Malicious Package Affecting @znan/wabot package, versions =0.2.2-beta.3=0.2.2-beta.2=0.2.2-beta.1=0.2.2-beta.0=0.2.1=0.2.0-beta.8=0.2.0-beta.7=0.2.0-beta.6=0.2.0-beta.5=0.2.0-beta.4=0.2.0-beta.3=0.2.0-beta.0=0.1.0-beta.0=0.1.0-rc.1=0.1.0-rc.0=0.0.106=0.0.105=0.0.104=0.0.103=0.0.102=0.0.101=0.0.99=0.0.98=0.0.97=0.0.96=0.0.95=0.0.94=0.0.93=0.0.90=0.0.89=0.0.88=0.0.87=0.0.86=0.0.85=0.0.84=0.0.83=0.0.82=0.0.79=0.0.78=0.0.74=0.0.73=0.0.72=0.0.71=0.0.70=0.0.69=0.0.68=0.0.67=0.0.66=0.0.65=0.0.64=0.0.63=0.0.62=0.0.61=0.0.60=0.0.59=0.0.58=0.0.57=0.0.56=0.0.55=0.0.54=0.0.53=0.0.52=0.0.51=0.0.50=0.0.49=0.0.42=0.0.41=0.0.40=0.0.39=0.0.38=0.0.37=0.0.36=0.0.35=0.0.34=0.0.33=0.0.32=0.0.31=0.0.30=0.0.29=0.0.28=0.0.27=0.0.25=0.0.24=0.0.23=0.0.22=0.0.21=0.0.20=0.0.19=0.0.18=0.0.17=0.0.15=0.0.14=0.0.13=0.0.12=0.0.11=0.0.10=0.0.9=0.0.8=0.0.7=0.0.6
Threat Intelligence
Exploit Maturity
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Attacked
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ZNANWABOT-19424447
- published28 Aug 2026
- disclosed27 Aug 2026
- creditUnknown
Introduced: 27 Aug 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Avoid using all malicious instances of the @znan/wabot package.
Overview
@znan/wabot is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.