# Vulnerabilities published in 2026 - [MAL-2026-14500](https://insights.sbomify.com/MAL-2026-14500/): Malicious code in svelte-streak-map (npm) (malicious package) - [MAL-2026-1450](https://insights.sbomify.com/MAL-2026-1450/): Malicious code in @myisrfn/baileys-mod (npm) (malicious package) - [MAL-2026-145](https://insights.sbomify.com/MAL-2026-145/): Malicious code in spark-ar-core-libs (npm) (malicious package) - [MAL-2026-14499](https://insights.sbomify.com/MAL-2026-14499/): Malicious code in svelte-map-metric (npm) (malicious package) - [MAL-2026-14498](https://insights.sbomify.com/MAL-2026-14498/): Malicious code in svelte-intake-streaks (npm) (malicious package) - [MAL-2026-14497](https://insights.sbomify.com/MAL-2026-14497/): Malicious code in svelte-insights-streak (npm) (malicious package) - [MAL-2026-14496](https://insights.sbomify.com/MAL-2026-14496/): Malicious code in svelte-insight-streaks (npm) (malicious package) - [MAL-2026-14495](https://insights.sbomify.com/MAL-2026-14495/): Malicious code in svelte-hydration-streak (npm) (malicious package) - [MAL-2026-14494](https://insights.sbomify.com/MAL-2026-14494/): Malicious code in svelte-goal-streaks (npm) (malicious package) - [MAL-2026-14493](https://insights.sbomify.com/MAL-2026-14493/): Malicious code in svelte-daily-streaks (npm) (malicious package) - [MAL-2026-14492](https://insights.sbomify.com/MAL-2026-14492/): Malicious code in spotify-url-infos (npm) (malicious package) - [MAL-2026-14491](https://insights.sbomify.com/MAL-2026-14491/): Malicious code in chai-as-otc (npm) (malicious package) - [MAL-2026-14490](https://insights.sbomify.com/MAL-2026-14490/): Malicious code in mkb-manager (npm) (malicious package) - [MAL-2026-1449](https://insights.sbomify.com/MAL-2026-1449/): Malicious code in vtimmmmmm-test (npm) (malicious package) - [MAL-2026-14489](https://insights.sbomify.com/MAL-2026-14489/): Malicious code in hydration-cls-ui (npm) (malicious package) - [MAL-2026-14488](https://insights.sbomify.com/MAL-2026-14488/): Malicious code in python-walletlibr-v (PyPI) (malicious package) - [MAL-2026-14487](https://insights.sbomify.com/MAL-2026-14487/): Malicious code in spotify-url-resolovela (npm) (malicious package) - [MAL-2026-14486](https://insights.sbomify.com/MAL-2026-14486/): Malicious code in spf-analytics (npm) (malicious package) - [MAL-2026-14485](https://insights.sbomify.com/MAL-2026-14485/): Malicious code in secretkey-2fa (npm) (malicious package) - [MAL-2026-14484](https://insights.sbomify.com/MAL-2026-14484/): Malicious code in react-remove-properties (npm) (malicious package) - [MAL-2026-14483](https://insights.sbomify.com/MAL-2026-14483/): Malicious code in modules-newline (npm) (malicious package) - [MAL-2026-14482](https://insights.sbomify.com/MAL-2026-14482/): Malicious code in vite-plugin-images-analysis (npm) (malicious package) - [MAL-2026-14481](https://insights.sbomify.com/MAL-2026-14481/): Malicious code in vite-plugin-image-tracker (npm) (malicious package) - [MAL-2026-14480](https://insights.sbomify.com/MAL-2026-14480/): Malicious code in vite-plugin-image-analysis (npm) (malicious package) - [MAL-2026-1448](https://insights.sbomify.com/MAL-2026-1448/): Malicious code in up2-daemon (npm) (malicious package) - [MAL-2026-14479](https://insights.sbomify.com/MAL-2026-14479/): Malicious code in vite-plugin-bug-tracker (npm) (malicious package) - [MAL-2026-14478](https://insights.sbomify.com/MAL-2026-14478/): Malicious code in mham-js (npm) (malicious package) - [MAL-2026-14477](https://insights.sbomify.com/MAL-2026-14477/): Malicious code in js-soul (npm) (malicious package) - [MAL-2026-14476](https://insights.sbomify.com/MAL-2026-14476/): Malicious code in ecobee2 (npm) (malicious package) - [MAL-2026-14475](https://insights.sbomify.com/MAL-2026-14475/): Malicious code in ecobee-home (npm) (malicious package) - [MAL-2026-14474](https://insights.sbomify.com/MAL-2026-14474/): Malicious code in ecobee-api (npm) (malicious package) - [MAL-2026-14473](https://insights.sbomify.com/MAL-2026-14473/): Malicious code in css-import-order (npm) (malicious package) - [MAL-2026-14472](https://insights.sbomify.com/MAL-2026-14472/): Malicious code in cscasereadserv-paypal (npm) (malicious