— npm MAL-2026-4284 · GHSA-p8hf-5qq9-8g8h Malicious code in workspace-config-loader (npm) Modified: 5/25/2026