# Vulnerabilities published in 2026 - [MAL-2026-18284](https://insights.sbomify.com/MAL-2026-18284/): Malicious code in @jm-telefonica/multibrand-components (npm) (malicious package) - [MAL-2026-18283](https://insights.sbomify.com/MAL-2026-18283/): Malicious code in @greenlake/session (npm) (malicious package) - [MAL-2026-18282](https://insights.sbomify.com/MAL-2026-18282/): Malicious code in @greenlake/common-context (npm) (malicious package) - [MAL-2026-18281](https://insights.sbomify.com/MAL-2026-18281/): Malicious code in @generic-means/ing-feat-scanner-libs (npm) (malicious package) - [MAL-2026-18280](https://insights.sbomify.com/MAL-2026-18280/): Malicious code in @futurae-public/adaptive-js (npm) (malicious package) - [MAL-2026-1828](https://insights.sbomify.com/MAL-2026-1828/): Malicious code in proleis-web-scanner (npm) (malicious package) - [MAL-2026-18279](https://insights.sbomify.com/MAL-2026-18279/): Malicious code in @fmr-ap153177/apex-kit-icons (npm) (malicious package) - [MAL-2026-18278](https://insights.sbomify.com/MAL-2026-18278/): Malicious code in @factoryz/apollo (npm) (malicious package) - [MAL-2026-18277](https://insights.sbomify.com/MAL-2026-18277/): Malicious code in @drone-js-ext/vip-badge (npm) (malicious package) - [MAL-2026-18276](https://insights.sbomify.com/MAL-2026-18276/): Malicious code in @drone-js-ext/core (npm) (malicious package) - [MAL-2026-18275](https://insights.sbomify.com/MAL-2026-18275/): Malicious code in @ppa-web-components/ppa-hotel-collection (npm) (malicious package) - [MAL-2026-18274](https://insights.sbomify.com/MAL-2026-18274/): Malicious code in @ppa-web-components/ppa-headerfooter (npm) (malicious package) - [MAL-2026-18273](https://insights.sbomify.com/MAL-2026-18273/): Malicious code in @ppa-web-components/ppa-builder (npm) (malicious package) - [MAL-2026-18272](https://insights.sbomify.com/MAL-2026-18272/): Malicious code in @ppa-web-components/ppa-banner (npm) (malicious package) - [MAL-2026-18271](https://insights.sbomify.com/MAL-2026-18271/): Malicious code in fontus (PyPI) (malicious package) - [MAL-2026-18270](https://insights.sbomify.com/MAL-2026-18270/): Malicious code in youtube-search-without-api-key (npm) (malicious package) - [MAL-2026-1827](https://insights.sbomify.com/MAL-2026-1827/): Malicious code in proleis-web-gallery (npm) (malicious package) - [MAL-2026-18269](https://insights.sbomify.com/MAL-2026-18269/): Malicious code in youtube-info-streams (npm) (malicious package) - [MAL-2026-18268](https://insights.sbomify.com/MAL-2026-18268/): Malicious code in tiktok-video-scraper (npm) (malicious package) - [MAL-2026-18267](https://insights.sbomify.com/MAL-2026-18267/): Malicious code in sound-cloud-loader-api (npm) (malicious package) - [MAL-2026-18266](https://insights.sbomify.com/MAL-2026-18266/): Malicious code in redis-dumper (npm) (malicious package) - [MAL-2026-18265](https://insights.sbomify.com/MAL-2026-18265/): Malicious code in p12-pem (npm) (malicious package) - [MAL-2026-18264](https://insights.sbomify.com/MAL-2026-18264/): Malicious code in ocsp-hashes (npm) (malicious package) - [MAL-2026-18263](https://insights.sbomify.com/MAL-2026-18263/): Malicious code in ionic-youtube-streams (npm) (malicious package) - [MAL-2026-18262](https://insights.sbomify.com/MAL-2026-18262/): Malicious code in ionic-youtube-search (npm) (malicious package) - [MAL-2026-18261](https://insights.sbomify.com/MAL-2026-18261/): Malicious code in ionic-tiktok-scraper (npm) (malicious package) - [MAL-2026-18260](https://insights.sbomify.com/MAL-2026-18260/): Malicious code in ionic-sound-cloud-loader-api (npm) (malicious package) - [MAL-2026-1826](https://insights.sbomify.com/MAL-2026-1826/): Malicious code in proleis-web-file-input (npm) (malicious package) - [MAL-2026-18259](https://insights.sbomify.com/MAL-2026-18259/): Malicious code in ionic-insta-search (npm) (malicious package) - [MAL-2026-18258](https://insights.sbomify.com/MAL-2026-18258/): Malicious code in insta-reel-search (npm) (malicious package) - [MAL-2026-18257](https://insights.sbomify.com/MAL-2026-18257/): Malicious code in insta-api-wrapper (npm) (malicious package) - [MAL-2026-18256](https://insights.sbomify.com/MAL-2026-18256/): Malicious code in cordova-plugin-geofence-appit (npm) (malicious package) - [MAL-2026-18255](https://insights.sbomify.com/MAL-2026-18255/): Malicious