils-core	1.0.2
npm	tensor-fi-utils-core	1.0.4
npm	tensor-fi-utils-core	1.1.0
npm	tensor-fi-utils-core	1.3.0
npm	tensor-fi-utils-lib	1.2.2
npm	tensor-fi-utils-lib	1.2.6
npm	tensorfi-secure-hash	1.0.0
npm	tensorfi-secure-hash	1.1.0
npm	xrpl-api	0.0.1-security
npm	xrpl-api	3.7.21

sonatype-2025-007267 | Components Impacted | Sonatype Guide | Sonatype Guide