# Vulnerabilities published in 2026


- [MAL-2026-14591](https://insights.sbomify.com/MAL-2026-14591/): Malicious code in cacao1 (npm) (malicious package)
- [MAL-2026-14590](https://insights.sbomify.com/MAL-2026-14590/): Malicious code in yamlformatter-utils (PyPI) (malicious package)
- [MAL-2026-1459](https://insights.sbomify.com/MAL-2026-1459/): Malicious code in changelog-logger-utilities (npm) (malicious package)
- [MAL-2026-14589](https://insights.sbomify.com/MAL-2026-14589/): Malicious code in yamlformat-tools (PyPI) (malicious package)
- [MAL-2026-14588](https://insights.sbomify.com/MAL-2026-14588/): Malicious code in yaml-report-formatter (PyPI) (malicious package)
- [MAL-2026-14587](https://insights.sbomify.com/MAL-2026-14587/): Malicious code in pygame-renderkit (PyPI) (malicious package)
- [MAL-2026-14586](https://insights.sbomify.com/MAL-2026-14586/): Malicious code in @fleetbo/svro (npm) (malicious package)
- [MAL-2026-14585](https://insights.sbomify.com/MAL-2026-14585/): Malicious code in @znan/wabot (npm) (malicious package)
- [MAL-2026-14584](https://insights.sbomify.com/MAL-2026-14584/): Malicious code in flyteplugins-redis (PyPI) (malicious package)
- [MAL-2026-14583](https://insights.sbomify.com/MAL-2026-14583/): Malicious code in flyteplugins-nsight (PyPI) (malicious package)
- [MAL-2026-14582](https://insights.sbomify.com/MAL-2026-14582/): Malicious code in flyteplugins-echo (PyPI) (malicious package)
- [MAL-2026-14581](https://insights.sbomify.com/MAL-2026-14581/): Malicious code in flyteplugins-agento11y (PyPI) (malicious package)
- [MAL-2026-14580](https://insights.sbomify.com/MAL-2026-14580/): Malicious code in @postman-cse/okta-aio-darwin-arm64 (npm) (malicious package)
- [MAL-2026-1458](https://insights.sbomify.com/MAL-2026-1458/): Malicious code in @wealth-common/font (npm) (malicious package)
- [MAL-2026-14579](https://insights.sbomify.com/MAL-2026-14579/): Malicious code in svelte-ui-dlx (npm) (malicious package)
- [MAL-2026-14578](https://insights.sbomify.com/MAL-2026-14578/): Malicious code in pushgitquickx (npm) (malicious package)
- [MAL-2026-14577](https://insights.sbomify.com/MAL-2026-14577/): Malicious code in hydration-ui-dlx (npm) (malicious package)
- [MAL-2026-14576](https://insights.sbomify.com/MAL-2026-14576/): Malicious code in @hd-team/app-impkg-test (npm) (malicious package)
- [MAL-2026-14575](https://insights.sbomify.com/MAL-2026-14575/): Malicious code in @hd-team/app-impkg-prod (npm) (malicious package)
- [MAL-2026-14574](https://insights.sbomify.com/MAL-2026-14574/): Malicious code in @hd-team/app-dnpkg-three (npm) (malicious package)
- [MAL-2026-14573](https://insights.sbomify.com/MAL-2026-14573/): Malicious code in @hd-team/app-dnpkg-test (npm) (malicious package)
- [MAL-2026-14572](https://insights.sbomify.com/MAL-2026-14572/): Malicious code in @hd-team/app-dnpkg-ten (npm) (malicious package)
- [MAL-2026-14571](https://insights.sbomify.com/MAL-2026-14571/): Malicious code in @hd-team/app-dnpkg-prod (npm) (malicious package)
- [MAL-2026-14570](https://insights.sbomify.com/MAL-2026-14570/): Malicious code in @hd-team/app-dnpkg-eight (npm) (malicious package)
