Recall Forensics

Recall Forensics: The Niwali Tejocote Yellow Oleander Recall — the validation failure behind it

Team ValidLeaf · September 2026 · 6 min read

Recall Forensics is our series tracing real product recalls to the specific validation gap that caused them. Every fact comes from public regulator records or trade-press reporting of those records — no speculation, no invented causes. This case is our first in dietary supplements, and it is the starkest identity failure we have covered yet: a product labeled as Mexican hawthorn that was never Mexican hawthorn at all — and not the first time it happened under the same brand name.

What happened

On September 21, 2026, Global Mix Inc. of Middle Village, New York, announced a voluntary recall of two dietary supplements: Niwali Tejocote Capsules (90-count bottles, lot RM500925) and Niwali Tejocote Pieces (90-day-supply bottles, lot RM400925, UPC 1 99284 23789 6), both carrying a best-by date of 03/03/2028. The recall notice, posted on the FDA's website, says FDA laboratory analysis determined the products appear to be yellow oleander (Thevetia peruviana) — a poisonous plant — rather than tejocote, also known as Mexican hawthorn (Crataegus mexicana).

Yellow oleander contains cardiac glycosides, compounds that act on the heart. The FDA warns that ingestion can cause severe or even fatal neurologic, gastrointestinal, and cardiovascular effects — nausea, vomiting, dizziness, diarrhea, abdominal pain, dangerous changes in heart rhythm, and arrhythmia. This was not a labeling typo. It was the wrong plant in the bottle, and a plant whose chemistry targets the heart (Medical Daily; ConsumerAffairs; Vitamin Rush).

The detection trail matters. The FDA collected the two samples on June 19, 2026 — roughly three months before the recall. On September 17, the agency added both Niwali products to its ongoing yellow-oleander safety alert alongside a third product, Easy Forte Natural Fiber (sold by Comercializadora Naturista del Bajio through Amazon's Jaola Store, and tested positive after a state laboratory partner's testing under the FDA's Laboratory Flexible Funding Model). The alert's product list now stands at 33 items. The Easy Forte finding widens the lesson: that product is not marketed as tejocote at all, so "just don't buy anything labeled tejocote" was never a sufficient defense (Food Safety News; SavingAdvice; Medical Daily).

Then there is the detail that converts this from an incident into a system failure. This is the second time the Niwali brand has been recalled for yellow oleander. In April 2024, Global Mix recalled tejocote root products sold under four brand names — Niwali, Eva Nutrition, Science of Alpha, and NWL Nutra — after yellow oleander was found in them. Two and a half years later, the same brand name, the same toxin, the same finding by a laboratory: products labeled as tejocote that were in fact yellow oleander (Medical Daily; Vitamin Rush).

Two more facts from the recall notice. The company says only five units were sold — two bottles of capsules, three of pieces — through ebay.com and Everymarket.com, and no illnesses had been reported to the company at the time of the announcement. But it also says it is unable to identify or notify every purchaser individually, because the online marketplaces do not release buyer contact details to sellers. So the recall depends entirely on consumers finding the notice on their own (ConsumerAffairs).

An honesty note, because we hold ourselves to it: public reporting does not explain how yellow oleander ended up in the Niwali products a second time, or what Global Mix changed — if anything — after the 2024 recall. The company says it is investigating. The lesson doesn't depend on the mechanism; it depends on the repetition.

The validation gap: botanical identity was never verified

Every other Recall Forensics case we have covered involved the right ingredient gone wrong — Listeria slipping past an environmental monitoring program in frozen pasta, methylene chloride hiding inside a purchased flavoring. This case is different and worse: the ingredient was never the ingredient. The identity on the label and the identity in the bottle were two different plants, and no control in the company's system caught the difference. Twice.

Under 21 CFR Part 111, the dietary supplement cGMP rule, a manufacturer must verify the identity of each dietary ingredient before it goes into a batch — through testing with a scientifically valid method, or by qualifying the supplier and confirming that qualification with certificates and periodic checks. Botanicals are the hardest case: a dried, powdered, or processed plant fragment can be visually indistinguishable from a related species, and substitution of one botanical for another is a known, documented fraud risk. That is exactly why the regulation exists, and exactly why skipping identity verification on botanicals is the single most dangerous corner to cut in this industry.

The CDC published the warning sign in September 2023: investigators bought ten products labeled as tejocote root online, and nine tested positive for yellow oleander — none contained any tejocote at all. Any supplement manufacturer sourcing tejocote after that date had public, citable notice that the supply chain for this botanical was compromised. Yet in 2026, the same substitution reached consumers under the same brand name that had already been burned by it in 2024 (Medical Daily).

A functioning identity-control system has four layers, and the repeat recall says none of them were operating:

• Identity testing of every incoming botanical lot. Macroscopic and microscopic examination, HPTLC fingerprinting, or another appropriate method — applied to every lot, not just the first shipment from a new supplier. A powdered capsule filler that "looks fine" is not an identity test.
• Supplier qualification for botanicals, scaled to fraud risk. After the CDC's 2023 finding, any supplier of tejocote should have been treated as high-risk: quality agreements, audit rights, and certificates that are verified rather than filed.
• Corrective action that actually closes the loop. A 2024 recall over yellow oleander should have triggered a root-cause investigation and a CAPA that made the 2026 recurrence impossible — requalification of suppliers, tightened identity specs, or discontinuing the botanical. The same toxin in the same brand 29 months later means the CAPA never closed.
• Distribution traceability. The company could not reach its own buyers because sales ran through marketplaces that withhold customer data. Part 111 requires distribution records — and when your channel can't give you names, your recall plan has to account for that limitation in advance, not discover it on recall day.

Compare the third September-17 addition, Easy Forte Natural Fiber: a fiber supplement that tested positive for yellow oleander without ever claiming to be tejocote. When substitution is that far upstream — when the wrong plant enters a supply chain wearing no label at all — the only defense is testing what actually arrives, not reading what the paperwork says. Paperwork says what sellers want you to believe; chromatography says what is in the drum.

How a GMP Readiness Assessment catches it

This is exactly the failure pattern a GMP Readiness Assessment for a supplement manufacturer is built to find. Over four weeks, it reviews:

• Your incoming-material identity program — does every botanical lot get identity-tested with a scientifically valid method, or does "verify" mean "read the supplier's certificate"?
• Supplier qualification vs. fraud risk — are botanical suppliers tiered by risk, with high-risk botanicals (like tejocote since 2023) getting audit rights, quality agreements, and verified certificates?
• Your CAPA system under stress — do past deviations and recalls trace to closed, verified corrective actions, or do the same findings recur under new lot codes?
• Distribution and recall readiness — can you actually reach your buyers if a recall hits tomorrow, including sales through marketplaces and third-party sellers?

It closes with a gap assessment, a remediation roadmap, and starter qualification templates — so the identity check happens before the FDA's laboratory does it for you.