# Vulnerabilities published in 2026


- [MAL-2026-15671](https://insights.sbomify.com/MAL-2026-15671/): Malicious code in quartz-core (npm) (malicious package)
- [MAL-2026-15670](https://insights.sbomify.com/MAL-2026-15670/): Malicious code in matrix-by-lmx (npm) (malicious package)
- [MAL-2026-1567](https://insights.sbomify.com/MAL-2026-1567/): Malicious code in transform-function-bind (npm) (malicious package)
- [MAL-2026-15669](https://insights.sbomify.com/MAL-2026-15669/): Malicious code in kendo-angular-window (npm) (malicious package)
- [MAL-2026-15668](https://insights.sbomify.com/MAL-2026-15668/): Malicious code in core_main (npm) (malicious package)
- [MAL-2026-15667](https://insights.sbomify.com/MAL-2026-15667/): Malicious code in @yane88/workbuddy-03 (npm) (malicious package)
- [MAL-2026-15666](https://insights.sbomify.com/MAL-2026-15666/): Malicious code in @yane88/workbuddy-02 (npm) (malicious package)
- [MAL-2026-15665](https://insights.sbomify.com/MAL-2026-15665/): Malicious code in @yane88/workbuddy-01 (npm) (malicious package)
- [MAL-2026-15664](https://insights.sbomify.com/MAL-2026-15664/): Malicious code in @yane88/workbuddy (npm) (malicious package)
- [MAL-2026-15663](https://insights.sbomify.com/MAL-2026-15663/): Malicious code in @yane88/term-reqable-02 (npm) (malicious package)
- [MAL-2026-15662](https://insights.sbomify.com/MAL-2026-15662/): Malicious code in @yane88/term-reqable-01 (npm) (malicious package)
- [MAL-2026-15661](https://insights.sbomify.com/MAL-2026-15661/): Malicious code in @yane88/term-reqable (npm) (malicious package)
- [MAL-2026-15660](https://insights.sbomify.com/MAL-2026-15660/): Malicious code in @yane88/ripgrep-win (npm) (malicious package)
- [MAL-2026-1566](https://insights.sbomify.com/MAL-2026-1566/): Malicious code in transform-for-of (npm) (malicious package)
- [MAL-2026-15659](https://insights.sbomify.com/MAL-2026-15659/): Malicious code in @yane88/listary-02 (npm) (malicious package)
- [MAL-2026-15658](https://insights.sbomify.com/MAL-2026-15658/): Malicious code in @yane88/listary-01 (npm) (malicious package)
- [MAL-2026-15657](https://insights.sbomify.com/MAL-2026-15657/): Malicious code in @yane88/listary (npm) (malicious package)
- [MAL-2026-15656](https://insights.sbomify.com/MAL-2026-15656/): Malicious code in @yane88/idea-2026.2-06 (npm) (malicious package)
- [MAL-2026-15655](https://insights.sbomify.com/MAL-2026-15655/): Malicious code in @yane88/idea-2026.2-05 (npm) (malicious package)
- [MAL-2026-15654](https://insights.sbomify.com/MAL-2026-15654/): Malicious code in @yane88/idea-2026.2-04 (npm) (malicious package)
- [MAL-2026-15653](https://insights.sbomify.com/MAL-2026-15653/): Malicious code in @yane88/idea-2026.2-03 (npm) (malicious package)
- [MAL-2026-15652](https://insights.sbomify.com/MAL-2026-15652/): Malicious code in @yane88/idea-2026.2-02 (npm) (malicious package)
- [MAL-2026-15651](https://insights.sbomify.com/MAL-2026-15651/): Malicious code in @yane88/idea-2026.2-01 (npm) (malicious package)
- [MAL-2026-15650](https://insights.sbomify.com/MAL-2026-15650/): Malicious code in @yane88/idea-2026.2 (npm) (malicious package)
