# Vulnerabilities published in 2026 - [MAL-2026-16300](https://insights.sbomify.com/MAL-2026-16300/): Malicious code in @baanx/solana-lib (npm) (malicious package) - [MAL-2026-1630](https://insights.sbomify.com/MAL-2026-1630/): Malicious code in @measures/responsive (npm) (malicious package) - [MAL-2026-163](https://insights.sbomify.com/MAL-2026-163/): Malicious code in do-not-install-this-package-002 (PyPI) (malicious package) - [MAL-2026-16299](https://insights.sbomify.com/MAL-2026-16299/): Malicious code in @pwaplatform/module-sso-integration (npm) (malicious package) - [MAL-2026-16298](https://insights.sbomify.com/MAL-2026-16298/): Malicious code in urc (PyPI) (malicious package) - [MAL-2026-16297](https://insights.sbomify.com/MAL-2026-16297/): Malicious code in keroeltop (npm) (malicious package) - [MAL-2026-16296](https://insights.sbomify.com/MAL-2026-16296/): Malicious code in py-venv-doctor (PyPI) (malicious package) - [MAL-2026-16295](https://insights.sbomify.com/MAL-2026-16295/): Malicious code in tailwindcss-forms-ui (npm) (malicious package) - [MAL-2026-16294](https://insights.sbomify.com/MAL-2026-16294/): Malicious code in internallib_v949 (npm) (malicious package) - [MAL-2026-16293](https://insights.sbomify.com/MAL-2026-16293/): Malicious code in chai-as-indexed (npm) (malicious package) - [MAL-2026-16292](https://insights.sbomify.com/MAL-2026-16292/): Malicious code in @shared-web/utils (npm) (malicious package) - [MAL-2026-16291](https://insights.sbomify.com/MAL-2026-16291/): Malicious code in @shared-runtime/modules (npm) (malicious package) - [MAL-2026-16290](https://insights.sbomify.com/MAL-2026-16290/): Malicious code in @insiderintelligence/googleadmanager (npm) (malicious package) - [MAL-2026-1629](https://insights.sbomify.com/MAL-2026-1629/): Malicious code in @legacy-utils/core (npm) (malicious package) - [MAL-2026-16289](https://insights.sbomify.com/MAL-2026-16289/): Malicious code in test890-auth (npm) (malicious package) - [MAL-2026-16288](https://insights.sbomify.com/MAL-2026-16288/): Malicious code in test89-auth (npm) (malicious package) - [MAL-2026-16287](https://insights.sbomify.com/MAL-2026-16287/): Malicious code in openmct-heatmap (npm) (malicious package) - [MAL-2026-16286](https://insights.sbomify.com/MAL-2026-16286/): Malicious code in test8999-auth (npm) (malicious package) - [MAL-2026-16285](https://insights.sbomify.com/MAL-2026-16285/): Malicious code in test899-auth (npm) (malicious package) - [MAL-2026-16284](https://insights.sbomify.com/MAL-2026-16284/): Malicious code in sinful (npm) (malicious package) - [MAL-2026-16283](https://insights.sbomify.com/MAL-2026-16283/): Malicious code in @shared-web/assets (npm) (malicious package) - [MAL-2026-16282](https://insights.sbomify.com/MAL-2026-16282/): Malicious code in tailwindcss-form (npm) (malicious package) - [MAL-2026-16281](https://insights.sbomify.com/MAL-2026-16281/): Malicious code in @sanzoffc/baileys (npm) (malicious package) - [MAL-2026-16280](https://insights.sbomify.com/MAL-2026-16280/): Malicious code in zero-baileys (npm) (malicious package) - [MAL-2026-1628](https://insights.sbomify.com/MAL-2026-1628/): Malicious code in @legacy-ui/core (npm) (malicious package) - [MAL-2026-16279](https://insights.sbomify.com/MAL-2026-16279/): Malicious code in xzvbailsx (npm) (malicious package) - [MAL-2026-16278](https://insights.sbomify.com/MAL-2026-16278/): Malicious code in xzvbailey (npm) (malicious package) - [MAL-2026-16277](https://insights.sbomify.com/MAL-2026-16277/): Malicious code in xa424234657567 (npm) (malicious package) - [MAL-2026-16276](https://insights.sbomify.com/MAL-2026-16276/): Malicious code in @lekzo/baileys (npm) (malicious package) - [MAL-2026-16275](https://insights.sbomify.com/MAL-2026-16275/): Malicious code in requests-triwes (PyPI) (malicious package) - [MAL-2026-16274](https://insights.sbomify.com/MAL-2026-16274/): Malicious code in requests-auroras (PyPI) (malicious package) - [MAL-2026-16273](https://insights.sbomify.com/MAL-2026-16273/): Malicious code in blue-string-formatter-utils (npm) (malicious package) - [MAL-2026-16272](https://insights.sbomify.com/MAL-2026-16272/): Malicious code in kartykgithub-multiversion-a (npm) (malicious package) - [MAL-2026-16271](https://insights.sbomify.com/MAL-2026-16271/): Malicious