Supply Chain Incidents

MAL-2026-1521

Malicious code in lit-a11y (npm)

MAL-2026-1533

Malicious code in todo-plz (npm)

MAL-2026-1538

Malicious code in vue-scoped-css (npm)

MAL-2026-1530

Malicious code in styled-components-a11y (npm)

MAL-2026-1524

Malicious code in no-type-assertion (npm)

MAL-2026-1503

Malicious code in minify-replace (npm)

MAL-2026-1505

Malicious code in transform-jscript (npm)

MAL-2026-1512

Malicious code in undeclared-variables-check (npm)

MAL-2026-1511

Malicious code in transform-undefined-to-void (npm)

MAL-2026-1509

Malicious code in transform-remove-debugger (npm)

MAL-2026-1501

Malicious code in @storylane/uikit (npm)

MAL-2026-1500

Malicious code in @storylane/shared-packages (npm)

MAL-2026-1513

Malicious code in vitest-globals (npm)

MAL-2026-1507

Malicious code in transform-property-literals (npm)

MAL-2026-1506

Malicious code in transform-minify-booleans (npm)

MAL-2026-1510

Malicious code in transform-simplify-comparison-operators (npm)

MAL-2026-1504

Malicious code in transform-jsbi-to-bigint (npm)

MAL-2026-1502

Malicious code in better-styled-components (npm)

MAL-2026-1508

Malicious code in transform-react-jsx (npm)

MAL-2026-1499

Malicious code in anistream (PyPI)

MAL-2026-1498

Malicious code in telegramdatas (PyPI)

MAL-2026-1497

Malicious code in robloxapi-test (PyPI)

MAL-2026-1496

Malicious code in robloxapi-testy (PyPI)

MAL-2026-1495

Malicious code in whatfix-icons (npm)