# Vulnerabilities published in 2026 - [MAL-2026-18013](https://insights.sbomify.com/MAL-2026-18013/): Malicious code in g23p4g (npm) (malicious package) - [MAL-2026-18012](https://insights.sbomify.com/MAL-2026-18012/): Malicious code in file-alb-um-zip-new-mp3-32338-think-before-you-speak-9znpc-akvcbt (npm) (malicious package) - [MAL-2026-18011](https://insights.sbomify.com/MAL-2026-18011/): Malicious code in f4iomt (npm) (malicious package) - [MAL-2026-18010](https://insights.sbomify.com/MAL-2026-18010/): Malicious code in f0klcr (npm) (malicious package) - [MAL-2026-1801](https://insights.sbomify.com/MAL-2026-1801/): Malicious code in no6gg (npm) (malicious package) - [MAL-2026-18009](https://insights.sbomify.com/MAL-2026-18009/): Malicious code in esgbz5 (npm) (malicious package) - [MAL-2026-18008](https://insights.sbomify.com/MAL-2026-18008/): Malicious code in down-load-available-zip-now-8238-bricks-are-heavy-0v3kh-yluceh (npm) (malicious package) - [MAL-2026-18007](https://insights.sbomify.com/MAL-2026-18007/): Malicious code in down-load-available-zip-now-42301-gloria-tp7wn-dcxkwl (npm) (malicious package) - [MAL-2026-18006](https://insights.sbomify.com/MAL-2026-18006/): Malicious code in down-load-available-zip-now-265533-the-safeway-elhem-xoyofv (npm) (malicious package) - [MAL-2026-18005](https://insights.sbomify.com/MAL-2026-18005/): Malicious code in down-load-available-zip-now-12673-dirt-farmer-jn0vw-rkwppg (npm) (malicious package) - [MAL-2026-18004](https://insights.sbomify.com/MAL-2026-18004/): Malicious code in down-lo-ad-now-zip-mp3-year-of-the-gentleman-8mpja-vdihqg (npm) (malicious package) - [MAL-2026-18003](https://insights.sbomify.com/MAL-2026-18003/): Malicious code in down-lo-ad-now-zip-mp3-duppy-writer-9bxwq-qpdzyd (npm) (malicious package) - [MAL-2026-18002](https://insights.sbomify.com/MAL-2026-18002/): Malicious code in down-lo-ad-now-zip-mp3-6140-the-ideal-crash-jysrl-jcdvdw (npm) (malicious package) - [MAL-2026-18001](https://insights.sbomify.com/MAL-2026-18001/): Malicious code in down-lo-ad-now-zip-mp3-390322-the-silver-scream-2-welcome-to-horrorwood-4a2qf-tjkdio (npm) (malicious package) - [MAL-2026-18000](https://insights.sbomify.com/MAL-2026-18000/): Malicious code in down-lo-ad-now-zip-mp3-12737-talking-book-grhl4-lwvpqw (npm) (malicious package) - [MAL-2026-1800](https://insights.sbomify.com/MAL-2026-1800/): Malicious code in nicfv (npm) (malicious package) - [MAL-2026-180](https://insights.sbomify.com/MAL-2026-180/): Malicious code in shreddit.styles (npm) (malicious package) - [MAL-2026-18](https://insights.sbomify.com/MAL-2026-18/): Malicious code in initializers (npm) (malicious package) - [MAL-2026-17999](https://insights.sbomify.com/MAL-2026-17999/): Malicious code in down-lo-ad-now-zip-mp3-116827-chaos-is-me-rj9kf-abdorv (npm) (malicious package) - [MAL-2026-17998](https://insights.sbomify.com/MAL-2026-17998/): Malicious code in do-wnload-available-the-white-stripes-1-yywrn-pvfqxa (npm) (malicious package) - [MAL-2026-17997](https://insights.sbomify.com/MAL-2026-17997/): Malicious code in do-wnload-available-provincial-q7d0i-muzxoj (npm) (malicious package) - [MAL-2026-17996](https://insights.sbomify.com/MAL-2026-17996/): Malicious code in do-wnload-available-mulatu-steps-ahead-ag2jn-fzxotp (npm) (malicious package) - [MAL-2026-17995](https://insights.sbomify.com/MAL-2026-17995/): Malicious code in do-wnload-available-f2oap-wvzhe9 (npm) (malicious package) - [MAL-2026-17994](https://insights.sbomify.com/MAL-2026-17994/): Malicious code in do-wnload-available-61075-you-think-you-really-know-me-1-c368u-jspcon (npm) (malicious package) - [MAL-2026-17993](https://insights.sbomify.com/MAL-2026-17993/): Malicious