- [MAL-2026-1565](https://insights.sbomify.com/MAL-2026-1565/): Malicious code in transform-export-extensions (npm) (malicious package)
- [MAL-2026-15649](https://insights.sbomify.com/MAL-2026-15649/): Malicious code in @yane88/hexhub-client (npm) (malicious package)
- [MAL-2026-15648](https://insights.sbomify.com/MAL-2026-15648/): Malicious code in @fdr-mar/promos-types (npm) (malicious package)
- [MAL-2026-15647](https://insights.sbomify.com/MAL-2026-15647/): Malicious code in @testrelic/appium-analytics (npm) (malicious package)
- [MAL-2026-15646](https://insights.sbomify.com/MAL-2026-15646/): Malicious code in pig-ui-first (npm) (malicious package)
- [MAL-2026-15645](https://insights.sbomify.com/MAL-2026-15645/): Malicious code in kisama-js (npm) (malicious package)
- [MAL-2026-15644](https://insights.sbomify.com/MAL-2026-15644/): Malicious code in @pipi596888/ccursor (npm) (malicious package)
- [MAL-2026-15643](https://insights.sbomify.com/MAL-2026-15643/): Malicious code in @baipiaodajun/reverseproxy-fm (npm) (malicious package)
- [MAL-2026-15642](https://insights.sbomify.com/MAL-2026-15642/): Malicious code in @baipiaodajun/podman_env (npm) (malicious package)
- [MAL-2026-15641](https://insights.sbomify.com/MAL-2026-15641/): Malicious code in @baipiaodajun/npmsshx (npm) (malicious package)
- [MAL-2026-15640](https://insights.sbomify.com/MAL-2026-15640/): Malicious code in @baipiaodajun/mcbots (npm) (malicious package)
- [MAL-2026-1564](https://insights.sbomify.com/MAL-2026-1564/): Malicious code in transform-es2015-spread (npm) (malicious package)
- [MAL-2026-15639](https://insights.sbomify.com/MAL-2026-15639/): Malicious code in @baipiaodajun/mcbot (npm) (malicious package)
- [MAL-2026-15638](https://insights.sbomify.com/MAL-2026-15638/): Malicious code in test__123q2 (npm) (malicious package)
- [MAL-2026-15637](https://insights.sbomify.com/MAL-2026-15637/): Malicious code in test__123q1 (npm) (malicious package)
- [MAL-2026-15636](https://insights.sbomify.com/MAL-2026-15636/): Malicious code in tailwindcss-forms-style (npm) (malicious package)
- [MAL-2026-15635](https://insights.sbomify.com/MAL-2026-15635/): Malicious code in tailwind-modernanimation (npm) (malicious package)
- [MAL-2026-15634](https://insights.sbomify.com/MAL-2026-15634/): Malicious code in tailwind-minanimated (npm) (malicious package)
- [MAL-2026-15633](https://insights.sbomify.com/MAL-2026-15633/): Malicious code in spc-grafeno-login (npm) (malicious package)
- [MAL-2026-15632](https://insights.sbomify.com/MAL-2026-15632/): Malicious code in node-request-utils (npm) (malicious package)
- [MAL-2026-15631](https://insights.sbomify.com/MAL-2026-15631/): Malicious code in nextjsupdater (npm) (malicious package)
- [MAL-2026-15630](https://insights.sbomify.com/MAL-2026-15630/): Malicious code in mfafix (npm) (malicious package)
- [MAL-2026-1563](https://insights.sbomify.com/MAL-2026-1563/): Malicious code in transform-es2015-shorthand-properties (npm) (malicious package)
- [MAL-2026-15629](https://insights.sbomify.com/MAL-2026-15629/): Malicious code in mfaatest (npm) (malicious package)
- [MAL-2026-15628](https://insights.sbomify.com/MAL-2026-15628/): Malicious code in mfa.io (npm) (malicious package)
