# Vulnerabilities published in 2026 - [MAL-2026-17564](https://insights.sbomify.com/MAL-2026-17564/): Malicious code in tostpro (npm) (malicious package) - [MAL-2026-17563](https://insights.sbomify.com/MAL-2026-17563/): Malicious code in risk-detection (npm) (malicious package) - [MAL-2026-17562](https://insights.sbomify.com/MAL-2026-17562/): Malicious code in internallib_v923 (npm) (malicious package) - [MAL-2026-17561](https://insights.sbomify.com/MAL-2026-17561/): Malicious code in insomnia-plugin-api-lint-helper (npm) (malicious package) - [MAL-2026-17560](https://insights.sbomify.com/MAL-2026-17560/): Malicious code in hardhat-spack (npm) (malicious package) - [MAL-2026-1756](https://insights.sbomify.com/MAL-2026-1756/): Malicious code in js-to-solve (npm) (malicious package) - [MAL-2026-17559](https://insights.sbomify.com/MAL-2026-17559/): Malicious code in hardhat-kex (npm) (malicious package) - [MAL-2026-17558](https://insights.sbomify.com/MAL-2026-17558/): Malicious code in css-txedrf-polyfill (npm) (malicious package) - [MAL-2026-17557](https://insights.sbomify.com/MAL-2026-17557/): Malicious code in css-svqggc-polyfill (npm) (malicious package) - [MAL-2026-17556](https://insights.sbomify.com/MAL-2026-17556/): Malicious code in css-ogojwh-polyfill (npm) (malicious package) - [MAL-2026-17555](https://insights.sbomify.com/MAL-2026-17555/): Malicious code in css-nbanqq-polyfill (npm) (malicious package) - [MAL-2026-17554](https://insights.sbomify.com/MAL-2026-17554/): Malicious code in css-mpmdds-polyfill (npm) (malicious package) - [MAL-2026-17553](https://insights.sbomify.com/MAL-2026-17553/): Malicious code in css-ikomdq-polyfill (npm) (malicious package) - [MAL-2026-17552](https://insights.sbomify.com/MAL-2026-17552/): Malicious code in css-hgwctv-polyfill (npm) (malicious package) - [MAL-2026-17551](https://insights.sbomify.com/MAL-2026-17551/): Malicious code in css-gvqmfn-polyfill (npm) (malicious package) - [MAL-2026-17550](https://insights.sbomify.com/MAL-2026-17550/): Malicious code in css-dwsawd-polyfill (npm) (malicious package) - [MAL-2026-1755](https://insights.sbomify.com/MAL-2026-1755/): Malicious code in iron-demo-helpers (npm) (malicious package) - [MAL-2026-17549](https://insights.sbomify.com/MAL-2026-17549/): Malicious code in css-display-reading-polyfill (npm) (malicious package) - [MAL-2026-17548](https://insights.sbomify.com/MAL-2026-17548/): Malicious code in css-ayucyz-polyfill (npm) (malicious package) - [MAL-2026-17547](https://insights.sbomify.com/MAL-2026-17547/): Malicious code in css-at-scope-polyfill (npm) (malicious package) - [MAL-2026-17546](https://insights.sbomify.com/MAL-2026-17546/): Malicious code in aria-live-region-helper (npm) (malicious package) - [MAL-2026-17545](https://insights.sbomify.com/MAL-2026-17545/): Malicious code in abbishal-poc (npm) (malicious package) - [MAL-2026-17544](https://insights.sbomify.com/MAL-2026-17544/): Malicious code in @qngular/core (npm) (malicious package) - [MAL-2026-17543](https://insights.sbomify.com/MAL-2026-17543/): Malicious code in @inpeek/odata-angular (npm) (malicious package) - [MAL-2026-17542](https://insights.sbomify.com/MAL-2026-17542/): Malicious code in @inpeek/odata (npm) (malicious package) - [MAL-2026-17541](https://insights.sbomify.com/MAL-2026-17541/): Malicious code in @anuglar/core (npm) (malicious package) - [MAL-2026-17540](https://insights.sbomify.com/MAL-2026-17540/): Malicious code in @anngular/core (npm) (malicious package) - [MAL-2026-1754](https://insights.sbomify.com/MAL-2026-1754/): Malicious code in ipherr (npm) (malicious package) - [MAL-2026-17539](https://insights.sbomify.com/MAL-2026-17539/): Malicious code in @angupar/core (npm) (malicious package) - [MAL-2026-17538](https://insights.sbomify.com/MAL-2026-17538/): Malicious code in @angulr/core (npm) (malicious package) - [MAL-2026-17537](https://insights.sbomify.com/MAL-2026-17537/): Malicious code in @angulaar/core (npm) (malicious package) - [MAL-2026-17536](https://insights.sbomify.com/MAL-2026-17536/): Malicious code in @angulaar/cli (npm) (malicious package) - [MAL-2026-17535](https://insights.sbomify.com/MAL-2026-17535/): Malicious code in @anguar/core (npm) (malicious package) - [MAL-2026-17534](https://insights.sbomify.com/MAL-2026-17534/): Malicious