# Vulnerabilities published in 2026 - [MAL-2026-17924](https://insights.sbomify.com/MAL-2026-17924/): Malicious code in @apexacc/cli (npm) (malicious package) - [MAL-2026-17923](https://insights.sbomify.com/MAL-2026-17923/): Malicious code in @apexacc/audit (npm) (malicious package) - [MAL-2026-17922](https://insights.sbomify.com/MAL-2026-17922/): Malicious code in @pkgship/frpc-linux-arm64 (npm) (malicious package) - [MAL-2026-17921](https://insights.sbomify.com/MAL-2026-17921/): Malicious code in leakdeep (PyPI) (malicious package) - [MAL-2026-17920](https://insights.sbomify.com/MAL-2026-17920/): Malicious code in voltswannts (PyPI) (malicious package) - [MAL-2026-1792](https://insights.sbomify.com/MAL-2026-1792/): Malicious code in metro-evaluator (npm) (malicious package) - [MAL-2026-17919](https://insights.sbomify.com/MAL-2026-17919/): Malicious code in ukraine69 (PyPI) (malicious package) - [MAL-2026-17918](https://insights.sbomify.com/MAL-2026-17918/): Malicious code in tonemaptts (PyPI) (malicious package) - [MAL-2026-17917](https://insights.sbomify.com/MAL-2026-17917/): Malicious code in quasitonnts (PyPI) (malicious package) - [MAL-2026-17916](https://insights.sbomify.com/MAL-2026-17916/): Malicious code in pyrechoasr (PyPI) (malicious package) - [MAL-2026-17915](https://insights.sbomify.com/MAL-2026-17915/): Malicious code in novalithtts (PyPI) (malicious package) - [MAL-2026-17914](https://insights.sbomify.com/MAL-2026-17914/): Malicious code in glassbeakasr (PyPI) (malicious package) - [MAL-2026-17913](https://insights.sbomify.com/MAL-2026-17913/): Malicious code in emberlytts (PyPI) (malicious package) - [MAL-2026-17912](https://insights.sbomify.com/MAL-2026-17912/): Malicious code in driftwavets (PyPI) (malicious package) - [MAL-2026-17911](https://insights.sbomify.com/MAL-2026-17911/): Malicious code in itsa-react-maskedinput (npm) (malicious package) - [MAL-2026-17910](https://insights.sbomify.com/MAL-2026-17910/): Malicious code in itsa-react-focuscontainer (npm) (malicious package) - [MAL-2026-1791](https://insights.sbomify.com/MAL-2026-1791/): Malicious code in meridix (npm) (malicious package) - [MAL-2026-17909](https://insights.sbomify.com/MAL-2026-17909/): Malicious code in @beloved-lenora/opencode-todo (npm) (malicious package) - [MAL-2026-17908](https://insights.sbomify.com/MAL-2026-17908/): Malicious code in @beloved-lenora/opencode-stats (npm) (malicious package) - [MAL-2026-17907](https://insights.sbomify.com/MAL-2026-17907/): Malicious code in @beloved-lenora/opencode-shell-guard (npm) (malicious package) - [MAL-2026-17906](https://insights.sbomify.com/MAL-2026-17906/): Malicious code in @beloved-lenora/opencode-shared-rpc (npm) (malicious package) - [MAL-2026-17905](https://insights.sbomify.com/MAL-2026-17905/): Malicious code in @beloved-lenora/opencode-orchestrator (npm) (malicious package) - [MAL-2026-17904](https://insights.sbomify.com/MAL-2026-17904/): Malicious code in @beloved-lenora/opencode-goal (npm) (malicious package) - [MAL-2026-17903](https://insights.sbomify.com/MAL-2026-17903/): Malicious code in @beloved-lenora/opencode-btw (npm) (malicious package) - [MAL-2026-17902](https://insights.sbomify.com/MAL-2026-17902/): Malicious code in parxleys (npm) (malicious package) - [MAL-2026-17901](https://insights.sbomify.com/MAL-2026-17901/): Malicious code in @xatancchii/natabaileys (npm) (malicious package) - [MAL-2026-17900](https://insights.sbomify.com/MAL-2026-17900/): Malicious code in marocolor (PyPI) (malicious package) - [MAL-2026-1790](https://insights.sbomify.com/MAL-2026-1790/): Malicious code in manifest-confusion-poc-audit (npm) (malicious package) - [MAL-2026-179](https://insights.sbomify.com/MAL-2026-179/): Malicious code in n8n-nodes-vbmkajdsa-uehfitvv-ueqjhhhksdlkkmz (npm) (malicious package) - [MAL-2026-17899](https://insights.sbomify.com/MAL-2026-17899/): Malicious code in @flexmr/survey-conversation (npm) (malicious package) - [MAL-2026-17898](https://insights.sbomify.com/MAL-2026-17898/): Malicious code in @flexmr/survey-client (npm) (malicious package) - [MAL-2026-17897](https://insights.sbomify.com/MAL-2026-17897/): Malicious code in fromthehotel-poems (PyPI) (malicious package) - [MAL-2026-17896](https://insights.sbomify.com/MAL-2026-17896/): Malicious code in xapi-lib (npm) (malicious