# Vulnerabilities published in 2026


- [MAL-2026-18103](https://insights.sbomify.com/MAL-2026-18103/): Malicious code in semverr (PyPI) (malicious package)
- [MAL-2026-18102](https://insights.sbomify.com/MAL-2026-18102/): Malicious code in semveer (PyPI) (malicious package)
- [MAL-2026-18101](https://insights.sbomify.com/MAL-2026-18101/): Malicious code in semmver (PyPI) (malicious package)
- [MAL-2026-18100](https://insights.sbomify.com/MAL-2026-18100/): Malicious code in unicode-title-normalizer (npm) (malicious package)
- [MAL-2026-1810](https://insights.sbomify.com/MAL-2026-1810/): Malicious code in phx-core1 (npm) (malicious package)
- [MAL-2026-181](https://insights.sbomify.com/MAL-2026-181/): Malicious code in smintio-portals-component-sdk (npm) (malicious package)
- [MAL-2026-18099](https://insights.sbomify.com/MAL-2026-18099/): Malicious code in formatting-subtitles-for-claude (npm) (malicious package)
- [MAL-2026-18098](https://insights.sbomify.com/MAL-2026-18098/): Malicious code in security-research-startup-snapshot-810764b303 (PyPI) (malicious package)
- [MAL-2026-18097](https://insights.sbomify.com/MAL-2026-18097/): Malicious code in research-probe-6150c1c915 (PyPI) (malicious package)
- [MAL-2026-18096](https://insights.sbomify.com/MAL-2026-18096/): Malicious code in workalender (PyPI) (malicious package)
- [MAL-2026-18095](https://insights.sbomify.com/MAL-2026-18095/): Malicious code in resion (PyPI) (malicious package)
- [MAL-2026-18094](https://insights.sbomify.com/MAL-2026-18094/): Malicious code in pafex (PyPI) (malicious package)
- [MAL-2026-18093](https://insights.sbomify.com/MAL-2026-18093/): Malicious code in workcalender (PyPI) (malicious package)
- [MAL-2026-18092](https://insights.sbomify.com/MAL-2026-18092/): Malicious code in test-workalendar-internal (PyPI) (malicious package)
- [MAL-2026-18091](https://insights.sbomify.com/MAL-2026-18091/): Malicious code in @platform-services/hrm-mfe-core (npm) (malicious package)
- [MAL-2026-18090](https://insights.sbomify.com/MAL-2026-18090/): Malicious code in tailwindcss-visual-kit (npm) (malicious package)
- [MAL-2026-1809](https://insights.sbomify.com/MAL-2026-1809/): Malicious code in ph-common (npm) (malicious package)
- [MAL-2026-18089](https://insights.sbomify.com/MAL-2026-18089/): Malicious code in tailwindcss-motionanimate (npm) (malicious package)
- [MAL-2026-18088](https://insights.sbomify.com/MAL-2026-18088/): Malicious code in tailwindcss-keyframe-kit (npm) (malicious package)
- [MAL-2026-18087](https://insights.sbomify.com/MAL-2026-18087/): Malicious code in tailwindcss-effect-lab (npm) (malicious package)
- [MAL-2026-18086](https://insights.sbomify.com/MAL-2026-18086/): Malicious code in tailwindcss-animatemotion (npm) (malicious package)
- [MAL-2026-18085](https://insights.sbomify.com/MAL-2026-18085/): Malicious code in tailwindcss-animate-catalog (npm) (malicious package)
- [MAL-2026-18084](https://insights.sbomify.com/MAL-2026-18084/): Malicious code in tailwind-kinetic (npm) (malicious package)
- [MAL-2026-18083](https://insights.sbomify.com/MAL-2026-18083/): Malicious code in tailwind-keyframes (npm) (malicious package)
- [MAL-2026-18082](https://insights.sbomify.com/MAL-2026-18082/): Malicious code in tailwind-fabric (npm) (malicious package)
