Supply Chain Incidents

MAL-2026-4375

Malicious code in @citely/mcp-server (npm)

MAL-2026-4645

Malicious code in prettier-sdk (npm)

MAL-2026-4518

Malicious code in cheaty-sync-bot (npm)

MAL-2026-4503

Malicious code in bytecore (npm)

MAL-2026-4174

Malicious code in durabletask (PyPI)

MAL-2026-4171

Malicious code in @mc-xp/mc-monolith-js-src-package (npm)

MAL-2026-4172

Malicious code in @piewasm/pie-web-npm-package (npm)

GHSA-xmpw-2vmm-p4p6

Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

MAL-2026-4173

Malicious code in is-really-odd (npm)

MAL-2026-4170

Malicious code in psxjson (npm)

MAL-2026-4169

Malicious code in paysafe-gbp-virtual-assistant-lib-fe (npm)

MAL-2026-4167

Malicious code in chai-as-attracted (npm)

MAL-2026-4168

Malicious code in chai-as-vec (npm)

MAL-2026-4165

Malicious code in paysafe-gbp-virtual-terminal-lib-fe (npm)

MAL-2026-4166

Malicious code in tarpackage (PyPI)

MAL-2026-4164

Malicious code in identitysecuretokenserv (npm)

MAL-2026-4163

Malicious code in vfat-ai (PyPI)

MAL-2026-4162

Malicious code in vfat (PyPI)

MAL-2026-4160

Malicious code in @apps-home-dashboard/events (npm)

MAL-2026-4161

Malicious code in @cap-js/openapi (npm)

MAL-2026-3847

Malicious code in openclaw-cn (npm)

MAL-2026-3841

Malicious code in @openclaw-cn/cli (npm)

MAL-2026-3844

Malicious code in @openclaw-cn/toutiao-ops (npm)

MAL-2026-3843

Malicious code in @openclaw-cn/libsignal (npm)