Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Malicious npm package 'sonatype' installed, compromise possible
published 5 years ago
Summary
A malicious package called 'sonatype' was found in the npm registry. If your computer has this package installed, it's possible that an attacker has taken control of your computer and accessed sensitive information. Immediately rotate any secrets or keys from a different computer and remove the package, but be aware that removal may not guarantee all malicious activity is stopped.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | lisayu | sonatype | >= 0.0.0 |
Original advisory text
Malicious npm package: sonatype
The npm `sonatype` package has been identified as malicious and removed from the npm package registry.
## Remediation
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
## Remediation
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Type
CWE-506Embedded Malicious Code
Timeline
Published29 Jan 2021
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-w8fh-pvq2-x8c4 · GHSA
Track software like this
Free during beta