Supply Chain Incidents

MAL-2026-6528

Malicious code in @immobiliarelabs/backstage-plugin-ldap-auth (npm)

@immobiliarelabs/backstage-plugin-gitlab

MAL-2026-6526

Malicious code in @immobiliarelabs/backstage-plugin-gitlab (npm)

@carvana.authentication-flows/shared

MAL-2026-6521

Malicious code in @carvana.authentication-flows/shared (npm)

express-plugin

MAL-2026-6523

Malicious code in express-plugin (npm)

ts-einkle

MAL-2026-6524

Malicious code in ts-einkle (npm)

Backdoor

ts-einkle-slot

MAL-2026-6525

Malicious code in ts-einkle-slot (npm)

@epsteinlovekids483/crossmint-wallets-sdk-pentest

MAL-2026-6522

Malicious code in @epsteinlovekids483/crossmint-wallets-sdk-pentest (npm)

react-icon-svgs

MAL-2026-6519

Malicious code in react-icon-svgs (npm)

rollup-plugin-polyfill-connect

MAL-2026-6520

Malicious code in rollup-plugin-polyfill-connect (npm)

ai-node-relay

MAL-2026-6518

Malicious code in ai-node-relay (npm)

ai-node-agent

MAL-2026-6517

Malicious code in ai-node-agent (npm)

inlifegram

PyPI

MAL-2026-6516

Malicious code in inlifegram (PyPI)

Backdoor

sqligen

PyPI

MAL-2026-6515

Malicious code in sqligen (PyPI)

dtxto1ols

MAL-2026-6513

Malicious code in dtxto1ols (npm)

dtxtools

MAL-2026-6514

Malicious code in dtxtools (npm)

@merceas/cross-fetch

MAL-2026-6510

Malicious code in @merceas/cross-fetch (npm)

@merceas/anchor

MAL-2026-6509

Malicious code in @merceas/anchor (npm)

Typosquat

react-context-form-tdsss

MAL-2026-6512

Malicious code in react-context-form-tdsss (npm)

tw-style-utils

MAL-2026-6508

Malicious code in tw-style-utils (npm)

pump-laserstream-parser

MAL-2026-6506

Malicious code in pump-laserstream-parser (npm)

pino-zod

MAL-2026-6505

Malicious code in pino-zod (npm)

pump-stream-logger

MAL-2026-6507

Malicious code in pump-stream-logger (npm)

hydanlabs

MAL-2026-6511

Malicious code in hydanlabs (npm)

openblox

PyPI

MAL-2026-6504

Malicious code in openblox (PyPI)