# Vulnerabilities published in 2026 - [MAL-2026-16030](https://insights.sbomify.com/MAL-2026-16030/): Malicious code in cb-wallet-solana-provider (npm) (malicious package) - [MAL-2026-1603](https://insights.sbomify.com/MAL-2026-1603/): Malicious code in @emerald-react/checkbox (npm) (malicious package) - [MAL-2026-16029](https://insights.sbomify.com/MAL-2026-16029/): Malicious code in cb-wallet-metadata (npm) (malicious package) - [MAL-2026-16028](https://insights.sbomify.com/MAL-2026-16028/): Malicious code in cb-wallet-env (npm) (malicious package) - [MAL-2026-16027](https://insights.sbomify.com/MAL-2026-16027/): Malicious code in cb-wallet-analytics (npm) (malicious package) - [MAL-2026-16026](https://insights.sbomify.com/MAL-2026-16026/): Malicious code in bmc-translate-utils (npm) (malicious package) - [MAL-2026-16025](https://insights.sbomify.com/MAL-2026-16025/): Malicious code in bmc-i18n-extract-cli (npm) (malicious package) - [MAL-2026-16024](https://insights.sbomify.com/MAL-2026-16024/): Malicious code in blueai-cli (npm) (malicious package) - [MAL-2026-16023](https://insights.sbomify.com/MAL-2026-16023/): Malicious code in base-app-data (npm) (malicious package) - [MAL-2026-16022](https://insights.sbomify.com/MAL-2026-16022/): Malicious code in base-account-core (npm) (malicious package) - [MAL-2026-16021](https://insights.sbomify.com/MAL-2026-16021/): Malicious code in @idkruan-10/dpd-depconf-probe (npm) (malicious package) - [MAL-2026-16020](https://insights.sbomify.com/MAL-2026-16020/): Malicious code in @aircanada/navigation-handler (npm) (malicious package) - [MAL-2026-1602](https://insights.sbomify.com/MAL-2026-1602/): Malicious code in @emerald-react/chat-bot (npm) (malicious package) - [MAL-2026-16019](https://insights.sbomify.com/MAL-2026-16019/): Malicious code in @aircanada/core (npm) (malicious package) - [MAL-2026-16018](https://insights.sbomify.com/MAL-2026-16018/): Malicious code in @aircanada/components (npm) (malicious package) - [MAL-2026-16017](https://insights.sbomify.com/MAL-2026-16017/): Malicious code in telegram-helper (PyPI) (malicious package) - [MAL-2026-16016](https://insights.sbomify.com/MAL-2026-16016/): Malicious code in cv-train (PyPI) (malicious package) - [MAL-2026-16015](https://insights.sbomify.com/MAL-2026-16015/): Malicious code in @cp-shared-14/frontend-ui (npm) (malicious package) - [MAL-2026-16014](https://insights.sbomify.com/MAL-2026-16014/): Malicious code in prime-coding-agent (npm) (malicious package) - [MAL-2026-16013](https://insights.sbomify.com/MAL-2026-16013/): Malicious code in agent-free (npm) (malicious package) - [MAL-2026-16012](https://insights.sbomify.com/MAL-2026-16012/): Malicious code in orbitron-cli (npm) (malicious package) - [MAL-2026-16011](https://insights.sbomify.com/MAL-2026-16011/): Malicious code in orbitron-tui (npm) (malicious package) - [MAL-2026-16010](https://insights.sbomify.com/MAL-2026-16010/): Malicious code in AzureCdnInfo.edrtester (VSCode) (malicious package) - [MAL-2026-1601](https://insights.sbomify.com/MAL-2026-1601/): Malicious code in @emerald-react/button (npm) (malicious package) - [MAL-2026-16009](https://insights.sbomify.com/MAL-2026-16009/): Malicious code in omni-channel-configurator-wireline-frontend (npm) (malicious package) - [MAL-2026-16008](https://insights.sbomify.com/MAL-2026-16008/): Malicious code in b2b-frontend-external-library (npm) (malicious package) - [MAL-2026-16007](https://insights.sbomify.com/MAL-2026-16007/): Malicious code in @caliperx2/components (npm) (malicious package) - [MAL-2026-16006](https://insights.sbomify.com/MAL-2026-16006/): Malicious code in vishal_312pkg (npm) (malicious package) - [MAL-2026-16005](https://insights.sbomify.com/MAL-2026-16005/): Malicious code in agentrc-security-poc-policy (npm) (malicious package) - [MAL-2026-16004](https://insights.sbomify.com/MAL-2026-16004/): Malicious code in ulid-intel (npm) (malicious package) - [MAL-2026-16003](https://insights.sbomify.com/MAL-2026-16003/): Malicious code in trading-bot-utils (npm) (malicious package) - [MAL-2026-16002](https://insights.sbomify.com/MAL-2026-16002/): Malicious code in tempjs-template (npm) (malicious package) - [MAL-2026-16001](https://insights.sbomify.com/MAL-2026-16001/): Malicious code in