# sonatype-2026-003558

Malicious Packages - Wed Jun 03 2026 \[Lazarus\] \[Dropper\]

Published Jun 3, 2026

CVSS Score High

8.7

## Security Details

### Components Impacted

### sonatype-2026-003558 Security Details

**CVE ID** sonatype-2026-003558  
**CVE Description** Malicious Packages - Wed Jun 03 2026 \[Lazarus\] \[Dropper\]  
**Published** Jun 3, 2026  
**CVSS Score & Severity**  
8.7 High  
**CVSS Vector** CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N  
**EPSS Score** 0%

### Malware

malware

### KEV Status

Not in KEV Catalog: No known exploits

### Affected Ecosystems

affected

**Source** Sonatype

**References**  
[help.sonatype.com](https://help.sonatype.com/en/sonatype-malware-data.html "https://help.sonatype.com/en/sonatype-malware-data.html") THIRD_PARTY  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5087.json "https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5087.json") THIRD_PARTY  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5169.json "https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5169.json") THIRD_PARTY  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5175.json "https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5175.json") THIRD_PARTY  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5406.json "https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5406.json") THIRD_PARTY  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5488.json "https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5488.json") THIRD_PARTY  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5734.json "https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5734.json") THIRD_PARTY  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5908.json "https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-5908.json") THIRD_PARTY  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6098.json "https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6098.json") THIRD_PARTY  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6141.json "https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6141.json") THIRD_PARTY  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-7235.json "https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-7235.json") THIRD_PARTY  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-7242.json "https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-7242.json") THIRD_PARTY