CWE-506 Embedded Malicious Code

Unauthorized npm publish of cline@2.3.0 with modified postinstall script

Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)

Malicious versions of Nx were published

num2words subjected to phishing attack, two versions published containing malware

`exploration` was removed from crates.io for malicious code

semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin

Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

Compromise of PyTorch Lightning PyPi Package Versions

Supply chain compromise via malicious @cap-js/openapi

Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

Malware in @opensearch-project/opensearch

Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp

Malicious dropper in mistralai 2.4.6 PyPI package

Compromised version of intercom-client published to npm

Compromised tag of intercom-php published via GitHub

`mysten-metrics` was removed from crates.io for malicious code

`sui-execution-cut` was removed from crates.io for malicious code

Axios npm Supply Chain Incident Impacting @usebruno/cli

Trivy ecosystem supply chain was briefly compromised

Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2

Two LiteLLM versions published containing credential harvesting malware

xygeni-action v5 tag poisoned with C2 backdoor

Embedded malware in ua-parser-js