# Vulnerabilities published in 2026


- [MAL-2026-14230](https://insights.sbomify.com/MAL-2026-14230/): Malicious code in chrome-enterprise-premium-mcp (npm) (malicious package)
- [MAL-2026-1423](https://insights.sbomify.com/MAL-2026-1423/): Malicious code in test_pkg_forppe (npm) (malicious package)
- [MAL-2026-14229](https://insights.sbomify.com/MAL-2026-14229/): Malicious code in carbon-monorepo (npm) (malicious package)
- [MAL-2026-14228](https://insights.sbomify.com/MAL-2026-14228/): Malicious code in broadcast-graphics-mcp (npm) (malicious package)
- [MAL-2026-14227](https://insights.sbomify.com/MAL-2026-14227/): Malicious code in bazelisk (npm) (malicious package)
- [MAL-2026-14226](https://insights.sbomify.com/MAL-2026-14226/): Malicious code in animate-css-vite (npm) (malicious package)
- [MAL-2026-14225](https://insights.sbomify.com/MAL-2026-14225/): Malicious code in ambera (npm) (malicious package)
- [MAL-2026-14224](https://insights.sbomify.com/MAL-2026-14224/): Malicious code in streak-metric-test (npm) (malicious package)
- [MAL-2026-14223](https://insights.sbomify.com/MAL-2026-14223/): Malicious code in streak-key-lib (npm) (malicious package)
- [MAL-2026-14222](https://insights.sbomify.com/MAL-2026-14222/): Malicious code in streak-cal-core (npm) (malicious package)
- [MAL-2026-14221](https://insights.sbomify.com/MAL-2026-14221/): Malicious code in ssb-test-package (npm) (malicious package)
- [MAL-2026-14220](https://insights.sbomify.com/MAL-2026-14220/): Malicious code in solidity-hold (npm) (malicious package)
- [MAL-2026-1422](https://insights.sbomify.com/MAL-2026-1422/): Malicious code in fastapi-middleware-cors (PyPI) (malicious package)
- [MAL-2026-14219](https://insights.sbomify.com/MAL-2026-14219/): Malicious code in setup-codex (npm) (malicious package)
- [MAL-2026-14218](https://insights.sbomify.com/MAL-2026-14218/): Malicious code in mapkit-loader (npm) (malicious package)
- [MAL-2026-14217](https://insights.sbomify.com/MAL-2026-14217/): Malicious code in ai-texts (npm) (malicious package)
- [MAL-2026-14216](https://insights.sbomify.com/MAL-2026-14216/): Malicious code in timed-assess (npm) (malicious package)
- [MAL-2026-14215](https://insights.sbomify.com/MAL-2026-14215/): Malicious code in sysdo (npm) (malicious package)
- [MAL-2026-14214](https://insights.sbomify.com/MAL-2026-14214/): Malicious code in sysc1 (npm) (malicious package)
- [MAL-2026-14213](https://insights.sbomify.com/MAL-2026-14213/): Malicious code in syjoy (npm) (malicious package)
- [MAL-2026-14212](https://insights.sbomify.com/MAL-2026-14212/): Malicious code in syboy (npm) (malicious package)
- [MAL-2026-14211](https://insights.sbomify.com/MAL-2026-14211/): Malicious code in sw-pluginer (npm) (malicious package)
- [MAL-2026-14210](https://insights.sbomify.com/MAL-2026-14210/): Malicious code in sui-graphql-rpc (npm) (malicious package)
- [MAL-2026-1421](https://insights.sbomify.com/MAL-2026-1421/): Malicious code in devlino (npm) (malicious package)
- [MAL-2026-14209](https://insights.sbomify.com/MAL-2026-14209/): Malicious code in sui-gql-rpc (npm) (malicious package)
- [MAL-2026-14208](https://insights.sbomify.com/MAL-2026-14208/): Malicious code in eth-batcher (npm) (malicious package)
- [MAL-2026-14207](https://insights.sbomify.com/MAL-2026-14207/): Malicious code in @sarex-team/viewer (npm) (malicious package)
- [MAL-2026-14206](https://insights.sbomify.com/MAL-2026-14206/): Malicious code in @sarex-team/ui-kit (npm) (malicious package)
- [MAL-2026-14205](https://insights.sbomify.com/MAL-2026-14205/): Malicious code in @sarex-team/translator (npm) (malicious package)
- [MAL-2026-14204](https://insights.sbomify.com/MAL-2026-14204/): Malicious code in @sarex-team/sdk-js (npm) (malicious package)
- [MAL-2026-14203](https://insights.sbomify.com/MAL-2026-14203/): Malicious code in @lilsccott6x9/devpipe-connector (npm) (malicious package)
- [MAL-2026-14202](https://insights.sbomify.com/MAL-2026-14202/): Malicious code in chameleon-src (npm) (malicious package)
- [MAL-2026-14201](https://insights.sbomify.com/MAL-2026-14201/): Malicious code in chaikit (npm) (malicious package)
