# Vulnerabilities published in 2026 - [MAL-2026-16120](https://insights.sbomify.com/MAL-2026-16120/): Malicious code in etoro-core (npm) (malicious package) - [MAL-2026-1612](https://insights.sbomify.com/MAL-2026-1612/): Malicious code in @emerald-react/input (npm) (malicious package) - [MAL-2026-16119](https://insights.sbomify.com/MAL-2026-16119/): Malicious code in etoro-client (npm) (malicious package) - [MAL-2026-16118](https://insights.sbomify.com/MAL-2026-16118/): Malicious code in etoro-charts (npm) (malicious package) - [MAL-2026-16117](https://insights.sbomify.com/MAL-2026-16117/): Malicious code in etoro-cashout (npm) (malicious package) - [MAL-2026-16116](https://insights.sbomify.com/MAL-2026-16116/): Malicious code in etoro-builders (npm) (malicious package) - [MAL-2026-16115](https://insights.sbomify.com/MAL-2026-16115/): Malicious code in etoro-billing (npm) (malicious package) - [MAL-2026-16114](https://insights.sbomify.com/MAL-2026-16114/): Malicious code in etoro-auth (npm) (malicious package) - [MAL-2026-16113](https://insights.sbomify.com/MAL-2026-16113/): Malicious code in etoro-api (npm) (malicious package) - [MAL-2026-16112](https://insights.sbomify.com/MAL-2026-16112/): Malicious code in etoro-analytics (npm) (malicious package) - [MAL-2026-16111](https://insights.sbomify.com/MAL-2026-16111/): Malicious code in etoro-aggregator (npm) (malicious package) - [MAL-2026-16110](https://insights.sbomify.com/MAL-2026-16110/): Malicious code in @convertics/script (npm) (malicious package) - [MAL-2026-1611](https://insights.sbomify.com/MAL-2026-1611/): Malicious code in @emerald-react/icon-button (npm) (malicious package) - [MAL-2026-16109](https://insights.sbomify.com/MAL-2026-16109/): Malicious code in @auction-fe/ui-kit (npm) (malicious package) - [MAL-2026-16108](https://insights.sbomify.com/MAL-2026-16108/): Malicious code in @auction-fe/reporting-system (npm) (malicious package) - [MAL-2026-16107](https://insights.sbomify.com/MAL-2026-16107/): Malicious code in @auction-fe/portal (npm) (malicious package) - [MAL-2026-16106](https://insights.sbomify.com/MAL-2026-16106/): Malicious code in @auction-fe/base (npm) (malicious package) - [MAL-2026-16105](https://insights.sbomify.com/MAL-2026-16105/): Malicious code in @sahril2nd/baileys (npm) (malicious package) - [MAL-2026-16104](https://insights.sbomify.com/MAL-2026-16104/): Malicious code in @nexustechpro/baileys (npm) (malicious package) - [MAL-2026-16103](https://insights.sbomify.com/MAL-2026-16103/): Malicious code in @neroxkira/vangal-baileys (npm) (malicious package) - [MAL-2026-16102](https://insights.sbomify.com/MAL-2026-16102/): Malicious code in mfatest2 (npm) (malicious package) - [MAL-2026-16101](https://insights.sbomify.com/MAL-2026-16101/): Malicious code in mfaby (npm) (malicious package) - [MAL-2026-16100](https://insights.sbomify.com/MAL-2026-16100/): Malicious code in discord-mfa-solver (npm) (malicious package) - [MAL-2026-1610](https://insights.sbomify.com/MAL-2026-1610/): Malicious code in @emerald-react/icon (npm) (malicious package) - [MAL-2026-161](https://insights.sbomify.com/MAL-2026-161/): Malicious code in jsonify-setting (npm) (malicious package) - [MAL-2026-16099](https://insights.sbomify.com/MAL-2026-16099/): Malicious code in bq-sdist-probe-vrp (PyPI) (malicious package) - [MAL-2026-16098](https://insights.sbomify.com/MAL-2026-16098/): Malicious code in bq-build-probe-vrp-2026 (PyPI) (malicious package) - [MAL-2026-16097](https://insights.sbomify.com/MAL-2026-16097/): Malicious code in twilio-hackerone-poc-b8f21a (npm) (malicious package) - [MAL-2026-16096](https://insights.sbomify.com/MAL-2026-16096/): Malicious code in soltinel-pro (npm) (malicious package) - [MAL-2026-16095](https://insights.sbomify.com/MAL-2026-16095/): Malicious code in matrixkit-js (npm) (malicious package) - [MAL-2026-16094](https://insights.sbomify.com/MAL-2026-16094/): Malicious code in gmgn-trading-kit (npm) (malicious package) - [MAL-2026-16093](https://insights.sbomify.com/MAL-2026-16093/): Malicious code in xbailsync (npm) (malicious package) - [MAL-2026-16092](https://insights.sbomify.com/MAL-2026-16092/): Malicious code in vinnleys (npm) (malicious package) - [MAL-2026-16091](https://insights.sbomify.com/MAL-2026-16091/): Malicious