MAL-2026-10232 Malicious code in salesforce-vscode-slds (npm)

The salesforce-vscode-slds package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a...

@ardibos/taekbos (1.1.4), @conlan2/cmpt315as2 (>=1.0.0, <=1.0.1) +8 more potentially affected by unknown CVE via public (0.1.5)

public NPM version 0.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on public and may be impacted: - @ardibos/taekbos 1.1.4 - @conlan2/cmpt315as2 =1.0.0, =1.0.8, =0.1.0, =0.1.2 - weektwoabc 1.0.0 - wjwrk9 1.0.1 - yyjchhym 1.0.0 Source cves: unknown C...