# Vulnerabilities published in 2026


- [MAL-2026-14320](https://insights.sbomify.com/MAL-2026-14320/): Malicious code in test-flow-entire6 (npm) (malicious package)
- [MAL-2026-1432](https://insights.sbomify.com/MAL-2026-1432/): Malicious code in dgl-cu117 (PyPI) (malicious package)
- [MAL-2026-14319](https://insights.sbomify.com/MAL-2026-14319/): Malicious code in test-flow-1 (npm) (malicious package)
- [MAL-2026-14318](https://insights.sbomify.com/MAL-2026-14318/): Malicious code in frenchworldcupwin (npm) (malicious package)
- [MAL-2026-14317](https://insights.sbomify.com/MAL-2026-14317/): Malicious code in fetch-webjs-script (npm) (malicious package)
- [MAL-2026-14316](https://insights.sbomify.com/MAL-2026-14316/): Malicious code in expect-dotenv (npm) (malicious package)
- [MAL-2026-14315](https://insights.sbomify.com/MAL-2026-14315/): Malicious code in @httttt/mcp-demo (npm) (malicious package)
- [MAL-2026-14314](https://insights.sbomify.com/MAL-2026-14314/): Malicious code in webpack-cdn-fetcher (npm) (malicious package)
- [MAL-2026-14313](https://insights.sbomify.com/MAL-2026-14313/): Malicious code in node-runtime-utils (npm) (malicious package)
- [MAL-2026-14312](https://insights.sbomify.com/MAL-2026-14312/): Malicious code in griffin-transliterator (npm) (malicious package)
- [MAL-2026-14311](https://insights.sbomify.com/MAL-2026-14311/): Malicious code in eslint-config-consumerweb (npm) (malicious package)
- [MAL-2026-14310](https://insights.sbomify.com/MAL-2026-14310/): Malicious code in bunnyhijack-test-0x00 (npm) (malicious package)
- [MAL-2026-1431](https://insights.sbomify.com/MAL-2026-1431/): Malicious code in ariadne-federation (PyPI) (malicious package)
- [MAL-2026-14309](https://insights.sbomify.com/MAL-2026-14309/): Malicious code in @idanefraim/my-ui-kit (npm) (malicious package)
- [MAL-2026-14308](https://insights.sbomify.com/MAL-2026-14308/): Malicious code in libasync (PyPI) (malicious package)
- [MAL-2026-14307](https://insights.sbomify.com/MAL-2026-14307/): Malicious code in express-route-engine (npm) (malicious package)
- [MAL-2026-14306](https://insights.sbomify.com/MAL-2026-14306/): Malicious code in rc4-secure (PyPI) (malicious package)
- [MAL-2026-14305](https://insights.sbomify.com/MAL-2026-14305/): Malicious code in mc-provider (npm) (malicious package)
- [MAL-2026-14304](https://insights.sbomify.com/MAL-2026-14304/): Malicious code in base99-85x (npm) (malicious package)
- [MAL-2026-14303](https://insights.sbomify.com/MAL-2026-14303/): Malicious code in x6842179305 (npm) (malicious package)
- [MAL-2026-14302](https://insights.sbomify.com/MAL-2026-14302/): Malicious code in ai-texts-utils (npm) (malicious package)
- [MAL-2026-14301](https://insights.sbomify.com/MAL-2026-14301/): Malicious code in evm-validation (npm) (malicious package)
- [MAL-2026-14300](https://insights.sbomify.com/MAL-2026-14300/): Malicious code in eth-react-provider (npm) (malicious package)
- [MAL-2026-1430](https://insights.sbomify.com/MAL-2026-1430/): Malicious code in @3stripes/utils (npm) (malicious package)
- [MAL-2026-143](https://insights.sbomify.com/MAL-2026-143/): Malicious code in rt-text-media-grid-collection (npm) (malicious package)
- [MAL-2026-14299](https://insights.sbomify.com/MAL-2026-14299/): Malicious code in gear-composer (npm) (malicious package)
- [MAL-2026-14298](https://insights.sbomify.com/MAL-2026-14298/): Malicious code in emoji-prints-fancy (npm) (malicious package)
- [MAL-2026-14297](https://insights.sbomify.com/MAL-2026-14297/): Malicious code in homekit-mcp (npm) (malicious package)
- [MAL-2026-14296](https://insights.sbomify.com/MAL-2026-14296/): Malicious code in gfff5 (npm) (malicious package)
- [MAL-2026-14295](https://insights.sbomify.com/MAL-2026-14295/): Malicious code in mcp-dev-toolkit (npm) (malicious package)
- [MAL-2026-14294](https://insights.sbomify.com/MAL-2026-14294/): Malicious code in mc-registry (npm) (malicious package)
- [MAL-2026-14293](https://insights.sbomify.com/MAL-2026-14293/): Malicious code in matrixflow-js (npm) (malicious package)
- [MAL-2026-14292](https://insights.sbomify.com/MAL-2026-14292/): Malicious code in log-res (npm) (malicious package)