code in test89078-auth (npm) (malicious package) - [MAL-2026-16270](https://insights.sbomify.com/MAL-2026-16270/): Malicious code in @tink/tink-link-core (npm) (malicious package) - [MAL-2026-1627](https://insights.sbomify.com/MAL-2026-1627/): Malicious code in @legacy-components/core (npm) (malicious package) - [MAL-2026-16269](https://insights.sbomify.com/MAL-2026-16269/): Malicious code in requests-asetwe (PyPI) (malicious package) - [MAL-2026-16268](https://insights.sbomify.com/MAL-2026-16268/): Malicious code in index-forum (PyPI) (malicious package) - [MAL-2026-16267](https://insights.sbomify.com/MAL-2026-16267/): Malicious code in pyjstat-smooth (PyPI) (malicious package) - [MAL-2026-16266](https://insights.sbomify.com/MAL-2026-16266/): Malicious code in @kartyk-github-org/takedown-b (npm) (malicious package) - [MAL-2026-16265](https://insights.sbomify.com/MAL-2026-16265/): Malicious code in @kartyk-github-org/takedown-a (npm) (malicious package) - [MAL-2026-16264](https://insights.sbomify.com/MAL-2026-16264/): Malicious code in aiosendletter (PyPI) (malicious package) - [MAL-2026-16263](https://insights.sbomify.com/MAL-2026-16263/): Malicious code in tailwindcss-form-utils (npm) (malicious package) - [MAL-2026-16262](https://insights.sbomify.com/MAL-2026-16262/): Malicious code in tailwindcss-form-ui (npm) (malicious package) - [MAL-2026-16261](https://insights.sbomify.com/MAL-2026-16261/): Malicious code in @railone/image-utils (npm) (malicious package) - [MAL-2026-16260](https://insights.sbomify.com/MAL-2026-16260/): Malicious code in confx1789550882 (npm) (malicious package) - [MAL-2026-1626](https://insights.sbomify.com/MAL-2026-1626/): Malicious code in @kui-react/table (npm) (malicious package) - [MAL-2026-16259](https://insights.sbomify.com/MAL-2026-16259/): Malicious code in randompkge (npm) (malicious package) - [MAL-2026-16258](https://insights.sbomify.com/MAL-2026-16258/): Malicious code in randompkgd (npm) (malicious package) - [MAL-2026-16257](https://insights.sbomify.com/MAL-2026-16257/): Malicious code in randompkgc (npm) (malicious package) - [MAL-2026-16256](https://insights.sbomify.com/MAL-2026-16256/): Malicious code in randompkgb (npm) (malicious package) - [MAL-2026-16255](https://insights.sbomify.com/MAL-2026-16255/): Malicious code in randompkga (npm) (malicious package) - [MAL-2026-16254](https://insights.sbomify.com/MAL-2026-16254/): Malicious code in pulse-pwn-9f3a2 (npm) (malicious package) - [MAL-2026-16253](https://insights.sbomify.com/MAL-2026-16253/): Malicious code in laycot (npm) (malicious package) - [MAL-2026-16252](https://insights.sbomify.com/MAL-2026-16252/): Malicious code in ragacateslikodi (npm) (malicious package) - [MAL-2026-16251](https://insights.sbomify.com/MAL-2026-16251/): Malicious code in tailwindcss-contact-form (npm) (malicious package) - [MAL-2026-16250](https://insights.sbomify.com/MAL-2026-16250/): Malicious code in marketing-mcp (PyPI) (malicious package) - [MAL-2026-1625](https://insights.sbomify.com/MAL-2026-1625/): Malicious code in @kui-react/button (npm) (malicious package) - [MAL-2026-16249](https://insights.sbomify.com/MAL-2026-16249/): Malicious code in kartykgithub-takedown-b (npm) (malicious package) - [MAL-2026-16248](https://insights.sbomify.com/MAL-2026-16248/): Malicious code in kartykgithub-takedown-a (npm) (malicious package) - [MAL-2026-16247](https://insights.sbomify.com/MAL-2026-16247/): Malicious code in pkg-rollback-dreed-viced-sonic-ponds (npm) (malicious package) - [MAL-2026-16246](https://insights.sbomify.com/MAL-2026-16246/): Malicious code in kartyk-github-token-pkg (npm) (malicious package) - [MAL-2026-16245](https://insights.sbomify.com/MAL-2026-16245/): Malicious code in kartyk-github-single-ver-pkg (npm) (malicious package) - [MAL-2026-16244](https://insights.sbomify.com/MAL-2026-16244/): Malicious code in kartyk-github-oidc-test-pkg (npm) (malicious package) - [MAL-2026-16243](https://insights.sbomify.com/MAL-2026-16243/): Malicious code in idx_form_script (npm) (malicious package) - [MAL-2026-16242](https://insights.sbomify.com/MAL-2026-16242/): Malicious code in trongappy (PyPI) (malicious package) - [MAL-2026-16241](https://insights.sbomify.com/MAL-2026-16241/): Malicious code in rak-lab-yoav-orca-zrktd2cp5hjmo4x7 (PyPI) (malicious