# Vulnerabilities published in 2026 - [MAL-2026-16391](https://insights.sbomify.com/MAL-2026-16391/): Malicious code in cloudndmcedu (npm) (malicious package) - [MAL-2026-16390](https://insights.sbomify.com/MAL-2026-16390/): Malicious code in oracle-redis (npm) (malicious package) - [MAL-2026-1639](https://insights.sbomify.com/MAL-2026-1639/): Malicious code in @uc-platform/advertisement-service-client (npm) (malicious package) - [MAL-2026-16389](https://insights.sbomify.com/MAL-2026-16389/): Malicious code in noverojava (npm) (malicious package) - [MAL-2026-16388](https://insights.sbomify.com/MAL-2026-16388/): Malicious code in nodetokyo (npm) (malicious package) - [MAL-2026-16387](https://insights.sbomify.com/MAL-2026-16387/): Malicious code in @mr-supun-fernando/supunmd-bail (npm) (malicious package) - [MAL-2026-16386](https://insights.sbomify.com/MAL-2026-16386/): Malicious code in @mikudeveloper/baileys (npm) (malicious package) - [MAL-2026-16385](https://insights.sbomify.com/MAL-2026-16385/): Malicious code in tlxbnhd (npm) (malicious package) - [MAL-2026-16384](https://insights.sbomify.com/MAL-2026-16384/): Malicious code in tldriver (npm) (malicious package) - [MAL-2026-16383](https://insights.sbomify.com/MAL-2026-16383/): Malicious code in mxdriver (npm) (malicious package) - [MAL-2026-16382](https://insights.sbomify.com/MAL-2026-16382/): Malicious code in take-home-caller-id (npm) (malicious package) - [MAL-2026-16381](https://insights.sbomify.com/MAL-2026-16381/): Malicious code in cisco-github-simple (npm) (malicious package) - [MAL-2026-16380](https://insights.sbomify.com/MAL-2026-16380/): Malicious code in chai-logger (npm) (malicious package) - [MAL-2026-1638](https://insights.sbomify.com/MAL-2026-1638/): Malicious code in @tl-icons/core (npm) (malicious package) - [MAL-2026-16379](https://insights.sbomify.com/MAL-2026-16379/): Malicious code in @user-services/web-components (npm) (malicious package) - [MAL-2026-16378](https://insights.sbomify.com/MAL-2026-16378/): Malicious code in @tesla-insurance/vinless-quote (npm) (malicious package) - [MAL-2026-16377](https://insights.sbomify.com/MAL-2026-16377/): Malicious code in cloushaar-poc-exfil-91827 (PyPI) (malicious package) - [MAL-2026-16376](https://insights.sbomify.com/MAL-2026-16376/): Malicious code in test-react-app-way (npm) (malicious package) - [MAL-2026-16375](https://insights.sbomify.com/MAL-2026-16375/): Malicious code in test-react-app-out (npm) (malicious package) - [MAL-2026-16374](https://insights.sbomify.com/MAL-2026-16374/): Malicious code in test-react-app-in (npm) (malicious package) - [MAL-2026-16373](https://insights.sbomify.com/MAL-2026-16373/): Malicious code in wos-library (npm) (malicious package) - [MAL-2026-16372](https://insights.sbomify.com/MAL-2026-16372/): Malicious code in @zig-design-system/react (npm) (malicious package) - [MAL-2026-16371](https://insights.sbomify.com/MAL-2026-16371/): Malicious code in @vite-tab/tabui (npm) (malicious package) - [MAL-2026-16370](https://insights.sbomify.com/MAL-2026-16370/): Malicious code in @uol-afiliados/affiliated-config-lib (npm) (malicious package) - [MAL-2026-1637](https://insights.sbomify.com/MAL-2026-1637/): Malicious code in @spot-dapp/web (npm) (malicious package) - [MAL-2026-16369](https://insights.sbomify.com/MAL-2026-16369/): Malicious code in mathsbase (npm) (malicious package) - [MAL-2026-16368](https://insights.sbomify.com/MAL-2026-16368/): Malicious code in mathmain (npm) (malicious package) - [MAL-2026-16367](https://insights.sbomify.com/MAL-2026-16367/): Malicious code in math-universe (npm) (malicious package) - [MAL-2026-16366](https://insights.sbomify.com/MAL-2026-16366/): Malicious code in pullgetsage (PyPI) (malicious package) - [MAL-2026-16365](https://insights.sbomify.com/MAL-2026-16365/): Malicious code in my-ctf-helper-script-9921 (npm) (malicious package) - [MAL-2026-16364](https://insights.sbomify.com/MAL-2026-16364/): Malicious code in bytepack-probe-a7x3 (npm) (malicious package) - [MAL-2026-16363](https://insights.sbomify.com/MAL-2026-16363/): Malicious code in blue-string-formatter-utilss (npm) (malicious package) - [MAL-2026-16362](https://insights.sbomify.com/MAL-2026-16362/): Malicious code in @uh-platform/webcard (npm) (malicious