Ecosystem	Package	Version

Vulnerabilities

sonatype-2026-000263

sonatype-2026-000263

Malicious Packages - Thu Jan 29 2026 [Lazarus] [Dropper/Loader]

Published Jan 29, 2026

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-677.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-707.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-721.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-748.json

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	bcryptjs-node-js	3.3.6
npm	chai-async-promised	3.3.5
npm	chai-async-test	3.3.5
npm	chai-async-tests	3.3.5
npm	chai-await-promised	3.3.5
npm	chai-chai-chain-promised	2.4.3
npm	chai-promise-tools	0.0.1-security
npm	chai-promise-tools	3.3.5
npm	chai-promised-async	2.4.3
npm	chai-promised-async	3.3.5
npm	chai-promised-await	3.3.5
npm	chai-promised-cli	3.3.5
npm	chai-promised-tools	3.3.5
npm	chai-test-async	3.3.5
npm	chai-test-await	3.3.5
npm	chai-tests-async	3.3.5
npm	chai-tests-await	3.3.5
npm	chai-tools	3.3.5
npm	chain-test-async	3.3.5
npm	charswap	7.2.7
npm	cookie-parsers-env	3.3.5
npm	dotenv-embed	3.3.5
npm	dotenv-embedded	0.0.1-security
npm	dotenv-embedded	3.3.5
npm	dotenv-expanded	3.3.5
npm	dotenv-extend	3.3.5
npm	dotenv-intend	3.3.5
npm	dotenv-intended	3.3.5
npm	dotenv-mono-cli	3.3.5
npm	dotenv-nodejs	3.3.5
npm	dotenv-plugin	3.3.5
npm	dotjsenv	1.1.7
npm	dotnetenv	1.1.7
npm	js-coauth	7.2.7
npm	js-copack	1.1.7
npm	js-copack	1.1.8
npm	js-copack	7.2.7
npm	js-cotype	4.1.4
npm	js-multer	5.1.7
npm	js-nodecat	1.0.7
npm	js-repack	5.1.0
npm	js-unpack	0.0.1-security
npm	js-unpack	1.1.7
npm	js-unpack	1.1.8
npm	js-uponcaps	7.2.7
npm	json-getin	7.2.7
npm	json-oauth	7.2.7
npm	json-prop	2.0.7
npm	json-ptype	1.1.7
npm	json-swap	7.2.7

sonatype-2026-000263 | Components Impacted | Sonatype Guide | Sonatype Guide