Supply Chain Incidents

MAL-2026-4193

Malicious code in private-next-pages (npm)

MAL-2026-4433

Malicious code in @self-evolving-harness/kivo (npm)

MAL-2026-4772

Malicious code in txdpy (PyPI)

MAL-2026-4771

Malicious code in strawberry-graphql (PyPI)

MAL-2026-4773

Malicious code in vlifegram (PyPI)

MAL-2026-4194

Malicious code in libhmac (PyPI)

MAL-2026-4186

Malicious code in @doctolib-apps/native-personalized-services (npm)

MAL-2026-4190

Malicious code in @limebike/supreme-date-pickers (npm)

MAL-2026-4187

Malicious code in @limebike/frontend-core-api (npm)

MAL-2026-4189

Malicious code in @limebike/supreme-data-grid (npm)

MAL-2026-4192

Malicious code in iv-stubborn (npm)

MAL-2026-4191

Malicious code in iv-bloomfilter (npm)

MAL-2026-4188

Malicious code in @limebike/supreme (npm)

MAL-2026-4185

Malicious code in uolcs-host-uol-anuncios-fe (npm)

GHSA-pvw4-cvr4-97p8

Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

MAL-2026-4409

Malicious code in @nutui/nutui-react-taro (npm)

MAL-2026-4184

Malicious code in stripe-internal-utils (npm)

MAL-2026-4372

Malicious code in @budetzz/baileys (npm)

MAL-2026-4367

Malicious code in @bcrumbs.net/bc-chat (npm)

MAL-2026-4605

Malicious code in mamadoos-test (npm)

MAL-2026-4657

Malicious code in randomlogs (npm)

MAL-2026-4569

Malicious code in gator-client (npm)

MAL-2026-4662

Malicious code in rendezvous-js (npm)

MAL-2026-4495

Malicious code in banana-stand (npm)