Supply Chain Incidents

MAL-2026-5394

Malicious code in @sql-access/nodesql (npm)

hey-base32

MAL-2026-5398

Malicious code in hey-base32 (npm)

Backdoor

@sql-trigger/nodesql

MAL-2026-5395

Malicious code in @sql-trigger/nodesql (npm)

enquriers

MAL-2026-5384

Malicious code in enquriers (npm)

@doaction/wasm-loader

MAL-2026-5383

Malicious code in @doaction/wasm-loader (npm)

@doaction/types

MAL-2026-5382

Malicious code in @doaction/types (npm)

@doaction/storage

MAL-2026-5379

Malicious code in @doaction/storage (npm)

@doaction/sudo-prompt

MAL-2026-5380

Malicious code in @doaction/sudo-prompt (npm)

@doaction/mapstore

MAL-2026-5374

Malicious code in @doaction/mapstore (npm)

@doaction/signalhub

MAL-2026-5378

Malicious code in @doaction/signalhub (npm)

@doaction/pay

MAL-2026-5375

Malicious code in @doaction/pay (npm)

@doaction/systeminformation

MAL-2026-5381

Malicious code in @doaction/systeminformation (npm)

@doaction/examples

MAL-2026-5372

Malicious code in @doaction/examples (npm)

@doaction/rrweb-sdk

MAL-2026-5376

Malicious code in @doaction/rrweb-sdk (npm)

@doaction/http

MAL-2026-5373

Malicious code in @doaction/http (npm)

@doaction/example

MAL-2026-5371

Malicious code in @doaction/example (npm)

@doaction/shared

MAL-2026-5377

Malicious code in @doaction/shared (npm)

@doaction/auth

MAL-2026-5369

Malicious code in @doaction/auth (npm)

@doaction/eventemitter

MAL-2026-5370

Malicious code in @doaction/eventemitter (npm)

transacts

MAL-2026-5368

Malicious code in transacts (npm)

moustick

MAL-2026-5347

Malicious code in moustick (npm)

cookie-parser-legacy

MAL-2026-5346

Malicious code in cookie-parser-legacy (npm)

dstill

PyPI

MAL-2026-5345

Malicious code in dstill (PyPI)

os-ulid-void

MAL-2026-5348

Malicious code in os-ulid-void (npm)