Supply Chain Incidents

MAL-2025-190869

Malicious code in @mcp-use/mcp-use (npm)

MAL-2025-190879

Malicious code in @posthog/geoip-plugin (npm)

MAL-2025-190895

Malicious code in @posthog/twilio-plugin (npm)

MAL-2025-190874

Malicious code in @posthog/currency-normalization-plugin (npm)

MAL-2025-190915

Malicious code in @seung-ju/react-native-action-sheet (npm)

MAL-2025-190910

Malicious code in @postman/pretty-ms (npm)

MAL-2025-190928

Malicious code in zapier-platform-legacy-scripting-runner (npm)

MAL-2025-190866

Malicious code in @ensdomains/buffer (npm)

MAL-2025-190927

Malicious code in web-types-lit (npm)

MAL-2025-190896

Malicious code in @posthog/twitter-followers-plugin (npm)

MAL-2025-190887

Malicious code in @posthog/nextjs-config (npm)

MAL-2025-190912

Malicious code in @postman/wdio-allure-reporter (npm)

MAL-2025-190907

Malicious code in @postman/postman-collection-fork (npm)

MAL-2025-190913

Malicious code in @postman/wdio-junit-reporter (npm)

MAL-2025-190902

Malicious code in @postman/mcp-ui-client (npm)

MAL-2025-190893

Malicious code in @posthog/snowflake-export-plugin (npm)

MAL-2025-190926

Malicious code in posthog-react-native (npm)

MAL-2025-190876

Malicious code in @posthog/databricks-plugin (npm)

MAL-2025-190871

Malicious code in @mparpaillon/imagesloaded (npm)

MAL-2025-190905

Malicious code in @postman/pm-bin-macos-x64 (npm)

MAL-2025-190903

Malicious code in @postman/pm-bin-linux-x64 (npm)

MAL-2025-190884

Malicious code in @posthog/kinesis-plugin (npm)

MAL-2025-190892

Malicious code in @posthog/sendgrid-plugin (npm)

MAL-2025-190922

Malicious code in create-mcp-use-app (npm)