Supply Chain Incidents

MAL-2026-10735

Malicious code in isite (npm)

MAL-2026-10713

Malicious code in @hibachi-xyz/config (npm)

MAL-2026-10716

Malicious code in @hibachi-xyz/ui (npm)

MAL-2026-10714

Malicious code in @hibachi-xyz/sdk (npm)

MAL-2026-10704

Malicious code in @across-toolkit/typescript-config (npm)

MAL-2026-10715

Malicious code in @hibachi-xyz/types (npm)

MAL-2026-10711

Malicious code in @funny-booth/agent-core (npm)

MAL-2026-10742

Malicious code in node-as-api (npm)

MAL-2026-10748

Malicious code in string-formatter-pro (npm)

MAL-2026-10703

Malicious code in @across-toolkit/eslint-config (npm)

MAL-2026-10700

Malicious code in time-format-kit (npm)

MAL-2026-10699

Malicious code in http-req-lite (npm)

MAL-2026-10695

Malicious code in ai-p2p (npm)

MAL-2026-10696

Malicious code in loader1 (npm)

MAL-2026-10698

Malicious code in websight2-p2p (npm)

MAL-2026-10697

Malicious code in websight-p2p (npm)

MAL-2026-10694

Malicious code in vor8zakon (npm)

MAL-2026-10693

Malicious code in claude-token-tracker-mcp (npm)

MAL-2026-10692

Malicious code in nyt-cms (npm)

MAL-2026-10762

Malicious code in @edgecommons/edgecommons (npm)

MAL-2026-10764

Malicious code in syft-acp-atoms (npm)

MAL-2026-10763

Malicious code in @edgecommons/streamlog-node (npm)

MAL-2026-10767

Malicious code in syft-acp-util (npm)

MAL-2026-10765

Malicious code in syft-acp-core (npm)