# Vulnerabilities published in 2026 - [MAL-2026-17834](https://insights.sbomify.com/MAL-2026-17834/): Malicious code in @revizahoshii/hoshino-wam (npm) (malicious package) - [MAL-2026-17833](https://insights.sbomify.com/MAL-2026-17833/): Malicious code in @revizahoshii/hoshino-voip (npm) (malicious package) - [MAL-2026-17832](https://insights.sbomify.com/MAL-2026-17832/): Malicious code in @revizahoshii/hoshino-store-sqlite (npm) (malicious package) - [MAL-2026-17831](https://insights.sbomify.com/MAL-2026-17831/): Malicious code in @revizahoshii/hoshino-store-redis (npm) (malicious package) - [MAL-2026-17830](https://insights.sbomify.com/MAL-2026-17830/): Malicious code in @revizahoshii/hoshino-store-postgres (npm) (malicious package) - [MAL-2026-1783](https://insights.sbomify.com/MAL-2026-1783/): Malicious code in libxmljs2var-ctf (npm) (malicious package) - [MAL-2026-17829](https://insights.sbomify.com/MAL-2026-17829/): Malicious code in @revizahoshii/hoshino-store-mysql (npm) (malicious package) - [MAL-2026-17828](https://insights.sbomify.com/MAL-2026-17828/): Malicious code in @revizahoshii/hoshino-store-mongo (npm) (malicious package) - [MAL-2026-17827](https://insights.sbomify.com/MAL-2026-17827/): Malicious code in @revizahoshii/hoshino-native (npm) (malicious package) - [MAL-2026-17826](https://insights.sbomify.com/MAL-2026-17826/): Malicious code in @revizahoshii/hoshino-media-utils (npm) (malicious package) - [MAL-2026-17825](https://insights.sbomify.com/MAL-2026-17825/): Malicious code in @revizahoshii/hoshino-mcp-server (npm) (malicious package) - [MAL-2026-17824](https://insights.sbomify.com/MAL-2026-17824/): Malicious code in @revizahoshii/hoshino-fake-server (npm) (malicious package) - [MAL-2026-17823](https://insights.sbomify.com/MAL-2026-17823/): Malicious code in @modss/libsignal (npm) (malicious package) - [MAL-2026-17822](https://insights.sbomify.com/MAL-2026-17822/): Malicious code in @fazzcodestudio/mediaformater (npm) (malicious package) - [MAL-2026-17821](https://insights.sbomify.com/MAL-2026-17821/): Malicious code in @fazzcodestudio/fbot (npm) (malicious package) - [MAL-2026-17820](https://insights.sbomify.com/MAL-2026-17820/): Malicious code in @fazzcodestudio/baileys (npm) (malicious package) - [MAL-2026-1782](https://insights.sbomify.com/MAL-2026-1782/): Malicious code in libxmljs2var (npm) (malicious package) - [MAL-2026-17819](https://insights.sbomify.com/MAL-2026-17819/): Malicious code in @badzz88/eslint-config (npm) (malicious package) - [MAL-2026-17818](https://insights.sbomify.com/MAL-2026-17818/): Malicious code in @alipclutch/libsignal-node (npm) (malicious package) - [MAL-2026-17817](https://insights.sbomify.com/MAL-2026-17817/): Malicious code in nakkinpm (npm) (malicious package) - [MAL-2026-17816](https://insights.sbomify.com/MAL-2026-17816/): Malicious code in ikanngeming (npm) (malicious package) - [MAL-2026-17815](https://insights.sbomify.com/MAL-2026-17815/): Malicious code in amprem (npm) (malicious package) - [MAL-2026-17814](https://insights.sbomify.com/MAL-2026-17814/): Malicious code in @mikudeveloper/libsignal-node (npm) (malicious package) - [MAL-2026-17813](https://insights.sbomify.com/MAL-2026-17813/): Malicious code in @lekzo_dev/amprem (npm) (malicious