# sonatype-2023-4000

## Malicious Packages at 13 September 2023

Published Sep 13, 2023

[help.sonatype.com](https://help.sonatype.com/en/sonatype-malware-data.html)  [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2023-8097.json)  [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2023-8098.json)  [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2023-8099.json)  [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2023-8105.json)  [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2024-2688.json)  [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2024-2695.json)  [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2024-3150.json)

**CVSS Score**: Critical 10.0

### Security Details

**CVE ID**: sonatype-2023-4000  
**CVE Description**: Malicious Packages at 13 September 2023  
**Published**: Sep 14, 2023

**CVSS Score & Severity**: 10.0 Critical  
**CVSS Vector**: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

**EPSS Score**: 0%

**Malware**: malware

**KEV Status**: Not in KEV Catalog: No known exploits

### Affected Ecosystems

**Source**: Sonatype

### References