package) - [MAL-2026-16240](https://insights.sbomify.com/MAL-2026-16240/): Malicious code in praetorian-mind-rce-test-2026 (PyPI) (malicious package) - [MAL-2026-1624](https://insights.sbomify.com/MAL-2026-1624/): Malicious code in @inter-ikea-gallery/integration (npm) (malicious package) - [MAL-2026-16239](https://insights.sbomify.com/MAL-2026-16239/): Malicious code in strapi-plugin-pysh-meeb (npm) (malicious package) - [MAL-2026-16238](https://insights.sbomify.com/MAL-2026-16238/): Malicious code in strapi-plugin-portcc-meeb (npm) (malicious package) - [MAL-2026-16237](https://insights.sbomify.com/MAL-2026-16237/): Malicious code in strapi-plugin-persh-meeb (npm) (malicious package) - [MAL-2026-16236](https://insights.sbomify.com/MAL-2026-16236/): Malicious code in strapi-plugin-perev-meeb (npm) (malicious package) - [MAL-2026-16235](https://insights.sbomify.com/MAL-2026-16235/): Malicious code in strapi-plugin-osag (npm) (malicious package) - [MAL-2026-16234](https://insights.sbomify.com/MAL-2026-16234/): Malicious code in strapi-plugin-os-rec (npm) (malicious package) - [MAL-2026-16233](https://insights.sbomify.com/MAL-2026-16233/): Malicious code in strapi-plugin-maylog-meeb (npm) (malicious package) - [MAL-2026-16232](https://insights.sbomify.com/MAL-2026-16232/): Malicious code in strapi-plugin-listcc-meeb (npm) (malicious package) - [MAL-2026-16231](https://insights.sbomify.com/MAL-2026-16231/): Malicious code in strapi-plugin-honey-meeb (npm) (malicious package) - [MAL-2026-16230](https://insights.sbomify.com/MAL-2026-16230/): Malicious code in strapi-plugin-feedmeeb (npm) (malicious package) - [MAL-2026-1623](https://insights.sbomify.com/MAL-2026-1623/): Malicious code in @f5rest/odata-v4-service-metadata (npm) (malicious package) - [MAL-2026-16229](https://insights.sbomify.com/MAL-2026-16229/): Malicious code in strapi-plugin-conresh-meeb (npm) (malicious package) - [MAL-2026-16228](https://insights.sbomify.com/MAL-2026-16228/): Malicious code in strapi-plugin-ccrev-meeb (npm) (malicious package) - [MAL-2026-16227](https://insights.sbomify.com/MAL-2026-16227/): Malicious code in strapi-plugin-ccrec-meeb (npm) (malicious package) - [MAL-2026-16226](https://insights.sbomify.com/MAL-2026-16226/): Malicious code in strapi-plugin-ccip-meeb (npm) (malicious package) - [MAL-2026-16225](https://insights.sbomify.com/MAL-2026-16225/): Malicious code in strapi-plugin-cccon-meeb (npm) (malicious package) - [MAL-2026-16224](https://insights.sbomify.com/MAL-2026-16224/): Malicious code in process-mite (npm) (malicious package) - [MAL-2026-16223](https://insights.sbomify.com/MAL-2026-16223/): Malicious code in @traktis/environment (npm) (malicious package) - [MAL-2026-16222](https://insights.sbomify.com/MAL-2026-16222/): Malicious code in @traktis/core (npm) (malicious package) - [MAL-2026-16221](https://insights.sbomify.com/MAL-2026-16221/): Malicious code in bender-rspack-config (npm) (malicious package) - [MAL-2026-16220](https://insights.sbomify.com/MAL-2026-16220/): Malicious code in jexkcode (npm) (malicious package) - [MAL-2026-1622](https://insights.sbomify.com/MAL-2026-1622/): Malicious code in @f5rest/odata-v4-server (npm) (malicious package) - [MAL-2026-16219](https://insights.sbomify.com/MAL-2026-16219/): Malicious code in licloud (PyPI) (malicious package) - [MAL-2026-16218](https://insights.sbomify.com/MAL-2026-16218/): Malicious code in tol8t (npm) (malicious package) - [MAL-2026-16217](https://insights.sbomify.com/MAL-2026-16217/): Malicious code in tetotest (npm) (malicious package) - [MAL-2026-16216](https://insights.sbomify.com/MAL-2026-16216/): Malicious code in tetomood (npm) (malicious package) - [MAL-2026-16215](https://insights.sbomify.com/MAL-2026-16215/): Malicious code in engin1 (npm) (malicious package) - [MAL-2026-16214](https://insights.sbomify.com/MAL-2026-16214/): Malicious code in discord-resolvers (npm) (malicious package) - [MAL-2026-16213](https://insights.sbomify.com/MAL-2026-16213/): Malicious code in discord-players (npm) (malicious package) - [MAL-2026-16212](https://insights.sbomify.com/MAL-2026-16212/): Malicious code in cli-anything-ai-market (PyPI) (malicious package) - [MAL-2026-16211](https://insights.sbomify.com/MAL-2026-16211/): Malicious code in swnwall (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/122/