# Vulnerabilities published in 2026 - [MAL-2026-16571](https://insights.sbomify.com/MAL-2026-16571/): Malicious code in bbiundler (RubyGems) (malicious package) - [MAL-2026-16570](https://insights.sbomify.com/MAL-2026-16570/): Malicious code in bausndler (RubyGems) (malicious package) - [MAL-2026-1657](https://insights.sbomify.com/MAL-2026-1657/): Malicious code in backstage-plugin-wpe-catalog (npm) (malicious package) - [MAL-2026-16569](https://insights.sbomify.com/MAL-2026-16569/): Malicious code in baunlder (RubyGems) (malicious package) - [MAL-2026-16568](https://insights.sbomify.com/MAL-2026-16568/): Malicious code in baundler (RubyGems) (malicious package) - [MAL-2026-16567](https://insights.sbomify.com/MAL-2026-16567/): Malicious code in baundlef (RubyGems) (malicious package) - [MAL-2026-16566](https://insights.sbomify.com/MAL-2026-16566/): Malicious code in baumdler (RubyGems) (malicious package) - [MAL-2026-16565](https://insights.sbomify.com/MAL-2026-16565/): Malicious code in basndler (RubyGems) (malicious package) - [MAL-2026-16564](https://insights.sbomify.com/MAL-2026-16564/): Malicious code in banlder (RubyGems) (malicious package) - [MAL-2026-16563](https://insights.sbomify.com/MAL-2026-16563/): Malicious code in bandler (RubyGems) (malicious package) - [MAL-2026-16562](https://insights.sbomify.com/MAL-2026-16562/): Malicious code in bandlef (RubyGems) (malicious package) - [MAL-2026-16561](https://insights.sbomify.com/MAL-2026-16561/): Malicious code in bamdler (RubyGems) (malicious package) - [MAL-2026-16560](https://insights.sbomify.com/MAL-2026-16560/): Malicious code in baiundler (RubyGems) (malicious package) - [MAL-2026-1656](https://insights.sbomify.com/MAL-2026-1656/): Malicious code in argonnode (npm) (malicious package) - [MAL-2026-16559](https://insights.sbomify.com/MAL-2026-16559/): Malicious code in ausndler (RubyGems) (malicious package) - [MAL-2026-16558](https://insights.sbomify.com/MAL-2026-16558/): Malicious code in aunlder (RubyGems) (malicious package) - [MAL-2026-16557](https://insights.sbomify.com/MAL-2026-16557/): Malicious code in aundler (RubyGems) (malicious package) - [MAL-2026-16556](https://insights.sbomify.com/MAL-2026-16556/): Malicious code in aundlef (RubyGems) (malicious package) - [MAL-2026-16555](https://insights.sbomify.com/MAL-2026-16555/): Malicious code in aumdler (RubyGems) (malicious package) - [MAL-2026-16554](https://insights.sbomify.com/MAL-2026-16554/): Malicious code in aubndler (RubyGems) (malicious package) - [MAL-2026-16553](https://insights.sbomify.com/MAL-2026-16553/): Malicious code in aiundler (RubyGems) (malicious package) - [MAL-2026-16552](https://insights.sbomify.com/MAL-2026-16552/): Malicious code in abusndler (RubyGems) (malicious package) - [MAL-2026-16551](https://insights.sbomify.com/MAL-2026-16551/): Malicious code in abunxler (RubyGems) (malicious package) - [MAL-2026-16550](https://insights.sbomify.com/MAL-2026-16550/): Malicious code in abunlder (RubyGems) (malicious package) - [MAL-2026-1655](https://insights.sbomify.com/MAL-2026-1655/): Malicious code in aligntyper (npm) (malicious package) - [MAL-2026-16549](https://insights.sbomify.com/MAL-2026-16549/): Malicious code in abundler (RubyGems) (malicious package) - [MAL-2026-16548](https://insights.sbomify.com/MAL-2026-16548/): Malicious code in abundlef (RubyGems) (malicious package) - [MAL-2026-16547](https://insights.sbomify.com/MAL-2026-16547/): Malicious code in abumdler (RubyGems) (malicious package) - [MAL-2026-16546](https://insights.sbomify.com/MAL-2026-16546/): Malicious code in abndler (RubyGems) (malicious package) - [MAL-2026-16545](https://insights.sbomify.com/MAL-2026-16545/): Malicious code in abiundler (RubyGems) (malicious package) - [MAL-2026-16544](https://insights.sbomify.com/MAL-2026-16544/): Malicious code in dip.ioc.extensions (NuGet) (malicious package) - [MAL-2026-16543](https://insights.sbomify.com/MAL-2026-16543/): Malicious code in dip.ioc (NuGet) (malicious package) - [MAL-2026-16542](https://insights.sbomify.com/MAL-2026-16542/): Malicious code in zeal-utils (npm) (malicious package) - [MAL-2026-16541](https://insights.sbomify.com/MAL-2026-16541/): Malicious code in zeal-util-hooks (npm) (malicious package) - [MAL-2026-16540](https://insights.sbomify.com/MAL-2026-16540/): Malicious code in style-class-utils (npm) (malicious