# Vulnerabilities published in 2026


- [MAL-2026-18194](https://insights.sbomify.com/MAL-2026-18194/): Malicious code in @lumen-labs-dev/whisper-node (npm) (malicious package)
- [MAL-2026-18193](https://insights.sbomify.com/MAL-2026-18193/): Malicious code in opencode-skills-collection (npm) (malicious package)
- [MAL-2026-18192](https://insights.sbomify.com/MAL-2026-18192/): Malicious code in agentic-awesome-skills (npm) (malicious package)
- [MAL-2026-18191](https://insights.sbomify.com/MAL-2026-18191/): Malicious code in @pkgship/frpc-darwin-amd64 (npm) (malicious package)
- [MAL-2026-18190](https://insights.sbomify.com/MAL-2026-18190/): Malicious code in @liauto/darwin-x64 (npm) (malicious package)
- [MAL-2026-1819](https://insights.sbomify.com/MAL-2026-1819/): Malicious code in player-common-composites (npm) (malicious package)
- [MAL-2026-18189](https://insights.sbomify.com/MAL-2026-18189/): Malicious code in aanthropic (PyPI) (malicious package)
- [MAL-2026-18188](https://insights.sbomify.com/MAL-2026-18188/): Malicious code in 1h1 (PyPI) (malicious package)
- [MAL-2026-18187](https://insights.sbomify.com/MAL-2026-18187/): Malicious code in simplewave (npm) (malicious package)
- [MAL-2026-18186](https://insights.sbomify.com/MAL-2026-18186/): Malicious code in net-codec-testmetest (npm) (malicious package)
- [MAL-2026-18185](https://insights.sbomify.com/MAL-2026-18185/): Malicious code in log-rotate-testmetest (npm) (malicious package)
- [MAL-2026-18184](https://insights.sbomify.com/MAL-2026-18184/): Malicious code in formatting-subtitles (npm) (malicious package)
- [MAL-2026-18183](https://insights.sbomify.com/MAL-2026-18183/): Malicious code in @conduitops/logview-archive (npm) (malicious package)
- [MAL-2026-18182](https://insights.sbomify.com/MAL-2026-18182/): Malicious code in test-brotli2-testmetest (npm) (malicious package)
- [MAL-2026-18181](https://insights.sbomify.com/MAL-2026-18181/): Malicious code in test-brotli-testmetest (npm) (malicious package)
- [MAL-2026-18180](https://insights.sbomify.com/MAL-2026-18180/): Malicious code in pixel-map-testmetest (npm) (malicious package)
- [MAL-2026-1818](https://insights.sbomify.com/MAL-2026-1818/): Malicious code in player-button (npm) (malicious package)
- [MAL-2026-18179](https://insights.sbomify.com/MAL-2026-18179/): Malicious code in log-sink-testmetest (npm) (malicious package)
- [MAL-2026-18178](https://insights.sbomify.com/MAL-2026-18178/): Malicious code in event-emitter-testmetest (npm) (malicious package)
- [MAL-2026-18177](https://insights.sbomify.com/MAL-2026-18177/): Malicious code in data-pipeline-testmetest (npm) (malicious package)
- [MAL-2026-18176](https://insights.sbomify.com/MAL-2026-18176/): Malicious code in voxweaver (PyPI) (malicious package)
- [MAL-2026-18175](https://insights.sbomify.com/MAL-2026-18175/): Malicious code in voicekit (PyPI) (malicious package)
- [MAL-2026-18174](https://insights.sbomify.com/MAL-2026-18174/): Malicious code in vocabblend (PyPI) (malicious package)
- [MAL-2026-18173](https://insights.sbomify.com/MAL-2026-18173/): Malicious code in vocabbench (PyPI) (malicious package)
- [MAL-2026-18172](https://insights.sbomify.com/MAL-2026-18172/): Malicious code in ttsweaver (PyPI) (malicious package)
- [MAL-2026-18171](https://insights.sbomify.com/MAL-2026-18171/): Malicious code in ttsprobe (PyPI) (malicious package)
- [MAL-2026-18170](https://insights.sbomify.com/MAL-2026-18170/): Malicious code in ttsflow (PyPI) (malicious package)
- [MAL-2026-1817](https://insights.sbomify.com/MAL-2026-1817/): Malicious code in plate-playground-template (npm) (malicious package)
- [MAL-2026-18169](https://insights.sbomify.com/MAL-2026-18169/): Malicious code in ttsdock (PyPI) (malicious package)
- [MAL-2026-18168](https://insights.sbomify.com/MAL-2026-18168/): Malicious code in speechprobe (PyPI) (malicious package)
- [MAL-2026-18167](https://insights.sbomify.com/MAL-2026-18167/): Malicious code in speaksocket (PyPI) (malicious package)
- [MAL-2026-18166](https://insights.sbomify.com/MAL-2026-18166/): Malicious code in speakbench (PyPI) (malicious package)
- [MAL-2026-18165](https://insights.sbomify.com/MAL-2026-18165/): Malicious code in soundsocket (PyPI) (malicious package)
