Ecosystem	Package	Version

Vulnerabilities

sonatype-2026-000107

sonatype-2026-000107

Malicious Packages - Tue Jan 13 2026 [RCE/Reverse Shell]

Published Jan 13, 2026

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-439.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-534.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-545.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-546.json

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	internallib_v828	0.0.1-security
npm	internallib_v828	1.0.0
npm	internallib_v828	1.0.1
npm	internallib_v828	1.0.2
npm	internallib_v828	1.0.3
npm	internallib_v828	2.0.0
npm	internallib_v828	3.69.69
npm	internallib_v828	4.0.0
npm	testxhjhka	0.0.1-security
npm	testxhjhka	1.6.0
npm	tv-admin-commons	0.0.1-security
npm	tv-admin-commons	0.2.29
npm	tv-admin-commons	0.2.30
npm	xhjxhjhiagent	0.0.1-security
npm	xhjxhjhiagent	1.6.0

sonatype-2026-000107 | Components Impacted | Sonatype Guide | Sonatype Guide