# sonatype-2026-004261

Malicious Packages - Thu Jun 25 2026 [SECRETS_EXFILTRATION]

Published Jun 25, 2026

## CVSS Score
Critical

**9.3**

## Security Details
### Components Impacted

Sonatype Research

### sonatype-2026-004261 Security Details

**CVE ID**  sonatype-2026-004261

**CVE Description**  Malicious Packages - Thu Jun 25 2026 [SECRETS_EXFILTRATION]

**Published**  Jun 25, 2026

### CVSS Score & Severity

**9.3** Critical

**CVSS Vector**  CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:H/SA:N

**EPSS Score**  0%

## Malware
malware

## KEV Status
Not in KEV Catalog: No known exploits

## Affected Ecosystems

affected

## Source
Sonatype

## References
- [help.sonatype.com](https://help.sonatype.com/en/sonatype-malware-data.html)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6417.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6418.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6419.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6420.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6421.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6422.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6423.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6424.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6425.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6426.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6427.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6428.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6429.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6430.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6431.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6432.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6433.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6434.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6435.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6436.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6491.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6492.json)
- [OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6493.json)