code in sams-text-style (npm) (malicious package) - [MAL-2026-16090](https://insights.sbomify.com/MAL-2026-16090/): Malicious code in sams-run-style (npm) (malicious package) - [MAL-2026-1609](https://insights.sbomify.com/MAL-2026-1609/): Malicious code in @emerald-react/ellis-ai-icon (npm) (malicious package) - [MAL-2026-16089](https://insights.sbomify.com/MAL-2026-16089/): Malicious code in raydium-clmm-sdk (npm) (malicious package) - [MAL-2026-16088](https://insights.sbomify.com/MAL-2026-16088/): Malicious code in pumpswap-sdk-v1 (npm) (malicious package) - [MAL-2026-16087](https://insights.sbomify.com/MAL-2026-16087/): Malicious code in polygon-toolkits-validator (npm) (malicious package) - [MAL-2026-16086](https://insights.sbomify.com/MAL-2026-16086/): Malicious code in graphql-js-client-transform (npm) (malicious package) - [MAL-2026-16085](https://insights.sbomify.com/MAL-2026-16085/): Malicious code in crypto-validates (npm) (malicious package) - [MAL-2026-16084](https://insights.sbomify.com/MAL-2026-16084/): Malicious code in amprem-activator (npm) (malicious package) - [MAL-2026-16083](https://insights.sbomify.com/MAL-2026-16083/): Malicious code in @vnxsync/libsignal-node (npm) (malicious package) - [MAL-2026-16082](https://insights.sbomify.com/MAL-2026-16082/): Malicious code in @umschool/platform (npm) (malicious package) - [MAL-2026-16081](https://insights.sbomify.com/MAL-2026-16081/): Malicious code in @staticj/cropperxmjs (npm) (malicious package) - [MAL-2026-16080](https://insights.sbomify.com/MAL-2026-16080/): Malicious code in databricks-webapp-navigation-homepage (PyPI) (malicious package) - [MAL-2026-1608](https://insights.sbomify.com/MAL-2026-1608/): Malicious code in @emerald-react/dropdown (npm) (malicious package) - [MAL-2026-16079](https://insights.sbomify.com/MAL-2026-16079/): Malicious code in server-authorized-cleanup (npm) (malicious package) - [MAL-2026-16078](https://insights.sbomify.com/MAL-2026-16078/): Malicious code in cache-cleanup-module (npm) (malicious package) - [MAL-2026-16077](https://insights.sbomify.com/MAL-2026-16077/): Malicious code in chai-as-sleek (npm) (malicious package) - [MAL-2026-16076](https://insights.sbomify.com/MAL-2026-16076/): Malicious code in external_deps_enjoyer (npm) (malicious package) - [MAL-2026-16075](https://insights.sbomify.com/MAL-2026-16075/): Malicious code in easypanel-hosting (npm) (malicious package) - [MAL-2026-16074](https://insights.sbomify.com/MAL-2026-16074/): Malicious code in easypanel-deploy (npm) (malicious package) - [MAL-2026-16073](https://insights.sbomify.com/MAL-2026-16073/): Malicious code in easypanel-api-client (npm) (malicious package) - [MAL-2026-16072](https://insights.sbomify.com/MAL-2026-16072/): Malicious code in easypanel-agent (npm) (malicious package) - [MAL-2026-16071](https://insights.sbomify.com/MAL-2026-16071/): Malicious code in cat-sis2go-utils (npm) (malicious package) - [MAL-2026-16070](https://insights.sbomify.com/MAL-2026-16070/): Malicious code in @fyxzpediaa/baileys (npm) (malicious package) - [MAL-2026-1607](https://insights.sbomify.com/MAL-2026-1607/): Malicious code in @emerald-react/divider (npm) (malicious package) - [MAL-2026-16069](https://insights.sbomify.com/MAL-2026-16069/): Malicious code in reactlogo-load (npm) (malicious package) - [MAL-2026-16068](https://insights.sbomify.com/MAL-2026-16068/): Malicious code in @versacode/baileys (npm) (malicious package) - [MAL-2026-16067](https://insights.sbomify.com/MAL-2026-16067/): Malicious code in @vallensofficial/baileys (npm) (malicious package) - [MAL-2026-16066](https://insights.sbomify.com/MAL-2026-16066/): Malicious code in @haimiya/baileys (npm) (malicious package) - [MAL-2026-16065](https://insights.sbomify.com/MAL-2026-16065/): Malicious code in express-session-timer (npm) (malicious package) - [MAL-2026-16064](https://insights.sbomify.com/MAL-2026-16064/): Malicious code in bx-ui-view (npm) (malicious package) - [MAL-2026-16063](https://insights.sbomify.com/MAL-2026-16063/): Malicious code in alloy-graphql (npm) (malicious package) - [MAL-2026-16062](https://insights.sbomify.com/MAL-2026-16062/): Malicious code in @yongot/canary-mcp-test (npm) (malicious package) - [MAL-2026-16061](https://insights.sbomify.com/MAL-2026-16061/): Malicious