package) - [MAL-2026-1654](https://insights.sbomify.com/MAL-2026-1654/): Malicious code in aligntypeer (npm) (malicious package) - [MAL-2026-16539](https://insights.sbomify.com/MAL-2026-16539/): Malicious code in speaker_tagging_media_player (npm) (malicious package) - [MAL-2026-16538](https://insights.sbomify.com/MAL-2026-16538/): Malicious code in spark-rpc (npm) (malicious package) - [MAL-2026-16537](https://insights.sbomify.com/MAL-2026-16537/): Malicious code in spark-common (npm) (malicious package) - [MAL-2026-16536](https://insights.sbomify.com/MAL-2026-16536/): Malicious code in mx-www-locales-common (npm) (malicious package) - [MAL-2026-16535](https://insights.sbomify.com/MAL-2026-16535/): Malicious code in mercuriusdream-oidc-replay-probe (npm) (malicious package) - [MAL-2026-16534](https://insights.sbomify.com/MAL-2026-16534/): Malicious code in halali-sample (npm) (malicious package) - [MAL-2026-16533](https://insights.sbomify.com/MAL-2026-16533/): Malicious code in exodus-firestore-synchronize (npm) (malicious package) - [MAL-2026-16532](https://insights.sbomify.com/MAL-2026-16532/): Malicious code in @yuva2210/poc-depconf (npm) (malicious package) - [MAL-2026-16531](https://insights.sbomify.com/MAL-2026-16531/): Malicious code in @yuva2210/okx-poc-preinstall (npm) (malicious package) - [MAL-2026-16530](https://insights.sbomify.com/MAL-2026-16530/): Malicious code in @ssgw/background-transition (npm) (malicious package) - [MAL-2026-1653](https://insights.sbomify.com/MAL-2026-1653/): Malicious code in align-configer (npm) (malicious package) - [MAL-2026-16529](https://insights.sbomify.com/MAL-2026-16529/): Malicious code in @larocas-bbresearch/tp-probe-e29834ce (npm) (malicious package) - [MAL-2026-16528](https://insights.sbomify.com/MAL-2026-16528/): Malicious code in @larocas-bbresearch/tp-probe-dc7a3670 (npm) (malicious package) - [MAL-2026-16527](https://insights.sbomify.com/MAL-2026-16527/): Malicious code in @larocas-bbresearch/tombstone-probe-odvz5y (npm) (malicious package) - [MAL-2026-16526](https://insights.sbomify.com/MAL-2026-16526/): Malicious code in @larocas-bbresearch/tombstone-probe-live-z6xz56 (npm) (malicious package) - [MAL-2026-16525](https://insights.sbomify.com/MAL-2026-16525/): Malicious code in @larocas-bbresearch/tombstone-probe-8ejnsa (npm) (malicious package) - [MAL-2026-16524](https://insights.sbomify.com/MAL-2026-16524/): Malicious code in @ks-cqc/h5-sig4 (npm) (malicious package) - [MAL-2026-16523](https://insights.sbomify.com/MAL-2026-16523/): Malicious code in @ks-cqc/fingerprint-generator (npm) (malicious package) - [MAL-2026-16522](https://insights.sbomify.com/MAL-2026-16522/): Malicious code in @egencia/uitk-react-text (npm) (malicious package) - [MAL-2026-16521](https://insights.sbomify.com/MAL-2026-16521/): Malicious code in @egencia/uitk-react-spacing (npm) (malicious package) - [MAL-2026-16520](https://insights.sbomify.com/MAL-2026-16520/): Malicious code in @egencia/uitk-react-layout-flex (npm) (malicious package) - [MAL-2026-1652](https://insights.sbomify.com/MAL-2026-1652/): Malicious code in alfasec (npm) (malicious package) - [MAL-2026-16519](https://insights.sbomify.com/MAL-2026-16519/): Malicious code in @egencia/uitk-react-foundation (npm) (malicious package) - [MAL-2026-16518](https://insights.sbomify.com/MAL-2026-16518/): Malicious code in @egencia/uitk-react (npm) (malicious package) - [MAL-2026-16517](https://insights.sbomify.com/MAL-2026-16517/): Malicious code in @egencia/uitk-global-styles-6 (npm) (malicious package) - [MAL-2026-16516](https://insights.sbomify.com/MAL-2026-16516/): Malicious code in @egencia/uitk-global-styles (npm) (malicious package) - [MAL-2026-16515](https://insights.sbomify.com/MAL-2026-16515/): Malicious code in @egencia/design-tokens (npm) (malicious package) - [MAL-2026-16514](https://insights.sbomify.com/MAL-2026-16514/): Malicious code in @client-web-next/utils (npm) (malicious package) - [MAL-2026-16513](https://insights.sbomify.com/MAL-2026-16513/): Malicious code in @client-web-next/ui-business (npm) (malicious package) - [MAL-2026-16512](https://insights.sbomify.com/MAL-2026-16512/): Malicious code in @client-web-next/ui (npm) (malicious package) - [MAL-2026-16511](https://insights.sbomify.com/MAL-2026-16511/): Malicious code in @client-web-next/ua-parser (npm) (malicious package) - [MAL-2026-16510](https://insights.sbomify.com/MAL-2026-16510/): Malicious