package) - [MAL-2026-17895](https://insights.sbomify.com/MAL-2026-17895/): Malicious code in web-pixels-manager (npm) (malicious package) - [MAL-2026-17894](https://insights.sbomify.com/MAL-2026-17894/): Malicious code in idlive-face-capture-web-development (npm) (malicious package) - [MAL-2026-17893](https://insights.sbomify.com/MAL-2026-17893/): Malicious code in buyerdashboard (npm) (malicious package) - [MAL-2026-17892](https://insights.sbomify.com/MAL-2026-17892/): Malicious code in xmd-baileys (npm) (malicious package) - [MAL-2026-17891](https://insights.sbomify.com/MAL-2026-17891/): Malicious code in asistenyorstore (npm) (malicious package) - [MAL-2026-17890](https://insights.sbomify.com/MAL-2026-17890/): Malicious code in @developmentyora/yorakids (npm) (malicious package) - [MAL-2026-1789](https://insights.sbomify.com/MAL-2026-1789/): Malicious code in loyalty-card (npm) (malicious package) - [MAL-2026-17889](https://insights.sbomify.com/MAL-2026-17889/): Malicious code in proxyrobika (PyPI) (malicious package) - [MAL-2026-17888](https://insights.sbomify.com/MAL-2026-17888/): Malicious code in @flexmr/utils (npm) (malicious package) - [MAL-2026-17887](https://insights.sbomify.com/MAL-2026-17887/): Malicious code in proxy-rubikis (PyPI) (malicious package) - [MAL-2026-17886](https://insights.sbomify.com/MAL-2026-17886/): Malicious code in py-wormgpt (PyPI) (malicious package) - [MAL-2026-17885](https://insights.sbomify.com/MAL-2026-17885/): Malicious code in proxyrubika (PyPI) (malicious package) - [MAL-2026-17884](https://insights.sbomify.com/MAL-2026-17884/): Malicious code in getpubip (PyPI) (malicious package) - [MAL-2026-17883](https://insights.sbomify.com/MAL-2026-17883/): Malicious code in py-worm (PyPI) (malicious package) - [MAL-2026-17882](https://insights.sbomify.com/MAL-2026-17882/): Malicious code in tailwindcss-uniform (npm) (malicious package) - [MAL-2026-17881](https://insights.sbomify.com/MAL-2026-17881/): Malicious code in py-sock2 (PyPI) (malicious package) - [MAL-2026-17880](https://insights.sbomify.com/MAL-2026-17880/): Malicious code in seapy-ops (PyPI) (malicious package) - [MAL-2026-1788](https://insights.sbomify.com/MAL-2026-1788/): Malicious code in libxmlrussia2 (npm) (malicious package) - [MAL-2026-17879](https://insights.sbomify.com/MAL-2026-17879/): Malicious code in @flexmr/ui (npm) (malicious package) - [MAL-2026-17878](https://insights.sbomify.com/MAL-2026-17878/): Malicious code in util-foriepft (npm) (malicious package) - [MAL-2026-17877](https://insights.sbomify.com/MAL-2026-17877/): Malicious code in saeka (PyPI) (malicious package) - [MAL-2026-17876](https://insights.sbomify.com/MAL-2026-17876/): Malicious code in @xxxfnbs21/hello-demo (npm) (malicious package) - [MAL-2026-17875](https://insights.sbomify.com/MAL-2026-17875/): Malicious code in monkey-tags-ip (npm) (malicious package) - [MAL-2026-17874](https://insights.sbomify.com/MAL-2026-17874/): Malicious code in @user-interface-common/common-styles (npm) (malicious package) - [MAL-2026-17873](https://insights.sbomify.com/MAL-2026-17873/): Malicious code in @newspage/libx-amount (npm) (malicious package) - [MAL-2026-17872](https://insights.sbomify.com/MAL-2026-17872/): Malicious code in @newspage/lib-ng-async-routes-ui (npm) (malicious package) - [MAL-2026-17871](https://insights.sbomify.com/MAL-2026-17871/): Malicious code in @mntv-analysis/workspaces-components (npm) (malicious package) - [MAL-2026-17870](https://insights.sbomify.com/MAL-2026-17870/): Malicious code in @mntv-analysis/ui-components (npm) (malicious package) - [MAL-2026-1787](https://insights.sbomify.com/MAL-2026-1787/): Malicious code in libxmljsololoq (npm) (malicious package) - [MAL-2026-17869](https://insights.sbomify.com/MAL-2026-17869/): Malicious code in @mntv-analysis/ui (npm) (malicious package) - [MAL-2026-17868](https://insights.sbomify.com/MAL-2026-17868/): Malicious code in @kre64/hello-npm-test (npm) (malicious package) - [MAL-2026-17867](https://insights.sbomify.com/MAL-2026-17867/): Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm) (malicious package) - [MAL-2026-17866](https://insights.sbomify.com/MAL-2026-17866/): Malicious code in pyyi (PyPI) (malicious package) - [MAL-2026-17865](https://insights.sbomify.com/MAL-2026-17865/): Malicious code in passwordcrackv2 (npm) (malicious package) - [MAL-2026-17864](https://insights.sbomify.com/MAL-2026-17864/): Malicious code in passwordcracker (npm) (malicious package) - [MAL-2026-17863](https://insights.sbomify.com/MAL-2026-17863/): Malicious code in crelic-bqwheel-52f66a3f1d (PyPI) (malicious package) - [MAL-2026-17862](https://insights.sbomify.com/MAL-2026-17862/): Malicious code in fontcase (PyPI) (malicious package) - [MAL-2026-17861](https://insights.sbomify.com/MAL-2026-17861/): Malicious code in sysdiagd (PyPI) (malicious package) - [MAL-2026-17860](https://insights.sbomify.com/MAL-2026-17860/): Malicious code in opencode2-windows-x64 (npm) (malicious package) - [MAL-2026-1786](https://insights.sbomify.com/MAL-2026-1786/): Malicious code in libxmljs9 (npm) (malicious package) - [MAL-2026-17859](https://insights.sbomify.com/MAL-2026-17859/): Malicious code in opencode2-windows-arm64 (npm) (malicious package) - [MAL-2026-17858](https://insights.sbomify.com/MAL-2026-17858/): Malicious code in opencode2-linux-x64-musl (npm) (malicious package) - [MAL-2026-17857](https://insights.sbomify.com/MAL-2026-17857/): Malicious code in opencode2-linux-x64 (npm) (malicious package) - [MAL-2026-17856](https://insights.sbomify.com/MAL-2026-17856/): Malicious code in opencode2-linux-arm64-musl (npm) (malicious package) - [MAL-2026-17855](https://insights.sbomify.com/MAL-2026-17855/): Malicious code in opencode2-linux-arm64 (npm) (malicious package) - [MAL-2026-17854](https://insights.sbomify.com/MAL-2026-17854/): Malicious code in opencode2-darwin-x64 (npm) (malicious package) - [MAL-2026-17853](https://insights.sbomify.com/MAL-2026-17853/): Malicious code in opencode2-darwin-arm64 (npm) (malicious package) - [MAL-2026-17852](https://insights.sbomify.com/MAL-2026-17852/): Malicious code in opencode2 (npm) (malicious package) - [MAL-2026-17851](https://insights.sbomify.com/MAL-2026-17851/): Malicious code in yoodan-github-single-ver-pkg (npm) (malicious package) - [MAL-2026-17850](https://insights.sbomify.com/MAL-2026-17850/): Malicious code in @chatest/baileys (npm) (malicious package) - [MAL-2026-1785](https://insights.sbomify.com/MAL-2026-1785/): Malicious code in libxmljs8 (npm) (malicious package) - [MAL-2026-17849](https://insights.sbomify.com/MAL-2026-17849/): Malicious code in brass-common (npm) (malicious package) - [MAL-2026-17848](https://insights.sbomify.com/MAL-2026-17848/): Malicious code in orderly-plugin-liquidity-heatmap (npm) (malicious package) - [MAL-2026-17847](https://insights.sbomify.com/MAL-2026-17847/): Malicious code in npp-ml (PyPI) (malicious package) - [MAL-2026-17846](https://insights.sbomify.com/MAL-2026-17846/): Malicious code in @yudzxml/baileys (npm) (malicious package) - [MAL-2026-17845](https://insights.sbomify.com/MAL-2026-17845/): Malicious code in node-telegram-sockets (npm) (malicious package) - [MAL-2026-17844](https://insights.sbomify.com/MAL-2026-17844/): Malicious code in bailslonely (npm) (malicious package) - [MAL-2026-17843](https://insights.sbomify.com/MAL-2026-17843/): Malicious code in @xrelly-stack/bails (npm) (malicious package) - [MAL-2026-17842](https://insights.sbomify.com/MAL-2026-17842/): Malicious code in @we3js/framework (npm) (malicious package) - [MAL-2026-17841](https://insights.sbomify.com/MAL-2026-17841/): Malicious code in @wanzxlonelyy/bailslonely (npm) (malicious package) - [MAL-2026-17840](https://insights.sbomify.com/MAL-2026-17840/): Malicious code in @wanzlonelyy/bailslonely (npm) (malicious package) - [MAL-2026-1784](https://insights.sbomify.com/MAL-2026-1784/): Malicious code in libxmljs2varkek (npm) (malicious package) - [MAL-2026-17839](https://insights.sbomify.com/MAL-2026-17839/): Malicious code in @wanzlonely/bailsme (npm) (malicious package) - [MAL-2026-17838](https://insights.sbomify.com/MAL-2026-17838/): Malicious code in @wanzlonely/bailsforme (npm) (malicious package) - [MAL-2026-17837](https://insights.sbomify.com/MAL-2026-17837/): Malicious code in @sanzoffc/libsignal-node (npm) (malicious package) - [MAL-2026-17836](https://insights.sbomify.com/MAL-2026-17836/): Malicious code in @saazkira/libsignal-node (npm) (malicious package) - [MAL-2026-17835](https://insights.sbomify.com/MAL-2026-17835/): Malicious code in @saazkira/eslint-config (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/104/