package) - [MAL-2026-17812](https://insights.sbomify.com/MAL-2026-17812/): Malicious code in @ikanngeming/npm (npm) (malicious package) - [MAL-2026-17811](https://insights.sbomify.com/MAL-2026-17811/): Malicious code in @ikanngeming/blubub (npm) (malicious package) - [MAL-2026-17810](https://insights.sbomify.com/MAL-2026-17810/): Malicious code in @zaka13/zakasite (npm) (malicious package) - [MAL-2026-1781](https://insights.sbomify.com/MAL-2026-1781/): Malicious code in libxmljs2v2 (npm) (malicious package) - [MAL-2026-17809](https://insights.sbomify.com/MAL-2026-17809/): Malicious code in minecraftaccfinder (PyPI) (malicious package) - [MAL-2026-17808](https://insights.sbomify.com/MAL-2026-17808/): Malicious code in @s4yhiitestpoc/r2-https-b (npm) (malicious package) - [MAL-2026-17807](https://insights.sbomify.com/MAL-2026-17807/): Malicious code in py2ops (PyPI) (malicious package) - [MAL-2026-17806](https://insights.sbomify.com/MAL-2026-17806/): Malicious code in ap3-foundations-ui (npm) (malicious package) - [MAL-2026-17805](https://insights.sbomify.com/MAL-2026-17805/): Malicious code in @dransay/api (npm) (malicious package) - [MAL-2026-17804](https://insights.sbomify.com/MAL-2026-17804/): Malicious code in css-nesting-transform (npm) (malicious package) - [MAL-2026-17803](https://insights.sbomify.com/MAL-2026-17803/): Malicious code in hridoy-ultimate (npm) (malicious package) - [MAL-2026-17802](https://insights.sbomify.com/MAL-2026-17802/): Malicious code in xrp-ledger-utils (RubyGems) (malicious package) - [MAL-2026-17801](https://insights.sbomify.com/MAL-2026-17801/): Malicious code in web3-signer-kit (RubyGems) (malicious package) - [MAL-2026-17800](https://insights.sbomify.com/MAL-2026-17800/): Malicious code in wallet-hd-derive (RubyGems) (malicious package) - [MAL-2026-1780](https://insights.sbomify.com/MAL-2026-1780/): Malicious code in libxmljs2qaz (npm) (malicious package) - [MAL-2026-178](https://insights.sbomify.com/MAL-2026-178/): Malicious code in n8n-nodes-hfgjf-irtuinvcm-lasdqewriit (npm) (malicious package) - [MAL-2026-17799](https://insights.sbomify.com/MAL-2026-17799/): Malicious code in wallet-balance-scanner (RubyGems) (malicious package) - [MAL-2026-17798](https://insights.sbomify.com/MAL-2026-17798/): Malicious code in tron-trc20-utils (RubyGems) (malicious package) - [MAL-2026-17797](https://insights.sbomify.com/MAL-2026-17797/): Malicious code in ton-jetton-tools (RubyGems) (malicious package) - [MAL-2026-17796](https://insights.sbomify.com/MAL-2026-17796/): Malicious code in staking-apr-fetcher (RubyGems) (malicious package) - [MAL-2026-17795](https://insights.sbomify.com/MAL-2026-17795/): Malicious code in sol-mint-utils (RubyGems) (malicious package) - [MAL-2026-17794](https://insights.sbomify.com/MAL-2026-17794/): Malicious code in seed-phrase-validator (RubyGems) (malicious package) - [MAL-2026-17793](https://insights.sbomify.com/MAL-2026-17793/): Malicious code in perp-funding-rates (RubyGems) (malicious package) - [MAL-2026-17792](https://insights.sbomify.com/MAL-2026-17792/): Malicious code in nft-metadata-resolver (RubyGems) (malicious package) - [MAL-2026-17791](https://insights.sbomify.com/MAL-2026-17791/): Malicious code in multichain-rpc (RubyGems) (malicious package) - [MAL-2026-17790](https://insights.sbomify.com/MAL-2026-17790/): Malicious