# Vulnerabilities published in 2026 - [MAL-2026-14410](https://insights.sbomify.com/MAL-2026-14410/): Malicious code in @temptation.js/utils (npm) (malicious package) - [MAL-2026-1441](https://insights.sbomify.com/MAL-2026-1441/): Malicious code in big-numben (npm) (malicious package) - [MAL-2026-14409](https://insights.sbomify.com/MAL-2026-14409/): Malicious code in polis-diraja (npm) (malicious package) - [MAL-2026-14408](https://insights.sbomify.com/MAL-2026-14408/): Malicious code in dext-crate-video (npm) (malicious package) - [MAL-2026-14407](https://insights.sbomify.com/MAL-2026-14407/): Malicious code in dext-crate-image (npm) (malicious package) - [MAL-2026-14406](https://insights.sbomify.com/MAL-2026-14406/): Malicious code in dext-crate-check (npm) (malicious package) - [MAL-2026-14405](https://insights.sbomify.com/MAL-2026-14405/): Malicious code in create-json-client (npm) (malicious package) - [MAL-2026-14404](https://insights.sbomify.com/MAL-2026-14404/): Malicious code in @blurrydespair/libsignal-node (npm) (malicious package) - [MAL-2026-14403](https://insights.sbomify.com/MAL-2026-14403/): Malicious code in react-emits (npm) (malicious package) - [MAL-2026-14402](https://insights.sbomify.com/MAL-2026-14402/): Malicious code in agentgui (npm) (malicious package) - [MAL-2026-14401](https://insights.sbomify.com/MAL-2026-14401/): Malicious code in multyproccess (PyPI) (malicious package) - [MAL-2026-14400](https://insights.sbomify.com/MAL-2026-14400/): Malicious code in sm-session (npm) (malicious package) - [MAL-2026-1440](https://insights.sbomify.com/MAL-2026-1440/): Malicious code in @vtim/xss-poc (npm) (malicious package) - [MAL-2026-144](https://insights.sbomify.com/MAL-2026-144/): Malicious code in scrollbar-stylecss (npm) (malicious package) - [MAL-2026-14399](https://insights.sbomify.com/MAL-2026-14399/): Malicious code in sm-payment (npm) (malicious package) - [MAL-2026-14398](https://insights.sbomify.com/MAL-2026-14398/): Malicious code in sm-oauth (npm) (malicious package) - [MAL-2026-14397](https://insights.sbomify.com/MAL-2026-14397/): Malicious code in sm-checkout (npm) (malicious package) - [MAL-2026-14396](https://insights.sbomify.com/MAL-2026-14396/): Malicious code in sm-cart (npm) (malicious package) - [MAL-2026-14395](https://insights.sbomify.com/MAL-2026-14395/): Malicious code in sm-billing-form (npm) (malicious package) - [MAL-2026-14394](https://insights.sbomify.com/MAL-2026-14394/): Malicious code in sm-apikey-model (npm) (malicious package) - [MAL-2026-14393](https://insights.sbomify.com/MAL-2026-14393/): Malicious code in sm-admin (npm) (malicious package) - [MAL-2026-14392](https://insights.sbomify.com/MAL-2026-14392/): Malicious code in message-compiler (npm) (malicious package) - [MAL-2026-14391](https://insights.sbomify.com/MAL-2026-14391/): Malicious code in fund-calculator (npm) (malicious package) - [MAL-2026-14390](https://insights.sbomify.com/MAL-2026-14390/): Malicious code in amundi-compare (npm) (malicious package) - [MAL-2026-1439](https://insights.sbomify.com/MAL-2026-1439/): Malicious code in @omhc/libsignal-node (npm) (malicious package) - [MAL-2026-14389](https://insights.sbomify.com/MAL-2026-14389/): Malicious code in envprovision (PyPI) (malicious package) - [MAL-2026-14388](https://insights.sbomify.com/MAL-2026-14388/): Malicious code in cryptgraphy (PyPI) (malicious package) - [MAL-2026-14387](https://insights.sbomify.com/MAL-2026-14387/): Malicious code in @opap/player-kyc-widget (npm) (malicious package) - [MAL-2026-14386](https://insights.sbomify.com/MAL-2026-14386/): Malicious code in svelte-dim-kit (npm) (malicious package) - [MAL-2026-14385](https://insights.sbomify.com/MAL-2026-14385/): Malicious code in hydration-dim-kit (npm) (malicious package) - [MAL-2026-14384](https://insights.sbomify.com/MAL-2026-14384/): Malicious code in mlflow-otel-instrumentor (PyPI) (malicious package) - [MAL-2026-14383](https://insights.sbomify.com/MAL-2026-14383/): Malicious code in @sdgdfgdfhhhfd/multiviewr (npm) (malicious package) - [MAL-2026-14382](https://insights.sbomify.com/MAL-2026-14382/): Malicious code in @sdgdfgdfhhhfd/chainvista (npm) (malicious package) - [MAL-2026-14381](https://insights.sbomify.com/MAL-2026-14381/): Malicious