Supply Chain Incidents

MAL-2026-1361

Malicious code in pcl-build-docroot (npm)

dappa-libsignal

MAL-2026-1358

Malicious code in dappa-libsignal (npm)

libsignal-mod

MAL-2026-1359

Malicious code in libsignal-mod (npm)

@dappaoffc/baileys

MAL-2026-1354

Malicious code in @dappaoffc/baileys (npm)

@dappaoffc/baileys-mod

MAL-2026-1355

Malicious code in @dappaoffc/baileys-mod (npm)

react-svg-anchor

MAL-2026-1363

Malicious code in react-svg-anchor (npm)

bign.ts

MAL-2026-1357

Malicious code in bign.ts (npm)

npm-doc-build

MAL-2026-1360

Malicious code in npm-doc-build (npm)

b2b-common-cb-lib

MAL-2026-1356

Malicious code in b2b-common-cb-lib (npm)

svg-safety-tool

MAL-2026-1364

Malicious code in svg-safety-tool (npm)

restrict-imports

MAL-2026-1353

Malicious code in restrict-imports (npm)

jinja-template

MAL-2026-1352

Malicious code in jinja-template (npm)

faaladorcli

MAL-2026-1351

Malicious code in faaladorcli (PyPI)

Dep Confusion

falador

MAL-2026-1350

Malicious code in falador (PyPI)

Dep Confusion

xygeni/xygeni-action

GitHub Actions

GHSA-f8q5-h5qh-33mh

xygeni-action v5 tag poisoned with C2 backdoor

Backdoor

1 CVE

f0-abstraction-resolver

MAL-2026-1347

Malicious code in f0-abstraction-resolver (npm)

locale-clamp-middleware

MAL-2026-1348

Malicious code in locale-clamp-middleware (npm)

mabibilabub

MAL-2026-1349

Malicious code in mabibilabub (npm)

ts-lint-builder

MAL-2026-1346

Malicious code in ts-lint-builder (npm)

bignum-ts

MAL-2026-1344

Malicious code in bignum-ts (npm)

npm-builders

MAL-2026-1345

Malicious code in npm-builders (npm)

chai-as-flex

MAL-2026-1343

Malicious code in chai-as-flex (npm)

collectables

MAL-2026-1342

Malicious code in collectables (PyPI)

collects

MAL-2026-1341

Malicious code in collects (PyPI)