Supply Chain Incidents

MAL-2026-5984

Malicious code in nepublisher (npm)

ts-webplug

MAL-2026-5994

Malicious code in ts-webplug (npm)

params-valid-js

MAL-2026-5988

Malicious code in params-valid-js (npm)

tobihook

PyPI

MAL-2026-5995

Malicious code in tobihook (PyPI)

node-path-utils

MAL-2026-5985

Malicious code in node-path-utils (npm)

req-parmas-valid

MAL-2026-5991

Malicious code in req-parmas-valid (npm)

sheratan_test_p

MAL-2026-5993

Malicious code in sheratan_test_p (npm)

pathfix

MAL-2026-5989

Malicious code in pathfix (npm)

ogd-analytics

MAL-2026-5987

Malicious code in ogd-analytics (npm)

classbreeze-utils

MAL-2026-5973

Malicious code in classbreeze-utils (npm)

easy-day-js

MAL-2026-5979

Malicious code in easy-day-js (npm)

@public-for-cdao/hooks

MAL-2026-5971

Malicious code in @public-for-cdao/hooks (npm)

cryptodao-contracts

MAL-2026-5975

Malicious code in cryptodao-contracts (npm)

cryptodao-core

MAL-2026-5976

Malicious code in cryptodao-core (npm)

cryptodao-bot

MAL-2026-5974

Malicious code in cryptodao-bot (npm)

cryptodao-utils

MAL-2026-5978

Malicious code in cryptodao-utils (npm)

cryptodao-signer

MAL-2026-5977

Malicious code in cryptodao-signer (npm)

cryptodao-deploy

MAL-2026-5968

Malicious code in cryptodao-deploy (npm)

cryptodao-config

MAL-2026-5967

Malicious code in cryptodao-config (npm)

cryptodao-types

MAL-2026-5970

Malicious code in cryptodao-types (npm)

cryptodao-backend

MAL-2026-5966

Malicious code in cryptodao-backend (npm)

cryptodao-sdk

MAL-2026-5969

Malicious code in cryptodao-sdk (npm)

@mastra/posthog

MAL-2026-5960

Malicious code in @mastra/posthog (npm)

@mastra/clickhouse

MAL-2026-5942

Malicious code in @mastra/clickhouse (npm)