# sonatype-2023-4004

Malicious Package at 15 September 2023

Published Sep 15, 2023

### Security Details

**CVE ID**: sonatype-2023-4004  
**CVE Description**: Malicious Package at 15 September 2023  
**CVSS Score & Severity**: 10.0 Critical  
**CVSS Vector**: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H  
**EPSS Score**: 0%  
**Malware**: malicious  
**KEV Status**: Not in KEV Catalog: No known exploits

### Components Impacted
- Sonatype Research

### Affected Ecosystems
- Source: Sonatype

### References
- [help.sonatype.com](https://help.sonatype.com/en/sonatype-malware-data.html)  
- [OSV 1](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2023-8165.json)  
- [OSV 2](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2023-8167.json)  
- [OSV 3](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2023-8168.json)