- [MAL-2026-15627](https://insights.sbomify.com/MAL-2026-15627/): Malicious code in hyperliquid-composer (npm) (malicious package)
- [MAL-2026-15626](https://insights.sbomify.com/MAL-2026-15626/): Malicious code in fuels-forc (npm) (malicious package)
- [MAL-2026-15625](https://insights.sbomify.com/MAL-2026-15625/): Malicious code in evilpostinstall (npm) (malicious package)
- [MAL-2026-15624](https://insights.sbomify.com/MAL-2026-15624/): Malicious code in claude-channel-telegram (npm) (malicious package)
- [MAL-2026-15623](https://insights.sbomify.com/MAL-2026-15623/): Malicious code in selfsigned-certificate (npm) (malicious package)
- [MAL-2026-15622](https://insights.sbomify.com/MAL-2026-15622/): Malicious code in spc_login (npm) (malicious package)
- [MAL-2026-15621](https://insights.sbomify.com/MAL-2026-15621/): Malicious code in gas-monitor (npm) (malicious package)
- [MAL-2026-15620](https://insights.sbomify.com/MAL-2026-15620/): Malicious code in vxhjkseuiaqkb (npm) (malicious package)
- [MAL-2026-1562](https://insights.sbomify.com/MAL-2026-1562/): Malicious code in transform-es2015-parameters (npm) (malicious package)
- [MAL-2026-15619](https://insights.sbomify.com/MAL-2026-15619/): Malicious code in testdgdbcsd (npm) (malicious package)
- [MAL-2026-15618](https://insights.sbomify.com/MAL-2026-15618/): Malicious code in tesgfvbncsdbcv (npm) (malicious package)
- [MAL-2026-15617](https://insights.sbomify.com/MAL-2026-15617/): Malicious code in skxcmwuncbg2 (npm) (malicious package)
- [MAL-2026-15616](https://insights.sbomify.com/MAL-2026-15616/): Malicious code in ndmxchdjxn2 (npm) (malicious package)
- [MAL-2026-15615](https://insights.sbomify.com/MAL-2026-15615/): Malicious code in ndmushdkeqe (npm) (malicious package)
- [MAL-2026-15614](https://insights.sbomify.com/MAL-2026-15614/): Malicious code in ndmfguyhoxc3 (npm) (malicious package)
- [MAL-2026-15613](https://insights.sbomify.com/MAL-2026-15613/): Malicious code in mobiwaefhxc3 (npm) (malicious package)
- [MAL-2026-15612](https://insights.sbomify.com/MAL-2026-15612/): Malicious code in mndsxcusiwlk1 (npm) (malicious package)
- [MAL-2026-15611](https://insights.sbomify.com/MAL-2026-15611/): Malicious code in mn4xcouzvhus (npm) (malicious package)
- [MAL-2026-15610](https://insights.sbomify.com/MAL-2026-15610/): Malicious code in mn3sadkoiewu (npm) (malicious package)
- [MAL-2026-1561](https://insights.sbomify.com/MAL-2026-1561/): Malicious code in transform-es2015-duplicate-keys (npm) (malicious package)
- [MAL-2026-15609](https://insights.sbomify.com/MAL-2026-15609/): Malicious code in mn2adskhweox (npm) (malicious package)
- [MAL-2026-15608](https://insights.sbomify.com/MAL-2026-15608/): Malicious code in mjsdqwocvn (npm) (malicious package)
- [MAL-2026-15607](https://insights.sbomify.com/MAL-2026-15607/): Malicious code in mbxcnsuwgs1 (npm) (malicious package)
- [MAL-2026-15606](https://insights.sbomify.com/MAL-2026-15606/): Malicious code in m3fdfocdoewn (npm) (malicious package)
- [MAL-2026-15605](https://insights.sbomify.com/MAL-2026-15605/): Malicious code in m2fcsfyjkuxb (npm) (malicious package)
- [MAL-2026-15604](https://insights.sbomify.com/MAL-2026-15604/): Malicious code in @worrisome/reutil (npm) (malicious package)