code in fund-portfolio (npm) (malicious package) - [MAL-2026-14380](https://insights.sbomify.com/MAL-2026-14380/): Malicious code in fund-list-filter (npm) (malicious package) - [MAL-2026-1438](https://insights.sbomify.com/MAL-2026-1438/): Malicious code in pymnemonic (PyPI) (malicious package) - [MAL-2026-14379](https://insights.sbomify.com/MAL-2026-14379/): Malicious code in totp-utils (npm) (malicious package) - [MAL-2026-14378](https://insights.sbomify.com/MAL-2026-14378/): Malicious code in stillm4ddpocs-rtest-bravo (npm) (malicious package) - [MAL-2026-14377](https://insights.sbomify.com/MAL-2026-14377/): Malicious code in stillm4ddpocs-rtest-alpha (npm) (malicious package) - [MAL-2026-14376](https://insights.sbomify.com/MAL-2026-14376/): Malicious code in stillm4ddpocs-demo-sprocket (npm) (malicious package) - [MAL-2026-14375](https://insights.sbomify.com/MAL-2026-14375/): Malicious code in solidity-testing-utils (npm) (malicious package) - [MAL-2026-14374](https://insights.sbomify.com/MAL-2026-14374/): Malicious code in rust-testing-utils (npm) (malicious package) - [MAL-2026-14373](https://insights.sbomify.com/MAL-2026-14373/): Malicious code in hatdhat-testkit (npm) (malicious package) - [MAL-2026-14372](https://insights.sbomify.com/MAL-2026-14372/): Malicious code in create-coin (npm) (malicious package) - [MAL-2026-14371](https://insights.sbomify.com/MAL-2026-14371/): Malicious code in chai-as-testkit (npm) (malicious package) - [MAL-2026-14370](https://insights.sbomify.com/MAL-2026-14370/): Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm) (malicious package) - [MAL-2026-1437](https://insights.sbomify.com/MAL-2026-1437/): Malicious code in flowpeek (PyPI) (malicious package) - [MAL-2026-14369](https://insights.sbomify.com/MAL-2026-14369/): Malicious code in @syncraft-labs/vue (npm) (malicious package) - [MAL-2026-14368](https://insights.sbomify.com/MAL-2026-14368/): Malicious code in @syncraft-labs/react (npm) (malicious package) - [MAL-2026-14367](https://insights.sbomify.com/MAL-2026-14367/): Malicious code in @syncraft-labs/core (npm) (malicious package) - [MAL-2026-14366](https://insights.sbomify.com/MAL-2026-14366/): Malicious code in 8-fetchsight-web (npm) (malicious package) - [MAL-2026-14365](https://insights.sbomify.com/MAL-2026-14365/): Malicious code in 6-viewsight-web (npm) (malicious package) - [MAL-2026-14364](https://insights.sbomify.com/MAL-2026-14364/): Malicious code in 3-buildsight-web (npm) (malicious package) - [MAL-2026-14363](https://insights.sbomify.com/MAL-2026-14363/): Malicious code in 2-loadsight-web (npm) (malicious package) - [MAL-2026-14362](https://insights.sbomify.com/MAL-2026-14362/): Malicious code in 10-shardsight-web (npm) (malicious package) - [MAL-2026-14361](https://insights.sbomify.com/MAL-2026-14361/): Malicious code in stillm4ddpocs-demo-gadget (npm) (malicious package) - [MAL-2026-14360](https://insights.sbomify.com/MAL-2026-14360/): Malicious code in stillm4ddpocs-demo-widget (npm) (malicious package) - [MAL-2026-1436](https://insights.sbomify.com/MAL-2026-1436/): Malicious code in do-not-install-this-package-004 (PyPI) (malicious package) - [MAL-2026-14359](https://insights.sbomify.com/MAL-2026-14359/): Malicious code in internallib_v902 (npm) (malicious package) - [MAL-2026-14358](https://insights.sbomify.com/MAL-2026-14358/): Malicious code in scrambleeeer (PyPI) (malicious package) - [MAL-2026-14357](https://insights.sbomify.com/MAL-2026-14357/): Malicious code in @postman-cse/okta-aio-linux-arm64 (npm) (malicious package) - [MAL-2026-14356](https://insights.sbomify.com/MAL-2026-14356/): Malicious code in lumen-pages-community (npm) (malicious package) - [MAL-2026-14355](https://insights.sbomify.com/MAL-2026-14355/): Malicious code in fuel-react (npm) (malicious package) - [MAL-2026-14354](https://insights.sbomify.com/MAL-2026-14354/): Malicious code in kelly-sizing (npm) (malicious package) - [MAL-2026-14353](https://insights.sbomify.com/MAL-2026-14353/): Malicious code in @gfe/lx-watcher (npm) (malicious package) - [MAL-2026-14352](https://insights.sbomify.com/MAL-2026-14352/): Malicious code in tailwind-animate-css-plugin (npm) (malicious package) - [MAL-2026-14351](https://insights.sbomify.com/MAL-2026-14351/): Malicious