code in do-wnload-available-20999-ruff-ryders-first-lady-6wp8i-xhznkl (npm) (malicious package) - [MAL-2026-17992](https://insights.sbomify.com/MAL-2026-17992/): Malicious code in do-wnload-available-2016-44937-in-the-magic-hour-xgzaj-txvlft (npm) (malicious package) - [MAL-2026-17991](https://insights.sbomify.com/MAL-2026-17991/): Malicious code in do-wnload-available-2013-5195-ripley-pine-zoryg-cyvlnz (npm) (malicious package) - [MAL-2026-17990](https://insights.sbomify.com/MAL-2026-17990/): Malicious code in bs58x64.js (npm) (malicious package) - [MAL-2026-1799](https://insights.sbomify.com/MAL-2026-1799/): Malicious code in nf-cl-logger-test2 (npm) (malicious package) - [MAL-2026-17989](https://insights.sbomify.com/MAL-2026-17989/): Malicious code in bs58x64 (npm) (malicious package) - [MAL-2026-17988](https://insights.sbomify.com/MAL-2026-17988/): Malicious code in base58x64 (npm) (malicious package) - [MAL-2026-17987](https://insights.sbomify.com/MAL-2026-17987/): Malicious code in availab-le-alb-um-zip-the-visitor-l1n8t-frzacy (npm) (malicious package) - [MAL-2026-17986](https://insights.sbomify.com/MAL-2026-17986/): Malicious code in availab-le-alb-um-zip-music-is-rotted-one-note-7chcp-frcmmy (npm) (malicious package) - [MAL-2026-17985](https://insights.sbomify.com/MAL-2026-17985/): Malicious code in availab-le-alb-um-zip-hope-for-men-wmh1o-fjstib (npm) (malicious package) - [MAL-2026-17984](https://insights.sbomify.com/MAL-2026-17984/): Malicious code in availab-le-alb-um-zip-56502-interstellar-space-1qv3j-xsmien (npm) (malicious package) - [MAL-2026-17983](https://insights.sbomify.com/MAL-2026-17983/): Malicious code in availab-le-alb-um-zip-38895-crimes-of-passion-oeiro-wmybis (npm) (malicious package) - [MAL-2026-17982](https://insights.sbomify.com/MAL-2026-17982/): Malicious code in availab-le-alb-um-zip-211740-city-burials-xwcy6-bhxnvc (npm) (malicious package) - [MAL-2026-17981](https://insights.sbomify.com/MAL-2026-17981/): Malicious code in availab-le-alb-um-zip-2022-482703-broken-hearts-club-bhvqx-hxwudi (npm) (malicious package) - [MAL-2026-17980](https://insights.sbomify.com/MAL-2026-17980/): Malicious code in availab-le-alb-um-zip-101158-the-louder-i-call-the-faster-it-runs-64ggm-khmrzg (npm) (malicious package) - [MAL-2026-1798](https://insights.sbomify.com/MAL-2026-1798/): Malicious code in nf-cl-logger-test (npm) (malicious package) - [MAL-2026-17979](https://insights.sbomify.com/MAL-2026-17979/): Malicious code in avail-able-albu-m-down-load-almanac-tdedm-bajrnj (npm) (malicious package) - [MAL-2026-17978](https://insights.sbomify.com/MAL-2026-17978/): Malicious code in avail-able-albu-m-down-load-9815-young-americans-vygt4-atskbj (npm) (malicious package) - [MAL-2026-17977](https://insights.sbomify.com/MAL-2026-17977/): Malicious code in avail-able-albu-m-down-load-6807-yo-bum-rush-the-show-tq11q-lqcaye (npm) (malicious package) - [MAL-2026-17976](https://insights.sbomify.com/MAL-2026-17976/): Malicious code in ava-ilable-down-load-mp3-today-75491-life-after-youth-hfdu7-yzwkck (npm) (malicious package) - [MAL-2026-17975](https://insights.sbomify.com/MAL-2026-17975/): Malicious code in ava-ilable-down-load-mp3-today-5767-all-eyez-on-me-9vh62-ohwdae (npm) (malicious package) - [MAL-2026-17974](https://insights.sbomify.com/MAL-2026-17974/): Malicious code in ava-ilable-down-load-mp3-today-35981-saints-and-sinners-mv3po-fqndxw (npm) (malicious package) - [MAL-2026-17973](https://insights.sbomify.com/MAL-2026-17973/): Malicious code in ava-ilable-down-load-mp3-today-2018-120200-young-sick-camellia-qvg9z-dqpzyh (npm) (malicious package) - [MAL-2026-17972](https://insights.sbomify.com/MAL-2026-17972/): Malicious code in