Ecosystem	Package	Version

Vulnerabilities

sonatype-2026-000086

sonatype-2026-000086

Malicious Packages - Fri Jan 09 2026 [Lazarus] [Dropper/Loader]

Published Jan 9, 2026

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-409.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-415.json

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	bcryptjs-node-js	3.3.6
npm	chai-async-promised	3.3.5
npm	chai-async-test	0.0.1-security
npm	chai-async-test	3.3.5
npm	chai-async-tests	3.3.5
npm	chai-await-promised	3.3.5
npm	chai-promised-async	3.3.5
npm	chai-promised-await	3.3.5
npm	chai-promised-cli	3.3.5
npm	chai-test-async	3.3.5
npm	chai-test-await	3.3.5
npm	chai-tests-async	3.3.5
npm	chai-tests-await	3.3.5
npm	chain-test-async	3.3.5
npm	dotenv-embed	3.3.5
npm	dotenv-embedded	3.3.5
npm	dotenv-expanded	0.0.1-security
npm	dotenv-expanded	3.3.5
npm	dotenv-extend	3.3.5
npm	dotenv-intend	3.3.5
npm	dotenv-intended	3.3.5
npm	dotenv-mono-cli	3.3.5
npm	dotenv-nodejs	3.3.5
npm	dotenv-plugin	3.3.5
npm	validator-node	3.3.4

sonatype-2026-000086 | Components Impacted | Sonatype Guide | Sonatype Guide