Supply Chain Incidents

MAL-2026-16056

Malicious code in tailwind-aspect-styles (npm)

MAL-2026-16052

Malicious code in open-item-validator (npm)

GHSA-rvx4-ffvw-m9q3

Composer arbitrary command execution via a malicious package's Perforce source URL

MAL-2026-16050

Malicious code in @aspect-adv-ui/consent-manager (npm)

MAL-2026-16051

Malicious code in @umschool/analytics (npm)

MAL-2026-16049

Malicious code in tailwindcss-aspectratio-styles (npm)

MAL-2026-16048

Malicious code in punypump (npm)

MAL-2026-16047

Malicious code in @usemosaik/template-react-js (npm)

GHSA-5wp5-5229-5g6q

NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

MAL-2026-16045

Malicious code in i18nexus (npm)

MAL-2026-16046

Malicious code in i18nexus-tools (npm)

MAL-2026-16043

Malicious code in @web2apk/baileys (npm)

MAL-2026-16042

Malicious code in krdpass-auth-react-native (npm)

MAL-2026-16199

Malicious code in plogme (npm)

MAL-2026-16017

Malicious code in telegram-helper (PyPI)

MAL-2026-16016

Malicious code in cv-train (PyPI)

MAL-2026-16015

Malicious code in @cp-shared-14/frontend-ui (npm)

MAL-2026-16020

Malicious code in @aircanada/navigation-handler (npm)

MAL-2026-16019

Malicious code in @aircanada/core (npm)

MAL-2026-16018

Malicious code in @aircanada/components (npm)

MAL-2026-16034

Malicious code in op-ts-server-core (npm)

MAL-2026-16039

Malicious code in service-home (npm)

MAL-2026-16021

Malicious code in @idkruan-10/dpd-depconf-probe (npm)

MAL-2026-16036

Malicious code in redis-type-intel (npm)