MAL-2026-2060

Affected Products

Timeline

• Mar 22, 2026 CVE Published
• Mar 26, 2026 CVE Updated

References

• https://socket.dev/blog/canisterworm-npm-publisher-compromise-deploys-backdoor-across-29-packages url
• https://github.com/advisories/GHSA-6w74-x38v-9ffj advisory
• https://research.jfrog.com/post/canister-worm/ url
• https://www.endorlabs.com/learn/canisterworm url