Supply Chain Incidents

MAL-2026-400

Malicious code in victim-package-b (npm)

MAL-2026-401

Malicious code in victim-package-c (npm)

MAL-2026-377

Malicious code in potdf (npm)

MAL-2026-376

Malicious code in coolpackage2323 (PyPI)

MAL-2026-375

Malicious code in spellcheckerpy (PyPI)

GHSA-2657-3c98-63jq

esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages

MAL-2026-374

Malicious code in mised-discordjs-selfbot-v14 (npm)

MAL-2026-371

Malicious code in theme-neutral (npm)

MAL-2026-370

Malicious code in sezzle (npm)

MAL-2026-373

Malicious code in webmd-debug (npm)

MAL-2026-368

Malicious code in mw-proto-models (npm)

MAL-2026-369

Malicious code in mw-shared-utils (npm)

MAL-2026-372

Malicious code in webmd-cookie (npm)

MAL-2026-359

Malicious code in dreame-claude (npm)

MAL-2026-363

Malicious code in pl-global-ec-uikit (npm)

MAL-2026-367

Malicious code in uq-global-ec-uikit (npm)

MAL-2026-364

Malicious code in shared-global-ec-uikit (npm)

MAL-2026-361

Malicious code in gu-global-ec-uikit (npm)

MAL-2026-360

Malicious code in excel-to-json-test (npm)

MAL-2026-365

Malicious code in telia-eventapi-client (npm)

MAL-2026-366

Malicious code in testing-package-bose (npm)

MAL-2026-357

Malicious code in chai-bin (npm)

MAL-2026-362

Malicious code in health-check-node (npm)

MAL-2026-358

Malicious code in dot-env-buffer (npm)