code in cert-infos (npm) (malicious package) - [MAL-2026-18254](https://insights.sbomify.com/MAL-2026-18254/): Malicious code in appit-cordova-plugin-ionic (npm) (malicious package) - [MAL-2026-18253](https://insights.sbomify.com/MAL-2026-18253/): Malicious code in appit-cordova-admob (npm) (malicious package) - [MAL-2026-18252](https://insights.sbomify.com/MAL-2026-18252/): Malicious code in @eforms/forms-api (npm) (malicious package) - [MAL-2026-18251](https://insights.sbomify.com/MAL-2026-18251/): Malicious code in tailwindcss-theme-kit (npm) (malicious package) - [MAL-2026-18250](https://insights.sbomify.com/MAL-2026-18250/): Malicious code in tailwind-base-buttons (npm) (malicious package) - [MAL-2026-1825](https://insights.sbomify.com/MAL-2026-1825/): Malicious code in proleis-web-app (npm) (malicious package) - [MAL-2026-18249](https://insights.sbomify.com/MAL-2026-18249/): Malicious code in noelc-css-blender (npm) (malicious package) - [MAL-2026-18248](https://insights.sbomify.com/MAL-2026-18248/): Malicious code in overarch-windows-x64-yr (npm) (malicious package) - [MAL-2026-18247](https://insights.sbomify.com/MAL-2026-18247/): Malicious code in @liauto/win32-x64 (npm) (malicious package) - [MAL-2026-18246](https://insights.sbomify.com/MAL-2026-18246/): Malicious code in orqiva-runtime-win32-x64 (npm) (malicious package) - [MAL-2026-18245](https://insights.sbomify.com/MAL-2026-18245/): Malicious code in @k18k/entrypoint-sdk-linux-x64 (npm) (malicious package) - [MAL-2026-18244](https://insights.sbomify.com/MAL-2026-18244/): Malicious code in @k18k/entrypoint-sdk-darwin-x64 (npm) (malicious package) - [MAL-2026-18243](https://insights.sbomify.com/MAL-2026-18243/): Malicious code in @k18k/entrypoint-sdk-darwin-arm64 (npm) (malicious package) - [MAL-2026-18242](https://insights.sbomify.com/MAL-2026-18242/): Malicious code in sitecard (PyPI) (malicious package) - [MAL-2026-18241](https://insights.sbomify.com/MAL-2026-18241/): Malicious code in workslip (PyPI) (malicious package) - [MAL-2026-18240](https://insights.sbomify.com/MAL-2026-18240/): Malicious code in thornqueue (PyPI) (malicious package) - [MAL-2026-1824](https://insights.sbomify.com/MAL-2026-1824/): Malicious code in proleis-web-animations (npm) (malicious package) - [MAL-2026-18239](https://insights.sbomify.com/MAL-2026-18239/): Malicious code in thistlerun (PyPI) (malicious package) - [MAL-2026-18238](https://insights.sbomify.com/MAL-2026-18238/): Malicious code in taskquay (PyPI) (malicious package) - [MAL-2026-18237](https://insights.sbomify.com/MAL-2026-18237/): Malicious code in slatejob (PyPI) (malicious package) - [MAL-2026-18236](https://insights.sbomify.com/MAL-2026-18236/): Malicious code in sedgehaul (PyPI) (malicious package) - [MAL-2026-18235](https://insights.sbomify.com/MAL-2026-18235/): Malicious code in runpier (PyPI) (malicious package) - [MAL-2026-18234](https://insights.sbomify.com/MAL-2026-18234/): Malicious code in reedworker (PyPI) (malicious package) - [MAL-2026-18233](https://insights.sbomify.com/MAL-2026-18233/): Malicious code in otterload (PyPI) (malicious package) - [MAL-2026-18232](https://insights.sbomify.com/MAL-2026-18232/): Malicious code in marshrunner (PyPI) (malicious package) - [MAL-2026-18231](https://insights.sbomify.com/MAL-2026-18231/): Malicious code in loadferry (PyPI) (malicious package) - [MAL-2026-18230](https://insights.sbomify.com/MAL-2026-18230/): Malicious code in larchworker (PyPI) (malicious package) - [MAL-2026-1823](https://insights.sbomify.com/MAL-2026-1823/): Malicious code in proleis-rest-client (npm) (malicious package) - [MAL-2026-18229](https://insights.sbomify.com/MAL-2026-18229/): Malicious code in juniperrun (PyPI) (malicious package) - [MAL-2026-18228](https://insights.sbomify.com/MAL-2026-18228/): Malicious code in jobwharf (PyPI) (malicious package) - [MAL-2026-18227](https://insights.sbomify.com/MAL-2026-18227/): Malicious code in flintqueue (PyPI) (malicious package) - [MAL-2026-18226](https://insights.sbomify.com/MAL-2026-18226/): Malicious code in ferretqueue (PyPI) (malicious package) - [MAL-2026-18225](https://insights.sbomify.com/MAL-2026-18225/): Malicious code in cobbleload (PyPI) (malicious package) - [MAL-2026-18224](https://insights.sbomify.com/MAL-2026-18224/): Malicious code in brookworker (PyPI) (malicious