items-validator and item-validator: three weeks old and six years dormant, flagged as malware the same morning
On the morning of 19 October 2026, GitHub's Advisory Database reviewed two npm packages as items-validator and item-validator — names one letter apart, Both are short, and both say the same thing in the same words: "Any computer that has this CWE-506, "Embedded Malicious Code." Neither advisory describes the actual payload, names a CVE, The registry's own time field — the publish timestamp of every version a package has ever had — $ curl -s https://registry.npmjs.org/items-validator | python3 -c
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.