- [MAL-2026-18081](https://insights.sbomify.com/MAL-2026-18081/): Malicious code in tailwind-css-keyframes (npm) (malicious package)
- [MAL-2026-18080](https://insights.sbomify.com/MAL-2026-18080/): Malicious code in tailwind-animationlab (npm) (malicious package)
- [MAL-2026-1808](https://insights.sbomify.com/MAL-2026-1808/): Malicious code in path-to-regexp-updated (npm) (malicious package)
- [MAL-2026-18079](https://insights.sbomify.com/MAL-2026-18079/): Malicious code in tailwind-animatecss-kit (npm) (malicious package)
- [MAL-2026-18078](https://insights.sbomify.com/MAL-2026-18078/): Malicious code in tailwind-animate-kit (npm) (malicious package)
- [MAL-2026-18077](https://insights.sbomify.com/MAL-2026-18077/): Malicious code in tailwind-animaflow-kit (npm) (malicious package)
- [MAL-2026-18076](https://insights.sbomify.com/MAL-2026-18076/): Malicious code in signalledger-diagnostics (npm) (malicious package)
- [MAL-2026-18075](https://insights.sbomify.com/MAL-2026-18075/): Malicious code in signalledger-bridge (npm) (malicious package)
- [MAL-2026-18074](https://insights.sbomify.com/MAL-2026-18074/): Malicious code in animatecss-tailwind-vectrix (npm) (malicious package)
- [MAL-2026-18073](https://insights.sbomify.com/MAL-2026-18073/): Malicious code in animatecss-tailwind-presets (npm) (malicious package)
- [MAL-2026-18072](https://insights.sbomify.com/MAL-2026-18072/): Malicious code in animatecss-tailwind-plugin (npm) (malicious package)
- [MAL-2026-18071](https://insights.sbomify.com/MAL-2026-18071/): Malicious code in animatecss-tailwind-luminary (npm) (malicious package)
- [MAL-2026-18070](https://insights.sbomify.com/MAL-2026-18070/): Malicious code in animatecss-tailwind-helper (npm) (malicious package)
- [MAL-2026-1807](https://insights.sbomify.com/MAL-2026-1807/): Malicious code in paramount-cmp-html5 (npm) (malicious package)
- [MAL-2026-18069](https://insights.sbomify.com/MAL-2026-18069/): Malicious code in animatecss-tailwind-graphic (npm) (malicious package)
- [MAL-2026-18068](https://insights.sbomify.com/MAL-2026-18068/): Malicious code in animatecss-tailwind-binary (npm) (malicious package)
- [MAL-2026-18067](https://insights.sbomify.com/MAL-2026-18067/): Malicious code in animate-twcss-pack (npm) (malicious package)
- [MAL-2026-18066](https://insights.sbomify.com/MAL-2026-18066/): Malicious code in animate-twcss-bridge (npm) (malicious package)
- [MAL-2026-18065](https://insights.sbomify.com/MAL-2026-18065/): Malicious code in animate-tailwind-kit (npm) (malicious package)
- [MAL-2026-18064](https://insights.sbomify.com/MAL-2026-18064/): Malicious code in sc-announcer (npm) (malicious package)
- [MAL-2026-18063](https://insights.sbomify.com/MAL-2026-18063/): Malicious code in fanarena-common (npm) (malicious package)
- [MAL-2026-18062](https://insights.sbomify.com/MAL-2026-18062/): Malicious code in sc-wizard (npm) (malicious package)
- [MAL-2026-18061](https://insights.sbomify.com/MAL-2026-18061/): Malicious code in ccl-global-shopping (npm) (malicious package)
- [MAL-2026-18060](https://insights.sbomify.com/MAL-2026-18060/): Malicious code in codex-setup (npm) (malicious package)
- [MAL-2026-1806](https://insights.sbomify.com/MAL-2026-1806/): Malicious code in ok-jest-config (npm) (malicious package)
- [MAL-2026-18059](https://insights.sbomify.com/MAL-2026-18059/): Malicious code in claude-desktop-setup (npm) (malicious package)
