# Vulnerabilities published in 2026


- [MAL-2026-17293](https://insights.sbomify.com/MAL-2026-17293/): Malicious code in @selfpentest/eslint-pentest-plugin (npm) (malicious package)
- [MAL-2026-17292](https://insights.sbomify.com/MAL-2026-17292/): Malicious code in @selfpentest/bin-confusion (npm) (malicious package)
- [MAL-2026-17291](https://insights.sbomify.com/MAL-2026-17291/): Malicious code in @rutxploit-sec/waves-icons (npm) (malicious package)
- [MAL-2026-17290](https://insights.sbomify.com/MAL-2026-17290/): Malicious code in @rutxploit-sec/waves-button-poc (npm) (malicious package)
- [MAL-2026-1729](https://insights.sbomify.com/MAL-2026-1729/): Malicious code in eslint-plugin-superhuman-custom-rules (npm) (malicious package)
- [MAL-2026-17289](https://insights.sbomify.com/MAL-2026-17289/): Malicious code in @rutxploit-sec/subsplash-google-tag-manager (npm) (malicious package)
- [MAL-2026-17288](https://insights.sbomify.com/MAL-2026-17288/): Malicious code in @rutxploit-sec/subsplash-canny (npm) (malicious package)
- [MAL-2026-17287](https://insights.sbomify.com/MAL-2026-17287/): Malicious code in @chatunity/baileys (npm) (malicious package)
- [MAL-2026-17286](https://insights.sbomify.com/MAL-2026-17286/): Malicious code in queeuees (PyPI) (malicious package)
- [MAL-2026-17285](https://insights.sbomify.com/MAL-2026-17285/): Malicious code in @akapaki/baileys (npm) (malicious package)
- [MAL-2026-17284](https://insights.sbomify.com/MAL-2026-17284/): Malicious code in sk-lib-enc (npm) (malicious package)
- [MAL-2026-17283](https://insights.sbomify.com/MAL-2026-17283/): Malicious code in @xoxo-momo/kit (npm) (malicious package)
- [MAL-2026-17282](https://insights.sbomify.com/MAL-2026-17282/): Malicious code in @hrmony/hyper-json-builder (npm) (malicious package)
- [MAL-2026-17281](https://insights.sbomify.com/MAL-2026-17281/): Malicious code in @hrmony/valuenet (npm) (malicious package)
- [MAL-2026-17280](https://insights.sbomify.com/MAL-2026-17280/): Malicious code in @hrmony/pladddform-testing (npm) (malicious package)
- [MAL-2026-1728](https://insights.sbomify.com/MAL-2026-1728/): Malicious code in escaux (npm) (malicious package)
- [MAL-2026-17279](https://insights.sbomify.com/MAL-2026-17279/): Malicious code in @hrmony/pladddform-shared-infrastructure (npm) (malicious package)
- [MAL-2026-17278](https://insights.sbomify.com/MAL-2026-17278/): Malicious code in @hrmony/pladddform-partner-registry (npm) (malicious package)
- [MAL-2026-17277](https://insights.sbomify.com/MAL-2026-17277/): Malicious code in @hrmony/pladddform-infrastructure (npm) (malicious package)
- [MAL-2026-17276](https://insights.sbomify.com/MAL-2026-17276/): Malicious code in @hrmony/pladddform-frontend (npm) (malicious package)
- [MAL-2026-17275](https://insights.sbomify.com/MAL-2026-17275/): Malicious code in @hrmony/pladddform-core (npm) (malicious package)
- [MAL-2026-17274](https://insights.sbomify.com/MAL-2026-17274/): Malicious code in @hrmony/pladddform-config (npm) (malicious package)
- [MAL-2026-17273](https://insights.sbomify.com/MAL-2026-17273/): Malicious code in @hrmony/pladddform-codegen (npm) (malicious package)
- [MAL-2026-17272](https://insights.sbomify.com/MAL-2026-17272/): Malicious code in @hrmony/pladddform-cli (npm) (malicious package)