- [MAL-2026-14291](https://insights.sbomify.com/MAL-2026-14291/): Malicious code in libas-signal (npm) (malicious package)
- [MAL-2026-14290](https://insights.sbomify.com/MAL-2026-14290/): Malicious code in anhn-cli (npm) (malicious package)
- [MAL-2026-1429](https://insights.sbomify.com/MAL-2026-1429/): Malicious code in @3stripes/ui (npm) (malicious package)
- [MAL-2026-14289](https://insights.sbomify.com/MAL-2026-14289/): Malicious code in @wizloft/harness-validation (npm) (malicious package)
- [MAL-2026-14288](https://insights.sbomify.com/MAL-2026-14288/): Malicious code in @wizloft/harness-plugin-repository-files (npm) (malicious package)
- [MAL-2026-14287](https://insights.sbomify.com/MAL-2026-14287/): Malicious code in @wizloft/harness-kernel (npm) (malicious package)
- [MAL-2026-14286](https://insights.sbomify.com/MAL-2026-14286/): Malicious code in @wizloft/harness-context (npm) (malicious package)
- [MAL-2026-14285](https://insights.sbomify.com/MAL-2026-14285/): Malicious code in @wizloft/harness (npm) (malicious package)
- [MAL-2026-14284](https://insights.sbomify.com/MAL-2026-14284/): Malicious code in nibra1 (npm) (malicious package)
- [MAL-2026-14283](https://insights.sbomify.com/MAL-2026-14283/): Malicious code in neverthrow-core (npm) (malicious package)
- [MAL-2026-14282](https://insights.sbomify.com/MAL-2026-14282/): Malicious code in mutex-plus (npm) (malicious package)
- [MAL-2026-14281](https://insights.sbomify.com/MAL-2026-14281/): Malicious code in mutex-lite (npm) (malicious package)
- [MAL-2026-14280](https://insights.sbomify.com/MAL-2026-14280/): Malicious code in mutex-core (npm) (malicious package)
- [MAL-2026-1428](https://insights.sbomify.com/MAL-2026-1428/): Malicious code in @3stripes/lib (npm) (malicious package)
- [MAL-2026-14279](https://insights.sbomify.com/MAL-2026-14279/): Malicious code in localize-translate (npm) (malicious package)
- [MAL-2026-14278](https://insights.sbomify.com/MAL-2026-14278/): Malicious code in layer2-sdk (npm) (malicious package)
- [MAL-2026-14277](https://insights.sbomify.com/MAL-2026-14277/): Malicious code in o0o9 (npm) (malicious package)
- [MAL-2026-14276](https://insights.sbomify.com/MAL-2026-14276/): Malicious code in node_cryptography (npm) (malicious package)
- [MAL-2026-14275](https://insights.sbomify.com/MAL-2026-14275/): Malicious code in minequest (npm) (malicious package)
- [MAL-2026-14274](https://insights.sbomify.com/MAL-2026-14274/): Malicious code in reqcrypt-dev (PyPI) (malicious package)
- [MAL-2026-14273](https://insights.sbomify.com/MAL-2026-14273/): Malicious code in rand-txs-sdk (npm) (malicious package)
- [MAL-2026-14272](https://insights.sbomify.com/MAL-2026-14272/): Malicious code in price-scripping-js (npm) (malicious package)
- [MAL-2026-14271](https://insights.sbomify.com/MAL-2026-14271/): Malicious code in nodeberlin (npm) (malicious package)
- [MAL-2026-14270](https://insights.sbomify.com/MAL-2026-14270/): Malicious code in nodealpha (npm) (malicious package)
- [MAL-2026-1427](https://insights.sbomify.com/MAL-2026-1427/): Malicious code in @3stripes/helpers (npm) (malicious package)
- [MAL-2026-14269](https://insights.sbomify.com/MAL-2026-14269/): Malicious code in novel-suduko (npm) (malicious package)
- [MAL-2026-14268](https://insights.sbomify.com/MAL-2026-14268/): Malicious code in no-for-of-loops (npm) (malicious package)
- [MAL-2026-14267](https://insights.sbomify.com/MAL-2026-14267/): Malicious code in karma-proxy (npm) (malicious package)
- [MAL-2026-14266](https://insights.sbomify.com/MAL-2026-14266/): Malicious code in electron-sessions (npm) (malicious package)
- [MAL-2026-14265](https://insights.sbomify.com/MAL-2026-14265/): Malicious code in easydsbots (npm) (malicious package)
- [MAL-2026-14264](https://insights.sbomify.com/MAL-2026-14264/): Malicious code in de-morgan (npm) (malicious package)
- [MAL-2026-14263](https://insights.sbomify.com/MAL-2026-14263/): Malicious code in arb-kit (npm) (malicious package)
- [MAL-2026-14262](https://insights.sbomify.com/MAL-2026-14262/): Malicious code in pump-fun-skills (npm) (malicious package)
