— npm MAL-2026-4283 · GHSA-6fxh-5965-3xf4 Malicious code in token-usage-tracker (npm) Modified: 5/25/2026