Supply Chain Incidents

MAL-2026-19127

Malicious code in chai-as-spy (npm)

MAL-2026-19141

Malicious code in verboset (npm)

MAL-2026-19132

Malicious code in gloglet (npm)

MAL-2026-19126

Malicious code in aurelia-type (npm)

MAL-2026-19130

Malicious code in express-helmet (npm)

MAL-2026-19138

Malicious code in shraps (npm)

MAL-2026-19133

Malicious code in helmify (npm)

MAL-2026-19135

Malicious code in ioredis-xyz (npm)

MAL-2026-19134

Malicious code in ioredis-om-typed (npm)

MAL-2026-19128

Malicious code in cronbits (npm)

MAL-2026-19140

Malicious code in textmark-engine (npm)

MAL-2026-19139

Malicious code in taskpace (npm)

MAL-2026-19122

Malicious code in @tomhundley/grafene (npm)

MAL-2026-19124

Malicious code in @tomhundley/prismdb (npm)

MAL-2026-19131

Malicious code in flowbits (npm)

MAL-2026-19136

Malicious code in jsonrail (npm)

MAL-2026-19129

Malicious code in csvbits (npm)

MAL-2026-19137

Malicious code in pathbits (npm)

MAL-2026-19123

Malicious code in @tomhundley/mypackagetest (npm)

MAL-2026-19125

Malicious code in @tomhundley/sparkdash (npm)

MAL-2026-19121

Malicious code in @tomhundley/condux (npm)

MAL-2026-19120

Malicious code in correct-calc (npm)

MAL-2026-19119

Malicious code in cal-time-stamper (npm)

MAL-2026-19118

Malicious code in 0sec-cli (npm)