- [MAL-2026-14261](https://insights.sbomify.com/MAL-2026-14261/): Malicious code in postcss-initialize-provider (npm) (malicious package)
- [MAL-2026-14260](https://insights.sbomify.com/MAL-2026-14260/): Malicious code in ranux-pro (npm) (malicious package)
- [MAL-2026-1426](https://insights.sbomify.com/MAL-2026-1426/): Malicious code in @3stripes/common (npm) (malicious package)
- [MAL-2026-14259](https://insights.sbomify.com/MAL-2026-14259/): Malicious code in ranux-dev (npm) (malicious package)
- [MAL-2026-14258](https://insights.sbomify.com/MAL-2026-14258/): Malicious code in ranux-cloud (npm) (malicious package)
- [MAL-2026-14257](https://insights.sbomify.com/MAL-2026-14257/): Malicious code in modsync (npm) (malicious package)
- [MAL-2026-14256](https://insights.sbomify.com/MAL-2026-14256/): Malicious code in api-rs-tuils (npm) (malicious package)
- [MAL-2026-14255](https://insights.sbomify.com/MAL-2026-14255/): Malicious code in secp256k1-lib (npm) (malicious package)
- [MAL-2026-14254](https://insights.sbomify.com/MAL-2026-14254/): Malicious code in saaa9 (npm) (malicious package)
- [MAL-2026-14253](https://insights.sbomify.com/MAL-2026-14253/): Malicious code in react-dom-helpers (npm) (malicious package)
- [MAL-2026-14252](https://insights.sbomify.com/MAL-2026-14252/): Malicious code in npm-wold (npm) (malicious package)
- [MAL-2026-14251](https://insights.sbomify.com/MAL-2026-14251/): Malicious code in ngsw-config (npm) (malicious package)
- [MAL-2026-14250](https://insights.sbomify.com/MAL-2026-14250/): Malicious code in luluking1 (npm) (malicious package)
- [MAL-2026-1425](https://insights.sbomify.com/MAL-2026-1425/): Malicious code in @3stripes/auth (npm) (malicious package)
- [MAL-2026-14249](https://insights.sbomify.com/MAL-2026-14249/): Malicious code in localize-extract (npm) (malicious package)
- [MAL-2026-14248](https://insights.sbomify.com/MAL-2026-14248/): Malicious code in nice-utils-helper (npm) (malicious package)
- [MAL-2026-14247](https://insights.sbomify.com/MAL-2026-14247/): Malicious code in magika-js (npm) (malicious package)
- [MAL-2026-14246](https://insights.sbomify.com/MAL-2026-14246/): Malicious code in hardhat-hold (npm) (malicious package)
- [MAL-2026-14245](https://insights.sbomify.com/MAL-2026-14245/): Malicious code in github-policy-bot (npm) (malicious package)
- [MAL-2026-14244](https://insights.sbomify.com/MAL-2026-14244/): Malicious code in gemini-cli-a2a-server (npm) (malicious package)
- [MAL-2026-14243](https://insights.sbomify.com/MAL-2026-14243/): Malicious code in flydev (npm) (malicious package)
- [MAL-2026-14242](https://insights.sbomify.com/MAL-2026-14242/): Malicious code in electro-session (npm) (malicious package)
- [MAL-2026-14241](https://insights.sbomify.com/MAL-2026-14241/): Malicious code in dxrs-dos (npm) (malicious package)
- [MAL-2026-14240](https://insights.sbomify.com/MAL-2026-14240/): Malicious code in dxr-dos (npm) (malicious package)
- [MAL-2026-1424](https://insights.sbomify.com/MAL-2026-1424/): Malicious code in @3stripes/api-client (npm) (malicious package)
- [MAL-2026-14239](https://insights.sbomify.com/MAL-2026-14239/): Malicious code in gaarf-node-bq (npm) (malicious package)
- [MAL-2026-14238](https://insights.sbomify.com/MAL-2026-14238/): Malicious code in gaarf-node (npm) (malicious package)
- [MAL-2026-14237](https://insights.sbomify.com/MAL-2026-14237/): Malicious code in gaarf-bq (npm) (malicious package)
- [MAL-2026-14236](https://insights.sbomify.com/MAL-2026-14236/): Malicious code in gaarf (npm) (malicious package)
- [MAL-2026-14235](https://insights.sbomify.com/MAL-2026-14235/): Malicious code in config-helper-kit (npm) (malicious package)
- [MAL-2026-14234](https://insights.sbomify.com/MAL-2026-14234/): Malicious code in commandor-lib (npm) (malicious package)
- [MAL-2026-14233](https://insights.sbomify.com/MAL-2026-14233/): Malicious code in code-assist-mcp (npm) (malicious package)
- [MAL-2026-14232](https://insights.sbomify.com/MAL-2026-14232/): Malicious code in chromeos-webdriver-cli (npm) (malicious package)
- [MAL-2026-14231](https://insights.sbomify.com/MAL-2026-14231/): Malicious code in chromecast-webdriver-cli (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/144/