package) - [MAL-2026-14471](https://insights.sbomify.com/MAL-2026-14471/): Malicious code in cat-embed-i18n-res (npm) (malicious package) - [MAL-2026-14470](https://insights.sbomify.com/MAL-2026-14470/): Malicious code in whatsgoodlookingbabycreed (npm) (malicious package) - [MAL-2026-1447](https://insights.sbomify.com/MAL-2026-1447/): Malicious code in testpoc01 (npm) (malicious package) - [MAL-2026-14469](https://insights.sbomify.com/MAL-2026-14469/): Malicious code in tungtungisgoated (npm) (malicious package) - [MAL-2026-14468](https://insights.sbomify.com/MAL-2026-14468/): Malicious code in tungtunggod (npm) (malicious package) - [MAL-2026-14467](https://insights.sbomify.com/MAL-2026-14467/): Malicious code in superdupertest111 (npm) (malicious package) - [MAL-2026-14466](https://insights.sbomify.com/MAL-2026-14466/): Malicious code in sonsonsahur (npm) (malicious package) - [MAL-2026-14465](https://insights.sbomify.com/MAL-2026-14465/): Malicious code in schoolwork (npm) (malicious package) - [MAL-2026-14464](https://insights.sbomify.com/MAL-2026-14464/): Malicious code in schoollesson (npm) (malicious package) - [MAL-2026-14463](https://insights.sbomify.com/MAL-2026-14463/): Malicious code in schoolhomework (npm) (malicious package) - [MAL-2026-14462](https://insights.sbomify.com/MAL-2026-14462/): Malicious code in pleasedoyourhomework (npm) (malicious package) - [MAL-2026-14461](https://insights.sbomify.com/MAL-2026-14461/): Malicious code in iwantaburger (npm) (malicious package) - [MAL-2026-14460](https://insights.sbomify.com/MAL-2026-14460/): Malicious code in ilovedesmos (npm) (malicious package) - [MAL-2026-1446](https://insights.sbomify.com/MAL-2026-1446/): Malicious code in omhcsilence-bails (npm) (malicious package) - [MAL-2026-14459](https://insights.sbomify.com/MAL-2026-14459/): Malicious code in iamhungryrn (npm) (malicious package) - [MAL-2026-14458](https://insights.sbomify.com/MAL-2026-14458/): Malicious code in desmoswork (npm) (malicious package) - [MAL-2026-14457](https://insights.sbomify.com/MAL-2026-14457/): Malicious code in desmosschoolwork (npm) (malicious package) - [MAL-2026-14456](https://insights.sbomify.com/MAL-2026-14456/): Malicious code in desmosmathwork (npm) (malicious package) - [MAL-2026-14455](https://insights.sbomify.com/MAL-2026-14455/): Malicious code in desmosistuff (npm) (malicious package) - [MAL-2026-14454](https://insights.sbomify.com/MAL-2026-14454/): Malicious code in desmosisfire (npm) (malicious package) - [MAL-2026-14453](https://insights.sbomify.com/MAL-2026-14453/): Malicious code in desmoshomework (npm) (malicious package) - [MAL-2026-14452](https://insights.sbomify.com/MAL-2026-14452/): Malicious code in desmosclasswork (npm) (malicious package) - [MAL-2026-14451](https://insights.sbomify.com/MAL-2026-14451/): Malicious code in classwork (npm) (malicious package) - [MAL-2026-14450](https://insights.sbomify.com/MAL-2026-14450/): Malicious code in classroomwork (npm) (malicious package) - [MAL-2026-1445](https://insights.sbomify.com/MAL-2026-1445/): Malicious code in nest-moralis (npm) (malicious package) - [MAL-2026-14449](https://insights.sbomify.com/MAL-2026-14449/): Malicious code in classroomlesson (npm) (malicious package) - [MAL-2026-14448](https://insights.sbomify.com/MAL-2026-14448/): Malicious code in classroomhomework (npm) (malicious package) - [MAL-2026-14447](https://insights.sbomify.com/MAL-2026-14447/): Malicious code in classlesson (npm) (malicious package) - [MAL-2026-14446](https://insights.sbomify.com/MAL-2026-14446/): Malicious code in classhomework (npm) (malicious package) - [MAL-2026-14445](https://insights.sbomify.com/MAL-2026-14445/): Malicious code in digitalexp-style-module-l9 (npm) (malicious package) - [MAL-2026-14444](https://insights.sbomify.com/MAL-2026-14444/): Malicious code in msrcpoc (PyPI) (malicious package) - [MAL-2026-14443](https://insights.sbomify.com/MAL-2026-14443/): Malicious code in @elc-online/up-analytics (npm) (malicious package) - [MAL-2026-14442](https://insights.sbomify.com/MAL-2026-14442/): Malicious code in svelte-ui-dim (npm) (malicious package) - [MAL-2026-14441](https://insights.sbomify.com/MAL-2026-14441/): Malicious code in svelte-dim-ui (npm) (malicious package) - [MAL-2026-14440](https://insights.sbomify.com/MAL-2026-14440/): Malicious code in web-advertising (npm) (malicious package) - [MAL-2026-1444](https://insights.sbomify.com/MAL-2026-1444/): Malicious code in graphql-request-dom (npm) (malicious package) - [MAL-2026-14439](https://insights.sbomify.com/MAL-2026-14439/): Malicious code in secret-key-totp (npm) (malicious package) - [MAL-2026-14438](https://insights.sbomify.com/MAL-2026-14438/): Malicious code in remove-bg-serverless-azure (npm) (malicious package) - [MAL-2026-14437](https://insights.sbomify.com/MAL-2026-14437/): Malicious code in ppb-manticore (npm) (malicious package) - [MAL-2026-14436](https://insights.sbomify.com/MAL-2026-14436/): Malicious code in poly-price-node (npm) (malicious package) - [MAL-2026-14435](https://insights.sbomify.com/MAL-2026-14435/): Malicious code in paypal-business-sdk (npm) (malicious package) - [MAL-2026-14434](https://insights.sbomify.com/MAL-2026-14434/): Malicious code in openai-pr-reviewer (npm) (malicious package) - [MAL-2026-14433](https://insights.sbomify.com/MAL-2026-14433/): Malicious code in manticore-log (npm) (malicious package) - [MAL-2026-14432](https://insights.sbomify.com/MAL-2026-14432/): Malicious code in kelly-stake-sizing (npm) (malicious package) - [MAL-2026-14431](https://insights.sbomify.com/MAL-2026-14431/): Malicious code in hydration-ui-dim (npm) (malicious package) - [MAL-2026-14430](https://insights.sbomify.com/MAL-2026-14430/): Malicious code in hydration-dim-ui (npm) (malicious package) - [MAL-2026-1443](https://insights.sbomify.com/MAL-2026-1443/): Malicious code in es-lint-builder (npm) (malicious package) - [MAL-2026-14429](https://insights.sbomify.com/MAL-2026-14429/): Malicious code in dim-hydration-ui (npm) (malicious package) - [MAL-2026-14428](https://insights.sbomify.com/MAL-2026-14428/): Malicious code in consumerweb-serverutils (npm) (malicious package) - [MAL-2026-14427](https://insights.sbomify.com/MAL-2026-14427/): Malicious code in chai-as-mno (npm) (malicious package) - [MAL-2026-14426](https://insights.sbomify.com/MAL-2026-14426/): Malicious code in babel-polyfill-plugin-corejs2 (npm) (malicious package) - [MAL-2026-14425](https://insights.sbomify.com/MAL-2026-14425/): Malicious code in auth-otp (npm) (malicious package) - [MAL-2026-14424](https://insights.sbomify.com/MAL-2026-14424/): Malicious code in @medisend/webview-bridge (npm) (malicious package) - [MAL-2026-14423](https://insights.sbomify.com/MAL-2026-14423/): Malicious code in @medisend/shared (npm) (malicious package) - [MAL-2026-14422](https://insights.sbomify.com/MAL-2026-14422/): Malicious code in @medisend/core (npm) (malicious package) - [MAL-2026-14421](https://insights.sbomify.com/MAL-2026-14421/): Malicious code in @medisend/auth (npm) (malicious package) - [MAL-2026-14420](https://insights.sbomify.com/MAL-2026-14420/): Malicious code in @gsas/gsas-sdk (npm) (malicious package) - [MAL-2026-1442](https://insights.sbomify.com/MAL-2026-1442/): Malicious code in bignumber-tool.js (npm) (malicious package) - [MAL-2026-14419](https://insights.sbomify.com/MAL-2026-14419/): Malicious code in tkyoussef-hb (npm) (malicious package) - [MAL-2026-14418](https://insights.sbomify.com/MAL-2026-14418/): Malicious code in dotish (npm) (malicious package) - [MAL-2026-14417](https://insights.sbomify.com/MAL-2026-14417/): Malicious code in dims-svelte-ui (npm) (malicious package) - [MAL-2026-14416](https://insights.sbomify.com/MAL-2026-14416/): Malicious code in dims-hydration-ui (npm) (malicious package) - [MAL-2026-14415](https://insights.sbomify.com/MAL-2026-14415/): Malicious code in react-dynamic-parser (npm) (malicious package) - [MAL-2026-14414](https://insights.sbomify.com/MAL-2026-14414/): Malicious code in mcp-real-chrome (npm) (malicious package) - [MAL-2026-14413](https://insights.sbomify.com/MAL-2026-14413/): Malicious code in livemcp (npm) (malicious package) - [MAL-2026-14412](https://insights.sbomify.com/MAL-2026-14412/): Malicious code in @deepaksilaych/sess (npm) (malicious package) - [MAL-2026-14411](https://insights.sbomify.com/MAL-2026-14411/): Malicious code in dpg-media-7ehemel (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/142/