— npm MAL-2026-4280 · GHSA-vxfv-w8fq-239r Malicious code in node-setup-helpers (npm) Modified: 5/25/2026