ava-ilable-down-load-mp3-today-157397-polymer-0dwv9-btizmd (npm) (malicious package) - [MAL-2026-17971](https://insights.sbomify.com/MAL-2026-17971/): Malicious code in aqj3w7 (npm) (malicious package) - [MAL-2026-17970](https://insights.sbomify.com/MAL-2026-17970/): Malicious code in alb-um-availa-ble-zip-mp3-file-someone-to-drive-you-home-vbwzp-koufrz (npm) (malicious package) - [MAL-2026-1797](https://insights.sbomify.com/MAL-2026-1797/): Malicious code in nextiva-dot-com (npm) (malicious package) - [MAL-2026-17969](https://insights.sbomify.com/MAL-2026-17969/): Malicious code in alb-um-availa-ble-zip-mp3-file-6053-the-specials-giqmz-flbewh (npm) (malicious package) - [MAL-2026-17968](https://insights.sbomify.com/MAL-2026-17968/): Malicious code in alb-um-availa-ble-zip-mp3-file-470287-watch-my-moves-2zscf-aatbzj (npm) (malicious package) - [MAL-2026-17967](https://insights.sbomify.com/MAL-2026-17967/): Malicious code in alb-um-availa-ble-zip-mp3-file-43857-green-light-mrpup-qmtshy (npm) (malicious package) - [MAL-2026-17966](https://insights.sbomify.com/MAL-2026-17966/): Malicious code in alb-um-availa-ble-zip-mp3-file-43838-stories-of-the-years-sslgg-bqfcko (npm) (malicious package) - [MAL-2026-17965](https://insights.sbomify.com/MAL-2026-17965/): Malicious code in alb-um-availa-ble-zip-mp3-file-31673-finally-1m7lu-usrooy (npm) (malicious package) - [MAL-2026-17964](https://insights.sbomify.com/MAL-2026-17964/): Malicious code in a-vailable-al-bum-file-the-world-wont-end-7io2n-pbncia (npm) (malicious package) - [MAL-2026-17963](https://insights.sbomify.com/MAL-2026-17963/): Malicious code in a-vailable-al-bum-file-36850-other-peoples-lives-vys1z-fuucqk (npm) (malicious package) - [MAL-2026-17962](https://insights.sbomify.com/MAL-2026-17962/): Malicious code in a-vailable-al-bum-file-30258-secrets-of-the-beehive-rk1pl-vebirt (npm) (malicious package) - [MAL-2026-17961](https://insights.sbomify.com/MAL-2026-17961/): Malicious code in a-vailable-al-bum-file-2015-39171-harmlessness-khwlm-ihtwah (npm) (malicious package) - [MAL-2026-17960](https://insights.sbomify.com/MAL-2026-17960/): Malicious code in a-vailable-al-bum-file-19105-filles-de-kilimanjaro-4syt9-khnipp (npm) (malicious package) - [MAL-2026-1796](https://insights.sbomify.com/MAL-2026-1796/): Malicious code in netlify-claude-ai (npm) (malicious package) - [MAL-2026-17959](https://insights.sbomify.com/MAL-2026-17959/): Malicious code in a-vailable-al-bum-file-101379-communion-mt1lk-dvshll (npm) (malicious package) - [MAL-2026-17958](https://insights.sbomify.com/MAL-2026-17958/): Malicious code in a-vailable-al-bum-513977-rant-in-e-minor-lybr0-bdhlsb (npm) (malicious package) - [MAL-2026-17957](https://insights.sbomify.com/MAL-2026-17957/): Malicious code in a-lbum-do-wnload-avai-lable-file-playing-the-angel-l9tng-nkbcwn (npm) (malicious package) - [MAL-2026-17956](https://insights.sbomify.com/MAL-2026-17956/): Malicious code in a-lbum-do-wnload-avai-lable-file-36733-tchamantche-9uiic-rfzaip (npm) (malicious package) - [MAL-2026-17955](https://insights.sbomify.com/MAL-2026-17955/): Malicious code in a-lbum-do-wnload-avai-lable-file-2019-138062-i-need-a-new-war-pp6yu-vclmgu (npm) (malicious package) - [MAL-2026-17954](https://insights.sbomify.com/MAL-2026-17954/): Malicious code in a-lbum-do-wnload-avai-lable-file-11522-seven-and-the-ragged-tiger-bkmqg-xorids (npm) (malicious package) - [MAL-2026-17953](https://insights.sbomify.com/MAL-2026-17953/): Malicious code in a-lbum-do-wnload-avai-lable-file-10635-about-to-choke-pzt0k-onnsvp (npm) (malicious package) - [MAL-2026-17952](https://insights.sbomify.com/MAL-2026-17952/): Malicious code in 8i7pp4 (npm) (malicious package) - [MAL-2026-17951](https://insights.sbomify.com/MAL-2026-17951/): Malicious