In the first incident, an officer at Ukraine's embassy in Madrid was injured when he opened a letter bomb addressed to the ambassador, prompting Kyiv to order greater security at all its representative offices abroad.
The letter, which arrived by regular mail and was not scanned, caused "a very small wound" on one finger when the officer opened it in the embassy garden, Mercedes Gonzalez, a Spanish government official, told broadcaster Telemadrid.
Hours later, an arms company in Zaragoza, northeastern Spain, received a similar package, police confirmed.
The government representative in Zaragoza, Rosa Serrano, said in an interview with the SER station that the two envelopes appeared to have the same sender since the same e-mail address was written on the back of both of them. Serrano said the packages came from Ukraine and this is what alarmed the arms company, which called the police.
The arms company is Instalaza, the manufacturer of the C90 rocket launcher that Spain donates to Ukraine.
After the first incident, Ukrainian Foreign Minister Dmytro Kuleba ordered all of Kyiv's embassies abroad to "urgently" strengthen security and urged Spain to take investigate the attack, a ministry spokesperson said.
The Ukrainian government did not immediately respond to a request for comment about the second incident.
Ukraine's ambassador to Madrid, Serhii Pohoreltsev, told TVE later that he was working as usual at the embassy "with no fear".
"We have instructions from the ministry in Ukraine that given the situation we have to be prepared for any kind of incident... any kind of Russian activities outside the country," he said.
Russia invaded Ukraine nine months ago in what it calls a "special military operation" that Kyiv and the West describe as an unprovoked, imperialist land grab.
The ambassador declined to give details of how the letter had been handled but said the injured worker had followed protocol and that the embassy would look into improving the system.
Spain's High Court has opened a probe into the attack as a possible case of terrorism, a judicial source said.
Police carried out a contained explosion in the factory and the incident reported no damage, according to the same media.
The envelope that was sent to Zaragoza was 10 x 15 cm and an X-ray showed the explosive charge with a wireline ready to be activated when the envelope was opened, Serrano said.
Correos, the Spanish state-run postal company, told Reuters it is cooperating with the investigation.
The residential area surrounding the embassy in northwestern Madrid was cordoned off and a bomb disposal unit was deployed to the scene, as well as the area around the Zaragoza factory.
Reuters