{"id":"MAL-2026-3514","url":"https://compromised.live/t/MAL-2026-3514","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in @tallyui/components (npm)","summary":"The npm package contains malicious code that can run on a developer's machine or build system once installed, potentially letting an attacker take control or steal data. npm package @tallyui/components, versions 1.0.1, 1.0.2 and 1.0.3. Remove these versions from your projects, pin to a known-safe release, and check for signs of compromise on any system that installed them.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"@tallyui/components","affected":"1.0.1, 1.0.2, 1.0.3","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z","status":"active","details":"","aliases":["GHSA-fc57-xv4v-8cp7","MAL-2026-3514"],"sources":[{"name":"osv","id":"MAL-2026-3514","url":"https://osv.dev/vulnerability/MAL-2026-3514"}]}