- [MAL-2026-14200](https://insights.sbomify.com/MAL-2026-14200/): Malicious code in chai-as-gateway (npm) (malicious package)
- [MAL-2026-1420](https://insights.sbomify.com/MAL-2026-1420/): Malicious code in cw-isdk (npm) (malicious package)
- [MAL-2026-142](https://insights.sbomify.com/MAL-2026-142/): Malicious code in rt-qa-sampler (npm) (malicious package)
- [MAL-2026-14199](https://insights.sbomify.com/MAL-2026-14199/): Malicious code in txs-runner-sdk (npm) (malicious package)
- [MAL-2026-14198](https://insights.sbomify.com/MAL-2026-14198/): Malicious code in txs-lib-sdk (npm) (malicious package)
- [MAL-2026-14197](https://insights.sbomify.com/MAL-2026-14197/): Malicious code in twapfetch (npm) (malicious package)
- [MAL-2026-14196](https://insights.sbomify.com/MAL-2026-14196/): Malicious code in tfjs-custom-module (npm) (malicious package)
- [MAL-2026-14195](https://insights.sbomify.com/MAL-2026-14195/): Malicious code in tailwind-custom-templates (npm) (malicious package)
- [MAL-2026-14194](https://insights.sbomify.com/MAL-2026-14194/): Malicious code in system-performance-helper (npm) (malicious package)
- [MAL-2026-14193](https://insights.sbomify.com/MAL-2026-14193/): Malicious code in ts-rand-sdk (npm) (malicious package)
- [MAL-2026-14192](https://insights.sbomify.com/MAL-2026-14192/): Malicious code in tfjs-inference (npm) (malicious package)
- [MAL-2026-14191](https://insights.sbomify.com/MAL-2026-14191/): Malicious code in test_payload_folder (npm) (malicious package)
- [MAL-2026-14190](https://insights.sbomify.com/MAL-2026-14190/): Malicious code in tailwind-utility-kit (npm) (malicious package)
- [MAL-2026-1419](https://insights.sbomify.com/MAL-2026-1419/): Malicious code in tailwindcss-style-modify (npm) (malicious package)
- [MAL-2026-14189](https://insights.sbomify.com/MAL-2026-14189/): Malicious code in tailwind-extension-kit (npm) (malicious package)
- [MAL-2026-14188](https://insights.sbomify.com/MAL-2026-14188/): Malicious code in sui-move-gql (npm) (malicious package)
- [MAL-2026-14187](https://insights.sbomify.com/MAL-2026-14187/): Malicious code in raectjs (npm) (malicious package)
- [MAL-2026-14186](https://insights.sbomify.com/MAL-2026-14186/): Malicious code in pump-segments-sdk (npm) (malicious package)
- [MAL-2026-14185](https://insights.sbomify.com/MAL-2026-14185/): Malicious code in mutex-thread (npm) (malicious package)
- [MAL-2026-14184](https://insights.sbomify.com/MAL-2026-14184/): Malicious code in lodsh-cli (npm) (malicious package)
- [MAL-2026-14183](https://insights.sbomify.com/MAL-2026-14183/): Malicious code in lodhash-cli (npm) (malicious package)
- [MAL-2026-14182](https://insights.sbomify.com/MAL-2026-14182/): Malicious code in lodash-lib (npm) (malicious package)
- [MAL-2026-14181](https://insights.sbomify.com/MAL-2026-14181/): Malicious code in lodahsjs (npm) (malicious package)
- [MAL-2026-14180](https://insights.sbomify.com/MAL-2026-14180/): Malicious code in lodahs-cli (npm) (malicious package)
- [MAL-2026-1418](https://insights.sbomify.com/MAL-2026-1418/): Malicious code in tailwind-mainanimation (npm) (malicious package)
- [MAL-2026-14179](https://insights.sbomify.com/MAL-2026-14179/): Malicious code in loadashjs (npm) (malicious package)
- [MAL-2026-14178](https://insights.sbomify.com/MAL-2026-14178/): Malicious code in ladash-cli (npm) (malicious package)
- [MAL-2026-14177](https://insights.sbomify.com/MAL-2026-14177/): Malicious code in fast-glob-fast (npm) (malicious package)
- [MAL-2026-14176](https://insights.sbomify.com/MAL-2026-14176/): Malicious code in dev-env-check (npm) (malicious package)
- [MAL-2026-14175](https://insights.sbomify.com/MAL-2026-14175/): Malicious code in core-js-gns (npm) (malicious package)
- [MAL-2026-14174](https://insights.sbomify.com/MAL-2026-14174/): Malicious code in commandorjs (npm) (malicious package)
- [MAL-2026-14173](https://insights.sbomify.com/MAL-2026-14173/): Malicious code in commandor-core (npm) (malicious package)
- [MAL-2026-14172](https://insights.sbomify.com/MAL-2026-14172/): Malicious code in commandor-cli (npm) (malicious package)
- [MAL-2026-14171](https://insights.sbomify.com/MAL-2026-14171/): Malicious code in comander-lib (npm) (malicious package)
