# sonatype-2020-1168

jdb.js, db-json.js - Malicious packages - njRAT/Bladabindi Remote Access Trojan (27 November 2020)

Published Nov 27, 2020

[blog.sonatype.com](https://blog.sonatype.com/bladabindi-njrat-rat-in-jdb.js-npm-malware) [help.sonatype.com](https://help.sonatype.com/en/sonatype-malware-data.html) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-18094.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-23714.json)

## CVSS Score
Critical  
10.0

## Security Details  
### Components Impacted

### Security Details

**CVE ID**: sonatype-2020-1168  
**CWE**: N/A  
**CVE Description**: jdb.js, db-json.js - Malicious packages - njRAT/Bladabindi Remote Access Trojan (27 November 2020)  
**Published**: Nov 27, 2020

### CVSS Score & Severity
10.0 Critical  
**CVSS Vector**: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H  
**EPSS Score**: 0%

### Malware  
malware

### KEV Status  
Not in KEV Catalog: No known exploits

### Affected Ecosystems  
affected

### Source  
Sonatype

### References  
[blog.sonatype.com](https://blog.sonatype.com/bladabindi-njrat-rat-in-jdb.js-npm-malware)  
[help.sonatype.com](https://help.sonatype.com/en/sonatype-malware-data.html)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-18094.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-23714.json)