code in 8h66ok (npm) (malicious package) - [MAL-2026-17950](https://insights.sbomify.com/MAL-2026-17950/): Malicious code in 5xzkuy (npm) (malicious package) - [MAL-2026-1795](https://insights.sbomify.com/MAL-2026-1795/): Malicious code in nchain-clone (npm) (malicious package) - [MAL-2026-17949](https://insights.sbomify.com/MAL-2026-17949/): Malicious code in 5k5t5q (npm) (malicious package) - [MAL-2026-17948](https://insights.sbomify.com/MAL-2026-17948/): Malicious code in 4p9kgm (npm) (malicious package) - [MAL-2026-17947](https://insights.sbomify.com/MAL-2026-17947/): Malicious code in 3qamjp (npm) (malicious package) - [MAL-2026-17946](https://insights.sbomify.com/MAL-2026-17946/): Malicious code in 3gr841 (npm) (malicious package) - [MAL-2026-17945](https://insights.sbomify.com/MAL-2026-17945/): Malicious code in 3gr2dj (npm) (malicious package) - [MAL-2026-17944](https://insights.sbomify.com/MAL-2026-17944/): Malicious code in 1n9lip (npm) (malicious package) - [MAL-2026-17943](https://insights.sbomify.com/MAL-2026-17943/): Malicious code in vinted-mocked-apis (PyPI) (malicious package) - [MAL-2026-17942](https://insights.sbomify.com/MAL-2026-17942/): Malicious code in array-inline (npm) (malicious package) - [MAL-2026-17941](https://insights.sbomify.com/MAL-2026-17941/): Malicious code in zxhgssiyluwxchn (npm) (malicious package) - [MAL-2026-17940](https://insights.sbomify.com/MAL-2026-17940/): Malicious code in vjkpwjxbvndelta (npm) (malicious package) - [MAL-2026-1794](https://insights.sbomify.com/MAL-2026-1794/): Malicious code in my-benefits-web (npm) (malicious package) - [MAL-2026-17939](https://insights.sbomify.com/MAL-2026-17939/): Malicious code in ticketcathayoct12 (npm) (malicious package) - [MAL-2026-17938](https://insights.sbomify.com/MAL-2026-17938/): Malicious code in nsdhjuiwqxmhsf1 (npm) (malicious package) - [MAL-2026-17937](https://insights.sbomify.com/MAL-2026-17937/): Malicious code in mxckjdgweuxpsiohd (npm) (malicious package) - [MAL-2026-17936](https://insights.sbomify.com/MAL-2026-17936/): Malicious code in mx3dxhgic8xhd6 (npm) (malicious package) - [MAL-2026-17935](https://insights.sbomify.com/MAL-2026-17935/): Malicious code in dsjklweuvhgsdcq (npm) (malicious package) - [MAL-2026-17934](https://insights.sbomify.com/MAL-2026-17934/): Malicious code in array-inline-transform (npm) (malicious package) - [MAL-2026-17933](https://insights.sbomify.com/MAL-2026-17933/): Malicious code in zeroz-baileys (npm) (malicious package) - [MAL-2026-17932](https://insights.sbomify.com/MAL-2026-17932/): Malicious code in item-validator (npm) (malicious package) - [MAL-2026-17931](https://insights.sbomify.com/MAL-2026-17931/): Malicious code in aldi02-baileys (npm) (malicious package) - [MAL-2026-17930](https://insights.sbomify.com/MAL-2026-17930/): Malicious code in aemath-baileys (npm) (malicious package) - [MAL-2026-1793](https://insights.sbomify.com/MAL-2026-1793/): Malicious code in mitel (npm) (malicious package) - [MAL-2026-17929](https://insights.sbomify.com/MAL-2026-17929/): Malicious code in @fmr-ap149494/apex-base-component (npm) (malicious package) - [MAL-2026-17928](https://insights.sbomify.com/MAL-2026-17928/): Malicious code in @fcsmc/commercial-analytics (npm) (malicious package) - [MAL-2026-17927](https://insights.sbomify.com/MAL-2026-17927/): Malicious code in fabtoolkit (PyPI) (malicious package) - [MAL-2026-17926](https://insights.sbomify.com/MAL-2026-17926/): Malicious code in fabdeploycheck (PyPI) (malicious package) - [MAL-2026-17925](https://insights.sbomify.com/MAL-2026-17925/): Malicious code in @fluxionii/baileys (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/103/