Ecosystem	Package	Version

Vulnerabilities

sonatype-2026-000694

sonatype-2026-000694

Malicious Packages - Tue Mar 03 2026 [Lazarus] [Dropper]

Published Mar 3, 2026

https://help.sonatype.com/en/sonatype-malware-data.html

CVSS ScoreHigh

8.7

Ecosystem	Package	Version


npm	chai-as-constrained	2.0.3
npm	chai-as-constrained	2.0.6
npm	chai-as-flex	7.2.8
npm	chai-as-mock	7.2.6
npm	chai-as-proofed	5.0.5
npm	chai-as-refined	7.0.2
npm	graphcore-js	2.1.10
npm	graphcore-js	2.1.11
npm	graphcore-js	2.1.8
npm	graphcore-js	2.1.9
npm	graphcore-js	2.2.0
npm	graphcore-js	2.2.1
npm	graphcore-js	2.2.2
npm	graphcore-js	2.3.0
npm	graphcore-js	2.3.1
npm	graphcore-js	2.3.2
npm	graphcore-js	2.3.3
npm	graphcore-js	2.3.4
npm	graphcore-js	2.4.0
npm	graphcore-js	2.4.1
npm	graphcore-js	2.4.2
npm	graphcore-js	2.4.3
npm	graphcore-js	2.4.4

sonatype-2026-000694 | Components Impacted | Sonatype Guide | Sonatype Guide