# sonatype-2025-000440

trufflevscode - Malicious Package - Tue Feb 04 2025 [Dropper]

Published Feb 5, 2025

[help.sonatype.com](https://help.sonatype.com/en/sonatype-malware-data.html) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-1261.json)

**CVSS Score:** High 8.7

## Security Details

### Components Impacted

#### Sonatype Research

### sonatype-2025-000440 Security Details

**CVE ID:** sonatype-2025-000440  
**CVE Description:** trufflevscode - Malicious Package - Tue Feb 04 2025 [Dropper]  
**Published:** Feb 5, 2025  
**CVSS Score & Severity:** 8.7 High  
**CVSS Vector:** CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N  
**EPSS Score:** 0%

### Malware

**KEV Status:** Not in KEV Catalog: No known exploits

### Affected Ecosystems

**Source:** Sonatype

### References

[help.sonatype.com](https://help.sonatype.com/en/sonatype-malware-data.html) THIRD_PARTY  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-1261.json) THIRD_PARTY