# Vulnerabilities published in 2026 - [MAL-2026-16481](https://insights.sbomify.com/MAL-2026-16481/): Malicious code in internallib_v463 (npm) (malicious package) - [MAL-2026-16480](https://insights.sbomify.com/MAL-2026-16480/): Malicious code in a-onesite (npm) (malicious package) - [MAL-2026-1648](https://insights.sbomify.com/MAL-2026-1648/): Malicious code in advertising-events (npm) (malicious package) - [MAL-2026-16479](https://insights.sbomify.com/MAL-2026-16479/): Malicious code in simplenewnpmpackage (npm) (malicious package) - [MAL-2026-16478](https://insights.sbomify.com/MAL-2026-16478/): Malicious code in event-hunter (npm) (malicious package) - [MAL-2026-16477](https://insights.sbomify.com/MAL-2026-16477/): Malicious code in com.apple.unityplugin.storekit (npm) (malicious package) - [MAL-2026-16476](https://insights.sbomify.com/MAL-2026-16476/): Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm) (malicious package) - [MAL-2026-16475](https://insights.sbomify.com/MAL-2026-16475/): Malicious code in memoryos (PyPI) (malicious package) - [MAL-2026-16474](https://insights.sbomify.com/MAL-2026-16474/): Malicious code in vite-dev-launcher (npm) (malicious package) - [MAL-2026-16473](https://insights.sbomify.com/MAL-2026-16473/): Malicious code in sea-baileys (npm) (malicious package) - [MAL-2026-16472](https://insights.sbomify.com/MAL-2026-16472/): Malicious code in z-deno-truth-ya1t4m (npm) (malicious package) - [MAL-2026-16471](https://insights.sbomify.com/MAL-2026-16471/): Malicious code in z-deno-truth-va499w (npm) (malicious package) - [MAL-2026-16470](https://insights.sbomify.com/MAL-2026-16470/): Malicious code in z-deno-truth-bwhlsz (npm) (malicious package) - [MAL-2026-1647](https://insights.sbomify.com/MAL-2026-1647/): Malicious code in adobe-tracking (npm) (malicious package) - [MAL-2026-16469](https://insights.sbomify.com/MAL-2026-16469/): Malicious code in @test1230504/test-publish-verify (npm) (malicious package) - [MAL-2026-16468](https://insights.sbomify.com/MAL-2026-16468/): Malicious code in @test1230504/string-format-helper (npm) (malicious package) - [MAL-2026-16467](https://insights.sbomify.com/MAL-2026-16467/): Malicious code in @test1230504/probe-7f3k2m-utils (npm) (malicious package) - [MAL-2026-16466](https://insights.sbomify.com/MAL-2026-16466/): Malicious code in wurl_show_data (RubyGems) (malicious package) - [MAL-2026-16465](https://insights.sbomify.com/MAL-2026-16465/): Malicious code in helpersutils-dev-tools (npm) (malicious package) - [MAL-2026-16464](https://insights.sbomify.com/MAL-2026-16464/): Malicious code in hachutis (npm) (malicious package) - [MAL-2026-16463](https://insights.sbomify.com/MAL-2026-16463/): Malicious code in godzzz (npm) (malicious package) - [MAL-2026-16462](https://insights.sbomify.com/MAL-2026-16462/): Malicious code in godzz (npm) (malicious package) - [MAL-2026-16461](https://insights.sbomify.com/MAL-2026-16461/): Malicious code in godxxx (npm) (malicious package) - [MAL-2026-16460](https://insights.sbomify.com/MAL-2026-16460/): Malicious code in xsjukcnv8low26 (npm) (malicious package) - [MAL-2026-1646](https://insights.sbomify.com/MAL-2026-1646/): Malicious code in abstract-http-request (npm) (malicious package) - [MAL-2026-16459](https://insights.sbomify.com/MAL-2026-16459/): Malicious code in webp-https-errors (npm) (malicious package) - [MAL-2026-16458](https://insights.sbomify.com/MAL-2026-16458/): Malicious code in tuxcmdfhjkw (npm) (malicious package) - [MAL-2026-16457](https://insights.sbomify.com/MAL-2026-16457/): Malicious code in tibcwmpoeafh (npm) (malicious package) - [MAL-2026-16456](https://insights.sbomify.com/MAL-2026-16456/): Malicious code in tib2jcvowuyma (npm) (malicious package) - [MAL-2026-16455](https://insights.sbomify.com/MAL-2026-16455/): Malicious code in some-tool-package (npm) (malicious package) - [MAL-2026-16454](https://insights.sbomify.com/MAL-2026-16454/): Malicious code in solo-async-pipe (npm) (malicious package) - [MAL-2026-16453](https://insights.sbomify.com/MAL-2026-16453/): Malicious code in semver-bump-io (npm) (malicious package) - [MAL-2026-16452](https://insights.sbomify.com/MAL-2026-16452/): Malicious code in mob4zchvuine (npm) (malicious package) - [MAL-2026-16451](https://insights.sbomify.com/MAL-2026-16451/): Malicious