Ecosystem	Package	Version

Vulnerabilities

sonatype-2025-007590

sonatype-2025-007590

Malicious Packages - Wed Dec 17 2025 [Credential Info Stealer]

Published Dec 17, 2025

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/PyPI/MAL-2025-192605.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-192602.json

CVSS ScoreHigh

7.1

Ecosystem	Package	Version


pypi	hexadec	0.0.1
pypi	hexadecpy	0.0.1
pypi	hexcon	0.0.1
pypi	hexdeci	0.0.1
pypi	hexdeclink	0.0.1
pypi	hexdecnet	0.0.1
npm	plugin-senna	0.0.1-security
npm	plugin-senna	9.3.127
npm	plugin-senna	9.3.128
npm	plugin-senna	9.3.129
npm	plugin-senna	9.3.130
npm	plugin-senna	9.3.131
npm	plugin-senna	9.3.132
npm	plugin-senna	9.3.133
npm	plugin-senna	9.3.134
pypi	troncloud	0.0.3
pypi	trondec	0.0.1
pypi	tronpad	0.0.1
npm	vitor-js	9.3.129
npm	vitor-js	9.3.130
npm	vitor-js	9.3.131

sonatype-2025-007590 | Components Impacted | Sonatype Guide | Sonatype Guide