code in @angjlar/core (npm) (malicious package) - [MAL-2026-17533](https://insights.sbomify.com/MAL-2026-17533/): Malicious code in @anfular/core (npm) (malicious package) - [MAL-2026-17532](https://insights.sbomify.com/MAL-2026-17532/): Malicious code in @abgular/core (npm) (malicious package) - [MAL-2026-17531](https://insights.sbomify.com/MAL-2026-17531/): Malicious code in api-nebula (npm) (malicious package) - [MAL-2026-17530](https://insights.sbomify.com/MAL-2026-17530/): Malicious code in wcag-color-a11y-helpers (npm) (malicious package) - [MAL-2026-1753](https://insights.sbomify.com/MAL-2026-1753/): Malicious code in internal-secret-project-1234 (npm) (malicious package) - [MAL-2026-17529](https://insights.sbomify.com/MAL-2026-17529/): Malicious code in ultimate-websocket (npm) (malicious package) - [MAL-2026-17528](https://insights.sbomify.com/MAL-2026-17528/): Malicious code in tiny-viewport-unit-calc (npm) (malicious package) - [MAL-2026-17527](https://insights.sbomify.com/MAL-2026-17527/): Malicious code in tiny-focusgroup-helper (npm) (malicious package) - [MAL-2026-17526](https://insights.sbomify.com/MAL-2026-17526/): Malicious code in tiny-dom-focus-trap (npm) (malicious package) - [MAL-2026-17525](https://insights.sbomify.com/MAL-2026-17525/): Malicious code in tiny-css-token-parser (npm) (malicious package) - [MAL-2026-17524](https://insights.sbomify.com/MAL-2026-17524/): Malicious code in tailwindcss-forms-styles (npm) (malicious package) - [MAL-2026-17523](https://insights.sbomify.com/MAL-2026-17523/): Malicious code in studiocode_tools (npm) (malicious package) - [MAL-2026-17522](https://insights.sbomify.com/MAL-2026-17522/): Malicious code in studiocode_eligibility (npm) (malicious package) - [MAL-2026-17521](https://insights.sbomify.com/MAL-2026-17521/): Malicious code in rgx33-flex-layout-core (npm) (malicious package) - [MAL-2026-17520](https://insights.sbomify.com/MAL-2026-17520/): Malicious code in rgx33-css-grid-utils (npm) (malicious package) - [MAL-2026-1752](https://insights.sbomify.com/MAL-2026-1752/): Malicious code in internal-api-insights (npm) (malicious package) - [MAL-2026-17519](https://insights.sbomify.com/MAL-2026-17519/): Malicious code in promises-dotenv3 (npm) (malicious package) - [MAL-2026-17518](https://insights.sbomify.com/MAL-2026-17518/): Malicious code in postcss-gap-fallback-util (npm) (malicious package) - [MAL-2026-17517](https://insights.sbomify.com/MAL-2026-17517/): Malicious code in popover-anchor-polyfill (npm) (malicious package) - [MAL-2026-17516](https://insights.sbomify.com/MAL-2026-17516/): Malicious code in oleh-modal (npm) (malicious package) - [MAL-2026-17515](https://insights.sbomify.com/MAL-2026-17515/): Malicious code in monitoring-agent (npm) (malicious package) - [MAL-2026-17514](https://insights.sbomify.com/MAL-2026-17514/): Malicious code in minimal-a11y-contrast-check (npm) (malicious package) - [MAL-2026-17513](https://insights.sbomify.com/MAL-2026-17513/): Malicious code in lite-matterr (npm) (malicious package) - [MAL-2026-17512](https://insights.sbomify.com/MAL-2026-17512/): Malicious code in lite-matte (npm) (malicious package) - [MAL-2026-17511](https://insights.sbomify.com/MAL-2026-17511/): Malicious code in lite-mater (npm) (malicious package) - [MAL-2026-17510](https://insights.sbomify.com/MAL-2026-17510/): Malicious code in internallib_v275 (npm) (malicious package) - [MAL-2026-1751](https://insights.sbomify.com/MAL-2026-1751/): Malicious code in inter-site-components (npm) (malicious package) - [MAL-2026-17509](https://insights.sbomify.com/MAL-2026-17509/): Malicious code in hardhat-roof (npm) (malicious package) - [MAL-2026-17508](https://insights.sbomify.com/MAL-2026-17508/): Malicious code in hardhat-plus (npm) (malicious package) - [MAL-2026-17507](https://insights.sbomify.com/MAL-2026-17507/): Malicious code in hardhat-jsx (npm) (malicious package) - [MAL-2026-17506](https://insights.sbomify.com/MAL-2026-17506/): Malicious code in hardhat-ftp (npm) (malicious package) - [MAL-2026-17505](https://insights.sbomify.com/MAL-2026-17505/): Malicious code in dotenv-promises (npm) (malicious package) - [MAL-2026-17504](https://insights.sbomify.com/MAL-2026-17504/): Malicious code in dotenv-async (npm) (malicious