Supply Chain Incidents

MAL-2026-397

Malicious code in recaptcha-cors (npm)

MAL-2026-378

Malicious code in @diendh/n8n-nodes-tiktok-v2 (npm)

MAL-2026-394

Malicious code in n8n-nodes-zl-vietts (npm)

MAL-2026-385

Malicious code in blocks-builder-manifest-generator (npm)

MAL-2026-395

Malicious code in natateste (npm)

MAL-2026-401

Malicious code in victim-package-c (npm)

MAL-2026-400

Malicious code in victim-package-b (npm)

MAL-2026-377

Malicious code in potdf (npm)

MAL-2026-376

Malicious code in coolpackage2323 (PyPI)

MAL-2026-375

Malicious code in spellcheckerpy (PyPI)

GHSA-2657-3c98-63jq

esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages

MAL-2026-374

Malicious code in mised-discordjs-selfbot-v14 (npm)

MAL-2026-371

Malicious code in theme-neutral (npm)

MAL-2026-370

Malicious code in sezzle (npm)

MAL-2026-368

Malicious code in mw-proto-models (npm)

MAL-2026-373

Malicious code in webmd-debug (npm)

MAL-2026-369

Malicious code in mw-shared-utils (npm)

MAL-2026-372

Malicious code in webmd-cookie (npm)

MAL-2026-359

Malicious code in dreame-claude (npm)

MAL-2026-364

Malicious code in shared-global-ec-uikit (npm)

MAL-2026-361

Malicious code in gu-global-ec-uikit (npm)

MAL-2026-367

Malicious code in uq-global-ec-uikit (npm)

MAL-2026-360

Malicious code in excel-to-json-test (npm)

MAL-2026-363

Malicious code in pl-global-ec-uikit (npm)