- [MAL-2026-18058](https://insights.sbomify.com/MAL-2026-18058/): Malicious code in chatgpt-pro-setup-tool (npm) (malicious package)
- [MAL-2026-18057](https://insights.sbomify.com/MAL-2026-18057/): Malicious code in chatgpt-pro-activator (npm) (malicious package)
- [MAL-2026-18056](https://insights.sbomify.com/MAL-2026-18056/): Malicious code in chatgpt-desktop-setup (npm) (malicious package)
- [MAL-2026-18055](https://insights.sbomify.com/MAL-2026-18055/): Malicious code in api-anthropic (npm) (malicious package)
- [MAL-2026-18054](https://insights.sbomify.com/MAL-2026-18054/): Malicious code in @decoopus/claude-setup (npm) (malicious package)
- [MAL-2026-18053](https://insights.sbomify.com/MAL-2026-18053/): Malicious code in @decoopus/chatgpt-setup (npm) (malicious package)
- [MAL-2026-18052](https://insights.sbomify.com/MAL-2026-18052/): Malicious code in @an1mshnpmb9c84920/stage-repo-m19g7 (npm) (malicious package)
- [MAL-2026-18051](https://insights.sbomify.com/MAL-2026-18051/): Malicious code in @an1mshnpmb9c84920/stage-outer-m19s5 (npm) (malicious package)
- [MAL-2026-18050](https://insights.sbomify.com/MAL-2026-18050/): Malicious code in @an1mshnpmb9c84920/stage-fn-m19p2 (npm) (malicious package)
- [MAL-2026-1805](https://insights.sbomify.com/MAL-2026-1805/): Malicious code in notification-settings-layout (npm) (malicious package)
- [MAL-2026-18049](https://insights.sbomify.com/MAL-2026-18049/): Malicious code in @an1mshnpmb9c84920/pipe-dns-m19t2 (npm) (malicious package)
- [MAL-2026-18048](https://insights.sbomify.com/MAL-2026-18048/): Malicious code in @an1mshnpmb9c84920/pipe-compat-m19r8 (npm) (malicious package)
- [MAL-2026-18047](https://insights.sbomify.com/MAL-2026-18047/): Malicious code in @an1mshnpmb9c84920/oidc-cross-cafb9d929e (npm) (malicious package)
- [MAL-2026-18046](https://insights.sbomify.com/MAL-2026-18046/): Malicious code in @an1mshnpmb9c84920/gat-scope-target-125ec19a (npm) (malicious package)
- [MAL-2026-18045](https://insights.sbomify.com/MAL-2026-18045/): Malicious code in asurion (PyPI) (malicious package)
- [MAL-2026-18044](https://insights.sbomify.com/MAL-2026-18044/): Malicious code in zubn7b (npm) (malicious package)
- [MAL-2026-18043](https://insights.sbomify.com/MAL-2026-18043/): Malicious code in zip-mp3-a-lbum-do-wnload-new-67476-what-we-do-egj2h-bgfgzz (npm) (malicious package)
- [MAL-2026-18042](https://insights.sbomify.com/MAL-2026-18042/): Malicious code in zip-mp3-a-lbum-do-wnload-new-392999-fantasy-island-wlvf4-bxyvtm (npm) (malicious package)
- [MAL-2026-18041](https://insights.sbomify.com/MAL-2026-18041/): Malicious code in ysqp68 (npm) (malicious package)
- [MAL-2026-18040](https://insights.sbomify.com/MAL-2026-18040/): Malicious code in x294tn (npm) (malicious package)
- [MAL-2026-1804](https://insights.sbomify.com/MAL-2026-1804/): Malicious code in not-remix (npm) (malicious package)
- [MAL-2026-18039](https://insights.sbomify.com/MAL-2026-18039/): Malicious code in waojpf (npm) (malicious package)
- [MAL-2026-18038](https://insights.sbomify.com/MAL-2026-18038/): Malicious code in v49yzy (npm) (malicious package)
- [MAL-2026-18037](https://insights.sbomify.com/MAL-2026-18037/): Malicious code in tkacg3 (npm) (malicious package)
- [MAL-2026-18036](https://insights.sbomify.com/MAL-2026-18036/): Malicious code in rvmbnj (npm) (malicious package)
