Ecosystem	Package	Version

Vulnerabilities

sonatype-2026-000257

sonatype-2026-000257

Malicious Packages - Wed Jan 28 2026 [Lazarus] [Dropper/Loader]

Published Jan 28, 2026

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-719.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-720.json

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	bcryptjs-node-js	3.3.6
npm	chai-as-executed	2.3.4
npm	chai-as-hashed	2.3.4
npm	chai-as-produced	7.0.1
npm	chai-as-prompt	1.2.7
npm	chai-as-prop	1.1.7
npm	chai-as-prop	5.1.7
npm	chai-as-sync	1.1.7
npm	chai-async	1.1.7
npm	chai-async-promised	0.0.1-security
npm	chai-async-promised	3.3.5
npm	chai-async-test	3.3.5
npm	chai-async-tests	3.3.5
npm	chai-auth	5.1.0
npm	chai-await-promised	3.3.5
npm	chai-bin	1.1.7
npm	chai-conf	1.1.7
npm	chai-dev	1.1.9
npm	chai-grab	0.0.1-security
npm	chai-grab	1.1.7
npm	chai-iotype	1.1.7
npm	chai-mui	1.1.9
npm	chai-nerd	1.1.7
npm	chai-pack	1.1.7
npm	chai-pack	1.1.9
npm	chai-pack	5.1.0
npm	chai-patch	1.1.7
npm	chai-patch	1.1.9
npm	chai-promised-async	3.3.5
npm	chai-promised-await	3.3.5
npm	chai-promised-cli	3.3.5
npm	chai-prop	1.1.7
npm	chai-proto	1.1.7
npm	chai-reg	1.1.9
npm	chai-set	1.1.9
npm	chai-sub	1.1.7
npm	chai-sync	1.1.9
npm	chai-test-async	3.3.5
npm	chai-test-await	3.3.5
npm	chai-tests-async	3.3.5
npm	chai-tests-await	3.3.5
npm	chai-type	5.1.0
npm	chai-types	1.1.7
npm	chai-vest	1.1.9
npm	chain-test-async	3.3.5
npm	dotenv-embed	3.3.5
npm	dotenv-embedded	3.3.5
npm	dotenv-expanded	3.3.5
npm	dotenv-extend	3.3.5
npm	dotenv-intend	3.3.5

sonatype-2026-000257 | Components Impacted | Sonatype Guide | Sonatype Guide