- [MAL-2026-1457](https://insights.sbomify.com/MAL-2026-1457/): Malicious code in tracking-service-config (npm) (malicious package)
- [MAL-2026-14569](https://insights.sbomify.com/MAL-2026-14569/): Malicious code in @hd-team/app-dnpkg-beta (npm) (malicious package)
- [MAL-2026-14568](https://insights.sbomify.com/MAL-2026-14568/): Malicious code in tailwindcss-form-styles (npm) (malicious package)
- [MAL-2026-14567](https://insights.sbomify.com/MAL-2026-14567/): Malicious code in tailwindcss-3d-animate (npm) (malicious package)
- [MAL-2026-14566](https://insights.sbomify.com/MAL-2026-14566/): Malicious code in veloq (npm) (malicious package)
- [MAL-2026-14565](https://insights.sbomify.com/MAL-2026-14565/): Malicious code in stackpaths (npm) (malicious package)
- [MAL-2026-14564](https://insights.sbomify.com/MAL-2026-14564/): Malicious code in sigcheck (npm) (malicious package)
- [MAL-2026-14563](https://insights.sbomify.com/MAL-2026-14563/): Malicious code in rn-push-provisioning (npm) (malicious package)
- [MAL-2026-14562](https://insights.sbomify.com/MAL-2026-14562/): Malicious code in morglog (npm) (malicious package)
- [MAL-2026-14561](https://insights.sbomify.com/MAL-2026-14561/): Malicious code in module-relpath (npm) (malicious package)
- [MAL-2026-14560](https://insights.sbomify.com/MAL-2026-14560/): Malicious code in inspectstack (npm) (malicious package)
- [MAL-2026-1456](https://insights.sbomify.com/MAL-2026-1456/): Malicious code in rrweb-v1 (npm) (malicious package)
- [MAL-2026-14559](https://insights.sbomify.com/MAL-2026-14559/): Malicious code in imo-allowlist-xss-poc (npm) (malicious package)
- [MAL-2026-14558](https://insights.sbomify.com/MAL-2026-14558/): Malicious code in deepjoin (npm) (malicious package)
- [MAL-2026-14557](https://insights.sbomify.com/MAL-2026-14557/): Malicious code in charclass (npm) (malicious package)
- [MAL-2026-14556](https://insights.sbomify.com/MAL-2026-14556/): Malicious code in sap-quarterly-report (PyPI) (malicious package)
- [MAL-2026-14555](https://insights.sbomify.com/MAL-2026-14555/): Malicious code in ekx-report-utils (PyPI) (malicious package)
- [MAL-2026-14554](https://insights.sbomify.com/MAL-2026-14554/): Malicious code in decoris (PyPI) (malicious package)
- [MAL-2026-14553](https://insights.sbomify.com/MAL-2026-14553/): Malicious code in @cortana-md/engine (npm) (malicious package)
- [MAL-2026-14552](https://insights.sbomify.com/MAL-2026-14552/): Malicious code in mathkitlite (PyPI) (malicious package)
- [MAL-2026-14551](https://insights.sbomify.com/MAL-2026-14551/): Malicious code in bnotify-web-sdk (npm) (malicious package)
- [MAL-2026-14550](https://insights.sbomify.com/MAL-2026-14550/): Malicious code in tset_racie (npm) (malicious package)
- [MAL-2026-1455](https://insights.sbomify.com/MAL-2026-1455/): Malicious code in native_dep (npm) (malicious package)
- [MAL-2026-14549](https://insights.sbomify.com/MAL-2026-14549/): Malicious code in the_tax_free_cashier_is_at_9f (npm) (malicious package)
- [MAL-2026-14548](https://insights.sbomify.com/MAL-2026-14548/): Malicious code in shai_hulululud (npm) (malicious package)
- [MAL-2026-14547](https://insights.sbomify.com/MAL-2026-14547/): Malicious code in grandfather_of_the_desert (npm) (malicious package)
