— npm MAL-2026-4277 · GHSA-gc4v-cqp6-5672 Malicious code in dev-env-bootstrapper (npm) Modified: 5/25/2026