Skip to main content

Using Security Events

Security Events is a curated view of important open-source security events. It includes vulnerabilities with a CVSS score of 8.0 or higher, malware campaigns, and other events identified by Sonatype Security Research. Events are displayed with the most recent first.

To open Security Events, select Security Events in the Sonatype AI Developer navigation.

Browse Security Events

Each event entry displays its title, severity, threat type, publication date, and a plain-language summary. Event details can also include affected ecosystems.

Use the following controls to find relevant events:

  • Filter security events: Enter a keyword or phrase to filter the event list and quickly find relevant security events.

  • Status: Filter by known-exploited status.

  • Ecosystem: Show events that affect a selected package ecosystem, such as npm, PyPI, Composer, Maven, and others. Select See more to view additional ecosystems.

  • Severity: Display events by severity: Critical, High, Medium, Low, None, or Undetermined.

  • Event Type: Filter by Vulnerable OSS or Malicious OSS.

  • Sort: Change the order in which events are displayed. Most Recent is the default.

View a Security Event

Select an event to understand the threat, assess its potential impact, and review the affected components and versions, when available. The event page includes Sonatype Security Research analysis and guidance.

Each event has an Overview tab and an Impacted Components tab.

Overview

Use the Overview tab to review the event summary, technical analysis, and guidance. Depending on the event, the page can include the following information:

Field

Description

Severity

The severity of the event.

Threat Type

Whether the event concerns a vulnerability in open-source software or malicious open-source software.

Known Exploited

Whether the vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog.

Ecosystems

The affected package ecosystems.

Malware Threat Types

The category of malware, such as a dropper, infostealer, or backdoor. Available for malware events.

Attack Vectors

The technique used to distribute or introduce the threat, such as typosquatting or dependency confusion.

CWEs

Applicable Common Weakness Enumeration (CWE) identifiers.

Advisory References

Related advisories and other published information.

The Guidance section describes the recommended response. Follow the guidance to determine the appropriate remediation for the event. When available, select Read the full Sonatype analysis to open the related Sonatype research article.

View Impacted Components

The Impacted Components tab lists the components and versions associated with an event. The number next to Impacted Components shows the number of affected components associated with the event.

Use Filter components to find a component by name.

The table can include the following information:

Column

Description

Ecosystem

The package ecosystem.

Namespace

The package namespace or scope, when applicable.

Name

The package name. Select the column heading to change the sort order.

Version

The affected component version.

Asset(s) Affected

Additional affected asset information, when available.

Use the page controls to move through large result sets. For supported ecosystems, select a component row to open its component details.

An event can have no impacted components. In this case, the tab displays an empty state. This can occur for malicious open-source software events or when the event is not associated with specific component versions.

Understand Event Classifications

Severity

Security Events commonly includes the following severity levels:

  • Critical: CVSS 9.0 to 10.0.

  • High: CVSS 8.0 to 8.9.

Sonatype Security Research can also include events below this threshold when they warrant attention.

Threat Type

  • Vulnerable OSS: A vulnerability affects a legitimate open-source package or one of its versions.

  • Malicious OSS: A package, or a version of a package, contains malicious behavior.

Known Exploited

Known Exploited indicates whether a vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog. Prioritize events that are known to be actively exploited.

Respond to a Security Event

  1. Review the event overview, guidance, and advisory references.

  2. Select Impacted Components and search for affected packages and versions.

  3. Determine the recommended remediation from the event guidance and related advisories.

  4. Update or remove affected components according to your organization's incident-response process.