Supply Chain Incidents

MAL-2026-1462

Malicious code in npm-demoo-1111 (npm)

MAL-2026-1486

Malicious code in trello-enterprises (npm)

MAL-2026-1485

Malicious code in react-refresh-update (npm)

MAL-2026-1484

Malicious code in internal-lib-vulnerable (npm)

MAL-2026-1487

Malicious code in vitest-config (npm)

MAL-2026-1458

Malicious code in @wealth-common/font (npm)

MAL-2026-1450

Malicious code in @myisrfn/baileys-mod (npm)

MAL-2026-1452

Malicious code in @sheniraid/libsignal-node (npm)

MAL-2026-1451

Malicious code in @sheniraid/baileys (npm)

MAL-2026-1441

Malicious code in big-numben (npm)

MAL-2026-1443

Malicious code in es-lint-builder (npm)

MAL-2026-1442

Malicious code in bignumber-tool.js (npm)

MAL-2026-1444

Malicious code in graphql-request-dom (npm)

MAL-2026-1447

Malicious code in testpoc01 (npm)

MAL-2026-1446

Malicious code in omhcsilence-bails (npm)

MAL-2026-1439

Malicious code in @omhc/libsignal-node (npm)

MAL-2026-1440

Malicious code in @vtim/xss-poc (npm)

MAL-2026-1449

Malicious code in vtimmmmmm-test (npm)

MAL-2026-1445

Malicious code in nest-moralis (npm)

MAL-2026-1448

Malicious code in up2-daemon (npm)

MAL-2026-3125

Malicious code in transform-regexp-constructors (npm)

MAL-0000-phantomraven-transform-jscript

Malicious npm package: transform-jscript (PhantomRaven campaign, Wave 2)

MAL-0000-phantomraven-no-type-assertion

Malicious npm package: no-type-assertion (PhantomRaven campaign, Wave 2)

MAL-0000-phantomraven-pear-wrk-wdk

Malicious npm package: pear-wrk-wdk (PhantomRaven campaign, Wave 2)