Ecosystem	Package	Version

Vulnerabilities

sonatype-2025-007384

sonatype-2025-007384

Malicious Packages - Tue Dec 02 2025 [Dropper] [Backdoor]

Published Dec 2, 2025

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-192574.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-192578.json

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	bigmathex	1.0.2
npm	bigmathix	1.0.2
npm	bigmathix	1.0.3
npm	bigmathix	1.0.4
npm	bigmathix	1.0.5
npm	bigmathix	1.0.6
npm	bigmathlib	1.0.0
npm	bigmathlib	1.0.2
npm	bignumberx	1.0.0
npm	bignumex	0.0.1-security
npm	bignumex	1.0.0
npm	bignumex	1.0.1
npm	bignumx	1.0.0
npm	multer-odm	1.0.0
npm	multer-odm	2.0.1
npm	multer-odm	2.0.2
npm	multer-odm	2.0.3
npm	xboxlive-auth	0.0.1-security
npm	xboxlive-auth	1.5.7
npm	xboxlive-auth	1.9.7

sonatype-2025-007384 | Components Impacted | Sonatype Guide | Sonatype Guide