Skip to main content

Sonatype Guide Security Events

Security Events is a curated view of important open-source security events. It includes vulnerabilities with a CVSS score of 8.0 or higher, malware campaigns, and other events identified by Sonatype Security Research. Events are displayed with the most recent first.

To open Security Events, select Security Events in the Sonatype Guide navigation.

Browse Security Events

Each event entry displays its title, severity, threat type, publication date, and a plain-language summary. Event details can also include affected ecosystems.

Use the following controls to find relevant events:

  • Filter security events: Enter a keyword or phrase to filter the event list and quickly find relevant security events.

  • Status: Filter by known-exploited status.

  • Ecosystem: Use the Ecosystem filter to show events that affect a selected package ecosystem, such as npm, PyPI, Composer, Maven, and others.

  • Severity: Use the Severity filter to display events by severity: Critical, High, Medium, Low, None, or Undetermined.

  • Event Type: Filter by Vulnerable OSS or Malicious OSS.

  • Sort: Change the order in which events are displayed.

Select an event to view its details.

View a Security Event

Select an event to understand the threat, assess its impact, and identify the affected components and versions. The event page includes the Sonatype Security Research analysis, remediation guidance, linked CVEs, and a list of impacted components.

Each event has an Overview tab and an Impacted Components tab.

Overview

The Overview tab provides a summary of the event and the information available from Sonatype Security Research. Depending on the event, it can include:

Field

Description

Severity

The severity of the event.

Threat Type

Whether the event concerns a vulnerability in open-source software or malicious open-source software.

Known Exploited

Whether the vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog.

Ecosystems

The affected package ecosystems.

Malware Threat Types

The category of malware, such as a dropper, infostealer, or backdoor. Available for malware events.

Attack Vectors

The technique used to distribute or introduce the threat, such as typosquatting or dependency confusion.

CWEs

Applicable Common Weakness Enumeration (CWE) identifiers.

Advisory References

Links to related advisories and other published information.

Linked CVEs

CVEs associated with the event. Select a CVE to open its vulnerability details in Sonatype Guide.

The tab can also include recommended remediation guidance. For malware events, follow the guidance to remove the affected package and investigate affected development and build environments.

Impacted Components

The Impacted Components tab lists the components and versions associated with an event. The number next to Impacted Components shows the number of affected components associated with the event. .

Use the Filter components field to find a component by name.

The table can include the following information:

Column

Description

Ecosystem

The package ecosystem.

Namespace

The package namespace or scope, when applicable.

Name

The package name.

Version

The component version.

Asset(s) Affected

Additional affected asset information, when available.

Select a column heading to sort the results. Use the page controls to move through large result sets. An event can have no impacted components; in this case, the tab displays an empty state.

Understand Event Classifications

Severity

Security Events commonly includes the following severity levels:

  • Critical: CVSS 9.0 to 10.0.

  • High: CVSS 8.0 to 8.9.

Sonatype Security Research can also include events below this threshold when they warrant attention.

Threat Type

  • Vulnerable OSS: A vulnerability affects a legitimate open-source package or one of its versions.

  • Malicious OSS: A package, or a version of a package, contains malicious behavior.

Known Exploited

Known Exploited indicates whether a vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog. Prioritize events that are known to be actively exploited.

Respond to a Security Event

Use Security Events to begin your investigation:

  1. Review the event overview, guidance, and linked advisories.

  2. Open Impacted Components and search for affected packages and versions.

  3. Review the event guidance and linked advisories to determine the recommended remediation.

  4. Select a linked CVE to review vulnerability details, including affected and fixed versions.

  5. Update or remove affected components according to your organization's incident-response process.