code in @client-web-next/transfer-state (npm) (malicious package) - [MAL-2026-1651](https://insights.sbomify.com/MAL-2026-1651/): Malicious code in ai-fast-auto-trader (npm) (malicious package) - [MAL-2026-16509](https://insights.sbomify.com/MAL-2026-16509/): Malicious code in @client-web-next/timer (npm) (malicious package) - [MAL-2026-16508](https://insights.sbomify.com/MAL-2026-16508/): Malicious code in @client-web-next/tarjeta-button (npm) (malicious package) - [MAL-2026-16507](https://insights.sbomify.com/MAL-2026-16507/): Malicious code in @client-web-next/providers (npm) (malicious package) - [MAL-2026-16506](https://insights.sbomify.com/MAL-2026-16506/): Malicious code in @client-web-next/origination-microfront (npm) (malicious package) - [MAL-2026-16505](https://insights.sbomify.com/MAL-2026-16505/): Malicious code in @client-web-next/navigation-link (npm) (malicious package) - [MAL-2026-16504](https://insights.sbomify.com/MAL-2026-16504/): Malicious code in @client-web-next/logger (npm) (malicious package) - [MAL-2026-16503](https://insights.sbomify.com/MAL-2026-16503/): Malicious code in @client-web-next/icons (npm) (malicious package) - [MAL-2026-16502](https://insights.sbomify.com/MAL-2026-16502/): Malicious code in @client-web-next/footer (npm) (malicious package) - [MAL-2026-16501](https://insights.sbomify.com/MAL-2026-16501/): Malicious code in @client-web-next/feature-flags (npm) (malicious package) - [MAL-2026-16500](https://insights.sbomify.com/MAL-2026-16500/): Malicious code in @client-web-next/event-bus-listener (npm) (malicious package) - [MAL-2026-1650](https://insights.sbomify.com/MAL-2026-1650/): Malicious code in advertising-shared (npm) (malicious package) - [MAL-2026-165](https://insights.sbomify.com/MAL-2026-165/): Malicious code in @kyriba/mf-kit (npm) (malicious package) - [MAL-2026-16499](https://insights.sbomify.com/MAL-2026-16499/): Malicious code in @client-web-next/env-util (npm) (malicious package) - [MAL-2026-16498](https://insights.sbomify.com/MAL-2026-16498/): Malicious code in @client-web-next/cms (npm) (malicious package) - [MAL-2026-16497](https://insights.sbomify.com/MAL-2026-16497/): Malicious code in @client-web-next/api-metrics (npm) (malicious package) - [MAL-2026-16496](https://insights.sbomify.com/MAL-2026-16496/): Malicious code in @client-web-next/analytics (npm) (malicious package) - [MAL-2026-16495](https://insights.sbomify.com/MAL-2026-16495/): Malicious code in @client-web-next/adaptive (npm) (malicious package) - [MAL-2026-16494](https://insights.sbomify.com/MAL-2026-16494/): Malicious code in @client-web-next/ab-tests (npm) (malicious package) - [MAL-2026-16493](https://insights.sbomify.com/MAL-2026-16493/): Malicious code in @client-web-next/ab-landing-form (npm) (malicious package) - [MAL-2026-16492](https://insights.sbomify.com/MAL-2026-16492/): Malicious code in @cartradetech/example-package (npm) (malicious package) - [MAL-2026-16491](https://insights.sbomify.com/MAL-2026-16491/): Malicious code in @adominadmininstr/fmt-date-helper (npm) (malicious package) - [MAL-2026-16490](https://insights.sbomify.com/MAL-2026-16490/): Malicious code in @adominadmininstr/date-util-helper (npm) (malicious package) - [MAL-2026-1649](https://insights.sbomify.com/MAL-2026-1649/): Malicious code in advertising-podlet (npm) (malicious package) - [MAL-2026-16489](https://insights.sbomify.com/MAL-2026-16489/): Malicious code in dip.infrastructure.context (NuGet) (malicious package) - [MAL-2026-16488](https://insights.sbomify.com/MAL-2026-16488/): Malicious code in dip.infrastructure (NuGet) (malicious package) - [MAL-2026-16487](https://insights.sbomify.com/MAL-2026-16487/): Malicious code in dip.api (NuGet) (malicious package) - [MAL-2026-16486](https://insights.sbomify.com/MAL-2026-16486/): Malicious code in @baanx/domain (npm) (malicious package) - [MAL-2026-16485](https://insights.sbomify.com/MAL-2026-16485/): Malicious code in @baanx/common (npm) (malicious package) - [MAL-2026-16484](https://insights.sbomify.com/MAL-2026-16484/): Malicious code in pino-testkit (npm) (malicious package) - [MAL-2026-16483](https://insights.sbomify.com/MAL-2026-16483/): Malicious code in @rixxcodex/baileys (npm) (malicious package) - [MAL-2026-16482](https://insights.sbomify.com/MAL-2026-16482/): Malicious code in internallib_v657 (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/119/