# Vulnerabilities published in 2026


- [MAL-2026-14140](https://insights.sbomify.com/MAL-2026-14140/): Malicious code in vite-svg-config (npm) (malicious package)
- [MAL-2026-1414](https://insights.sbomify.com/MAL-2026-1414/): Malicious code in hardhat2-config (npm) (malicious package)
- [MAL-2026-14139](https://insights.sbomify.com/MAL-2026-14139/): Malicious code in prism-registry (npm) (malicious package)
- [MAL-2026-14138](https://insights.sbomify.com/MAL-2026-14138/): Malicious code in optimizely-starter-kit-for-fastly-compute (npm) (malicious package)
- [MAL-2026-14137](https://insights.sbomify.com/MAL-2026-14137/): Malicious code in mtslink-depconf-probe-profileusername (npm) (malicious package)
- [MAL-2026-14136](https://insights.sbomify.com/MAL-2026-14136/): Malicious code in agora402-payment-utils (npm) (malicious package)
- [MAL-2026-14135](https://insights.sbomify.com/MAL-2026-14135/): Malicious code in @mohamed_nowisar/token3-check (npm) (malicious package)
- [MAL-2026-14134](https://insights.sbomify.com/MAL-2026-14134/): Malicious code in @mohamed_nowisar/depconf-canary-test (npm) (malicious package)
- [MAL-2026-14133](https://insights.sbomify.com/MAL-2026-14133/): Malicious code in reqcrypt (PyPI) (malicious package)
- [MAL-2026-14132](https://insights.sbomify.com/MAL-2026-14132/): Malicious code in deepface-weights (PyPI) (malicious package)
- [MAL-2026-14131](https://insights.sbomify.com/MAL-2026-14131/): Malicious code in infogram-bot (PyPI) (malicious package)
- [MAL-2026-14130](https://insights.sbomify.com/MAL-2026-14130/): Malicious code in httpz-requests (PyPI) (malicious package)
- [MAL-2026-1413](https://insights.sbomify.com/MAL-2026-1413/): Malicious code in brlc-base (npm) (malicious package)
- [MAL-2026-14129](https://insights.sbomify.com/MAL-2026-14129/): Malicious code in plugin-react-vite (npm) (malicious package)
- [MAL-2026-14128](https://insights.sbomify.com/MAL-2026-14128/): Malicious code in motionspring (npm) (malicious package)
- [MAL-2026-14127](https://insights.sbomify.com/MAL-2026-14127/): Malicious code in @reducers/projects (npm) (malicious package)
- [MAL-2026-14126](https://insights.sbomify.com/MAL-2026-14126/): Malicious code in @milleree/date-display (npm) (malicious package)
- [MAL-2026-14125](https://insights.sbomify.com/MAL-2026-14125/): Malicious code in @guildai-services/guildai (npm) (malicious package)
- [MAL-2026-14124](https://insights.sbomify.com/MAL-2026-14124/): Malicious code in alphazone (npm) (malicious package)
- [MAL-2026-14123](https://insights.sbomify.com/MAL-2026-14123/): Malicious code in @oyo_tech/oyochat_user (npm) (malicious package)
- [MAL-2026-14122](https://insights.sbomify.com/MAL-2026-14122/): Malicious code in ulebkit (npm) (malicious package)
- [MAL-2026-14121](https://insights.sbomify.com/MAL-2026-14121/): Malicious code in sui-move-graphql (npm) (malicious package)
- [MAL-2026-14120](https://insights.sbomify.com/MAL-2026-14120/): Malicious code in blastradar (npm) (malicious package)
- [MAL-2026-1412](https://insights.sbomify.com/MAL-2026-1412/): Malicious code in project47 (PyPI) (malicious package)
- [MAL-2026-14119](https://insights.sbomify.com/MAL-2026-14119/): Malicious code in bcc-design-icons (npm) (malicious package)
- [MAL-2026-14118](https://insights.sbomify.com/MAL-2026-14118/): Malicious code in core-tailwindcss-utility (npm) (malicious package)
- [MAL-2026-14117](https://insights.sbomify.com/MAL-2026-14117/): Malicious code in bcc-design (npm) (malicious package)
- [MAL-2026-14116](https://insights.sbomify.com/MAL-2026-14116/): Malicious code in runtime-health (npm) (malicious package)
- [MAL-2026-14115](https://insights.sbomify.com/MAL-2026-14115/): Malicious code in userbotjs-jun (npm) (malicious package)
- [MAL-2026-14114](https://insights.sbomify.com/MAL-2026-14114/): Malicious code in userbotjs (npm) (malicious package)
- [MAL-2026-14113](https://insights.sbomify.com/MAL-2026-14113/): Malicious code in sui-move-rpc (npm) (malicious package)
- [MAL-2026-14112](https://insights.sbomify.com/MAL-2026-14112/): Malicious code in sui-gql-core (npm) (malicious package)
- [MAL-2026-14111](https://insights.sbomify.com/MAL-2026-14111/): Malicious code in sugarball-cli (npm) (malicious package)