- [MAL-2026-18035](https://insights.sbomify.com/MAL-2026-18035/): Malicious code in rhlozh (npm) (malicious package)
- [MAL-2026-18034](https://insights.sbomify.com/MAL-2026-18034/): Malicious code in oo9fja (npm) (malicious package)
- [MAL-2026-18033](https://insights.sbomify.com/MAL-2026-18033/): Malicious code in noe77e (npm) (malicious package)
- [MAL-2026-18032](https://insights.sbomify.com/MAL-2026-18032/): Malicious code in new-al-bum-av-ailable-girls-can-tell-ccfoc-vmqodd (npm) (malicious package)
- [MAL-2026-18031](https://insights.sbomify.com/MAL-2026-18031/): Malicious code in new-al-bum-av-ailable-50924-satta-massagana-rje2z-lfxsfe (npm) (malicious package)
- [MAL-2026-18030](https://insights.sbomify.com/MAL-2026-18030/): Malicious code in new-al-bum-av-ailable-131000-eton-alive-qzngy-cjxczf (npm) (malicious package)
- [MAL-2026-1803](https://insights.sbomify.com/MAL-2026-1803/): Malicious code in node-intend (npm) (malicious package)
- [MAL-2026-18029](https://insights.sbomify.com/MAL-2026-18029/): Malicious code in mp3-file-zip-d-ownload-hypnotize-kpkk0-ygzaqq (npm) (malicious package)
- [MAL-2026-18028](https://insights.sbomify.com/MAL-2026-18028/): Malicious code in mp3-file-zip-d-ownload-hearts-of-oak-7cyqu-oiygcz (npm) (malicious package)
- [MAL-2026-18027](https://insights.sbomify.com/MAL-2026-18027/): Malicious code in mp3-file-zip-d-ownload-challengers-ym2l6-mkqhum (npm) (malicious package)
- [MAL-2026-18026](https://insights.sbomify.com/MAL-2026-18026/): Malicious code in mp3-file-zip-d-ownload-48120-lost-nation-road-0cibe-ynawhz (npm) (malicious package)
- [MAL-2026-18025](https://insights.sbomify.com/MAL-2026-18025/): Malicious code in mp3-file-zip-d-ownload-10759-grand-prix-ojzwj-auchhw (npm) (malicious package)
- [MAL-2026-18024](https://insights.sbomify.com/MAL-2026-18024/): Malicious code in mp3-do-wnload-file-to-day-d-nu951-cjkdsy (npm) (malicious package)
- [MAL-2026-18023](https://insights.sbomify.com/MAL-2026-18023/): Malicious code in mp3-do-wnload-file-to-day-27091-usa-united-state-of-atlanta-xoisl-pqpsio (npm) (malicious package)
- [MAL-2026-18022](https://insights.sbomify.com/MAL-2026-18022/): Malicious code in lstsyw (npm) (malicious package)
- [MAL-2026-18021](https://insights.sbomify.com/MAL-2026-18021/): Malicious code in ljem3j (npm) (malicious package)
- [MAL-2026-18020](https://insights.sbomify.com/MAL-2026-18020/): Malicious code in ju0oud (npm) (malicious package)
- [MAL-2026-1802](https://insights.sbomify.com/MAL-2026-1802/): Malicious code in node-cli-dotenv (npm) (malicious package)
- [MAL-2026-18019](https://insights.sbomify.com/MAL-2026-18019/): Malicious code in j5opb7 (npm) (malicious package)
- [MAL-2026-18018](https://insights.sbomify.com/MAL-2026-18018/): Malicious code in j019qc (npm) (malicious package)
- [MAL-2026-18017](https://insights.sbomify.com/MAL-2026-18017/): Malicious code in ivzlid (npm) (malicious package)
- [MAL-2026-18016](https://insights.sbomify.com/MAL-2026-18016/): Malicious code in gtjgd4 (npm) (malicious package)
- [MAL-2026-18015](https://insights.sbomify.com/MAL-2026-18015/): Malicious code in giu094 (npm) (malicious package)
- [MAL-2026-18014](https://insights.sbomify.com/MAL-2026-18014/): Malicious code in g8ez1y (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/102/