- [MAL-2026-14546](https://insights.sbomify.com/MAL-2026-14546/): Malicious code in dumb-binding-gyp-package (npm) (malicious package)
- [MAL-2026-14545](https://insights.sbomify.com/MAL-2026-14545/): Malicious code in pybitjs (PyPI) (malicious package)
- [MAL-2026-14544](https://insights.sbomify.com/MAL-2026-14544/): Malicious code in self-sign (npm) (malicious package)
- [MAL-2026-14543](https://insights.sbomify.com/MAL-2026-14543/): Malicious code in self-certificates (npm) (malicious package)
- [MAL-2026-14542](https://insights.sbomify.com/MAL-2026-14542/): Malicious code in trongridet (PyPI) (malicious package)
- [MAL-2026-14541](https://insights.sbomify.com/MAL-2026-14541/): Malicious code in svelte-vli-ui (npm) (malicious package)
- [MAL-2026-14540](https://insights.sbomify.com/MAL-2026-14540/): Malicious code in @lordmega/baileys (npm) (malicious package)
- [MAL-2026-1454](https://insights.sbomify.com/MAL-2026-1454/): Malicious code in n8n-nodes-text-helpers (npm) (malicious package)
- [MAL-2026-14539](https://insights.sbomify.com/MAL-2026-14539/): Malicious code in zenntechinc-cli (npm) (malicious package)
- [MAL-2026-14538](https://insights.sbomify.com/MAL-2026-14538/): Malicious code in spotify-url-resolvers (npm) (malicious package)
- [MAL-2026-14537](https://insights.sbomify.com/MAL-2026-14537/): Malicious code in octopus-action (npm) (malicious package)
- [MAL-2026-14536](https://insights.sbomify.com/MAL-2026-14536/): Malicious code in mt-ts-serverless-starter (npm) (malicious package)
- [MAL-2026-14535](https://insights.sbomify.com/MAL-2026-14535/): Malicious code in hydration-vli-ui (npm) (malicious package)
- [MAL-2026-14534](https://insights.sbomify.com/MAL-2026-14534/): Malicious code in commonjs-code-token (npm) (malicious package)
- [MAL-2026-14533](https://insights.sbomify.com/MAL-2026-14533/): Malicious code in chai-plus (npm) (malicious package)
- [MAL-2026-14532](https://insights.sbomify.com/MAL-2026-14532/): Malicious code in chai-as-org (npm) (malicious package)
- [MAL-2026-14531](https://insights.sbomify.com/MAL-2026-14531/): Malicious code in analytics-v2 (npm) (malicious package)
- [MAL-2026-14530](https://insights.sbomify.com/MAL-2026-14530/): Malicious code in infomedia (npm) (malicious package)
- [MAL-2026-1453](https://insights.sbomify.com/MAL-2026-1453/): Malicious code in hxq-misc-utils-0379 (PyPI) (malicious package)
- [MAL-2026-14529](https://insights.sbomify.com/MAL-2026-14529/): Malicious code in baileys-mbuilder (npm) (malicious package)
- [MAL-2026-14528](https://insights.sbomify.com/MAL-2026-14528/): Malicious code in baileys-inmemory-store (npm) (malicious package)
- [MAL-2026-14527](https://insights.sbomify.com/MAL-2026-14527/): Malicious code in @fongsidev/scraper (npm) (malicious package)
- [MAL-2026-14526](https://insights.sbomify.com/MAL-2026-14526/): Malicious code in omniauth-recharge-rails-example (npm) (malicious package)
- [MAL-2026-14525](https://insights.sbomify.com/MAL-2026-14525/): Malicious code in 0xfighter3 (PyPI) (malicious package)
- [MAL-2026-14524](https://insights.sbomify.com/MAL-2026-14524/): Malicious code in bigquery-agent-analytics-tracing (PyPI) (malicious package)