- [MAL-2026-18164](https://insights.sbomify.com/MAL-2026-18164/): Malicious code in phonemeprobe (PyPI) (malicious package)
- [MAL-2026-18163](https://insights.sbomify.com/MAL-2026-18163/): Malicious code in phonemeforge (PyPI) (malicious package)
- [MAL-2026-18162](https://insights.sbomify.com/MAL-2026-18162/): Malicious code in modelworks (PyPI) (malicious package)
- [MAL-2026-18161](https://insights.sbomify.com/MAL-2026-18161/): Malicious code in evalstream (PyPI) (malicious package)
- [MAL-2026-18160](https://insights.sbomify.com/MAL-2026-18160/): Malicious code in benchworks (PyPI) (malicious package)
- [MAL-2026-1816](https://insights.sbomify.com/MAL-2026-1816/): Malicious code in pkgnewfefame1 (npm) (malicious package)
- [MAL-2026-18159](https://insights.sbomify.com/MAL-2026-18159/): Malicious code in benchbridge (PyPI) (malicious package)
- [MAL-2026-18158](https://insights.sbomify.com/MAL-2026-18158/): Malicious code in audiokit (PyPI) (malicious package)
- [MAL-2026-18157](https://insights.sbomify.com/MAL-2026-18157/): Malicious code in asrloom (PyPI) (malicious package)
- [MAL-2026-18156](https://insights.sbomify.com/MAL-2026-18156/): Malicious code in asrdock (PyPI) (malicious package)
- [MAL-2026-18155](https://insights.sbomify.com/MAL-2026-18155/): Malicious code in acoustichub (PyPI) (malicious package)
- [MAL-2026-18154](https://insights.sbomify.com/MAL-2026-18154/): Malicious code in pipegrip (PyPI) (malicious package)
- [MAL-2026-18153](https://insights.sbomify.com/MAL-2026-18153/): Malicious code in hookgantry (PyPI) (malicious package)
- [MAL-2026-18152](https://insights.sbomify.com/MAL-2026-18152/): Malicious code in acousticpack (PyPI) (malicious package)
- [MAL-2026-18151](https://insights.sbomify.com/MAL-2026-18151/): Malicious code in zennittts (PyPI) (malicious package)
- [MAL-2026-18150](https://insights.sbomify.com/MAL-2026-18150/): Malicious code in voxilaratts (PyPI) (malicious package)
- [MAL-2026-1815](https://insights.sbomify.com/MAL-2026-1815/): Malicious code in pkg1511222 (npm) (malicious package)
- [MAL-2026-18149](https://insights.sbomify.com/MAL-2026-18149/): Malicious code in vellutts (PyPI) (malicious package)
- [MAL-2026-18148](https://insights.sbomify.com/MAL-2026-18148/): Malicious code in tessivatts (PyPI) (malicious package)
- [MAL-2026-18147](https://insights.sbomify.com/MAL-2026-18147/): Malicious code in solivoxtts (PyPI) (malicious package)
- [MAL-2026-18146](https://insights.sbomify.com/MAL-2026-18146/): Malicious code in shellgrip (PyPI) (malicious package)
- [MAL-2026-18145](https://insights.sbomify.com/MAL-2026-18145/): Malicious code in quillonatts (PyPI) (malicious package)
- [MAL-2026-18144](https://insights.sbomify.com/MAL-2026-18144/): Malicious code in prosodinetts (PyPI) (malicious package)
- [MAL-2026-18143](https://insights.sbomify.com/MAL-2026-18143/): Malicious code in phonoviatts (PyPI) (malicious package)
- [MAL-2026-18142](https://insights.sbomify.com/MAL-2026-18142/): Malicious code in orchestril (PyPI) (malicious package)
- [MAL-2026-18141](https://insights.sbomify.com/MAL-2026-18141/): Malicious code in melcuratts (PyPI) (malicious package)
- [MAL-2026-18140](https://insights.sbomify.com/MAL-2026-18140/): Malicious code in grommatts (PyPI) (malicious package)
- [MAL-2026-1814](https://insights.sbomify.com/MAL-2026-1814/): Malicious code in phx-core5 (npm) (malicious package)
- [MAL-2026-18139](https://insights.sbomify.com/MAL-2026-18139/): Malicious code in dictanovaasr (PyPI) (malicious package)
- [MAL-2026-18138](https://insights.sbomify.com/MAL-2026-18138/): Malicious code in crenelatts (PyPI) (malicious package)
- [MAL-2026-18137](https://insights.sbomify.com/MAL-2026-18137/): Malicious code in codecraze (PyPI) (malicious package)
- [MAL-2026-18136](https://insights.sbomify.com/MAL-2026-18136/): Malicious code in brummatts (PyPI) (malicious package)
- [MAL-2026-18135](https://insights.sbomify.com/MAL-2026-18135/): Malicious code in batchspar (PyPI) (malicious package)
- [MAL-2026-18134](https://insights.sbomify.com/MAL-2026-18134/): Malicious code in aurenatts (PyPI) (malicious package)
