Ecosystem	Package	Version

Vulnerabilities

sonatype-2026-000387

sonatype-2026-000387

Malicious Packages - Tue Feb 10 2026 [Dropper]

Published Feb 10, 2026

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-1179.json

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	chai-as-prompt	1.2.7
npm	chai-as-prop	1.1.7
npm	chai-as-prop	5.1.7
npm	chai-as-sync	1.1.7
npm	chai-async	1.1.7
npm	chai-auth	5.1.0
npm	chai-bin	1.1.7
npm	chai-conf	1.1.7
npm	chai-dev	1.1.9
npm	chai-grab	1.1.7
npm	chai-iotype	1.1.7
npm	chai-mui	1.1.9
npm	chai-nerd	1.1.7
npm	chai-pack	1.1.7
npm	chai-pack	1.1.9
npm	chai-pack	5.1.0
npm	chai-patch	1.1.7
npm	chai-patch	1.1.9
npm	chai-prop	1.1.7
npm	chai-proto	1.1.7
npm	chai-reg	1.1.9
npm	chai-set	1.1.9
npm	chai-sub	1.1.7
npm	chai-sync	1.1.9
npm	chai-type	5.1.0
npm	chai-types	1.1.7
npm	chai-vest	1.1.9
npm	magala	0.0.1-security
npm	magala	1.0.0
npm	magala	1.0.10
npm	magala	1.0.11
npm	magala	1.0.14
npm	magala	1.0.15
npm	magala	1.0.16
npm	magala	1.0.17
npm	magala	1.0.18
npm	magala	1.0.2
npm	magala	1.0.3
npm	magala	1.0.4
npm	magala	1.0.7
npm	magala	1.0.8
npm	magala	1.0.9

sonatype-2026-000387 | Components Impacted | Sonatype Guide | Sonatype Guide