Supply Chain Incidents

MAL-2026-2692

Malicious code in fusion-events (npm)

MAL-2026-2690

Malicious code in @pnc-ref/harmony-support-v18 (npm)

MAL-2026-2689

Malicious code in @pnc-ref/harmony-core-v18 (npm)

MAL-2026-2688

Malicious code in @pnc-cib/cib-core-lib (npm)

MAL-2026-2687

Malicious code in com.baogong.app_push_permission (npm)

MAL-2026-2685

Malicious code in react-dom-19 (npm)

MAL-2026-2686

Malicious code in neverinstallme (PyPI)

MAL-2026-2684

Malicious code in tensorzero-node (npm)

MAL-2026-2683

Malicious code in @athena-ui-components/axios (npm)

MAL-2026-2681

Malicious code in @athena-ui-components/dashboard-widget (npm)

MAL-2026-2682

Malicious code in @athena-ui-components/deeplink (npm)

MAL-2026-2916

Malicious code in @jesusvizcaino2021/com.baogong.app-push-permission (npm)

MAL-2026-2827

Malicious code in js-logger-pack (npm)

MAL-2026-2680

Malicious code in @veygo/component-library (npm)

MAL-2026-2677

Malicious code in pdf-linker (npm)

MAL-2026-2679

Malicious code in snitz-chief-cloud-config (npm)

MAL-2026-2678

Malicious code in snitz-chief-cloud (npm)

MAL-2026-2674

Malicious code in chief-proxy-out (npm)

MAL-2026-2673

Malicious code in chief-documentation (npm)

MAL-2026-2676

Malicious code in moscova-plural-json-parser (npm)

MAL-2026-2675

Malicious code in mongoose-stamps (npm)

MAL-2026-2672

Malicious code in ahmed_salem_ph (npm)

GHSA-pj97-4p9w-gx3q

Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

MAL-2026-2671

Malicious code in kryptex-os (PyPI)