# Vulnerabilities published in 2026


- [MAL-2026-15581](https://insights.sbomify.com/MAL-2026-15581/): Malicious code in cloudfcrxz (npm) (malicious package)
- [MAL-2026-15580](https://insights.sbomify.com/MAL-2026-15580/): Malicious code in brat-codex (npm) (malicious package)
- [MAL-2026-1558](https://insights.sbomify.com/MAL-2026-1558/): Malicious code in syntax-async-generators (npm) (malicious package)
- [MAL-2026-15579](https://insights.sbomify.com/MAL-2026-15579/): Malicious code in @fidzzhost/baileys (npm) (malicious package)
- [MAL-2026-15578](https://insights.sbomify.com/MAL-2026-15578/): Malicious code in trongridor (PyPI) (malicious package)
- [MAL-2026-15577](https://insights.sbomify.com/MAL-2026-15577/): Malicious code in auth-app-streamlit (PyPI) (malicious package)
- [MAL-2026-15576](https://insights.sbomify.com/MAL-2026-15576/): Malicious code in quesoeducation (npm) (malicious package)
- [MAL-2026-15575](https://insights.sbomify.com/MAL-2026-15575/): Malicious code in opiumbest (npm) (malicious package)
- [MAL-2026-15574](https://insights.sbomify.com/MAL-2026-15574/): Malicious code in gclassroom (npm) (malicious package)
- [MAL-2026-15573](https://insights.sbomify.com/MAL-2026-15573/): Malicious code in grafeno-webhook (npm) (malicious package)
- [MAL-2026-15572](https://insights.sbomify.com/MAL-2026-15572/): Malicious code in grafeno-payments (npm) (malicious package)
- [MAL-2026-15571](https://insights.sbomify.com/MAL-2026-15571/): Malicious code in grafeno-billing (npm) (malicious package)
- [MAL-2026-15570](https://insights.sbomify.com/MAL-2026-15570/): Malicious code in node-net-pool (npm) (malicious package)
- [MAL-2026-1557](https://insights.sbomify.com/MAL-2026-1557/): Malicious code in add-react-displayname (npm) (malicious package)
- [MAL-2026-15569](https://insights.sbomify.com/MAL-2026-15569/): Malicious code in nuvyra-marketplace-sdk (npm) (malicious package)
- [MAL-2026-15568](https://insights.sbomify.com/MAL-2026-15568/): Malicious code in manager-thedate (npm) (malicious package)
- [MAL-2026-15567](https://insights.sbomify.com/MAL-2026-15567/): Malicious code in htps-provider (npm) (malicious package)
- [MAL-2026-15566](https://insights.sbomify.com/MAL-2026-15566/): Malicious code in flask-header-guard (PyPI) (malicious package)
- [MAL-2026-15565](https://insights.sbomify.com/MAL-2026-15565/): Malicious code in @testrelic/playwright-analytics (npm) (malicious package)
- [MAL-2026-15564](https://insights.sbomify.com/MAL-2026-15564/): Malicious code in vs-modules (npm) (malicious package)
- [MAL-2026-15563](https://insights.sbomify.com/MAL-2026-15563/): Malicious code in vitest-chalk-pro (npm) (malicious package)
- [MAL-2026-15562](https://insights.sbomify.com/MAL-2026-15562/): Malicious code in test-in-one (npm) (malicious package)
- [MAL-2026-15561](https://insights.sbomify.com/MAL-2026-15561/): Malicious code in techportal (npm) (malicious package)
- [MAL-2026-15560](https://insights.sbomify.com/MAL-2026-15560/): Malicious code in supersignaturenature (npm) (malicious package)
- [MAL-2026-1556](https://insights.sbomify.com/MAL-2026-1556/): Malicious code in yoshi-base (npm) (malicious package)
- [MAL-2026-15559](https://insights.sbomify.com/MAL-2026-15559/): Malicious code in secretkey2fa (npm) (malicious package)
- [MAL-2026-15558](https://insights.sbomify.com/MAL-2026-15558/): Malicious code in mfakit (npm) (malicious package)
- [MAL-2026-15557](https://insights.sbomify.com/MAL-2026-15557/): Malicious code in mfacord (npm) (malicious package)
- [MAL-2026-15556](https://insights.sbomify.com/MAL-2026-15556/): Malicious code in js-tokens-array (npm) (malicious package)
- [MAL-2026-15555](https://insights.sbomify.com/MAL-2026-15555/): Malicious code in js-array-tokens (npm) (malicious package)
- [MAL-2026-15554](https://insights.sbomify.com/MAL-2026-15554/): Malicious code in eth-pino (npm) (malicious package)
- [MAL-2026-15553](https://insights.sbomify.com/MAL-2026-15553/): Malicious code in es6-migrator (npm) (malicious package)
- [MAL-2026-15552](https://insights.sbomify.com/MAL-2026-15552/): Malicious code in discord-mfa (npm) (malicious package)
- [MAL-2026-15551](https://insights.sbomify.com/MAL-2026-15551/): Malicious code in date-fns-sync (npm) (malicious package)
