Ecosystem	Package	Version

Vulnerabilities

sonatype-2026-000192

sonatype-2026-000192

Malicious Packages - Tue Jan 20 2026 [RCE/C2 Agent] [Obfuscated]

Published Jan 20, 2026

https://help.sonatype.com/en/sonatype-malware-data.html

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	env-workflow-test	2.1.10
npm	env-workflow-test	2.1.12
npm	env-workflow-test	2.1.13
npm	env-workflow-test	2.1.14
npm	env-workflow-test	2.1.15
npm	env-workflow-test	2.1.16
npm	env-workflow-test	2.1.17
npm	env-workflow-test	2.1.18
npm	env-workflow-test	2.1.19
npm	env-workflow-test	2.1.20
npm	env-workflow-test	2.1.21
npm	env-workflow-test	2.1.22
npm	env-workflow-test	2.1.23
npm	env-workflow-test	2.1.5
npm	env-workflow-test	2.1.6
npm	env-workflow-test	2.1.7
npm	env-workflow-test	2.1.8
npm	env-workflow-test	2.1.9
npm	sra-test-test	1.1.26
npm	sra-test-test	1.1.27
npm	sra-test-test	1.1.28
npm	sra-test-test-test	1.1.38
npm	sra-test-test-test	1.1.39
npm	sra-test-test-test	1.1.40
npm	sra-test-test-test	1.1.41
npm	sra-test-test-test	1.1.42
npm	sra-test-test-tester	1.1.41
npm	sra-test-test-tester	1.1.42
npm	sra-test-test-tester	1.1.43
npm	sra-test-test-tester	1.1.44
npm	sra-test-test-tester	1.1.45
npm	sra-test-test-tester	1.1.46
npm	sra-testing-test	3.0.7
npm	vg-ccc-client	3.0.5
npm	vg-dev-env	1.9.9
npm	vg-dev-env	2.9.9
npm	vg-dev-env	5.9.9
npm	vg-env-enum-test-local	1.0.1
npm	vg-env-enum-test-local	1.0.2
npm	vg-env-enum-test-local	1.0.3
npm	vg-gatekeeper	3.0.5
npm	vg-tea-leaf	3.3.2
npm	vg-test-env	2.9.5
npm	vg-test-env	5.9.5
npm	vg-tester	1.8.8
npm	vg-tester	2.9.8
npm	vg-tester	5.9.8

sonatype-2026-000192 | Components Impacted | Sonatype Guide | Sonatype Guide