Supply Chain Incidents

MAL-2026-5401

Malicious code in savant-listing (npm)

Dep Confusion

screenpipe-mcp-http

MAL-2026-5402

Malicious code in screenpipe-mcp-http (npm)

multica

MAL-2026-5400

Malicious code in multica (npm)

create-docs-mcp

MAL-2026-5397

Malicious code in create-docs-mcp (npm)

t-invest-mcp-server

MAL-2026-5403

Malicious code in t-invest-mcp-server (npm)

@sqlite-node/createsql

MAL-2026-5396

Malicious code in @sqlite-node/createsql (npm)

@sql-access/nodesql

MAL-2026-5394

Malicious code in @sql-access/nodesql (npm)

hey-base32

MAL-2026-5398

Malicious code in hey-base32 (npm)

Backdoor

@sql-trigger/nodesql

MAL-2026-5395

Malicious code in @sql-trigger/nodesql (npm)

enquriers

MAL-2026-5384

Malicious code in enquriers (npm)

@doaction/wasm-loader

MAL-2026-5383

Malicious code in @doaction/wasm-loader (npm)

@doaction/types

MAL-2026-5382

Malicious code in @doaction/types (npm)

@doaction/pay

MAL-2026-5375

Malicious code in @doaction/pay (npm)

@doaction/examples

MAL-2026-5372

Malicious code in @doaction/examples (npm)

@doaction/sudo-prompt

MAL-2026-5380

Malicious code in @doaction/sudo-prompt (npm)

@doaction/storage

MAL-2026-5379

Malicious code in @doaction/storage (npm)

@doaction/signalhub

MAL-2026-5378

Malicious code in @doaction/signalhub (npm)

@doaction/http

MAL-2026-5373

Malicious code in @doaction/http (npm)

@doaction/rrweb-sdk

MAL-2026-5376

Malicious code in @doaction/rrweb-sdk (npm)

@doaction/mapstore

MAL-2026-5374

Malicious code in @doaction/mapstore (npm)

@doaction/systeminformation

MAL-2026-5381

Malicious code in @doaction/systeminformation (npm)

@doaction/example

MAL-2026-5371

Malicious code in @doaction/example (npm)

@doaction/eventemitter

MAL-2026-5370

Malicious code in @doaction/eventemitter (npm)

@doaction/auth

MAL-2026-5369

Malicious code in @doaction/auth (npm)