- [MAL-2026-14110](https://insights.sbomify.com/MAL-2026-14110/): Malicious code in reseller-app (npm) (malicious package)
- [MAL-2026-1411](https://insights.sbomify.com/MAL-2026-1411/): Malicious code in nfd (PyPI) (malicious package)
- [MAL-2026-14109](https://insights.sbomify.com/MAL-2026-14109/): Malicious code in leb128x (npm) (malicious package)
- [MAL-2026-14108](https://insights.sbomify.com/MAL-2026-14108/): Malicious code in junofficial-userbot (npm) (malicious package)
- [MAL-2026-14107](https://insights.sbomify.com/MAL-2026-14107/): Malicious code in club-sauce (npm) (malicious package)
- [MAL-2026-14106](https://insights.sbomify.com/MAL-2026-14106/): Malicious code in cloud-agen-bot (npm) (malicious package)
- [MAL-2026-14105](https://insights.sbomify.com/MAL-2026-14105/): Malicious code in bcs-core (npm) (malicious package)
- [MAL-2026-14104](https://insights.sbomify.com/MAL-2026-14104/): Malicious code in autoai (npm) (malicious package)
- [MAL-2026-14103](https://insights.sbomify.com/MAL-2026-14103/): Malicious code in a.poltoradnev-package-a (npm) (malicious package)
- [MAL-2026-14102](https://insights.sbomify.com/MAL-2026-14102/): Malicious code in @siwatfa/yorn (npm) (malicious package)
- [MAL-2026-14101](https://insights.sbomify.com/MAL-2026-14101/): Malicious code in @junofficial/baileys (npm) (malicious package)
- [MAL-2026-14100](https://insights.sbomify.com/MAL-2026-14100/): Malicious code in socks5901 (PyPI) (malicious package)
- [MAL-2026-1410](https://insights.sbomify.com/MAL-2026-1410/): Malicious code in ighack (PyPI) (malicious package)
- [MAL-2026-141](https://insights.sbomify.com/MAL-2026-141/): Malicious code in rt-long-form-content (npm) (malicious package)
- [MAL-2026-14099](https://insights.sbomify.com/MAL-2026-14099/): Malicious code in zip-bundle (npm) (malicious package)
- [MAL-2026-14098](https://insights.sbomify.com/MAL-2026-14098/): Malicious code in utils-bundle (npm) (malicious package)
- [MAL-2026-14097](https://insights.sbomify.com/MAL-2026-14097/): Malicious code in thepackagethatworks_ (npm) (malicious package)
- [MAL-2026-14096](https://insights.sbomify.com/MAL-2026-14096/): Malicious code in svelte-goal-vim (npm) (malicious package)
- [MAL-2026-14095](https://insights.sbomify.com/MAL-2026-14095/): Malicious code in sui-gql-lite (npm) (malicious package)
- [MAL-2026-14094](https://insights.sbomify.com/MAL-2026-14094/): Malicious code in saps_secplayground_npm_ai (npm) (malicious package)
- [MAL-2026-14093](https://insights.sbomify.com/MAL-2026-14093/): Malicious code in rtms-manager-dev (npm) (malicious package)
- [MAL-2026-14092](https://insights.sbomify.com/MAL-2026-14092/): Malicious code in rimo-env-validator (npm) (malicious package)
- [MAL-2026-14091](https://insights.sbomify.com/MAL-2026-14091/): Malicious code in pocbitbarrontest (npm) (malicious package)
- [MAL-2026-14090](https://insights.sbomify.com/MAL-2026-14090/): Malicious code in npm_pkg_1094 (npm) (malicious package)
- [MAL-2026-1409](https://insights.sbomify.com/MAL-2026-1409/): Malicious code in darkig (PyPI) (malicious package)
- [MAL-2026-14089](https://insights.sbomify.com/MAL-2026-14089/): Malicious code in npm_pkg_1093 (npm) (malicious package)
- [MAL-2026-14088](https://insights.sbomify.com/MAL-2026-14088/): Malicious code in nolimitcity (npm) (malicious package)
- [MAL-2026-14087](https://insights.sbomify.com/MAL-2026-14087/): Malicious code in mw-filesystem-events-nodream-es6 (npm) (malicious package)
- [MAL-2026-14086](https://insights.sbomify.com/MAL-2026-14086/): Malicious code in kit-hydration-vim (npm) (malicious package)
- [MAL-2026-14085](https://insights.sbomify.com/MAL-2026-14085/): Malicious code in hrp9872 (npm) (malicious package)
- [MAL-2026-14084](https://insights.sbomify.com/MAL-2026-14084/): Malicious code in hrp9871 (npm) (malicious package)
- [MAL-2026-14083](https://insights.sbomify.com/MAL-2026-14083/): Malicious code in heft-storybook-v6-react-tutorial-storykit (npm) (malicious package)
- [MAL-2026-14082](https://insights.sbomify.com/MAL-2026-14082/): Malicious code in google-logging-utils-internal (npm) (malicious package)
- [MAL-2026-14081](https://insights.sbomify.com/MAL-2026-14081/): Malicious code in game_overlay (npm) (malicious package)
