# sonatype-2020-1058

## twilio-npm - Malicious packages - November 2, 2020

**Published**: Nov 2, 2020  
**CVSS Score**: Critical  
**Score**: 9.8

## Security Details
### Components Impacted

### Security Details
- **CVE ID**: sonatype-2020-1058  
- **CVE Description**: twilio-npm - Malicious packages - November 2, 2020  
- **Published**: Nov 2, 2020  
- **CVSS Score & Severity**: 9.8 Critical  
- **CVSS Vector**: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H  
- **EPSS Score**: 0%

## Malware
- **Malware**: malware

## KEV Status
- **Not in KEV Catalog**: No known exploits

## Affected Ecosystems
- **Source**: Sonatype

## References
- [Sonatype Blog](https://blog.sonatype.com/twilio-npm-is-brandjacking-malware-in-disguise)  
- [Sonatype Help](https://help.sonatype.com/en/sonatype-malware-data.html)  
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-37375.json)