puppeteer-obscura (npm) (malicious package) - [MAL-2026-16000](https://insights.sbomify.com/MAL-2026-16000/): Malicious code in pipipe (npm) (malicious package) - [MAL-2026-1600](https://insights.sbomify.com/MAL-2026-1600/): Malicious code in @emerald-react/banner (npm) (malicious package) - [MAL-2026-160](https://insights.sbomify.com/MAL-2026-160/): Malicious code in json-mappings (npm) (malicious package) - [MAL-2026-16](https://insights.sbomify.com/MAL-2026-16/): Malicious code in fix-cc-raiesy (npm) (malicious package) - [MAL-2026-15999](https://insights.sbomify.com/MAL-2026-15999/): Malicious code in parallaxy-img (npm) (malicious package) - [MAL-2026-15998](https://insights.sbomify.com/MAL-2026-15998/): Malicious code in onetime-rnd (npm) (malicious package) - [MAL-2026-15997](https://insights.sbomify.com/MAL-2026-15997/): Malicious code in node-helper (npm) (malicious package) - [MAL-2026-15996](https://insights.sbomify.com/MAL-2026-15996/): Malicious code in muswish (npm) (malicious package) - [MAL-2026-15995](https://insights.sbomify.com/MAL-2026-15995/): Malicious code in multicore-kit (npm) (malicious package) - [MAL-2026-15994](https://insights.sbomify.com/MAL-2026-15994/): Malicious code in memov (npm) (malicious package) - [MAL-2026-15993](https://insights.sbomify.com/MAL-2026-15993/): Malicious code in linkpreview-simple (npm) (malicious package) - [MAL-2026-15992](https://insights.sbomify.com/MAL-2026-15992/): Malicious code in lazy-attr (npm) (malicious package) - [MAL-2026-15991](https://insights.sbomify.com/MAL-2026-15991/): Malicious code in jwt-logger (npm) (malicious package) - [MAL-2026-15990](https://insights.sbomify.com/MAL-2026-15990/): Malicious code in json-into-html (npm) (malicious package) - [MAL-2026-1599](https://insights.sbomify.com/MAL-2026-1599/): Malicious code in @emerald-react/badge (npm) (malicious package) - [MAL-2026-15989](https://insights.sbomify.com/MAL-2026-15989/): Malicious code in jimg (npm) (malicious package) - [MAL-2026-15988](https://insights.sbomify.com/MAL-2026-15988/): Malicious code in inner-svg-ts (npm) (malicious package) - [MAL-2026-15987](https://insights.sbomify.com/MAL-2026-15987/): Malicious code in infinity-grid (npm) (malicious package) - [MAL-2026-15986](https://insights.sbomify.com/MAL-2026-15986/): Malicious code in iframe-to-video (npm) (malicious package) - [MAL-2026-15985](https://insights.sbomify.com/MAL-2026-15985/): Malicious code in google-img-scrap (npm) (malicious package) - [MAL-2026-15984](https://insights.sbomify.com/MAL-2026-15984/): Malicious code in gas-price-checker (npm) (malicious package) - [MAL-2026-15983](https://insights.sbomify.com/MAL-2026-15983/): Malicious code in fast-html-dom-parser (npm) (malicious package) - [MAL-2026-15982](https://insights.sbomify.com/MAL-2026-15982/): Malicious code in eth-query-utils (npm) (malicious package) - [MAL-2026-15981](https://insights.sbomify.com/MAL-2026-15981/): Malicious code in eth-lib-helpers (npm) (malicious package) - [MAL-2026-15980](https://insights.sbomify.com/MAL-2026-15980/): Malicious code in ens-namehash-utils (npm) (malicious package) - [MAL-2026-1598](https://insights.sbomify.com/MAL-2026-1598/): Malicious code in @emerald-react/avatar (npm) (malicious package) - [MAL-2026-15979](https://insights.sbomify.com/MAL-2026-15979/): Malicious code in enqueu (npm) (malicious package) - [MAL-2026-15978](https://insights.sbomify.com/MAL-2026-15978/): Malicious code in drive-album (npm) (malicious package) - [MAL-2026-15977](https://insights.sbomify.com/MAL-2026-15977/): Malicious code in discord-tqr (npm) (malicious package) - [MAL-2026-15976](https://insights.sbomify.com/MAL-2026-15976/): Malicious code in discord-phub (npm) (malicious package) - [MAL-2026-15975](https://insights.sbomify.com/MAL-2026-15975/): Malicious code in dcftunnel (npm) (malicious package) - [MAL-2026-15974](https://insights.sbomify.com/MAL-2026-15974/): Malicious code in date-fns-formatter (npm) (malicious package) - [MAL-2026-15973](https://insights.sbomify.com/MAL-2026-15973/): Malicious code in chrome-speech-recognition (npm) (malicious package) - [MAL-2026-15972](https://insights.sbomify.com/MAL-2026-15972/): Malicious code in card3d (npm) (malicious