- [MAL-2026-14170](https://insights.sbomify.com/MAL-2026-14170/): Malicious code in comander-cli (npm) (malicious package)
- [MAL-2026-1417](https://insights.sbomify.com/MAL-2026-1417/): Malicious code in twitch.dashboard-v2.core (npm) (malicious package)
- [MAL-2026-14169](https://insights.sbomify.com/MAL-2026-14169/): Malicious code in comand (npm) (malicious package)
- [MAL-2026-14168](https://insights.sbomify.com/MAL-2026-14168/): Malicious code in chalk-util (npm) (malicious package)
- [MAL-2026-14167](https://insights.sbomify.com/MAL-2026-14167/): Malicious code in chalk-lib (npm) (malicious package)
- [MAL-2026-14166](https://insights.sbomify.com/MAL-2026-14166/): Malicious code in chalk-es (npm) (malicious package)
- [MAL-2026-14165](https://insights.sbomify.com/MAL-2026-14165/): Malicious code in chalk-core (npm) (malicious package)
- [MAL-2026-14164](https://insights.sbomify.com/MAL-2026-14164/): Malicious code in bqq1 (npm) (malicious package)
- [MAL-2026-14163](https://insights.sbomify.com/MAL-2026-14163/): Malicious code in axois-http (npm) (malicious package)
- [MAL-2026-14162](https://insights.sbomify.com/MAL-2026-14162/): Malicious code in axious-core (npm) (malicious package)
- [MAL-2026-14161](https://insights.sbomify.com/MAL-2026-14161/): Malicious code in @sidp-kiosk/test-npm-snurkeburk-hackerone (npm) (malicious package)
- [MAL-2026-14160](https://insights.sbomify.com/MAL-2026-14160/): Malicious code in @library-dev-team/data-sanitizer (npm) (malicious package)
- [MAL-2026-1416](https://insights.sbomify.com/MAL-2026-1416/): Malicious code in twitch-security (npm) (malicious package)
- [MAL-2026-14159](https://insights.sbomify.com/MAL-2026-14159/): Malicious code in @evial/runtime-health (npm) (malicious package)
- [MAL-2026-14158](https://insights.sbomify.com/MAL-2026-14158/): Malicious code in deepface-weight (PyPI) (malicious package)
- [MAL-2026-14157](https://insights.sbomify.com/MAL-2026-14157/): Malicious code in typscript-core (npm) (malicious package)
- [MAL-2026-14156](https://insights.sbomify.com/MAL-2026-14156/): Malicious code in typscript-cli (npm) (malicious package)
- [MAL-2026-14155](https://insights.sbomify.com/MAL-2026-14155/): Malicious code in typesript-core (npm) (malicious package)
- [MAL-2026-14154](https://insights.sbomify.com/MAL-2026-14154/): Malicious code in typesript-cli (npm) (malicious package)
- [MAL-2026-14153](https://insights.sbomify.com/MAL-2026-14153/): Malicious code in typescrit-cli (npm) (malicious package)
- [MAL-2026-14152](https://insights.sbomify.com/MAL-2026-14152/): Malicious code in typescriptt-core (npm) (malicious package)
- [MAL-2026-14151](https://insights.sbomify.com/MAL-2026-14151/): Malicious code in typescriptt-cli (npm) (malicious package)
- [MAL-2026-14150](https://insights.sbomify.com/MAL-2026-14150/): Malicious code in typescrip-cli (npm) (malicious package)
- [MAL-2026-1415](https://insights.sbomify.com/MAL-2026-1415/): Malicious code in pulsard-utils (npm) (malicious package)
- [MAL-2026-14149](https://insights.sbomify.com/MAL-2026-14149/): Malicious code in typescirpt-core (npm) (malicious package)
- [MAL-2026-14148](https://insights.sbomify.com/MAL-2026-14148/): Malicious code in typescirpt-cli (npm) (malicious package)
- [MAL-2026-14147](https://insights.sbomify.com/MAL-2026-14147/): Malicious code in typescipt-core (npm) (malicious package)
- [MAL-2026-14146](https://insights.sbomify.com/MAL-2026-14146/): Malicious code in typescipt-cli (npm) (malicious package)
- [MAL-2026-14145](https://insights.sbomify.com/MAL-2026-14145/): Malicious code in typecript-cli (npm) (malicious package)
- [MAL-2026-14144](https://insights.sbomify.com/MAL-2026-14144/): Malicious code in tyepescript-core (npm) (malicious package)
- [MAL-2026-14143](https://insights.sbomify.com/MAL-2026-14143/): Malicious code in tyepescript-cli (npm) (malicious package)
- [MAL-2026-14142](https://insights.sbomify.com/MAL-2026-14142/): Malicious code in testingsmthb1g (npm) (malicious package)
- [MAL-2026-14141](https://insights.sbomify.com/MAL-2026-14141/): Malicious code in test-npm-snurkeburk-hackerone (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/145/