- [MAL-2026-17271](https://insights.sbomify.com/MAL-2026-17271/): Malicious code in @hrmony/pladddform-application (npm) (malicious package)
- [MAL-2026-17270](https://insights.sbomify.com/MAL-2026-17270/): Malicious code in @hrmony/organisationsverwaltung (npm) (malicious package)
- [MAL-2026-1727](https://insights.sbomify.com/MAL-2026-1727/): Malicious code in es1int-configer (npm) (malicious package)
- [MAL-2026-17269](https://insights.sbomify.com/MAL-2026-17269/): Malicious code in @hrmony/middlewares (npm) (malicious package)
- [MAL-2026-17268](https://insights.sbomify.com/MAL-2026-17268/): Malicious code in @hrmony/mailer-pladddform (npm) (malicious package)
- [MAL-2026-17267](https://insights.sbomify.com/MAL-2026-17267/): Malicious code in @hrmony/lohndateien (npm) (malicious package)
- [MAL-2026-17266](https://insights.sbomify.com/MAL-2026-17266/): Malicious code in @hrmony/kit-5 (npm) (malicious package)
- [MAL-2026-17265](https://insights.sbomify.com/MAL-2026-17265/): Malicious code in @hrmony/kit-4 (npm) (malicious package)
- [MAL-2026-17264](https://insights.sbomify.com/MAL-2026-17264/): Malicious code in @hrmony/kit-1 (npm) (malicious package)
- [MAL-2026-17263](https://insights.sbomify.com/MAL-2026-17263/): Malicious code in @hrmony/kit (npm) (malicious package)
- [MAL-2026-17262](https://insights.sbomify.com/MAL-2026-17262/): Malicious code in @hrmony/interfaces (npm) (malicious package)
- [MAL-2026-17261](https://insights.sbomify.com/MAL-2026-17261/): Malicious code in @hrmony/gutscheinverwaltung (npm) (malicious package)
- [MAL-2026-17260](https://insights.sbomify.com/MAL-2026-17260/): Malicious code in @hrmony/devtool-configuration (npm) (malicious package)
- [MAL-2026-1726](https://insights.sbomify.com/MAL-2026-1726/): Malicious code in ersagent-frontend (npm) (malicious package)
- [MAL-2026-17259](https://insights.sbomify.com/MAL-2026-17259/): Malicious code in @hrmony/component-library (npm) (malicious package)
- [MAL-2026-17258](https://insights.sbomify.com/MAL-2026-17258/): Malicious code in @hrmony/cdk-constructs (npm) (malicious package)
- [MAL-2026-17257](https://insights.sbomify.com/MAL-2026-17257/): Malicious code in @hrmony/benefitverwaltung (npm) (malicious package)
- [MAL-2026-17256](https://insights.sbomify.com/MAL-2026-17256/): Malicious code in @hrmony/benefit-sachbezug (npm) (malicious package)
- [MAL-2026-17255](https://insights.sbomify.com/MAL-2026-17255/): Malicious code in @hrmony/benefit-mobilitaet (npm) (malicious package)
- [MAL-2026-17254](https://insights.sbomify.com/MAL-2026-17254/): Malicious code in @hrmony/benefit-internetzuschuss (npm) (malicious package)
- [MAL-2026-17253](https://insights.sbomify.com/MAL-2026-17253/): Malicious code in @hrmony/benefit-essenszuschuss (npm) (malicious package)
- [MAL-2026-17252](https://insights.sbomify.com/MAL-2026-17252/): Malicious code in @hrmony/belegerfassung-pladddform (npm) (malicious package)
- [MAL-2026-17251](https://insights.sbomify.com/MAL-2026-17251/): Malicious code in @hrmony/app-gateway-templates (npm) (malicious package)
- [MAL-2026-17250](https://insights.sbomify.com/MAL-2026-17250/): Malicious code in @hrmony/api-gateway-service-config (npm) (malicious package)
