Supply Chain Incidents

MAL-2026-4386

Malicious code in @elvatis_com/openclaw-cli-bridge-elvatis (npm)

MAL-2026-4377

Malicious code in @ctrl/plex (npm)

MAL-2026-4448

Malicious code in @tailwind-core/oxide-linux-x64-gnu (npm)

MAL-2026-4364

Malicious code in @aswinsparky/api (npm)

MAL-2026-4499

Malicious code in bolt-delivery-menu-app (npm)

MAL-2026-4430

Malicious code in @saidddddddddd/somethingelse (npm)

MAL-2026-4360

Malicious code in @aledan007/tester (npm)

MAL-2026-4463

Malicious code in @vivaux/telemetry (npm)

MAL-2026-4507

Malicious code in cb-wallet-http (npm)

MAL-2026-4553

Malicious code in ethers-wallet-package (npm)

MAL-2026-4193

Malicious code in private-next-pages (npm)

MAL-2026-4433

Malicious code in @self-evolving-harness/kivo (npm)

MAL-2026-4187

Malicious code in @limebike/frontend-core-api (npm)

MAL-2026-4188

Malicious code in @limebike/supreme (npm)

MAL-2026-4191

Malicious code in iv-bloomfilter (npm)

MAL-2026-4189

Malicious code in @limebike/supreme-data-grid (npm)

MAL-2026-4186

Malicious code in @doctolib-apps/native-personalized-services (npm)

MAL-2026-4192

Malicious code in iv-stubborn (npm)

MAL-2026-4190

Malicious code in @limebike/supreme-date-pickers (npm)

MAL-2026-4185

Malicious code in uolcs-host-uol-anuncios-fe (npm)

GHSA-pvw4-cvr4-97p8

Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

MAL-2026-4409

Malicious code in @nutui/nutui-react-taro (npm)

MAL-2026-4184

Malicious code in stripe-internal-utils (npm)

MAL-2026-4372

Malicious code in @budetzz/baileys (npm)