— npm MAL-2026-5062 · GHSA-frcf-f9wx-gq64 Malicious code in codex-devcontainer-install (npm) Modified: 5/29/2026