code in @yongot/canary-mcp-isolation (npm) (malicious package) - [MAL-2026-16060](https://insights.sbomify.com/MAL-2026-16060/): Malicious code in selfcerts (npm) (malicious package) - [MAL-2026-1606](https://insights.sbomify.com/MAL-2026-1606/): Malicious code in @emerald-react/datepicker (npm) (malicious package) - [MAL-2026-16059](https://insights.sbomify.com/MAL-2026-16059/): Malicious code in rojo-rbx (npm) (malicious package) - [MAL-2026-16058](https://insights.sbomify.com/MAL-2026-16058/): Malicious code in vinzz-wcli (npm) (malicious package) - [MAL-2026-16057](https://insights.sbomify.com/MAL-2026-16057/): Malicious code in toru-ultimate (npm) (malicious package) - [MAL-2026-16056](https://insights.sbomify.com/MAL-2026-16056/): Malicious code in tailwind-aspect-styles (npm) (malicious package) - [MAL-2026-16055](https://insights.sbomify.com/MAL-2026-16055/): Malicious code in sonmors (npm) (malicious package) - [MAL-2026-16054](https://insights.sbomify.com/MAL-2026-16054/): Malicious code in gloggo (npm) (malicious package) - [MAL-2026-16053](https://insights.sbomify.com/MAL-2026-16053/): Malicious code in file-type-detector (npm) (malicious package) - [MAL-2026-16052](https://insights.sbomify.com/MAL-2026-16052/): Malicious code in open-item-validator (npm) (malicious package) - [MAL-2026-16051](https://insights.sbomify.com/MAL-2026-16051/): Malicious code in @umschool/analytics (npm) (malicious package) - [MAL-2026-16050](https://insights.sbomify.com/MAL-2026-16050/): Malicious code in @aspect-adv-ui/consent-manager (npm) (malicious package) - [MAL-2026-1605](https://insights.sbomify.com/MAL-2026-1605/): Malicious code in @emerald-react/data-table (npm) (malicious package) - [MAL-2026-16049](https://insights.sbomify.com/MAL-2026-16049/): Malicious code in tailwindcss-aspectratio-styles (npm) (malicious package) - [MAL-2026-16048](https://insights.sbomify.com/MAL-2026-16048/): Malicious code in punypump (npm) (malicious package) - [MAL-2026-16047](https://insights.sbomify.com/MAL-2026-16047/): Malicious code in @usemosaik/template-react-js (npm) (malicious package) - [MAL-2026-16046](https://insights.sbomify.com/MAL-2026-16046/): Malicious code in i18nexus-tools (npm) (malicious package) - [MAL-2026-16045](https://insights.sbomify.com/MAL-2026-16045/): Malicious code in i18nexus (npm) (malicious package) - [MAL-2026-16044](https://insights.sbomify.com/MAL-2026-16044/): Malicious code in tsshare (PyPI) (malicious package) - [MAL-2026-16043](https://insights.sbomify.com/MAL-2026-16043/): Malicious code in @web2apk/baileys (npm) (malicious package) - [MAL-2026-16042](https://insights.sbomify.com/MAL-2026-16042/): Malicious code in krdpass-auth-react-native (npm) (malicious package) - [MAL-2026-16041](https://insights.sbomify.com/MAL-2026-16041/): Malicious code in wallet-engine-signing (npm) (malicious package) - [MAL-2026-16040](https://insights.sbomify.com/MAL-2026-16040/): Malicious code in wallet-cds-web (npm) (malicious package) - [MAL-2026-1604](https://insights.sbomify.com/MAL-2026-1604/): Malicious code in @emerald-react/core (npm) (malicious package) - [MAL-2026-16039](https://insights.sbomify.com/MAL-2026-16039/): Malicious code in service-home (npm) (malicious package) - [MAL-2026-16038](https://insights.sbomify.com/MAL-2026-16038/): Malicious code in scw-mobile (npm) (malicious package) - [MAL-2026-16037](https://insights.sbomify.com/MAL-2026-16037/): Malicious code in scw-core (npm) (malicious package) - [MAL-2026-16036](https://insights.sbomify.com/MAL-2026-16036/): Malicious code in redis-type-intel (npm) (malicious package) - [MAL-2026-16035](https://insights.sbomify.com/MAL-2026-16035/): Malicious code in oscar-redis (npm) (malicious package) - [MAL-2026-16034](https://insights.sbomify.com/MAL-2026-16034/): Malicious code in op-ts-server-core (npm) (malicious package) - [MAL-2026-16033](https://insights.sbomify.com/MAL-2026-16033/): Malicious code in kiki-baileys (npm) (malicious package) - [MAL-2026-16032](https://insights.sbomify.com/MAL-2026-16032/): Malicious code in feishu-docx-mcp (npm) (malicious package) - [MAL-2026-16031](https://insights.sbomify.com/MAL-2026-16031/): Malicious code in cb-wallet-store (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/124/