Ecosystem	Package	Version

Vulnerabilities

sonatype-2026-000255

sonatype-2026-000255

Malicious Packages - Wed Jan 28 2026 [Credential Info Stealer/Env Vars]

Published Jan 28, 2026

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-611.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-726.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-727.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-728.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-729.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-730.json

CVSS ScoreHigh

7.1

Ecosystem	Package	Version


npm	mbo-letters-cl	1.9.991
npm	mbo-letters-cl	1.9.992
npm	mbo-letters-cl	1.9.99
npm	mbo-letters-cl	1.9.9
npm	z-shop-event-bus	0.0.1-security
npm	z-shop-event-bus	1.0.0
npm	z-shop-event-bus	56.2.1
npm	z-shop-js-env	0.0.1-security
npm	z-shop-js-env	56.2.1
npm	z-shop-ui	0.0.1-security
npm	z-shop-ui	56.2.1
npm	zalando-consent-api	0.0.1-security
npm	zalando-consent-api	56.2.1
npm	zappr	0.0.1-security
npm	zappr	56.2.1

sonatype-2026-000255 | Components Impacted | Sonatype Guide | Sonatype Guide