code in mev-sandwich-detect (RubyGems) (malicious package) - [MAL-2026-1779](https://insights.sbomify.com/MAL-2026-1779/): Malicious code in libxmljs2as (npm) (malicious package) - [MAL-2026-17789](https://insights.sbomify.com/MAL-2026-17789/): Malicious code in hd-wallet-generator (RubyGems) (malicious package) - [MAL-2026-17788](https://insights.sbomify.com/MAL-2026-17788/): Malicious code in gas-refuel-bridge (RubyGems) (malicious package) - [MAL-2026-17787](https://insights.sbomify.com/MAL-2026-17787/): Malicious code in evm-tx-decoder (RubyGems) (malicious package) - [MAL-2026-17786](https://insights.sbomify.com/MAL-2026-17786/): Malicious code in eth-gas-oracle (RubyGems) (malicious package) - [MAL-2026-17785](https://insights.sbomify.com/MAL-2026-17785/): Malicious code in erc20-approve-audit (RubyGems) (malicious package) - [MAL-2026-17784](https://insights.sbomify.com/MAL-2026-17784/): Malicious code in dex-router-abis (RubyGems) (malicious package) - [MAL-2026-17783](https://insights.sbomify.com/MAL-2026-17783/): Malicious code in defi-yield-calculator (RubyGems) (malicious package) - [MAL-2026-17782](https://insights.sbomify.com/MAL-2026-17782/): Malicious code in crypto-tax-export (RubyGems) (malicious package) - [MAL-2026-17781](https://insights.sbomify.com/MAL-2026-17781/): Malicious code in btc-fee-estimator (RubyGems) (malicious package) - [MAL-2026-17780](https://insights.sbomify.com/MAL-2026-17780/): Malicious code in block-explorer-api (RubyGems) (malicious package) - [MAL-2026-1778](https://insights.sbomify.com/MAL-2026-1778/): Malicious code in libxmljs21471479 (npm) (malicious package) - [MAL-2026-17779](https://insights.sbomify.com/MAL-2026-17779/): Malicious code in airdrop-eligibility-check (RubyGems) (malicious package) - [MAL-2026-17778](https://insights.sbomify.com/MAL-2026-17778/): Malicious code in some-very-long-package-name (npm) (malicious package) - [MAL-2026-17777](https://insights.sbomify.com/MAL-2026-17777/): Malicious code in react-paginate-v5 (npm) (malicious package) - [MAL-2026-17776](https://insights.sbomify.com/MAL-2026-17776/): Malicious code in pay-methods-kmf (npm) (malicious package) - [MAL-2026-17775](https://insights.sbomify.com/MAL-2026-17775/): Malicious code in nitro-cjs-requirer (npm) (malicious package) - [MAL-2026-17774](https://insights.sbomify.com/MAL-2026-17774/): Malicious code in nitro-bundled-dep (npm) (malicious package) - [MAL-2026-17773](https://insights.sbomify.com/MAL-2026-17773/): Malicious code in nested-lib (npm) (malicious package) - [MAL-2026-17772](https://insights.sbomify.com/MAL-2026-17772/): Malicious code in liferay-workspace-scripts (npm) (malicious package) - [MAL-2026-17771](https://insights.sbomify.com/MAL-2026-17771/): Malicious code in ksp-client-registry (npm) (malicious package) - [MAL-2026-17770](https://insights.sbomify.com/MAL-2026-17770/): Malicious code in ksp-app (npm) (malicious package) - [MAL-2026-1777](https://insights.sbomify.com/MAL-2026-1777/): Malicious code in libxmljs2147147 (npm) (malicious package) - [MAL-2026-17769](https://insights.sbomify.com/MAL-2026-17769/): Malicious code in deposit-limit-fe (npm) (malicious package) - [MAL-2026-17768](https://insights.sbomify.com/MAL-2026-17768/): Malicious