# sonatype-2026-004261

Malicious Packages - Thu Jun 25 2026 [SECRETS_EXFILTRATION]

Published Jun 25, 2026

[help.sonatype.com](https://help.sonatype.com/en/sonatype-malware-data.html)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6417.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6418.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6419.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6420.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6421.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6422.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6423.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6424.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6425.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6426.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6427.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6428.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6429.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6430.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6431.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6432.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6433.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6434.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6435.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6436.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6491.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6492.json)  
[OSV](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2026-6493.json)

CVSS Score: Critical  
**9.3**

## Security Details

### Components Impacted

#### Sonatype Research

### Sonatype Research Data

**Explanation**  
Sonatype's security research team provides comprehensive analysis of this vulnerability, including detailed explanations of the attack vectors, affected code patterns, and real-world exploitation scenarios. This proprietary research helps development teams understand the full scope and impact of the security issue.

**Detection**  
Sonatype has advanced methods and detection techniques to detect whether your applications and infrastructure are affected by this vulnerability. Sonatype's detection guidance includes code patterns to search for, configuration checks to perform, and runtime indicators that signal potential exploitation.

**Recommendation**  
Sonatype provides expert remediation guidance tailored to this specific vulnerability, including mitigation strategies, secure coding practices, and version upgrade recommendations. Sonatype recommendations help you prioritize and implement fixes efficiently while minimizing risk to your applications.