package) - [MAL-2026-16361](https://insights.sbomify.com/MAL-2026-16361/): Malicious code in @uh-platform/nadaver2 (npm) (malicious package) - [MAL-2026-16360](https://insights.sbomify.com/MAL-2026-16360/): Malicious code in @uh-platform/nadaver (npm) (malicious package) - [MAL-2026-1636](https://insights.sbomify.com/MAL-2026-1636/): Malicious code in @sommos/create-leaverule-or-terminationrule-form-data (npm) (malicious package) - [MAL-2026-16359](https://insights.sbomify.com/MAL-2026-16359/): Malicious code in @uh-platform/domain-widget (npm) (malicious package) - [MAL-2026-16358](https://insights.sbomify.com/MAL-2026-16358/): Malicious code in @uh-platform/cloud (npm) (malicious package) - [MAL-2026-16357](https://insights.sbomify.com/MAL-2026-16357/): Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm) (malicious package) - [MAL-2026-16356](https://insights.sbomify.com/MAL-2026-16356/): Malicious code in starlette-healthchecks (PyPI) (malicious package) - [MAL-2026-16355](https://insights.sbomify.com/MAL-2026-16355/): Malicious code in gemini-computer-use (npm) (malicious package) - [MAL-2026-16354](https://insights.sbomify.com/MAL-2026-16354/): Malicious code in @woodpecker-web-shared/components (npm) (malicious package) - [MAL-2026-16353](https://insights.sbomify.com/MAL-2026-16353/): Malicious code in @insiderintelligence/componentlibrary (npm) (malicious package) - [MAL-2026-16352](https://insights.sbomify.com/MAL-2026-16352/): Malicious code in @baanx/blockchain-config (npm) (malicious package) - [MAL-2026-16351](https://insights.sbomify.com/MAL-2026-16351/): Malicious code in @baanx/abis (npm) (malicious package) - [MAL-2026-16350](https://insights.sbomify.com/MAL-2026-16350/): Malicious code in bnppf-flag-icons (npm) (malicious package) - [MAL-2026-1635](https://insights.sbomify.com/MAL-2026-1635/): Malicious code in @polymarket-developers/clob-client (npm) (malicious package) - [MAL-2026-16349](https://insights.sbomify.com/MAL-2026-16349/): Malicious code in hardhat-devkit (npm) (malicious package) - [MAL-2026-16348](https://insights.sbomify.com/MAL-2026-16348/): Malicious code in hardhat-base (npm) (malicious package) - [MAL-2026-16347](https://insights.sbomify.com/MAL-2026-16347/): Malicious code in radio-player-theme (npm) (malicious package) - [MAL-2026-16346](https://insights.sbomify.com/MAL-2026-16346/): Malicious code in rrs (PyPI) (malicious package) - [MAL-2026-16345](https://insights.sbomify.com/MAL-2026-16345/): Malicious code in starbucks-sdk (npm) (malicious package) - [MAL-2026-16344](https://insights.sbomify.com/MAL-2026-16344/): Malicious code in sorrawit-dev-helper (npm) (malicious package) - [MAL-2026-16343](https://insights.sbomify.com/MAL-2026-16343/): Malicious code in siriusbeyond (npm) (malicious package) - [MAL-2026-16342](https://insights.sbomify.com/MAL-2026-16342/): Malicious code in pflag29424 (npm) (malicious package) - [MAL-2026-16341](https://insights.sbomify.com/MAL-2026-16341/): Malicious code in pflag14570 (npm) (malicious package) - [MAL-2026-16340](https://insights.sbomify.com/MAL-2026-16340/): Malicious code in pf25262 (npm) (malicious package) - [MAL-2026-1634](https://insights.sbomify.com/MAL-2026-1634/): Malicious code in @panopto/api-core (npm) (malicious package) - [MAL-2026-16339](https://insights.sbomify.com/MAL-2026-16339/): Malicious code in pf25133 (npm) (malicious package) - [MAL-2026-16338](https://insights.sbomify.com/MAL-2026-16338/): Malicious code in pf23727 (npm) (malicious package) - [MAL-2026-16337](https://insights.sbomify.com/MAL-2026-16337/): Malicious code in my-cdn-script (npm) (malicious package) - [MAL-2026-16336](https://insights.sbomify.com/MAL-2026-16336/): Malicious code in keroeltopkkk (npm) (malicious package) - [MAL-2026-16335](https://insights.sbomify.com/MAL-2026-16335/): Malicious code in keroeltopkk (npm) (malicious package) - [MAL-2026-16334](https://insights.sbomify.com/MAL-2026-16334/): Malicious code in keroeltopgg (npm) (malicious package) - [MAL-2026-16333](https://insights.sbomify.com/MAL-2026-16333/): Malicious code in homestack-cheer (npm) (malicious package) - [MAL-2026-16332](https://insights.sbomify.com/MAL-2026-16332/): Malicious code in feed-widget-helper (npm) (malicious package) - [MAL-2026-16331](https://insights.sbomify.com/MAL-2026-16331/): Malicious code in