supply-chain

• CVE-2026-55487 - pnpm allowBuilds identity spoof 2026-06-27
• GHSA-72r4-9c5j-mj57 - pnpm better-node-range CPU exhaustion 2026-06-27
• GHSA-fr4h-3cph-29xv - pnpm protocol specifier bypass 2026-06-27
• GHSA-qrv3-253h-g69c - pnpm configDependencies symlink traversal 2026-06-27
• SLSA provenance evidence check 2026-06-25
• GHSA-gv7w-rqvm-qjhr - esbuild Deno binary integrity RCE 2026-06-13
• CVE-2026-34841 - @usebruno/cli axios supply-chain RAT 2026-06-09
• GHSA-jpvj-wpmj-h7rv - @cap-js/openapi package compromise 2026-06-09
• CVE-2026-10796 - nvm mirror version command injection 2026-06-07
• CVE-2026-45321 - TanStack npm supply-chain compromise 2026-06-07
• CVE-2026-48027 - Nx Console extension compromise 2026-06-07
• GHSA-wx3m-whqv-xv47 - skillctl path and symlink traversal 2026-06-07
• CVE-2026-48501 - GitHub CLI TUF token leakage 2026-06-06
• Source code audit - dependency and build integrity 2026-06-06
• GHSA-54pg-9963-v8vg - Intercom client package compromise 2026-05-10
• CVE-2026-40903 - goshs ArtiPACKED GitHub Actions token leakage 2026-05-03
• GHSA-rpm5/GHSA-x2qx - GitPython command injection 2026-05-02
• Compromised package — cache quarantine 2026-04-25
• CVE-2024-3094 — xz-utils backdoor 2026-04-25