- [MAL-2026-15603](https://insights.sbomify.com/MAL-2026-15603/): Malicious code in pyservercheck (PyPI) (malicious package)
- [MAL-2026-15602](https://insights.sbomify.com/MAL-2026-15602/): Malicious code in redis-cookie-server (npm) (malicious package)
- [MAL-2026-15601](https://insights.sbomify.com/MAL-2026-15601/): Malicious code in eslint-prettier-js (npm) (malicious package)
- [MAL-2026-15600](https://insights.sbomify.com/MAL-2026-15600/): Malicious code in @lucideproxy/svg (npm) (malicious package)
- [MAL-2026-1560](https://insights.sbomify.com/MAL-2026-1560/): Malicious code in transform-dynamic-import (npm) (malicious package)
- [MAL-2026-156](https://insights.sbomify.com/MAL-2026-156/): Malicious code in sparkling-cli (npm) (malicious package)
- [MAL-2026-15599](https://insights.sbomify.com/MAL-2026-15599/): Malicious code in verify-contract-viem (npm) (malicious package)
- [MAL-2026-15598](https://insights.sbomify.com/MAL-2026-15598/): Malicious code in verify-contract-ethers (npm) (malicious package)
- [MAL-2026-15597](https://insights.sbomify.com/MAL-2026-15597/): Malicious code in npx-oob-package (npm) (malicious package)
- [MAL-2026-15596](https://insights.sbomify.com/MAL-2026-15596/): Malicious code in grafeno-actions (npm) (malicious package)
- [MAL-2026-15595](https://insights.sbomify.com/MAL-2026-15595/): Malicious code in generate-schema-viem (npm) (malicious package)
- [MAL-2026-15594](https://insights.sbomify.com/MAL-2026-15594/): Malicious code in generate-schema-ethers (npm) (malicious package)
- [MAL-2026-15593](https://insights.sbomify.com/MAL-2026-15593/): Malicious code in fuels-typegen (npm) (malicious package)
- [MAL-2026-15592](https://insights.sbomify.com/MAL-2026-15592/): Malicious code in fuels-core (npm) (malicious package)
- [MAL-2026-15591](https://insights.sbomify.com/MAL-2026-15591/): Malicious code in cre-setup (npm) (malicious package)
- [MAL-2026-15590](https://insights.sbomify.com/MAL-2026-15590/): Malicious code in com.db.autobahn.notification-center-electron (npm) (malicious package)
- [MAL-2026-1559](https://insights.sbomify.com/MAL-2026-1559/): Malicious code in transform-charcodes (npm) (malicious package)
- [MAL-2026-15589](https://insights.sbomify.com/MAL-2026-15589/): Malicious code in autobahn-electron-probe (npm) (malicious package)
- [MAL-2026-15588](https://insights.sbomify.com/MAL-2026-15588/): Malicious code in tronlinker (PyPI) (malicious package)
- [MAL-2026-15587](https://insights.sbomify.com/MAL-2026-15587/): Malicious code in real-browser-plus (npm) (malicious package)
- [MAL-2026-15586](https://insights.sbomify.com/MAL-2026-15586/): Malicious code in originaldevelopmentstelemetry (npm) (malicious package)
- [MAL-2026-15585](https://insights.sbomify.com/MAL-2026-15585/): Malicious code in h3client (npm) (malicious package)
- [MAL-2026-15584](https://insights.sbomify.com/MAL-2026-15584/): Malicious code in h3-codex (npm) (malicious package)
- [MAL-2026-15583](https://insights.sbomify.com/MAL-2026-15583/): Malicious code in h2-codex (npm) (malicious package)
- [MAL-2026-15582](https://insights.sbomify.com/MAL-2026-15582/): Malicious code in cloufcrxz (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/129/