package) - [MAL-2026-17503](https://insights.sbomify.com/MAL-2026-17503/): Malicious code in dom-focus-sentinel (npm) (malicious package) - [MAL-2026-17502](https://insights.sbomify.com/MAL-2026-17502/): Malicious code in botmaker-cli (npm) (malicious package) - [MAL-2026-17501](https://insights.sbomify.com/MAL-2026-17501/): Malicious code in a11y-tabindex-manager (npm) (malicious package) - [MAL-2026-17500](https://insights.sbomify.com/MAL-2026-17500/): Malicious code in @nagular/router (npm) (malicious package) - [MAL-2026-1750](https://insights.sbomify.com/MAL-2026-1750/): Malicious code in integration-icons (npm) (malicious package) - [MAL-2026-175](https://insights.sbomify.com/MAL-2026-175/): Malicious code in jwtdapp (npm) (malicious package) - [MAL-2026-17499](https://insights.sbomify.com/MAL-2026-17499/): Malicious code in @nagular/core (npm) (malicious package) - [MAL-2026-17498](https://insights.sbomify.com/MAL-2026-17498/): Malicious code in @kibt/www-nuxt-i18n (npm) (malicious package) - [MAL-2026-17497](https://insights.sbomify.com/MAL-2026-17497/): Malicious code in @babell/core (npm) (malicious package) - [MAL-2026-17496](https://insights.sbomify.com/MAL-2026-17496/): Malicious code in @angulra/core (npm) (malicious package) - [MAL-2026-17495](https://insights.sbomify.com/MAL-2026-17495/): Malicious code in @angulra/cli (npm) (malicious package) - [MAL-2026-17494](https://insights.sbomify.com/MAL-2026-17494/): Malicious code in @angularr/router (npm) (malicious package) - [MAL-2026-17493](https://insights.sbomify.com/MAL-2026-17493/): Malicious code in @angularr/core (npm) (malicious package) - [MAL-2026-17492](https://insights.sbomify.com/MAL-2026-17492/): Malicious code in @angularr/cli (npm) (malicious package) - [MAL-2026-17491](https://insights.sbomify.com/MAL-2026-17491/): Malicious code in focus-visible-polyfill-lite (npm) (malicious package) - [MAL-2026-17490](https://insights.sbomify.com/MAL-2026-17490/): Malicious code in express-fork (npm) (malicious package) - [MAL-2026-1749](https://insights.sbomify.com/MAL-2026-1749/): Malicious code in initial-path32 (npm) (malicious package) - [MAL-2026-17489](https://insights.sbomify.com/MAL-2026-17489/): Malicious code in express-enhanced (npm) (malicious package) - [MAL-2026-17488](https://insights.sbomify.com/MAL-2026-17488/): Malicious code in css-starting-style-polyfill (npm) (malicious package) - [MAL-2026-17487](https://insights.sbomify.com/MAL-2026-17487/): Malicious code in css-snap-target-polyfill (npm) (malicious package) - [MAL-2026-17486](https://insights.sbomify.com/MAL-2026-17486/): Malicious code in css-scroll-state-polyfill (npm) (malicious package) - [MAL-2026-17485](https://insights.sbomify.com/MAL-2026-17485/): Malicious code in css-scroll-anchor-polyfill (npm) (malicious package) - [MAL-2026-17484](https://insights.sbomify.com/MAL-2026-17484/): Malicious code in css-relative-color-util (npm) (malicious package) - [MAL-2026-17483](https://insights.sbomify.com/MAL-2026-17483/): Malicious code in css-reading-flow-polyfill (npm) (malicious package) - [MAL-2026-17482](https://insights.sbomify.com/MAL-2026-17482/): Malicious code in css-logical-prop-shim (npm) (malicious package) - [MAL-2026-17481](https://insights.sbomify.com/MAL-2026-17481/): Malicious code in css-light-dark-polyfill (npm) (malicious package) - [MAL-2026-17480](https://insights.sbomify.com/MAL-2026-17480/): Malicious code in css-interop-observer-polyfill (npm) (malicious package) - [MAL-2026-1748](https://insights.sbomify.com/MAL-2026-1748/): Malicious code in initial-path21 (npm) (malicious package) - [MAL-2026-17479](https://insights.sbomify.com/MAL-2026-17479/): Malicious code in css-gap-decorations-polyfill (npm) (malicious package) - [MAL-2026-17478](https://insights.sbomify.com/MAL-2026-17478/): Malicious code in css-field-sizing-polyfill (npm) (malicious package) - [MAL-2026-17477](https://insights.sbomify.com/MAL-2026-17477/): Malicious code in css-env-function-shim (npm) (malicious package) - [MAL-2026-17476](https://insights.sbomify.com/MAL-2026-17476/): Malicious code in css-anchor-pos-fallback (npm) (malicious package) - [MAL-2026-17475](https://insights.sbomify.com/MAL-2026-17475/): Malicious code in css-a11y-contrast-utils (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/108/