— npm MAL-2026-4294 · GHSA-vhfh-fm2f-jp72 Malicious code in flow-parser-oxidized (npm) Modified: 5/25/2026