- [MAL-2026-15550](https://insights.sbomify.com/MAL-2026-15550/): Malicious code in common-array-token (npm) (malicious package)
- [MAL-2026-1555](https://insights.sbomify.com/MAL-2026-1555/): Malicious code in typescript-vue-apollo-smart-ops (npm) (malicious package)
- [MAL-2026-15549](https://insights.sbomify.com/MAL-2026-15549/): Malicious code in ckeditor5-ckbox (npm) (malicious package)
- [MAL-2026-15548](https://insights.sbomify.com/MAL-2026-15548/): Malicious code in 2fasecretkey (npm) (malicious package)
- [MAL-2026-15547](https://insights.sbomify.com/MAL-2026-15547/): Malicious code in 2fa-secretkey (npm) (malicious package)
- [MAL-2026-15546](https://insights.sbomify.com/MAL-2026-15546/): Malicious code in vui-gateway (npm) (malicious package)
- [MAL-2026-15545](https://insights.sbomify.com/MAL-2026-15545/): Malicious code in ux-metrics-client-interaction-subscriber (npm) (malicious package)
- [MAL-2026-15544](https://insights.sbomify.com/MAL-2026-15544/): Malicious code in sentrykit (npm) (malicious package)
- [MAL-2026-15543](https://insights.sbomify.com/MAL-2026-15543/): Malicious code in prm-bundles (npm) (malicious package)
- [MAL-2026-15542](https://insights.sbomify.com/MAL-2026-15542/): Malicious code in paper-password-input (npm) (malicious package)
- [MAL-2026-15541](https://insights.sbomify.com/MAL-2026-15541/): Malicious code in oit-lib-oracle-util (npm) (malicious package)
- [MAL-2026-15540](https://insights.sbomify.com/MAL-2026-15540/): Malicious code in mkt-ui-library (npm) (malicious package)
- [MAL-2026-1554](https://insights.sbomify.com/MAL-2026-1554/): Malicious code in typescript-validation-schema (npm) (malicious package)
- [MAL-2026-15539](https://insights.sbomify.com/MAL-2026-15539/): Malicious code in loading-performance-instrumentation (npm) (malicious package)
- [MAL-2026-15538](https://insights.sbomify.com/MAL-2026-15538/): Malicious code in librastandardlib (npm) (malicious package)
- [MAL-2026-15537](https://insights.sbomify.com/MAL-2026-15537/): Malicious code in jira-projects-backbone (npm) (malicious package)
- [MAL-2026-15536](https://insights.sbomify.com/MAL-2026-15536/): Malicious code in ir-annuities-client-authentication-module (npm) (malicious package)
- [MAL-2026-15535](https://insights.sbomify.com/MAL-2026-15535/): Malicious code in gridster-coords (npm) (malicious package)
- [MAL-2026-15534](https://insights.sbomify.com/MAL-2026-15534/): Malicious code in firestore-lite (npm) (malicious package)
- [MAL-2026-15533](https://insights.sbomify.com/MAL-2026-15533/): Malicious code in data-value (npm) (malicious package)
- [MAL-2026-15532](https://insights.sbomify.com/MAL-2026-15532/): Malicious code in confluence-rest (npm) (malicious package)
- [MAL-2026-15531](https://insights.sbomify.com/MAL-2026-15531/): Malicious code in confluence-editor (npm) (malicious package)
- [MAL-2026-15530](https://insights.sbomify.com/MAL-2026-15530/): Malicious code in confluence-create-content (npm) (malicious package)
- [MAL-2026-1553](https://insights.sbomify.com/MAL-2026-1553/): Malicious code in typescript-react-query (npm) (malicious package)
- [MAL-2026-15529](https://insights.sbomify.com/MAL-2026-15529/): Malicious code in bui-react-10themes (npm) (malicious package)
- [MAL-2026-15528](https://insights.sbomify.com/MAL-2026-15528/): Malicious code in axis-datagrid (npm) (malicious package)
- [MAL-2026-15527](https://insights.sbomify.com/MAL-2026-15527/): Malicious code in aura-instrumentation (npm) (malicious package)
- [MAL-2026-15526](https://insights.sbomify.com/MAL-2026-15526/): Malicious code in analytics-web-client (npm) (malicious package)
- [MAL-2026-15525](https://insights.sbomify.com/MAL-2026-15525/): Malicious code in amplitude-react-native (npm) (malicious package)
- [MAL-2026-15524](https://insights.sbomify.com/MAL-2026-15524/): Malicious code in tabbables (npm) (malicious package)
- [MAL-2026-15523](https://insights.sbomify.com/MAL-2026-15523/): Malicious code in sycm-vendors (npm) (malicious package)
- [MAL-2026-15522](https://insights.sbomify.com/MAL-2026-15522/): Malicious code in spc-grafeno (npm) (malicious package)
- [MAL-2026-15521](https://insights.sbomify.com/MAL-2026-15521/): Malicious code in search-reservation (npm) (malicious package)
