Ecosystem	Package	Version

Vulnerabilities

sonatype-2026-000584

sonatype-2026-000584

Malicious Packages - Wed Feb 25 2026 [Lazarus] [Dropper]

Published Feb 25, 2026

https://help.sonatype.com/en/sonatype-malware-data.html

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	align-configer	3.4.2
npm	align-configer	3.4.3
npm	aligned-array	3.4.3
npm	aligned-array	3.4.4
npm	aligntype	3.3.8
npm	aligntype	3.3.9
npm	aligntypeer	3.3.9
npm	aligntyper	3.3.9
npm	chai-as-prompt	1.2.7
npm	chai-as-prop	1.1.7
npm	chai-as-prop	5.1.7
npm	chai-as-sync	1.1.7
npm	chai-async	1.1.7
npm	chai-auth	5.1.0
npm	chai-await	2.4.5
npm	chai-await-cli	2.3.5
npm	chai-await-test	2.3.7
npm	chai-bin	1.1.7
npm	chai-cli	2.4.5
npm	chai-cli-async	3.3.5
npm	chai-cli-await	2.4.5
npm	chai-cli-sinon	2.4.5
npm	chai-conf	1.1.7
npm	chai-dev	1.1.9
npm	chai-grab	1.1.7
npm	chai-iotype	1.1.7
npm	chai-jsons	3.3.7
npm	chai-jsons	3.3.8
npm	chai-mui	1.1.9
npm	chai-nerd	1.1.7
npm	chai-pack	1.1.7
npm	chai-pack	1.1.9
npm	chai-pack	5.1.0
npm	chai-patch	1.1.7
npm	chai-patch	1.1.9
npm	chai-promise-tools	3.3.5
npm	chai-promised-plugin	2.3.5
npm	chai-promised-tools	3.3.5
npm	chai-prop	1.1.7
npm	chai-proto	1.1.7
npm	chai-reg	1.1.9
npm	chai-set	1.1.9
npm	chai-sub	1.1.7
npm	chai-sync	1.1.9
npm	chai-tools	3.3.5
npm	chai-type	5.1.0
npm	chai-types	1.1.7
npm	chai-uuids	2.3.7
npm	chai-vest	1.1.9
npm	chain-cli-promised	2.3.5

sonatype-2026-000584 | Components Impacted | Sonatype Guide | Sonatype Guide