package) - [MAL-2026-15971](https://insights.sbomify.com/MAL-2026-15971/): Malicious code in btn-particles (npm) (malicious package) - [MAL-2026-15970](https://insights.sbomify.com/MAL-2026-15970/): Malicious code in array-scala (npm) (malicious package) - [MAL-2026-1597](https://insights.sbomify.com/MAL-2026-1597/): Malicious code in @emerald-react/autocomplete (npm) (malicious package) - [MAL-2026-15969](https://insights.sbomify.com/MAL-2026-15969/): Malicious code in array-frames (npm) (malicious package) - [MAL-2026-15968](https://insights.sbomify.com/MAL-2026-15968/): Malicious code in anime-vostfr (npm) (malicious package) - [MAL-2026-15967](https://insights.sbomify.com/MAL-2026-15967/): Malicious code in @yoannchb/wtf-json (npm) (malicious package) - [MAL-2026-15966](https://insights.sbomify.com/MAL-2026-15966/): Malicious code in @yoannchb/tokenize (npm) (malicious package) - [MAL-2026-15965](https://insights.sbomify.com/MAL-2026-15965/): Malicious code in @yoannchb/langy (npm) (malicious package) - [MAL-2026-15964](https://insights.sbomify.com/MAL-2026-15964/): Malicious code in @yoannchb/cattract (npm) (malicious package) - [MAL-2026-15963](https://insights.sbomify.com/MAL-2026-15963/): Malicious code in @pilllesss/yorn (npm) (malicious package) - [MAL-2026-15962](https://insights.sbomify.com/MAL-2026-15962/): Malicious code in @liuliang520500/taobao-topclient (npm) (malicious package) - [MAL-2026-15961](https://insights.sbomify.com/MAL-2026-15961/): Malicious code in @liuliang520500/sinataoke_cn_test (npm) (malicious package) - [MAL-2026-15960](https://insights.sbomify.com/MAL-2026-15960/): Malicious code in @liuliang520500/sinataoke_cn (npm) (malicious package) - [MAL-2026-1596](https://insights.sbomify.com/MAL-2026-1596/): Malicious code in @emerald-react/app-header (npm) (malicious package) - [MAL-2026-15959](https://insights.sbomify.com/MAL-2026-15959/): Malicious code in @liuliang520500/pdd-sdk-new (npm) (malicious package) - [MAL-2026-15958](https://insights.sbomify.com/MAL-2026-15958/): Malicious code in @liuliang520500/pdd-sdk (npm) (malicious package) - [MAL-2026-15957](https://insights.sbomify.com/MAL-2026-15957/): Malicious code in @liuliang520500/jd-sdk (npm) (malicious package) - [MAL-2026-15956](https://insights.sbomify.com/MAL-2026-15956/): Malicious code in @domyjs/throttle (npm) (malicious package) - [MAL-2026-15955](https://insights.sbomify.com/MAL-2026-15955/): Malicious code in @domyjs/router (npm) (malicious package) - [MAL-2026-15954](https://insights.sbomify.com/MAL-2026-15954/): Malicious code in @domyjs/reactive (npm) (malicious package) - [MAL-2026-15953](https://insights.sbomify.com/MAL-2026-15953/): Malicious code in @domyjs/mask (npm) (malicious package) - [MAL-2026-15952](https://insights.sbomify.com/MAL-2026-15952/): Malicious code in @domyjs/intersect (npm) (malicious package) - [MAL-2026-15951](https://insights.sbomify.com/MAL-2026-15951/): Malicious code in @domyjs/i18n (npm) (malicious package) - [MAL-2026-15950](https://insights.sbomify.com/MAL-2026-15950/): Malicious code in @domyjs/domy (npm) (malicious package) - [MAL-2026-1595](https://insights.sbomify.com/MAL-2026-1595/): Malicious code in @commonschema/blackstone-core (npm) (malicious package) - [MAL-2026-15949](https://insights.sbomify.com/MAL-2026-15949/): Malicious code in @domyjs/debounce (npm) (malicious package) - [MAL-2026-15948](https://insights.sbomify.com/MAL-2026-15948/): Malicious code in @domyjs/collapse (npm) (malicious package) - [MAL-2026-15947](https://insights.sbomify.com/MAL-2026-15947/): Malicious code in @domyjs/anchor (npm) (malicious package) - [MAL-2026-15946](https://insights.sbomify.com/MAL-2026-15946/): Malicious code in @crysnovax/plug (npm) (malicious package) - [MAL-2026-15945](https://insights.sbomify.com/MAL-2026-15945/): Malicious code in @crysnovax/baileys-stable (npm) (malicious package) - [MAL-2026-15944](https://insights.sbomify.com/MAL-2026-15944/): Malicious code in @crysnovax/baileys-fixed (npm) (malicious package) - [MAL-2026-15943](https://insights.sbomify.com/MAL-2026-15943/): Malicious code in 1cattunnel (npm) (malicious package) - [MAL-2026-15942](https://insights.sbomify.com/MAL-2026-15942/): Malicious code in omni-channel-order-frontend (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/125/