Supply Chain Incidents

MAL-2026-12394

Malicious code in jquery.ui.core (npm)

MAL-2026-12319

Malicious code in @kite-js-tools/core (npm)

MAL-2026-12334

Malicious code in ach-detail (npm)

MAL-2026-12481

Malicious code in token-list-fetcher (npm)

MAL-2026-12378

Malicious code in express-rate-controller (npm)

MAL-2026-12429

Malicious code in rollup-plugins-check (npm)

MAL-2026-12353

Malicious code in clover-codelab-remote-pay-cloud (npm)

MAL-2026-12321

Malicious code in @mgor/fw-canary-20260725-394b024b (npm)

MAL-2026-12404

Malicious code in npm-module-service (npm)

MAL-2026-12482

Malicious code in tool-registry-scripts (npm)

MAL-2026-12329

Malicious code in @shiftmarkets/shift-sdk-v4 (npm)

MAL-2026-12419

Malicious code in pp-react-worldready-v5 (npm)

MAL-2026-12399

Malicious code in luluking3 (npm)

MAL-2026-12368

Malicious code in electrode-ota-ui-app (npm)

MAL-2026-12400

Malicious code in matlab-azure-devops-extension (npm)

MAL-2026-12398

Malicious code in luluking2 (npm)

MAL-2026-12379

Malicious code in fastify-client-bundler (npm)

MAL-2026-12315

Malicious code in @cryptosrvc/no-brainer-sdk (npm)

MAL-2026-12317

Malicious code in @cryptosrvc/shift-sdk-v4 (npm)

MAL-2026-12392

Malicious code in hyper-kube-config (npm)

MAL-2026-12416

Malicious code in poly-custom-api (npm)

MAL-2026-12337

Malicious code in akamaijs-sensor (npm)

MAL-2026-12427

Malicious code in remote_session_elements (npm)

MAL-2026-12356

Malicious code in content-publisher-sdks (npm)