— npm MAL-2026-6116 · GHSA-5786-jcjh-w75f Malicious code in npm-sandbox-research-f1g2 (npm) Modified: 6/18/2026