# sonatype-2026-003429

Malicious Packages - Thu May 28 2026 [Dropper]

Published May 28, 2026

[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4843.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4844.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4845.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4846.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4847.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4848.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4849.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4850.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4851.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4852.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4853.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4854.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4855.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4856.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4857.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4858.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4863.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4864.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4865.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4866.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4867.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4869.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4870.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4872.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4873.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4874.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4875.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4876.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4878.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4879.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4880.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4881.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4882.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4883.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4884.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4886.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4887.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4888.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4890.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4891.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4892.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4893.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4894.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4895.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4896.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4897.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4898.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4899.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4900.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4901.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4902.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4903.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4904.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4905.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4906.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4907.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4908.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4909.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4910.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4911.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4912.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4913.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4914.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4915.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4916.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4917.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4918.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4919.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4920.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4921.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4922.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4923.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4924.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4925.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4927.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4928.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4929.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4930.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4931.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4933.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4934.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4935.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4936.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4937.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4938.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4939.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4940.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4941.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4943.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4944.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4945.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4946.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4947.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4949.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4950.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4951.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4952.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4953.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4954.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4955.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4956.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4957.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4958.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4959.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4960.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4961.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4962.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4963.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4964.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4965.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4966.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4967.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4968.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4969.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4970.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4971.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4972.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4974.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4975.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4976.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4977.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4978.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4979.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4980.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4981.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4982.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4983.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4985.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4986.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4987.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4990.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4992.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4994.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4995.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4996.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4998.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-4999.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5001.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5002.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5003.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5005.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5006.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5007.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5008.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5009.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5010.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5011.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5012.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5013.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5014.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5015.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5016.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5017.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5018.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5019.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5020.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5021.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5022.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5023.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5025.json) [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5026.json)

CVSS Score High

8.7

## Security Details

### Components Impacted

### Sonatype Research Data

**Explanation**  
Sonatype's security research team provides comprehensive analysis of this vulnerability, including detailed explanations of the attack vectors, affected code patterns, and real-world exploitation scenarios. This proprietary research helps development teams understand the full scope and impact of the security issue.

**Detection**  
Sonatype has advanced methods and detection techniques to detect whether your applications and infrastructure are affected by this vulnerability. Sonatype's detection guidance includes code patterns to search for, configuration checks to perform, and runtime indicators that signal potential exploitation.

**Recommendation**  
Sonatype provides expert remediation guidance tailored to this specific vulnerability, including mitigation strategies, secure coding practices, and version upgrade recommendations. Sonatype recommendations help you prioritize and implement fixes efficiently while minimizing risk to your applications.