Components
Vulnerabilities
Pricing
MCP
Docs
Sign up
Login
Find vulnerabilities. Fix fast with AI.
Search components by package, version, or CVE to get started.
Ecosystem
Package
Version
Vulnerabilities
sonatype-2025-007287
sonatype-2025-007287
Malicious Packages - Mon Nov 24 2025 [Dropper] [Lazarus]
Published Nov 26, 2025
https://help.sonatype.com/en/sonatype-malware-data.html
CVSS Score
High
8.7
Components Impacted
Components Impacted
Security Details
Security Details
Sonatype Research
Sonatype Research
Ecosystem
Package
Version
Ecosystem
Package
Version
npm
chai-async-chain
2.4.1
npm
chai-async-chains
2.4.2
npm
chai-await-chain
2.4.2
npm
chai-await-chain
2.4.3
npm
chai-await-test
2.4.1
npm
chai-chain-async
2.4.3
npm
chai-chains-async
2.4.3
npm
chai-promise-chain
2.4.1
npm
chai-promised-chain
2.4.2
npm
chai-promised-chains
2.4.2
npm
chai-promised-expect
2.4.1
npm
chai-proxy
2.4.2
npm
cookie-mapper
1.1.0
npm
cross-sessions
2.4.1
npm
database-mongoose-kit
2.1.0
npm
error-fallback
2.4.2
npm
fileupload-core
2.4.3
npm
fileupload-util
2.4.3
npm
fileuploadcore
2.4.3
npm
init-router
2.0.1
npm
parse-session
2.4.1
npm
react-flex-tools
2.0.1
npm
session-expire
2.4.1
npm
session-parse
2.4.1
npm
smart-parser
2.0.1
1-25 of 25
sonatype-2025-007287 | Components Impacted | Sonatype Guide | Sonatype Guide