- [MAL-2026-18133](https://insights.sbomify.com/MAL-2026-18133/): Malicious code in journey-test-hellospy (PyPI) (malicious package)
- [MAL-2026-18132](https://insights.sbomify.com/MAL-2026-18132/): Malicious code in libseal (PyPI) (malicious package)
- [MAL-2026-18131](https://insights.sbomify.com/MAL-2026-18131/): Malicious code in iterquarry (PyPI) (malicious package)
- [MAL-2026-18130](https://insights.sbomify.com/MAL-2026-18130/): Malicious code in @sudobility/wildduck_client (npm) (malicious package)
- [MAL-2026-1813](https://insights.sbomify.com/MAL-2026-1813/): Malicious code in phx-core4 (npm) (malicious package)
- [MAL-2026-18129](https://insights.sbomify.com/MAL-2026-18129/): Malicious code in @sudobility/testomniac_client (npm) (malicious package)
- [MAL-2026-18128](https://insights.sbomify.com/MAL-2026-18128/): Malicious code in @sudobility/shaperouter_client (npm) (malicious package)
- [MAL-2026-18127](https://insights.sbomify.com/MAL-2026-18127/): Malicious code in @sudobility/indexer_client (npm) (malicious package)
- [MAL-2026-18126](https://insights.sbomify.com/MAL-2026-18126/): Malicious code in zzhelloworld_socktest (RubyGems) (malicious package)
- [MAL-2026-18125](https://insights.sbomify.com/MAL-2026-18125/): Malicious code in @worrisome/aaaa (npm) (malicious package)
- [MAL-2026-18124](https://insights.sbomify.com/MAL-2026-18124/): Malicious code in journey-test-helloshell (PyPI) (malicious package)
- [MAL-2026-18123](https://insights.sbomify.com/MAL-2026-18123/): Malicious code in peptide-modify (npm) (malicious package)
- [MAL-2026-18122](https://insights.sbomify.com/MAL-2026-18122/): Malicious code in moveworks-capi-starter (PyPI) (malicious package)
- [MAL-2026-18121](https://insights.sbomify.com/MAL-2026-18121/): Malicious code in my-auto-follow-eltio (npm) (malicious package)
- [MAL-2026-18120](https://insights.sbomify.com/MAL-2026-18120/): Malicious code in @alannxd/baileys (npm) (malicious package)
- [MAL-2026-1812](https://insights.sbomify.com/MAL-2026-1812/): Malicious code in phx-core3 (npm) (malicious package)
- [MAL-2026-18119](https://insights.sbomify.com/MAL-2026-18119/): Malicious code in ssemver (PyPI) (malicious package)
- [MAL-2026-18118](https://insights.sbomify.com/MAL-2026-18118/): Malicious code in semer (PyPI) (malicious package)
- [MAL-2026-18117](https://insights.sbomify.com/MAL-2026-18117/): Malicious code in deebug (PyPI) (malicious package)
- [MAL-2026-18116](https://insights.sbomify.com/MAL-2026-18116/): Malicious code in debbug (PyPI) (malicious package)
- [MAL-2026-18115](https://insights.sbomify.com/MAL-2026-18115/): Malicious code in tellyo-colours (npm) (malicious package)
- [MAL-2026-18114](https://insights.sbomify.com/MAL-2026-18114/): Malicious code in trijigo-kalip (PyPI) (malicious package)
- [MAL-2026-18113](https://insights.sbomify.com/MAL-2026-18113/): Malicious code in jiklpo-tsunari-kay (PyPI) (malicious package)
- [MAL-2026-18112](https://insights.sbomify.com/MAL-2026-18112/): Malicious code in hijok-lampam (PyPI) (malicious package)
- [MAL-2026-18111](https://insights.sbomify.com/MAL-2026-18111/): Malicious code in hijiko-pilaka (PyPI) (malicious package)
- [MAL-2026-18110](https://insights.sbomify.com/MAL-2026-18110/): Malicious code in facewareretargeter (PyPI) (malicious package)
- [MAL-2026-1811](https://insights.sbomify.com/MAL-2026-1811/): Malicious code in phx-core2 (npm) (malicious package)
- [MAL-2026-18109](https://insights.sbomify.com/MAL-2026-18109/): Malicious code in rs-lookout-sandbox-poc (npm) (malicious package)
- [MAL-2026-18108](https://insights.sbomify.com/MAL-2026-18108/): Malicious code in rootaccessxvv-bbmarker (npm) (malicious package)
- [MAL-2026-18107](https://insights.sbomify.com/MAL-2026-18107/): Malicious code in nwfp-build-config (npm) (malicious package)
- [MAL-2026-18106](https://insights.sbomify.com/MAL-2026-18106/): Malicious code in memories-core-web (npm) (malicious package)
- [MAL-2026-18105](https://insights.sbomify.com/MAL-2026-18105/): Malicious code in @securihackbot/depconf-stage-1792484738 (npm) (malicious package)
- [MAL-2026-18104](https://insights.sbomify.com/MAL-2026-18104/): Malicious code in semvver (PyPI) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/101/