- [MAL-2026-14080](https://insights.sbomify.com/MAL-2026-14080/): Malicious code in expect-bundle (npm) (malicious package)
- [MAL-2026-1408](https://insights.sbomify.com/MAL-2026-1408/): Malicious code in nai (PyPI) (malicious package)
- [MAL-2026-14079](https://insights.sbomify.com/MAL-2026-14079/): Malicious code in elf-stats-cranberry-wishlist-933 (npm) (malicious package)
- [MAL-2026-14078](https://insights.sbomify.com/MAL-2026-14078/): Malicious code in elf-stats-caroling-stocking-510 (npm) (malicious package)
- [MAL-2026-14077](https://insights.sbomify.com/MAL-2026-14077/): Malicious code in dinotech-auth-utils (npm) (malicious package)
- [MAL-2026-14076](https://insights.sbomify.com/MAL-2026-14076/): Malicious code in bcs-mini (npm) (malicious package)
- [MAL-2026-14075](https://insights.sbomify.com/MAL-2026-14075/): Malicious code in ak-mal-test-poc (npm) (malicious package)
- [MAL-2026-14074](https://insights.sbomify.com/MAL-2026-14074/): Malicious code in @vyzensockets/baileys (npm) (malicious package)
- [MAL-2026-14073](https://insights.sbomify.com/MAL-2026-14073/): Malicious code in @veertly/web-app (npm) (malicious package)
- [MAL-2026-14072](https://insights.sbomify.com/MAL-2026-14072/): Malicious code in @peptideventure/peptide-unit (npm) (malicious package)
- [MAL-2026-14071](https://insights.sbomify.com/MAL-2026-14071/): Malicious code in @peptideventure/peptide-score-modifier (npm) (malicious package)
- [MAL-2026-14070](https://insights.sbomify.com/MAL-2026-14070/): Malicious code in @ai-vertical/ai-agent (npm) (malicious package)
- [MAL-2026-1407](https://insights.sbomify.com/MAL-2026-1407/): Malicious code in thief-utils (PyPI) (malicious package)
- [MAL-2026-14069](https://insights.sbomify.com/MAL-2026-14069/): Malicious code in kb-ai (PyPI) (malicious package)
- [MAL-2026-14068](https://insights.sbomify.com/MAL-2026-14068/): Malicious code in depcruise-wrap-stream-in-html (npm) (malicious package)
- [MAL-2026-14067](https://insights.sbomify.com/MAL-2026-14067/): Malicious code in upload-to-gcp (npm) (malicious package)
- [MAL-2026-14066](https://insights.sbomify.com/MAL-2026-14066/): Malicious code in akamaijs-sensorv1 (npm) (malicious package)
- [MAL-2026-14065](https://insights.sbomify.com/MAL-2026-14065/): Malicious code in akamai-sensor (npm) (malicious package)
- [MAL-2026-14064](https://insights.sbomify.com/MAL-2026-14064/): Malicious code in @finaxis/common-js (npm) (malicious package)
- [MAL-2026-14063](https://insights.sbomify.com/MAL-2026-14063/): Malicious code in twilio-hackerone-poc-afe6937c (npm) (malicious package)
- [MAL-2026-14062](https://insights.sbomify.com/MAL-2026-14062/): Malicious code in tw-pkgprobe-7731 (npm) (malicious package)
- [MAL-2026-14061](https://insights.sbomify.com/MAL-2026-14061/): Malicious code in hunterone-build-probe-9210 (npm) (malicious package)
- [MAL-2026-14060](https://insights.sbomify.com/MAL-2026-14060/): Malicious code in fastly-vcl-language-client (npm) (malicious package)
- [MAL-2026-1406](https://insights.sbomify.com/MAL-2026-1406/): Malicious code in makenotion-ppetest (PyPI) (malicious package)
- [MAL-2026-14059](https://insights.sbomify.com/MAL-2026-14059/): Malicious code in autbank-core (npm) (malicious package)
- [MAL-2026-14058](https://insights.sbomify.com/MAL-2026-14058/): Malicious code in adxaa (npm) (malicious package)
- [MAL-2026-14057](https://insights.sbomify.com/MAL-2026-14057/): Malicious code in @openrepl/shared (npm) (malicious package)
- [MAL-2026-14056](https://insights.sbomify.com/MAL-2026-14056/): Malicious code in gunzip-js (npm) (malicious package)
- [MAL-2026-14055](https://insights.sbomify.com/MAL-2026-14055/): Malicious code in harmony-app-toolkit (npm) (malicious package)
- [MAL-2026-14054](https://insights.sbomify.com/MAL-2026-14054/): Malicious code in depcruise-fmt (npm) (malicious package)
- [MAL-2026-14053](https://insights.sbomify.com/MAL-2026-14053/): Malicious code in depcruise-baseline (npm) (malicious package)
- [MAL-2026-14052](https://insights.sbomify.com/MAL-2026-14052/): Malicious code in require-i18next (npm) (malicious package)
- [MAL-2026-14051](https://insights.sbomify.com/MAL-2026-14051/): Malicious code in @velliajs/discord (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/146/