# sonatype-2023-2789

darcyclarke-manifest-pkg - Potentially Unwanted Application [PUA]

Published Jun 28, 2023

[blog.vlt.sh](https://blog.vlt.sh/blog/the-massive-hole-in-the-npm-ecosystem)

## CVSS Score
**Critical**  
**10.0**

## Security Details
### Components Impacted
#### Sonatype Research

### sonatype-2023-2789 Security Details

**CVE ID**  
sonatype-2023-2789

**CVE Description**  
darcyclarke-manifest-pkg - Potentially Unwanted Application [PUA]

**Published**  
Jun 28, 2023

**CVSS Score & Severity**  
10.0 Critical

**CVSS Vector**  
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

**EPSS Score**  
0%

**Malware**  
malware

**KEV Status**  
Not in KEV Catalog: No known exploits

### Affected Ecosystems
Source  
Sonatype

### References
[blog.vlt.sh](https://blog.vlt.sh/blog/the-massive-hole-in-the-npm-ecosystem) THIRD_PARTY