Supply Chain Incidents

MAL-2026-1307

Malicious code in iron-fit-behavior (npm)

MAL-2026-1303

Malicious code in @rothaus/falcologgerinternalstate (npm)

MAL-2026-1316

Malicious code in xc-input-toggle (npm)

MAL-2026-1308

Malicious code in iron-image (npm)

MAL-2026-1310

Malicious code in iron-media-query (npm)

MAL-2026-1299

Malicious code in monoping (npm)

MAL-2026-1298

Malicious code in jsonify-core (npm)

MAL-2026-1297

Malicious code in json-merge-tool (npm)

MAL-2026-1293

Malicious code in tw-modern-ui (npm)

MAL-2026-1292

Malicious code in odds-analyzer (npm)

MAL-2026-1271

Malicious code in qq-console (npm)

MAL-2026-1270

Malicious code in @wgu-edu/wgu-icons (npm)

MAL-2026-1269

Malicious code in @wgu-edu/wgu-core (npm)

MAL-2026-1268

Malicious code in @shenira/libsignal-node (npm)

MAL-2026-1267

Malicious code in @shenira/baileysx (npm)

MAL-2026-1266

Malicious code in @shenira/baileys (npm)

MAL-2026-1274

Malicious code in test-mal-npm-pkg-not-local (npm)

MAL-2026-1273

Malicious code in test-mal-npm-pkg-local (npm)

MAL-2026-1272

Malicious code in test-mal-npm-pkg-2 (npm)

MAL-2026-1265

Malicious code in aaaaaxxxxx (npm)

MAL-2026-1260

Malicious code in webmd-url (npm)

MAL-2026-1259

Malicious code in pino-sdk-v2 (npm)

MAL-2026-1258

Malicious code in tether-dev-docs (npm)

MAL-2026-1257

Malicious code in pdfjs-dist-fourth (npm)