- [MAL-2026-15520](https://insights.sbomify.com/MAL-2026-15520/): Malicious code in ring-device-settings-library (npm) (malicious package)
- [MAL-2026-1552](https://insights.sbomify.com/MAL-2026-1552/): Malicious code in typescript-nhost (npm) (malicious package)
- [MAL-2026-15519](https://insights.sbomify.com/MAL-2026-15519/): Malicious code in qbo-ui-services (npm) (malicious package)
- [MAL-2026-15518](https://insights.sbomify.com/MAL-2026-15518/): Malicious code in payments-ui-services (npm) (malicious package)
- [MAL-2026-15517](https://insights.sbomify.com/MAL-2026-15517/): Malicious code in one-intuit-help-system-utils (npm) (malicious package)
- [MAL-2026-15516](https://insights.sbomify.com/MAL-2026-15516/): Malicious code in nx-app (npm) (malicious package)
- [MAL-2026-15515](https://insights.sbomify.com/MAL-2026-15515/): Malicious code in npm-extension (npm) (malicious package)
- [MAL-2026-15514](https://insights.sbomify.com/MAL-2026-15514/): Malicious code in mintel-taskbar (npm) (malicious package)
- [MAL-2026-15513](https://insights.sbomify.com/MAL-2026-15513/): Malicious code in katal-logger (npm) (malicious package)
- [MAL-2026-15512](https://insights.sbomify.com/MAL-2026-15512/): Malicious code in jsb-adapter (npm) (malicious package)
- [MAL-2026-15511](https://insights.sbomify.com/MAL-2026-15511/): Malicious code in intuit-authz (npm) (malicious package)
- [MAL-2026-15510](https://insights.sbomify.com/MAL-2026-15510/): Malicious code in integration-amplitude (npm) (malicious package)
- [MAL-2026-1551](https://insights.sbomify.com/MAL-2026-1551/): Malicious code in syntax-function-bind (npm) (malicious package)
- [MAL-2026-15509](https://insights.sbomify.com/MAL-2026-15509/): Malicious code in grafeno-utils (npm) (malicious package)
- [MAL-2026-15508](https://insights.sbomify.com/MAL-2026-15508/): Malicious code in grafeno-sdk (npm) (malicious package)
- [MAL-2026-15507](https://insights.sbomify.com/MAL-2026-15507/): Malicious code in grafeno-pix (npm) (malicious package)
- [MAL-2026-15506](https://insights.sbomify.com/MAL-2026-15506/): Malicious code in grafeno-logger (npm) (malicious package)
- [MAL-2026-15505](https://insights.sbomify.com/MAL-2026-15505/): Malicious code in grafeno-core (npm) (malicious package)
- [MAL-2026-15504](https://insights.sbomify.com/MAL-2026-15504/): Malicious code in grafeno-config (npm) (malicious package)
- [MAL-2026-15503](https://insights.sbomify.com/MAL-2026-15503/): Malicious code in grafeno-client (npm) (malicious package)
- [MAL-2026-15502](https://insights.sbomify.com/MAL-2026-15502/): Malicious code in grafeno-auth (npm) (malicious package)
- [MAL-2026-15501](https://insights.sbomify.com/MAL-2026-15501/): Malicious code in grafeno-api (npm) (malicious package)
- [MAL-2026-15500](https://insights.sbomify.com/MAL-2026-15500/): Malicious code in framework-zero (npm) (malicious package)
- [MAL-2026-1550](https://insights.sbomify.com/MAL-2026-1550/): Malicious code in syntax-export-extensions (npm) (malicious package)
- [MAL-2026-155](https://insights.sbomify.com/MAL-2026-155/): Malicious code in shaktihacker2026 (npm) (malicious package)
- [MAL-2026-15499](https://insights.sbomify.com/MAL-2026-15499/): Malicious code in calcite-web (npm) (malicious package)
- [MAL-2026-15498](https://insights.sbomify.com/MAL-2026-15498/): Malicious code in aws-blog (npm) (malicious package)
- [MAL-2026-15497](https://insights.sbomify.com/MAL-2026-15497/): Malicious code in amplitude-session-replay (npm) (malicious package)
- [MAL-2026-15496](https://insights.sbomify.com/MAL-2026-15496/): Malicious code in amplitude-experiment (npm) (malicious package)
- [MAL-2026-15495](https://insights.sbomify.com/MAL-2026-15495/): Malicious code in alimama-minisite (npm) (malicious package)
- [MAL-2026-15494](https://insights.sbomify.com/MAL-2026-15494/): Malicious code in @7nohe/openapi-react-query-codegen (npm) (malicious package)
- [MAL-2026-15493](https://insights.sbomify.com/MAL-2026-15493/): Malicious code in ozturk-mfa (npm) (malicious package)
- [MAL-2026-15492](https://insights.sbomify.com/MAL-2026-15492/): Malicious code in mfa-js (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/130/