- [MAL-2026-1725](https://insights.sbomify.com/MAL-2026-1725/): Malicious code in env-workflow-test (npm) (malicious package)
- [MAL-2026-17249](https://insights.sbomify.com/MAL-2026-17249/): Malicious code in @hrmony/account-management (npm) (malicious package)
- [MAL-2026-17248](https://insights.sbomify.com/MAL-2026-17248/): Malicious code in xeprews (npm) (malicious package)
- [MAL-2026-17247](https://insights.sbomify.com/MAL-2026-17247/): Malicious code in exptredd (npm) (malicious package)
- [MAL-2026-17246](https://insights.sbomify.com/MAL-2026-17246/): Malicious code in exptred (npm) (malicious package)
- [MAL-2026-17245](https://insights.sbomify.com/MAL-2026-17245/): Malicious code in exptrdd (npm) (malicious package)
- [MAL-2026-17244](https://insights.sbomify.com/MAL-2026-17244/): Malicious code in exprrdd (npm) (malicious package)
- [MAL-2026-17243](https://insights.sbomify.com/MAL-2026-17243/): Malicious code in express-nodejs (npm) (malicious package)
- [MAL-2026-17242](https://insights.sbomify.com/MAL-2026-17242/): Malicious code in express-javascript (npm) (malicious package)
- [MAL-2026-17241](https://insights.sbomify.com/MAL-2026-17241/): Malicious code in exprdd (npm) (malicious package)
- [MAL-2026-17240](https://insights.sbomify.com/MAL-2026-17240/): Malicious code in aseitylab (PyPI) (malicious package)
- [MAL-2026-1724](https://insights.sbomify.com/MAL-2026-1724/): Malicious code in engineers (npm) (malicious package)
- [MAL-2026-17239](https://insights.sbomify.com/MAL-2026-17239/): Malicious code in test-agency-assignment (npm) (malicious package)
- [MAL-2026-17238](https://insights.sbomify.com/MAL-2026-17238/): Malicious code in rai6jaisahthaghee5ou-loader-package (npm) (malicious package)
- [MAL-2026-17237](https://insights.sbomify.com/MAL-2026-17237/): Malicious code in native-env (npm) (malicious package)
- [MAL-2026-17236](https://insights.sbomify.com/MAL-2026-17236/): Malicious code in mini-hardhat (npm) (malicious package)
- [MAL-2026-17235](https://insights.sbomify.com/MAL-2026-17235/): Malicious code in items-validator (npm) (malicious package)
- [MAL-2026-17234](https://insights.sbomify.com/MAL-2026-17234/): Malicious code in hardhat-zet (npm) (malicious package)
- [MAL-2026-17233](https://insights.sbomify.com/MAL-2026-17233/): Malicious code in hardhat-lock (npm) (malicious package)
- [MAL-2026-17232](https://insights.sbomify.com/MAL-2026-17232/): Malicious code in fabric-native-loader (npm) (malicious package)
- [MAL-2026-17231](https://insights.sbomify.com/MAL-2026-17231/): Malicious code in dotenv-native (npm) (malicious package)
- [MAL-2026-17230](https://insights.sbomify.com/MAL-2026-17230/): Malicious code in llm-nebula (npm) (malicious package)
- [MAL-2026-1723](https://insights.sbomify.com/MAL-2026-1723/): Malicious code in elf-stats-velvet-ledger-928 (npm) (malicious package)
- [MAL-2026-17229](https://insights.sbomify.com/MAL-2026-17229/): Malicious code in simple-date-formatter-new-12 (npm) (malicious package)
- [MAL-2026-17228](https://insights.sbomify.com/MAL-2026-17228/): Malicious code in nebulaai-sdk (npm) (malicious package)
- [MAL-2026-17227](https://insights.sbomify.com/MAL-2026-17227/): Malicious code in nebula-llm (npm) (malicious package)
- [MAL-2026-17226](https://insights.sbomify.com/MAL-2026-17226/): Malicious code in figlet-chalk-render (npm) (malicious package)