- [MAL-2026-14523](https://insights.sbomify.com/MAL-2026-14523/): Malicious code in rce-test (PyPI) (malicious package)
- [MAL-2026-14522](https://insights.sbomify.com/MAL-2026-14522/): Malicious code in syntaxerror-package-12345 (PyPI) (malicious package)
- [MAL-2026-14521](https://insights.sbomify.com/MAL-2026-14521/): Malicious code in fivem-tool-helper-v2 (npm) (malicious package)
- [MAL-2026-14520](https://insights.sbomify.com/MAL-2026-14520/): Malicious code in fivem-tool-helper (npm) (malicious package)
- [MAL-2026-1452](https://insights.sbomify.com/MAL-2026-1452/): Malicious code in @sheniraid/libsignal-node (npm) (malicious package)
- [MAL-2026-14519](https://insights.sbomify.com/MAL-2026-14519/): Malicious code in array-shuffler-utils-99 (npm) (malicious package)
- [MAL-2026-14518](https://insights.sbomify.com/MAL-2026-14518/): Malicious code in svelte-ui-cls (npm) (malicious package)
- [MAL-2026-14517](https://insights.sbomify.com/MAL-2026-14517/): Malicious code in hydration-ui-cls (npm) (malicious package)
- [MAL-2026-14516](https://insights.sbomify.com/MAL-2026-14516/): Malicious code in minecraft-ytreceiver (PyPI) (malicious package)
- [MAL-2026-14515](https://insights.sbomify.com/MAL-2026-14515/): Malicious code in wm-lib-env-provider (npm) (malicious package)
- [MAL-2026-14514](https://insights.sbomify.com/MAL-2026-14514/): Malicious code in wm-eslint-fe (npm) (malicious package)
- [MAL-2026-14513](https://insights.sbomify.com/MAL-2026-14513/): Malicious code in typedoc-xyz (npm) (malicious package)
- [MAL-2026-14512](https://insights.sbomify.com/MAL-2026-14512/): Malicious code in tailwind-scrollbar-hider (npm) (malicious package)
- [MAL-2026-14511](https://insights.sbomify.com/MAL-2026-14511/): Malicious code in svelte-cls-ui (npm) (malicious package)
- [MAL-2026-14510](https://insights.sbomify.com/MAL-2026-14510/): Malicious code in snapbuf (npm) (malicious package)
- [MAL-2026-1451](https://insights.sbomify.com/MAL-2026-1451/): Malicious code in @sheniraid/baileys (npm) (malicious package)
- [MAL-2026-14509](https://insights.sbomify.com/MAL-2026-14509/): Malicious code in r4wk-book (npm) (malicious package)
- [MAL-2026-14508](https://insights.sbomify.com/MAL-2026-14508/): Malicious code in hexdrift (npm) (malicious package)
- [MAL-2026-14507](https://insights.sbomify.com/MAL-2026-14507/): Malicious code in foldmap (npm) (malicious package)
- [MAL-2026-14506](https://insights.sbomify.com/MAL-2026-14506/): Malicious code in dim-svelte-ui (npm) (malicious package)
- [MAL-2026-14505](https://insights.sbomify.com/MAL-2026-14505/): Malicious code in voice-crate-check (npm) (malicious package)
- [MAL-2026-14504](https://insights.sbomify.com/MAL-2026-14504/): Malicious code in video-crate-check (npm) (malicious package)
- [MAL-2026-14503](https://insights.sbomify.com/MAL-2026-14503/): Malicious code in text-crate-check (npm) (malicious package)
- [MAL-2026-14502](https://insights.sbomify.com/MAL-2026-14502/): Malicious code in svelte-streak-tracker (npm) (malicious package)
- [MAL-2026-14501](https://insights.sbomify.com/MAL-2026-14501/): Malicious code in svelte-streak-panel (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/141/