CVE-2026-26974: Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde

This is a remote code execution (RCE) vulnerability. Node.js automatically imports **/*.plugin.{js,mjs} files including those from node_modules, so any malicious package with a .plugin.js file could execute arbitrary code when installed or required. All projects using this loading behavior are affected, especially those installing untrusted packages.