Ecosystem	Package	Version

Vulnerabilities

sonatype-2025-007411

sonatype-2025-007411

Malicious Packages - Thu Nov 27 2025 [Backdoor]

Published Dec 3, 2025

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-191954.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-192025.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-192121.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-192139.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-192152.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-192192.json

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	elf-stats-evergreen-sled-681	1.0.0
npm	elf-stats-evergreen-sled-681	1.0.1
npm	elf-stats-evergreen-sled-681	1.0.2
npm	elf-stats-evergreen-sled-681	1.0.3
npm	elf-stats-evergreen-sled-681	1.0.4
npm	elf-stats-evergreen-sled-681	1.0.5
npm	elf-stats-rooftop-garland-184	1.0.0
npm	elf-stats-silvered-ornament-756	1.0.1
npm	elf-stats-snowdusted-bauble-104	1.0.0
npm	elf-stats-snuggly-workshop-421	9999.0.2
npm	elf-stats-snuggly-workshop-421	9999.0.3
npm	elf-stats-snuggly-workshop-421	9999.0.5
npm	elf-stats-snuggly-workshop-421	9999.0.6
npm	elf-stats-snuggly-workshop-421	9999.0.7
npm	elf-stats-whimsical-rocket-922	1.0.0
npm	elf-stats-whimsical-rocket-922	1.0.1
npm	elf-stats-whimsical-rocket-922	1.0.2

sonatype-2025-007411 | Components Impacted | Sonatype Guide | Sonatype Guide