code in luftzxyuiwgbgsp (npm) (malicious package) - [MAL-2026-16450](https://insights.sbomify.com/MAL-2026-16450/): Malicious code in kamafhbnowct (npm) (malicious package) - [MAL-2026-1645](https://insights.sbomify.com/MAL-2026-1645/): Malicious code in aboba-initial (npm) (malicious package) - [MAL-2026-16449](https://insights.sbomify.com/MAL-2026-16449/): Malicious code in iso-datetime-core (npm) (malicious package) - [MAL-2026-16448](https://insights.sbomify.com/MAL-2026-16448/): Malicious code in debounce-throttle-base (npm) (malicious package) - [MAL-2026-16447](https://insights.sbomify.com/MAL-2026-16447/): Malicious code in caphsmgiwy (npm) (malicious package) - [MAL-2026-16446](https://insights.sbomify.com/MAL-2026-16446/): Malicious code in better-md (npm) (malicious package) - [MAL-2026-16445](https://insights.sbomify.com/MAL-2026-16445/): Malicious code in n8n-nodes-metricsagent (npm) (malicious package) - [MAL-2026-16444](https://insights.sbomify.com/MAL-2026-16444/): Malicious code in n8n-nodes-healthmon (npm) (malicious package) - [MAL-2026-16443](https://insights.sbomify.com/MAL-2026-16443/): Malicious code in my-company-device (npm) (malicious package) - [MAL-2026-16442](https://insights.sbomify.com/MAL-2026-16442/): Malicious code in moudeva (npm) (malicious package) - [MAL-2026-16441](https://insights.sbomify.com/MAL-2026-16441/): Malicious code in moidevl (npm) (malicious package) - [MAL-2026-16440](https://insights.sbomify.com/MAL-2026-16440/): Malicious code in turbo-ws (npm) (malicious package) - [MAL-2026-1644](https://insights.sbomify.com/MAL-2026-1644/): Malicious code in aboba-docker-check (npm) (malicious package) - [MAL-2026-16439](https://insights.sbomify.com/MAL-2026-16439/): Malicious code in internallib_v550 (npm) (malicious package) - [MAL-2026-16438](https://insights.sbomify.com/MAL-2026-16438/): Malicious code in internallib_v497 (npm) (malicious package) - [MAL-2026-16437](https://insights.sbomify.com/MAL-2026-16437/): Malicious code in eslint-plugin-i18n-shreddit (npm) (malicious package) - [MAL-2026-16436](https://insights.sbomify.com/MAL-2026-16436/): Malicious code in efhthrthrthregerht (npm) (malicious package) - [MAL-2026-16435](https://insights.sbomify.com/MAL-2026-16435/): Malicious code in catqrcodeconverter (npm) (malicious package) - [MAL-2026-16434](https://insights.sbomify.com/MAL-2026-16434/): Malicious code in catplatebarcodeparser (npm) (malicious package) - [MAL-2026-16433](https://insights.sbomify.com/MAL-2026-16433/): Malicious code in @vitemirrorte/element-plus-vite-cli (npm) (malicious package) - [MAL-2026-16432](https://insights.sbomify.com/MAL-2026-16432/): Malicious code in @wizloft/harness-project (npm) (malicious package) - [MAL-2026-16431](https://insights.sbomify.com/MAL-2026-16431/): Malicious code in @wizloft/harness-plugin-memory-context (npm) (malicious package) - [MAL-2026-16430](https://insights.sbomify.com/MAL-2026-16430/): Malicious code in @wizloft/harness-plugin-file-memory (npm) (malicious package) - [MAL-2026-1643](https://insights.sbomify.com/MAL-2026-1643/): Malicious code in @vampirchik147/libxmljs2 (npm) (malicious package) - [MAL-2026-16429](https://insights.sbomify.com/MAL-2026-16429/): Malicious code in @wizloft/harness-plugin-file-events (npm) (malicious package) - [MAL-2026-16428](https://insights.sbomify.com/MAL-2026-16428/): Malicious code in @wizloft/harness-memory (npm) (malicious package) - [MAL-2026-16427](https://insights.sbomify.com/MAL-2026-16427/): Malicious code in @wizloft/harness-file-providers (npm) (malicious package) - [MAL-2026-16426](https://insights.sbomify.com/MAL-2026-16426/): Malicious code in @wizloft/harness-evidence (npm) (malicious package) - [MAL-2026-16425](https://insights.sbomify.com/MAL-2026-16425/): Malicious code in @wizloft/harness-commands (npm) (malicious package) - [MAL-2026-16424](https://insights.sbomify.com/MAL-2026-16424/): Malicious code in @wizloft/harness-cli-adapter (npm) (malicious package) - [MAL-2026-16423](https://insights.sbomify.com/MAL-2026-16423/): Malicious code in @wizloft/harness-authority (npm) (malicious package) - [MAL-2026-16422](https://insights.sbomify.com/MAL-2026-16422/): Malicious code in @httttt/mcp-npx-fetch-1 (npm) (malicious package) - [MAL-2026-16421](https://insights.sbomify.com/MAL-2026-16421/): Malicious