code in requests-crypt (PyPI) (malicious package) - [MAL-2026-14350](https://insights.sbomify.com/MAL-2026-14350/): Malicious code in scrambleeer (PyPI) (malicious package) - [MAL-2026-1435](https://insights.sbomify.com/MAL-2026-1435/): Malicious code in python-anchor (PyPI) (malicious package) - [MAL-2026-14349](https://insights.sbomify.com/MAL-2026-14349/): Malicious code in boto4 (PyPI) (malicious package) - [MAL-2026-14348](https://insights.sbomify.com/MAL-2026-14348/): Malicious code in moidevy (npm) (malicious package) - [MAL-2026-14347](https://insights.sbomify.com/MAL-2026-14347/): Malicious code in mcq-session (npm) (malicious package) - [MAL-2026-14346](https://insights.sbomify.com/MAL-2026-14346/): Malicious code in @next-fonts/font (npm) (malicious package) - [MAL-2026-14345](https://insights.sbomify.com/MAL-2026-14345/): Malicious code in express-session-handler (npm) (malicious package) - [MAL-2026-14344](https://insights.sbomify.com/MAL-2026-14344/): Malicious code in @js-lib-team/env-parser (npm) (malicious package) - [MAL-2026-14343](https://insights.sbomify.com/MAL-2026-14343/): Malicious code in chai-as-soul (npm) (malicious package) - [MAL-2026-14342](https://insights.sbomify.com/MAL-2026-14342/): Malicious code in coin-fees (npm) (malicious package) - [MAL-2026-14341](https://insights.sbomify.com/MAL-2026-14341/): Malicious code in reqcrypts (PyPI) (malicious package) - [MAL-2026-14340](https://insights.sbomify.com/MAL-2026-14340/): Malicious code in tinymember (crates.io) (malicious package) - [MAL-2026-1434](https://insights.sbomify.com/MAL-2026-1434/): Malicious code in my-super-lib (PyPI) (malicious package) - [MAL-2026-14339](https://insights.sbomify.com/MAL-2026-14339/): Malicious code in proc_macro_en (crates.io) (malicious package) - [MAL-2026-14338](https://insights.sbomify.com/MAL-2026-14338/): Malicious code in proc_macro1 (crates.io) (malicious package) - [MAL-2026-14337](https://insights.sbomify.com/MAL-2026-14337/): Malicious code in internment (crates.io) (malicious package) - [MAL-2026-14336](https://insights.sbomify.com/MAL-2026-14336/): Malicious code in arrayref (crates.io) (malicious package) - [MAL-2026-14335](https://insights.sbomify.com/MAL-2026-14335/): Malicious code in aronenao (crates.io) (malicious package) - [MAL-2026-14334](https://insights.sbomify.com/MAL-2026-14334/): Malicious code in arone (crates.io) (malicious package) - [MAL-2026-14333](https://insights.sbomify.com/MAL-2026-14333/): Malicious code in append_only_vec (crates.io) (malicious package) - [MAL-2026-14332](https://insights.sbomify.com/MAL-2026-14332/): Malicious code in aovine (crates.io) (malicious package) - [MAL-2026-14331](https://insights.sbomify.com/MAL-2026-14331/): Malicious code in exam-kit (npm) (malicious package) - [MAL-2026-14330](https://insights.sbomify.com/MAL-2026-14330/): Malicious code in @pablo_clueless/sniffr (npm) (malicious package) - [MAL-2026-1433](https://insights.sbomify.com/MAL-2026-1433/): Malicious code in kvstore-pb2-grpc (PyPI) (malicious package) - [MAL-2026-14329](https://insights.sbomify.com/MAL-2026-14329/): Malicious code in @pablo_clueless/printr (npm) (malicious package) - [MAL-2026-14328](https://insights.sbomify.com/MAL-2026-14328/): Malicious code in goldstar-api-server (npm) (malicious package) - [MAL-2026-14327](https://insights.sbomify.com/MAL-2026-14327/): Malicious code in ethereum-validator (npm) (malicious package) - [MAL-2026-14326](https://insights.sbomify.com/MAL-2026-14326/): Malicious code in create-react-app-ux (npm) (malicious package) - [MAL-2026-14325](https://insights.sbomify.com/MAL-2026-14325/): Malicious code in create-react-app-ui (npm) (malicious package) - [MAL-2026-14324](https://insights.sbomify.com/MAL-2026-14324/): Malicious code in create-react-app-text (npm) (malicious package) - [MAL-2026-14323](https://insights.sbomify.com/MAL-2026-14323/): Malicious code in cig-data-patcher (npm) (malicious package) - [MAL-2026-14322](https://insights.sbomify.com/MAL-2026-14322/): Malicious code in debug-fnt (npm) (malicious package) - [MAL-2026-14321](https://insights.sbomify.com/MAL-2026-14321/): Malicious code in test-flow-entire7 (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/143/