— npm MAL-2026-4279 · GHSA-vvr8-673r-w4j2 Malicious code in model-switch-router (npm) Modified: 5/25/2026