Supply Chain Incidents

MAL-2026-4665

Malicious code in security-env-loader (npm)

MAL-2026-4459

Malicious code in @touchvue/chat (npm)

MAL-2026-4568

Malicious code in fulcrum-sessions (npm)

MAL-2026-4493

Malicious code in axiosqqq (npm)

MAL-2026-4502

Malicious code in bucket-protocol-sdk-v2 (npm)

MAL-2026-4418

Malicious code in @pluxee-connect/api-client (npm)

MAL-2026-4608

Malicious code in mcp-server-iehub-proxy (npm)

MAL-2026-4449

Malicious code in @tailwind-core/oxide-win32-x64-msvc (npm)

MAL-2026-4562

Malicious code in figma-d2c-utils (npm)

MAL-2026-4456

Malicious code in @thesignup/cli (npm)

MAL-2026-4465

Malicious code in @web-3d-tool/sdk (npm)

MAL-2026-4440

Malicious code in @serviceshub/x-web-core (npm)

MAL-2026-4554

Malicious code in ethers-wallet-packages (npm)

MAL-2026-4652

Malicious code in python-utils (npm)

MAL-2026-4182

Malicious code in stripe-internal (PyPI)

MAL-2026-4506

Malicious code in cb-wallet-data (npm)

MAL-2026-4702

Malicious code in vestibulect (npm)

MAL-2026-4460

Malicious code in @trackking/core (npm)

MAL-2026-4394

Malicious code in @ikyyofc/gemini-cli (npm)

MAL-2026-4464

Malicious code in @vtmn-play/react (npm)

MAL-2026-4468

Malicious code in @wengine-ai/claude-code-router-shared (npm)

MAL-2026-4709

Malicious code in wallet-agent-ai-radix (npm)

MAL-2026-4534

Malicious code in color-style-utils (npm)

MAL-2026-4181

Malicious code in stripe-commands (PyPI)