- [MAL-2026-17225](https://insights.sbomify.com/MAL-2026-17225/): Malicious code in fabric-render-bridge (npm) (malicious package)
- [MAL-2026-17224](https://insights.sbomify.com/MAL-2026-17224/): Malicious code in fabric-asset-pipeline (npm) (malicious package)
- [MAL-2026-17223](https://insights.sbomify.com/MAL-2026-17223/): Malicious code in chalk-figlet (npm) (malicious package)
- [MAL-2026-17222](https://insights.sbomify.com/MAL-2026-17222/): Malicious code in vite-plugin-crypto (npm) (malicious package)
- [MAL-2026-17221](https://insights.sbomify.com/MAL-2026-17221/): Malicious code in tailwindcss-form-kit (npm) (malicious package)
- [MAL-2026-17220](https://insights.sbomify.com/MAL-2026-17220/): Malicious code in nebulajs-api (npm) (malicious package)
- [MAL-2026-1722](https://insights.sbomify.com/MAL-2026-1722/): Malicious code in ehance-assistant33 (npm) (malicious package)
- [MAL-2026-17219](https://insights.sbomify.com/MAL-2026-17219/): Malicious code in nebula-sdk (npm) (malicious package)
- [MAL-2026-17218](https://insights.sbomify.com/MAL-2026-17218/): Malicious code in native-runner (npm) (malicious package)
- [MAL-2026-17217](https://insights.sbomify.com/MAL-2026-17217/): Malicious code in my-skibidi (npm) (malicious package)
- [MAL-2026-17216](https://insights.sbomify.com/MAL-2026-17216/): Malicious code in img-to-native (npm) (malicious package)
- [MAL-2026-17215](https://insights.sbomify.com/MAL-2026-17215/): Malicious code in eslint-plugin-skywagon-web (npm) (malicious package)
- [MAL-2026-17214](https://insights.sbomify.com/MAL-2026-17214/): Malicious code in git-en-boite-logging (npm) (malicious package)
- [MAL-2026-17213](https://insights.sbomify.com/MAL-2026-17213/): Malicious code in azure-langchain-example (PyPI) (malicious package)
- [MAL-2026-17212](https://insights.sbomify.com/MAL-2026-17212/): Malicious code in wbnr-probe-visible-check (npm) (malicious package)
- [MAL-2026-17211](https://insights.sbomify.com/MAL-2026-17211/): Malicious code in vinzzsync-wacli (npm) (malicious package)
- [MAL-2026-17210](https://insights.sbomify.com/MAL-2026-17210/): Malicious code in uuid-date (npm) (malicious package)
- [MAL-2026-1721](https://insights.sbomify.com/MAL-2026-1721/): Malicious code in ehance-assistant (npm) (malicious package)
- [MAL-2026-17209](https://insights.sbomify.com/MAL-2026-17209/): Malicious code in tanksync (npm) (malicious package)
- [MAL-2026-17208](https://insights.sbomify.com/MAL-2026-17208/): Malicious code in riot-private (npm) (malicious package)
- [MAL-2026-17207](https://insights.sbomify.com/MAL-2026-17207/): Malicious code in kjj81 (npm) (malicious package)
- [MAL-2026-17206](https://insights.sbomify.com/MAL-2026-17206/): Malicious code in kalasnik-npm-simple-test (npm) (malicious package)
- [MAL-2026-17205](https://insights.sbomify.com/MAL-2026-17205/): Malicious code in @wbnr/lottiefiles-loader (npm) (malicious package)
- [MAL-2026-17204](https://insights.sbomify.com/MAL-2026-17204/): Malicious code in @wbnr/design-kit (npm) (malicious package)
- [MAL-2026-17203](https://insights.sbomify.com/MAL-2026-17203/): Malicious code in @digi-kernel/digi-kernel-constrains (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/111/