Ecosystem	Package	Version

Vulnerabilities

sonatype-2025-007326

sonatype-2025-007326

Malicious Packages - Thu Nov 27 2025 [Dropper] [Lazarus]

Published Nov 28, 2025

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-192319.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-192398.json

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	chai-as-awaited	2.3.1
npm	chai-as-deployed	2.3.2
npm	chai-as-required	2.3.2
npm	chai-as-resolved	2.3.2
npm	chai-as-validated	0.0.1-security
npm	chai-as-validated	2.3.2
npm	chai-async-chain	2.4.1
npm	chai-async-chains	2.4.2
npm	chai-await-chain	2.4.2
npm	chai-await-chain	2.4.3
npm	chai-await-test	2.4.1
npm	chai-chain-async	2.4.3
npm	chai-chains-async	2.4.3
npm	chai-promise-chain	2.4.1
npm	chai-promised-chain	0.0.1-security
npm	chai-promised-chain	2.4.2
npm	chai-promised-chains	2.4.2
npm	chai-promised-expect	2.4.1
npm	chai-proxy	2.4.2
npm	cross-sessions	2.4.1
npm	database-mongoose-kit	0.0.1-security
npm	database-mongoose-kit	2.1.0
npm	error-fallback	2.4.2
npm	fileupload-core	2.4.3
npm	fileupload-util	2.4.3
npm	fileuploadcore	2.4.3
npm	init-router	2.0.1
npm	parse-session	2.4.1
npm	react-flex-tools	2.0.1
npm	session-expire	2.4.1
npm	session-parse	2.4.1
npm	smart-parser	2.0.1

sonatype-2025-007326 | Components Impacted | Sonatype Guide | Sonatype Guide