Supply Chain Incidents

MAL-2026-11979

Malicious code in picasso.js (npm)

MAL-2026-11573

Malicious code in @nebula.js/sn-distributionplot (npm)

MAL-2026-11977

Malicious code in picasso-plugin-hammer (npm)

MAL-2026-11571

Malicious code in @nebula.js/sn-action-button (npm)

MAL-2026-11789

Malicious code in @qlik/embed-react (npm)

MAL-2026-11565

Malicious code in @nebula.js/cli (npm)

MAL-2026-11625

Malicious code in @onereach/regular-expressions-test (npm)

MAL-2026-11799

Malicious code in @qlik/oxfmt-config (npm)

MAL-2026-11585

Malicious code in @nebula.js/test-utils (npm)

MAL-2026-11792

Malicious code in @qlik/embed-web-components (npm)

MAL-2026-11787

Malicious code in @qlik/design-tokens (npm)

MAL-2026-11569

Malicious code in @nebula.js/locale (npm)

MAL-2026-11577

Malicious code in @nebula.js/sn-map (npm)

MAL-2026-11572

Malicious code in @nebula.js/sn-animator (npm)

MAL-2026-11578

Malicious code in @nebula.js/sn-nav-menu (npm)

MAL-2026-11974

Malicious code in hamus.js (npm)

MAL-2026-11622

Malicious code in @onereach/postcss-scoped-selector (npm)

MAL-2026-11867

Malicious code in @servicetitan/feature-spotlight (npm)

MAL-2026-11988

Malicious code in tslint-folder-schema (npm)

MAL-2026-11925

Malicious code in @servicetitan/startup-mfe-compat (npm)

MAL-2026-11901

Malicious code in @servicetitan/microfront (npm)

MAL-2026-11866

Malicious code in @servicetitan/examples (npm)

MAL-2026-11972

Malicious code in folder-lint (npm)

MAL-2026-11918

Malicious code in @servicetitan/standalone-core-feature-gates (npm)