Supply Chain Incidents

MAL-2026-2686

Malicious code in neverinstallme (PyPI)

MAL-2026-2684

Malicious code in tensorzero-node (npm)

MAL-2026-2683

Malicious code in @athena-ui-components/axios (npm)

MAL-2026-2681

Malicious code in @athena-ui-components/dashboard-widget (npm)

MAL-2026-2682

Malicious code in @athena-ui-components/deeplink (npm)

MAL-2026-2916

Malicious code in @jesusvizcaino2021/com.baogong.app-push-permission (npm)

MAL-2026-2827

Malicious code in js-logger-pack (npm)

MAL-2026-2680

Malicious code in @veygo/component-library (npm)

MAL-2026-2677

Malicious code in pdf-linker (npm)

MAL-2026-2678

Malicious code in snitz-chief-cloud (npm)

MAL-2026-2674

Malicious code in chief-proxy-out (npm)

MAL-2026-2679

Malicious code in snitz-chief-cloud-config (npm)

MAL-2026-2673

Malicious code in chief-documentation (npm)

MAL-2026-2676

Malicious code in moscova-plural-json-parser (npm)

MAL-2026-2675

Malicious code in mongoose-stamps (npm)

MAL-2026-2672

Malicious code in ahmed_salem_ph (npm)

GHSA-pj97-4p9w-gx3q

Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

MAL-2026-2671

Malicious code in kryptex-os (PyPI)

MAL-2026-2670

Malicious code in 7miners (PyPI)

MAL-2026-2669

Malicious code in ant-mcp-proxy-for-test (PyPI)

MAL-2026-2668

Malicious code in pnpm-workspaces (npm)

MAL-2026-2667

Malicious code in ckeditor5-minimap (npm)

MAL-2026-2666

Malicious code in moooo (PyPI)

MAL-2026-2664

Malicious code in buildenv-telemetry (PyPI)