code in kerokwis (PyPI) (malicious package) - [MAL-2026-16420](https://insights.sbomify.com/MAL-2026-16420/): Malicious code in kerokwis (RubyGems) (malicious package) - [MAL-2026-1642](https://insights.sbomify.com/MAL-2026-1642/): Malicious code in @upstashed/context7-mcp (npm) (malicious package) - [MAL-2026-16419](https://insights.sbomify.com/MAL-2026-16419/): Malicious code in @gsutevil/hta-stage (npm) (malicious package) - [MAL-2026-16418](https://insights.sbomify.com/MAL-2026-16418/): Malicious code in n8n-nodes-data-transformer-utils (npm) (malicious package) - [MAL-2026-16417](https://insights.sbomify.com/MAL-2026-16417/): Malicious code in eslint-config-compact-utils (npm) (malicious package) - [MAL-2026-16416](https://insights.sbomify.com/MAL-2026-16416/): Malicious code in @tvg-mar/utils (npm) (malicious package) - [MAL-2026-16415](https://insights.sbomify.com/MAL-2026-16415/): Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm) (malicious package) - [MAL-2026-16414](https://insights.sbomify.com/MAL-2026-16414/): Malicious code in @tvg-mar/storyblok-bridge (npm) (malicious package) - [MAL-2026-16413](https://insights.sbomify.com/MAL-2026-16413/): Malicious code in @tvg-mar/promos-gtm (npm) (malicious package) - [MAL-2026-16412](https://insights.sbomify.com/MAL-2026-16412/): Malicious code in @tvg-mar/promos-context (npm) (malicious package) - [MAL-2026-16411](https://insights.sbomify.com/MAL-2026-16411/): Malicious code in no-fun (RubyGems) (malicious package) - [MAL-2026-16410](https://insights.sbomify.com/MAL-2026-16410/): Malicious code in auclean (PyPI) (malicious package) - [MAL-2026-1641](https://insights.sbomify.com/MAL-2026-1641/): Malicious code in @uc-platform/user-service-client-ts (npm) (malicious package) - [MAL-2026-16409](https://insights.sbomify.com/MAL-2026-16409/): Malicious code in ubiquiti-agents-link-mcp (npm) (malicious package) - [MAL-2026-16408](https://insights.sbomify.com/MAL-2026-16408/): Malicious code in snap-queue (PyPI) (malicious package) - [MAL-2026-16407](https://insights.sbomify.com/MAL-2026-16407/): Malicious code in poly-check-b (PyPI) (malicious package) - [MAL-2026-16406](https://insights.sbomify.com/MAL-2026-16406/): Malicious code in crypto-trader-py (PyPI) (malicious package) - [MAL-2026-16405](https://insights.sbomify.com/MAL-2026-16405/): Malicious code in tailwind-form-styles (npm) (malicious package) - [MAL-2026-16404](https://insights.sbomify.com/MAL-2026-16404/): Malicious code in sysverify (npm) (malicious package) - [MAL-2026-16403](https://insights.sbomify.com/MAL-2026-16403/): Malicious code in node-env-buffer (npm) (malicious package) - [MAL-2026-16402](https://insights.sbomify.com/MAL-2026-16402/): Malicious code in ndmcmsujey (npm) (malicious package) - [MAL-2026-16401](https://insights.sbomify.com/MAL-2026-16401/): Malicious code in ndmckauxuoincv (npm) (malicious package) - [MAL-2026-16400](https://insights.sbomify.com/MAL-2026-16400/): Malicious code in ndmcjcxiebysfdb (npm) (malicious package) - [MAL-2026-1640](https://insights.sbomify.com/MAL-2026-1640/): Malicious code in @uc-platform/auth (npm) (malicious package) - [MAL-2026-164](https://insights.sbomify.com/MAL-2026-164/): Malicious code in @kyriba/data-frontend (npm) (malicious package) - [MAL-2026-16399](https://insights.sbomify.com/MAL-2026-16399/): Malicious code in lufxchwmxwyps (npm) (malicious package) - [MAL-2026-16398](https://insights.sbomify.com/MAL-2026-16398/): Malicious code in luftmvfiwgxydes (npm) (malicious package) - [MAL-2026-16397](https://insights.sbomify.com/MAL-2026-16397/): Malicious code in kambxjowhdsgyw (npm) (malicious package) - [MAL-2026-16396](https://insights.sbomify.com/MAL-2026-16396/): Malicious code in fdhcxvnwhjiofv (npm) (malicious package) - [MAL-2026-16395](https://insights.sbomify.com/MAL-2026-16395/): Malicious code in envparse3 (npm) (malicious package) - [MAL-2026-16394](https://insights.sbomify.com/MAL-2026-16394/): Malicious code in envparse2 (npm) (malicious package) - [MAL-2026-16393](https://insights.sbomify.com/MAL-2026-16393/): Malicious code in envforge3 (npm) (malicious package) - [MAL-2026-16392](https://insights.sbomify.com/MAL-2026-16392/): Malicious code in envforge2 (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/120/