package) - [MAL-2026-18223](https://insights.sbomify.com/MAL-2026-18223/): Malicious code in brambletask (PyPI) (malicious package) - [MAL-2026-18222](https://insights.sbomify.com/MAL-2026-18222/): Malicious code in badgertask (PyPI) (malicious package) - [MAL-2026-18221](https://insights.sbomify.com/MAL-2026-18221/): Malicious code in kestreljob (PyPI) (malicious package) - [MAL-2026-18220](https://insights.sbomify.com/MAL-2026-18220/): Malicious code in skillward (npm) (malicious package) - [MAL-2026-1822](https://insights.sbomify.com/MAL-2026-1822/): Malicious code in postcss-hotfix (npm) (malicious package) - [MAL-2026-18219](https://insights.sbomify.com/MAL-2026-18219/): Malicious code in onsokets (PyPI) (malicious package) - [MAL-2026-18218](https://insights.sbomify.com/MAL-2026-18218/): Malicious code in qowa (PyPI) (malicious package) - [MAL-2026-18217](https://insights.sbomify.com/MAL-2026-18217/): Malicious code in @grabcad/user-license (npm) (malicious package) - [MAL-2026-18216](https://insights.sbomify.com/MAL-2026-18216/): Malicious code in @grabcad/preferences-client (npm) (malicious package) - [MAL-2026-18215](https://insights.sbomify.com/MAL-2026-18215/): Malicious code in @grabcad/grabcad-shop-shared (npm) (malicious package) - [MAL-2026-18214](https://insights.sbomify.com/MAL-2026-18214/): Malicious code in @grabcad/company-server-shared (npm) (malicious package) - [MAL-2026-18213](https://insights.sbomify.com/MAL-2026-18213/): Malicious code in @cecm-web-sdk/core (npm) (malicious package) - [MAL-2026-18212](https://insights.sbomify.com/MAL-2026-18212/): Malicious code in @blueskydataplatform/shared-ui (npm) (malicious package) - [MAL-2026-18211](https://insights.sbomify.com/MAL-2026-18211/): Malicious code in @ecg-internal/reviews-dialog-ui (npm) (malicious package) - [MAL-2026-18210](https://insights.sbomify.com/MAL-2026-18210/): Malicious code in @ecg-internal/media-util-js-lib (npm) (malicious package) - [MAL-2026-1821](https://insights.sbomify.com/MAL-2026-1821/): Malicious code in portal-lime (npm) (malicious package) - [MAL-2026-18209](https://insights.sbomify.com/MAL-2026-18209/): Malicious code in @ecg-internal/js-react-i18n (npm) (malicious package) - [MAL-2026-18208](https://insights.sbomify.com/MAL-2026-18208/): Malicious code in @ecg-internal/favourites-ui (npm) (malicious package) - [MAL-2026-18207](https://insights.sbomify.com/MAL-2026-18207/): Malicious code in @ecg-internal/aurora-js-formatters (npm) (malicious package) - [MAL-2026-18206](https://insights.sbomify.com/MAL-2026-18206/): Malicious code in @ecg-internal/adobe-dmp-js (npm) (malicious package) - [MAL-2026-18205](https://insights.sbomify.com/MAL-2026-18205/): Malicious code in @tekmidian/pai (npm) (malicious package) - [MAL-2026-18204](https://insights.sbomify.com/MAL-2026-18204/): Malicious code in @factiii/runner (npm) (malicious package) - [MAL-2026-18203](https://insights.sbomify.com/MAL-2026-18203/): Malicious code in journey-teste-shellhello (PyPI) (malicious package) - [MAL-2026-18202](https://insights.sbomify.com/MAL-2026-18202/): Malicious code in sdk-utils-testmetest (npm) (malicious package) - [MAL-2026-18201](https://insights.sbomify.com/MAL-2026-18201/): Malicious code in kvarzo8f3atestmetest (npm) (malicious package) - [MAL-2026-18200](https://insights.sbomify.com/MAL-2026-18200/): Malicious code in @seggy116/next-diff (npm) (malicious package) - [MAL-2026-1820](https://insights.sbomify.com/MAL-2026-1820/): Malicious code in player-common-controls (npm) (malicious package) - [MAL-2026-182](https://insights.sbomify.com/MAL-2026-182/): Malicious code in yunxohang10 (npm) (malicious package) - [MAL-2026-18199](https://insights.sbomify.com/MAL-2026-18199/): Malicious code in @pkgship/frps-linux-amd64 (npm) (malicious package) - [MAL-2026-18198](https://insights.sbomify.com/MAL-2026-18198/): Malicious code in @pkgship/frpc-linux-amd64 (npm) (malicious package) - [MAL-2026-18197](https://insights.sbomify.com/MAL-2026-18197/): Malicious code in x402-prompt-injection-scan (npm) (malicious package) - [MAL-2026-18196](https://insights.sbomify.com/MAL-2026-18196/): Malicious code in imgdecode (npm) (malicious package) - [MAL-2026-18195](https://insights.sbomify.com/MAL-2026-18195/): Malicious code in darknode-cli (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/100/