code in cloudflare_module (npm) (malicious package) - [MAL-2026-17767](https://insights.sbomify.com/MAL-2026-17767/): Malicious code in another-very-long-name (npm) (malicious package) - [MAL-2026-17766](https://insights.sbomify.com/MAL-2026-17766/): Malicious code in @s4yhiitestpoc/scan-https-d (npm) (malicious package) - [MAL-2026-17765](https://insights.sbomify.com/MAL-2026-17765/): Malicious code in @s4yhiitestpoc/r3-https (npm) (malicious package) - [MAL-2026-17764](https://insights.sbomify.com/MAL-2026-17764/): Malicious code in @s4yhiitestpoc/r2-https (npm) (malicious package) - [MAL-2026-17763](https://insights.sbomify.com/MAL-2026-17763/): Malicious code in @coopeuch/core (npm) (malicious package) - [MAL-2026-17762](https://insights.sbomify.com/MAL-2026-17762/): Malicious code in @coopeuch/config (npm) (malicious package) - [MAL-2026-17761](https://insights.sbomify.com/MAL-2026-17761/): Malicious code in @coopeuch/components (npm) (malicious package) - [MAL-2026-17760](https://insights.sbomify.com/MAL-2026-17760/): Malicious code in @coopeuch/common (npm) (malicious package) - [MAL-2026-1776](https://insights.sbomify.com/MAL-2026-1776/): Malicious code in libxmljs2147 (npm) (malicious package) - [MAL-2026-17759](https://insights.sbomify.com/MAL-2026-17759/): Malicious code in @coopeuch/button (npm) (malicious package) - [MAL-2026-17758](https://insights.sbomify.com/MAL-2026-17758/): Malicious code in react-dropzone-v4 (npm) (malicious package) - [MAL-2026-17757](https://insights.sbomify.com/MAL-2026-17757/): Malicious code in webreader (PyPI) (malicious package) - [MAL-2026-17756](https://insights.sbomify.com/MAL-2026-17756/): Malicious code in pafer (PyPI) (malicious package) - [MAL-2026-17755](https://insights.sbomify.com/MAL-2026-17755/): Malicious code in agent-vx (PyPI) (malicious package) - [MAL-2026-17754](https://insights.sbomify.com/MAL-2026-17754/): Malicious code in @library-wide/library-shell (npm) (malicious package) - [MAL-2026-17753](https://insights.sbomify.com/MAL-2026-17753/): Malicious code in media-manager5 (PyPI) (malicious package) - [MAL-2026-17752](https://insights.sbomify.com/MAL-2026-17752/): Malicious code in agentaix (PyPI) (malicious package) - [MAL-2026-17751](https://insights.sbomify.com/MAL-2026-17751/): Malicious code in cloud-baileys (npm) (malicious package) - [MAL-2026-17750](https://insights.sbomify.com/MAL-2026-17750/): Malicious code in @fer2809fl/baileys (npm) (malicious package) - [MAL-2026-1775](https://insights.sbomify.com/MAL-2026-1775/): Malicious code in libxmljs2-malicious (npm) (malicious package) - [MAL-2026-17749](https://insights.sbomify.com/MAL-2026-17749/): Malicious code in @myorder-frontend-commons/analytics (npm) (malicious package) - [MAL-2026-17748](https://insights.sbomify.com/MAL-2026-17748/): Malicious code in test-account-portal-fe (npm) (malicious package) - [MAL-2026-17747](https://insights.sbomify.com/MAL-2026-17747/): Malicious code in kmf-i18n (npm) (malicious package) - [MAL-2026-17746](https://insights.sbomify.com/MAL-2026-17746/): Malicious code in kmf-bootstrap (npm) (malicious package) - [MAL-2026-17745](https://insights.sbomify.com/MAL-2026-17745/): Malicious code in @tunstock/remact-dom (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/105/