Supply Chain Incidents

MAL-2026-10163

Malicious code in llama-tokenizer (npm)

Typosquat

type-async

MAL-2026-10164

Malicious code in type-async (npm)

Typosquat

@bcryptln/becryptjs

MAL-2026-10162

Malicious code in @bcryptln/becryptjs (npm)

rollup-packages-polyfill-core

MAL-2026-10160

Malicious code in rollup-packages-polyfill-core (npm)

Typosquat

buffer-util-internal

MAL-2026-10151

Malicious code in buffer-util-internal (npm)

ap3-components-ui

MAL-2026-10150

Malicious code in ap3-components-ui (npm)

notify-utilities

MAL-2026-10158

Malicious code in notify-utilities (npm)

notify-logs

MAL-2026-10156

Malicious code in notify-logs (npm)

notify-theme

MAL-2026-10157

Malicious code in notify-theme (npm)

notify-dist

MAL-2026-10154

Malicious code in notify-dist (npm)

notify-funcs

MAL-2026-10155

Malicious code in notify-funcs (npm)

notifier-log

MAL-2026-10153

Malicious code in notifier-log (npm)

notifier-funcs

MAL-2026-10152

Malicious code in notifier-funcs (npm)

npm-rce-safe-proof-yourname

MAL-2026-10159

Malicious code in npm-rce-safe-proof-yourname (npm)

sidecar-mcp

MAL-2026-10161

Malicious code in sidecar-mcp (npm)

Backdoor

@amtrav/webservice

MAL-2026-10140

Malicious code in @amtrav/webservice (npm)

@genie-auth/config

MAL-2026-10141

Malicious code in @genie-auth/config (npm)

motiondnb

MAL-2026-10145

Malicious code in motiondnb (npm)

ng-search-api

MAL-2026-10146

Malicious code in ng-search-api (npm)

react-jsonwebtoken

MAL-2026-10132

Malicious code in react-jsonwebtoken (npm)

theta-sdk-js

MAL-2026-10135

Malicious code in theta-sdk-js (npm)

mdb-vite

MAL-2026-10144

Malicious code in mdb-vite (npm)

polygon-gamma-apis

MAL-2026-10148

Malicious code in polygon-gamma-apis (npm)

polygon-gama-apis

MAL-2026-10147

Malicious code in polygon-gama-apis (npm)