element-plus-vite-cli (npm) (malicious package) - [MAL-2026-16330](https://insights.sbomify.com/MAL-2026-16330/): Malicious code in commerce-materials (npm) (malicious package) - [MAL-2026-1633](https://insights.sbomify.com/MAL-2026-1633/): Malicious code in @nxt-costco-com/forge-icons (npm) (malicious package) - [MAL-2026-16329](https://insights.sbomify.com/MAL-2026-16329/): Malicious code in chai-as-viem (npm) (malicious package) - [MAL-2026-16328](https://insights.sbomify.com/MAL-2026-16328/): Malicious code in catwrestlinghuman (npm) (malicious package) - [MAL-2026-16327](https://insights.sbomify.com/MAL-2026-16327/): Malicious code in catwrestlingbird (npm) (malicious package) - [MAL-2026-16326](https://insights.sbomify.com/MAL-2026-16326/): Malicious code in byted-commerce-materials (npm) (malicious package) - [MAL-2026-16325](https://insights.sbomify.com/MAL-2026-16325/): Malicious code in bulk-add-sdk (npm) (malicious package) - [MAL-2026-16324](https://insights.sbomify.com/MAL-2026-16324/): Malicious code in better-envforge (npm) (malicious package) - [MAL-2026-16323](https://insights.sbomify.com/MAL-2026-16323/): Malicious code in action-slack-message-root (npm) (malicious package) - [MAL-2026-16322](https://insights.sbomify.com/MAL-2026-16322/): Malicious code in @siriusbeyond/utils (npm) (malicious package) - [MAL-2026-16321](https://insights.sbomify.com/MAL-2026-16321/): Malicious code in @siriusbeyond/ui (npm) (malicious package) - [MAL-2026-16320](https://insights.sbomify.com/MAL-2026-16320/): Malicious code in @siriusbeyond/auth (npm) (malicious package) - [MAL-2026-1632](https://insights.sbomify.com/MAL-2026-1632/): Malicious code in @nxt-costco-com/forge-design-tokens (npm) (malicious package) - [MAL-2026-16319](https://insights.sbomify.com/MAL-2026-16319/): Malicious code in @dbbhk/ui-components (npm) (malicious package) - [MAL-2026-16318](https://insights.sbomify.com/MAL-2026-16318/): Malicious code in @asenfotech/unplugin-element-plus (npm) (malicious package) - [MAL-2026-16317](https://insights.sbomify.com/MAL-2026-16317/): Malicious code in testmgkregme (npm) (malicious package) - [MAL-2026-16316](https://insights.sbomify.com/MAL-2026-16316/): Malicious code in test1sdsd2 (npm) (malicious package) - [MAL-2026-16315](https://insights.sbomify.com/MAL-2026-16315/): Malicious code in test1ro (npm) (malicious package) - [MAL-2026-16314](https://insights.sbomify.com/MAL-2026-16314/): Malicious code in test1hh235 (npm) (malicious package) - [MAL-2026-16313](https://insights.sbomify.com/MAL-2026-16313/): Malicious code in test1gg234 (npm) (malicious package) - [MAL-2026-16312](https://insights.sbomify.com/MAL-2026-16312/): Malicious code in test1df23 (npm) (malicious package) - [MAL-2026-16311](https://insights.sbomify.com/MAL-2026-16311/): Malicious code in test12vv36 (npm) (malicious package) - [MAL-2026-16310](https://insights.sbomify.com/MAL-2026-16310/): Malicious code in npx-test-ma980 (npm) (malicious package) - [MAL-2026-1631](https://insights.sbomify.com/MAL-2026-1631/): Malicious code in @nxt-costco-com/forge-components (npm) (malicious package) - [MAL-2026-16309](https://insights.sbomify.com/MAL-2026-16309/): Malicious code in npmscript_tesstalert_unpkg (npm) (malicious package) - [MAL-2026-16308](https://insights.sbomify.com/MAL-2026-16308/): Malicious code in chat-adapter-matrix (npm) (malicious package) - [MAL-2026-16307](https://insights.sbomify.com/MAL-2026-16307/): Malicious code in chai-testing (npm) (malicious package) - [MAL-2026-16306](https://insights.sbomify.com/MAL-2026-16306/): Malicious code in @nimbusedge2/xa (npm) (malicious package) - [MAL-2026-16305](https://insights.sbomify.com/MAL-2026-16305/): Malicious code in @nimbusedge2/x (npm) (malicious package) - [MAL-2026-16304](https://insights.sbomify.com/MAL-2026-16304/): Malicious code in @nimbusedge2/authxsas1 (npm) (malicious package) - [MAL-2026-16303](https://insights.sbomify.com/MAL-2026-16303/): Malicious code in @nimbusedge2/authxsas (npm) (malicious package) - [MAL-2026-16302](https://insights.sbomify.com/MAL-2026-16302/): Malicious code in @nimbusedge2/auth (npm) (malicious package) - [MAL-2026-16301](https://insights.sbomify.com/MAL-2026-16301/): Malicious code in @nimbsuedge3/xar (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/121/