The Notepad++ supply chain attack — unnoticed execution chains and new IoCs

UPD 11.02.2026: added recommendations on how to use the Notepad++ supply chain attack rules package in our SIEM system. Introduction On February 2, 2026, the developers of Notepad++, a text editor popular among developers, published a statement claiming that the update infrastructure of Notepad++...

Malicious code in fileupload-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 284fb08fce78b3881a87fa045e3cd78babfd4be9859ffd8be916952b1088fc19 The package fileupload-util was found to contain malicious code. Source: ghsa-malware 86e2a72f365ef548c52ca11a5bcfa8cbca1b7ff90e2e35aa34b8d9c2abb9c85...

Malicious code in tarax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b8d2d32117867326488c0c11c3433f88d30b084b30dd132f3b7a9c40c5eef4 The package tarax was found to contain malicious code. Source: ghsa-malware 2f70e23fbb33630933dc47a10dfd81d1e652f73e3ed7afe4aaee5ffc2b65afa7 Any...

Malicious code in @uselagoon/ui-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bda12522a61c5fdbf5675903128a573bb6dcf1bd1aee45a1340877450fb2112f The package @uselagoon/ui-library was found to contain malicious code. Source: ghsa-malware...

MAL-2026-687 Malicious code in @uselagoon/ui-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bda12522a61c5fdbf5675903128a573bb6dcf1bd1aee45a1340877450fb2112f The package @uselagoon/ui-library was found to contain malicious code. Source: ghsa-malware...

Malicious code in internallib_v782 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a9bbdd15886eccdbdf53f99ad4fa7b9f17035436062908eba77c7e312b1b1fe The package internallibv782 was found to contain malicious code. Source: ghsa-malware 9464930de83ed1ea306de3a4bfaa8b022df793d329bcbb9c72523418a652e14...

MAL-2026-679 Malicious code in epic-admin-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53764f149897a5c5d4373d2f217da3994123f2664db8150cfcf37b474ee632db The package epic-admin-ui was found to contain malicious code. Source: ghsa-malware 34cc1c893e75c3b3e5849e74fed6d7f75ce784c9e933d878d93e773fae313305...

MAL-2026-680 Malicious code in frontend-js-state-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 770e7ef9c670e6c188650363a084728f7827f49ab63d6fb9aa57f6e4cfd07dbf The package frontend-js-state-web was found to contain malicious code. Source: ghsa-malware...

Malicious code in l2-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb0d21ff2e4e02ef879ddbcc41ef5c3d957ef37495bb5815beb17335f6579acc The package l2-contracts was found to contain malicious code. Source: ghsa-malware 8d05d077850c263135146bdb5b17ae9606f3f4fcd7eff921214f6ed00118cc4e A...

Malicious code in kwp-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff8db163baaddfa00a5ad4be917d7b8147bbc3b1b0807694614ab14ebac6c431 The package kwp-analytics was found to contain malicious code. Source: ghsa-malware 57994b2b00321595177d73893abdd66ed3fdbe0f5ff0a7565c59efb6126d9e7a...

MAL-2026-682 Malicious code in kwp-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff8db163baaddfa00a5ad4be917d7b8147bbc3b1b0807694614ab14ebac6c431 The package kwp-analytics was found to contain malicious code. Source: ghsa-malware 57994b2b00321595177d73893abdd66ed3fdbe0f5ff0a7565c59efb6126d9e7a...

Malicious code in cookie-parsers-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4a2885cd84876f478aa25e2b8efddc48e11530aef832f085e0b9d8d114ae481 The package cookie-parsers-env was found to contain malicious code. Source: ghsa-malware...

MAL-2026-678 Malicious code in cookie-parsers-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4a2885cd84876f478aa25e2b8efddc48e11530aef832f085e0b9d8d114ae481 The package cookie-parsers-env was found to contain malicious code. Source: ghsa-malware...

Malicious code in @ikeacnalan/icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69aa8245ea172b28e43591f47b972fc5e5901c90a4154f6b5962f7a9a3a2e844 The package @ikeacnalan/icons was found to contain malicious code. Source: ghsa-malware...

MAL-2026-676 Malicious code in @ikeacnalan/icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69aa8245ea172b28e43591f47b972fc5e5901c90a4154f6b5962f7a9a3a2e844 The package @ikeacnalan/icons was found to contain malicious code. Source: ghsa-malware...

Malicious code in freedom-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4512163cbee4473b3f1fec8504df8a156ada7ac4ca90a763fb9968ba58178ade The package freedom-baileys was found to contain malicious code. Source: ghsa-malware 7c21d9105c9c9c7f67546b69fd620327c3b304280b1113d557601d49a0639cd...

Malicious code in supun-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a334e071b736bf620c4a29e4ec2bbaaf59bc6c3d3ab7b44603e19e9a8d95d8e9 The package supun-baileys was found to contain malicious code. Source: ghsa-malware 43ec7bfea6bfa4e623dfafee2f6f8843915886935b0d44ad5d6de4b52f72cb41...

Malicious code in baileys-dtz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 109634c377dbfbc10a7374fb473b28d85fcd47c764895f0c5e685a1f974a0120 The package baileys-dtz was found to contain malicious code. Source: ghsa-malware 14a91b23d2ef0b2dede76b5344cd84626e539f40e791d84f2a793b34d285e196 An...

MAL-2026-675 Malicious code in supun-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a334e071b736bf620c4a29e4ec2bbaaf59bc6c3d3ab7b44603e19e9a8d95d8e9 The package supun-baileys was found to contain malicious code. Source: ghsa-malware 43ec7bfea6bfa4e623dfafee2f6f8843915886935b0d44ad5d6de4b52f72cb41...

CVE-2026-24936

When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can...