Supply Chain Incidents

MAL-2026-13737

Malicious code in @openzeppelin-4/contracts (npm)

MAL-2026-13738

Malicious code in @openzeppelin-5/contracts (npm)

MAL-2026-13739

Malicious code in ethereum-vault-connector (npm)

MAL-2026-13741

Malicious code in safe-local-env-loader (npm)

MAL-2026-13740

Malicious code in kit-vim-map (npm)

MAL-2026-13735

Malicious code in @aerodrome-finance/slipstream (npm)

MAL-2026-13766

Malicious code in node-internal-svg-loader (npm)

MAL-2026-13762

Malicious code in developer-dashboard (npm)

MAL-2026-13733

Malicious code in newtun (npm)

MAL-2026-13732

Malicious code in joule-btp-extension (PyPI)

MAL-2026-13763

Malicious code in fetch-runtime (npm)

MAL-2026-13765

Malicious code in lines-columns (npm)

MAL-2026-13730

Malicious code in euler-sdk (PyPI)

MAL-2026-13731

Malicious code in morpho-sdk (PyPI)

MAL-2026-13729

Malicious code in dlmm-sdk (PyPI)

MAL-2026-13728

Malicious code in dlmm (PyPI)

MAL-2026-13776

Malicious code in upshift-config (npm)

MAL-2026-13771

Malicious code in boring-vault (npm)

MAL-2026-13775

Malicious code in permit2 (npm)

MAL-2026-13777

Malicious code in upshift-finance (npm)

MAL-2026-13770

Malicious code in @telekom-ods/react-ui-kit (npm)

MAL-2026-13774

Malicious code in augustdigital-sdk (npm)

MAL-2026-13772

Malicious code in camelot-ammv2-core (npm)

MAL-2026-13773

Malicious code in camelot-ammv2-periphery (npm)