Ecosystem	Package	Version

Vulnerabilities

sonatype-2026-000054

sonatype-2026-000054

Malicious Packages - Thu Jan 08 2026 [Lazarus] [Loader] [Credential Info Stealer]

Published Jan 8, 2026

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-386.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-387.json

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	chai-async-chain	2.4.1
npm	chai-async-chains	2.4.2
npm	chai-await-chain	2.4.2
npm	chai-await-chain	2.4.3
npm	chai-await-test	2.4.1
npm	chai-chain-async	0.0.1-security
npm	chai-chain-async	2.4.3
npm	chai-chains-async	2.4.3
npm	chai-dex	0.0.1-security
npm	chai-dex	2.4.2
npm	chai-max	2.4.2
npm	chai-max	2.4.3
npm	chai-min	2.4.2
npm	chai-promise-chain	2.4.1
npm	chai-promised-chain	2.4.2
npm	chai-promised-chains	2.4.2
npm	chai-promised-expect	2.4.1
npm	chai-proxify	2.4.2
npm	chai-proxy	2.4.2
npm	chai-proxy	2.4.3
npm	chai-px	2.4.2
npm	chai-status	2.4.2
npm	cross-sessions	2.4.1
npm	error-fallback	2.4.2
npm	fileupload-core	2.4.3
npm	fileupload-util	2.4.3
npm	fileuploadcore	2.4.3
npm	parse-session	2.4.1
npm	session-expire	2.4.1
npm	session-parse	2.4.1

sonatype-2026-000054 | Components Impacted | Sonatype Guide | Sonatype Guide