Ecosystem	Package	Version

Vulnerabilities

sonatype-2026-000647

sonatype-2026-000647

Malicious Packages - Wed Feb 25 2026 [Info Stealer]

Published Mar 2, 2026

https://help.sonatype.com/en/sonatype-malware-data.html https://osv-vulnerabilities.storage.googleapis.com/PyPI/MAL-2026-1080.json https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-1217.json

CVSS ScoreMedium

5.3

Ecosystem	Package	Version


npm	@vk-cloud-billing/common	0.0.1-security
npm	@vk-cloud-billing/common	0.17.0
npm	@vk-cloud-billing/common	0.17.1
npm	@vk-cloud-billing/common	0.17.4
npm	@vk-cloud-billing/common	0.17.5
npm	@vk-cloud-billing/common	0.17.6
npm	@vk-cloud-billing/common	0.17.7
npm	@vk-cloud-billing/common	0.17.8
npm	attacker-evil-mcp	1.0.0
pypi	curl-requester	0.1.0
pypi	hashtools32	1.0.0
pypi	hashtools32	2.1.0
npm	mtpdb	0.1.0
npm	mtpdb	0.1.1
npm	mtpdb	0.1.2
npm	mtpdb	0.2.0
npm	mtpdb	0.2.1
npm	mtpdb	0.2.2
npm	mtpdb	0.3.0
npm	pd-design-tokens	1.0.0
npm	pd-design-tokens	1.12.0
npm	pd-design-tokens	1.13.0
npm	pd-design-tokens	1.13.1
npm	pd-design-tokens	1.13.2
npm	pd-vault-client-api	2.2.0
npm	pd-vault-client-api	2.3.0
npm	pd-vault-client-api	2.3.1

sonatype-2026-000647 | Components Impacted | Sonatype Guide | Sonatype Guide