Supply Chain Incidents

MAL-2026-12397

Malicious code in luluking (npm)

MAL-2026-12338

Malicious code in alpha-helper (npm)

MAL-2026-12325

Malicious code in @nextco/utils (npm)

MAL-2026-12465

Malicious code in streak-daykey-lib (npm)

MAL-2026-12435

Malicious code in sc-geeksquad-core (npm)

MAL-2026-12316

Malicious code in @cryptosrvc/shift-exchange-root (npm)

MAL-2026-12491

Malicious code in uploader-frontend (npm)

MAL-2026-12492

Malicious code in uploader-frontend-legacy (npm)

MAL-2026-12358

Malicious code in croft-node (npm)

MAL-2026-12395

Malicious code in jquery.ui.tabs (npm)

MAL-2026-12403

Malicious code in node-cache-multithread (npm)

MAL-2026-12430

Malicious code in rollup-plugins-polyfills-rode (npm)

MAL-2026-12394

Malicious code in jquery.ui.core (npm)

MAL-2026-12319

Malicious code in @kite-js-tools/core (npm)

MAL-2026-12334

Malicious code in ach-detail (npm)

MAL-2026-12481

Malicious code in token-list-fetcher (npm)

MAL-2026-12378

Malicious code in express-rate-controller (npm)

MAL-2026-12429

Malicious code in rollup-plugins-check (npm)

MAL-2026-12353

Malicious code in clover-codelab-remote-pay-cloud (npm)

MAL-2026-12321

Malicious code in @mgor/fw-canary-20260725-394b024b (npm)

MAL-2026-12404

Malicious code in npm-module-service (npm)

MAL-2026-12482

Malicious code in tool-registry-scripts (npm)

MAL-2026-12329

Malicious code in @shiftmarkets/shift-sdk-v4 (npm)

MAL-2026-12419

Malicious code in pp-react-worldready-v5 (npm)