— npm MAL-2026-4341 · GHSA-pqjf-2x7v-f9r6 Malicious code in wm-plugin-set-walkme-language (npm) Modified: 5/25/2026