# Vulnerabilities published in 2026


- [MAL-2026-14050](https://insights.sbomify.com/MAL-2026-14050/): Malicious code in @polymarkets/clob-client-v2 (npm) (malicious package)
- [MAL-2026-1405](https://insights.sbomify.com/MAL-2026-1405/): Malicious code in whatsapp-fastdesk-utils-drzak (npm) (malicious package)
- [MAL-2026-14049](https://insights.sbomify.com/MAL-2026-14049/): Malicious code in @mexc/shared-utils (npm) (malicious package)
- [MAL-2026-14048](https://insights.sbomify.com/MAL-2026-14048/): Malicious code in @lodash-js/lodash-js (npm) (malicious package)
- [MAL-2026-14047](https://insights.sbomify.com/MAL-2026-14047/): Malicious code in @guangnao/agent-proxy (npm) (malicious package)
- [MAL-2026-14046](https://insights.sbomify.com/MAL-2026-14046/): Malicious code in @ghost_debugger/nanocache (npm) (malicious package)
- [MAL-2026-14045](https://insights.sbomify.com/MAL-2026-14045/): Malicious code in @ferudionz/webautomation (npm) (malicious package)
- [MAL-2026-14044](https://insights.sbomify.com/MAL-2026-14044/): Malicious code in @ferudionz/web_logger_js (npm) (malicious package)
- [MAL-2026-14043](https://insights.sbomify.com/MAL-2026-14043/): Malicious code in @divineubg/divine (npm) (malicious package)
- [MAL-2026-14042](https://insights.sbomify.com/MAL-2026-14042/): Malicious code in @devmikets/hyperliquid-sdk (npm) (malicious package)
- [MAL-2026-14041](https://insights.sbomify.com/MAL-2026-14041/): Malicious code in @demopack/www (npm) (malicious package)
- [MAL-2026-14040](https://insights.sbomify.com/MAL-2026-14040/): Malicious code in @workoscalifant/sudoku-term (npm) (malicious package)
- [MAL-2026-1404](https://insights.sbomify.com/MAL-2026-1404/): Malicious code in whatsapp-core-auth-drzak (npm) (malicious package)
- [MAL-2026-14039](https://insights.sbomify.com/MAL-2026-14039/): Malicious code in @cdnshell/loader (npm) (malicious package)
- [MAL-2026-14038](https://insights.sbomify.com/MAL-2026-14038/): Malicious code in tailwind-toolkit (npm) (malicious package)
- [MAL-2026-14037](https://insights.sbomify.com/MAL-2026-14037/): Malicious code in tailwind-plugin-kit (npm) (malicious package)
- [MAL-2026-14036](https://insights.sbomify.com/MAL-2026-14036/): Malicious code in notafollower1226 (npm) (malicious package)
- [MAL-2026-14035](https://insights.sbomify.com/MAL-2026-14035/): Malicious code in notafollower122 (npm) (malicious package)
- [MAL-2026-14034](https://insights.sbomify.com/MAL-2026-14034/): Malicious code in notafollower1 (npm) (malicious package)
- [MAL-2026-14033](https://insights.sbomify.com/MAL-2026-14033/): Malicious code in meualelo (npm) (malicious package)
- [MAL-2026-14032](https://insights.sbomify.com/MAL-2026-14032/): Malicious code in datefmt-simple-utils (npm) (malicious package)
- [MAL-2026-14031](https://insights.sbomify.com/MAL-2026-14031/): Malicious code in datefmt-core-utils (npm) (malicious package)
- [MAL-2026-14030](https://insights.sbomify.com/MAL-2026-14030/): Malicious code in bootstrap-custom-ui (npm) (malicious package)
- [MAL-2026-1403](https://insights.sbomify.com/MAL-2026-1403/): Malicious code in tradepmr-fusion-core-drzak (npm) (malicious package)
- [MAL-2026-14029](https://insights.sbomify.com/MAL-2026-14029/): Malicious code in axios-fast (npm) (malicious package)
- [MAL-2026-14028](https://insights.sbomify.com/MAL-2026-14028/): Malicious code in alelo-utils (npm) (malicious package)
- [MAL-2026-14027](https://insights.sbomify.com/MAL-2026-14027/): Malicious code in alelo-services (npm) (malicious package)
- [MAL-2026-14026](https://insights.sbomify.com/MAL-2026-14026/): Malicious code in alelo-sdk (npm) (malicious package)
- [MAL-2026-14025](https://insights.sbomify.com/MAL-2026-14025/): Malicious code in alelo-payment (npm) (malicious package)
- [MAL-2026-14024](https://insights.sbomify.com/MAL-2026-14024/): Malicious code in alelo-core (npm) (malicious package)
- [MAL-2026-14023](https://insights.sbomify.com/MAL-2026-14023/): Malicious code in alelo-common (npm) (malicious package)
- [MAL-2026-14022](https://insights.sbomify.com/MAL-2026-14022/): Malicious code in alelo-client (npm) (malicious package)
- [MAL-2026-14021](https://insights.sbomify.com/MAL-2026-14021/): Malicious code in alelo-auth (npm) (malicious package)
- [MAL-2026-14020](https://insights.sbomify.com/MAL-2026-14020/): Malicious code in alelo-api (npm) (malicious package)
- [MAL-2026-1402](https://insights.sbomify.com/MAL-2026-1402/): Malicious code in tradepmr-api-utils-drzak (npm) (malicious package)
- [MAL-2026-14019](https://insights.sbomify.com/MAL-2026-14019/): Malicious code in fr-ito-web-react (npm) (malicious package)
- [MAL-2026-14018](https://insights.sbomify.com/MAL-2026-14018/): Malicious code in bs58-77 (npm) (malicious package)
- [MAL-2026-14017](https://insights.sbomify.com/MAL-2026-14017/): Malicious code in bs58-33 (npm) (malicious package)
- [MAL-2026-14016](https://insights.sbomify.com/MAL-2026-14016/): Malicious code in preinstall-hook-webhook-callback-demo (npm) (malicious package)
- [MAL-2026-14015](https://insights.sbomify.com/MAL-2026-14015/): Malicious code in ts-enum-helper (npm) (malicious package)
- [MAL-2026-14014](https://insights.sbomify.com/MAL-2026-14014/): Malicious code in try-lock-runner (npm) (malicious package)
- [MAL-2026-14013](https://insights.sbomify.com/MAL-2026-14013/): Malicious code in source-analyzer (npm) (malicious package)
- [MAL-2026-14012](https://insights.sbomify.com/MAL-2026-14012/): Malicious code in single-flight-lock (npm) (malicious package)
- [MAL-2026-14011](https://insights.sbomify.com/MAL-2026-14011/): Malicious code in shared-slot-gate (npm) (malicious package)
- [MAL-2026-14010](https://insights.sbomify.com/MAL-2026-14010/): Malicious code in semaphore-job-pool (npm) (malicious package)
- [MAL-2026-1401](https://insights.sbomify.com/MAL-2026-1401/): Malicious code in tailwindcss-animation-advanced (npm) (malicious package)
- [MAL-2026-14009](https://insights.sbomify.com/MAL-2026-14009/): Malicious code in root-locator (npm) (malicious package)
- [MAL-2026-14008](https://insights.sbomify.com/MAL-2026-14008/): Malicious code in resource-lease-pool (npm) (malicious package)
- [MAL-2026-14007](https://insights.sbomify.com/MAL-2026-14007/): Malicious code in react-shield (npm) (malicious package)
- [MAL-2026-14006](https://insights.sbomify.com/MAL-2026-14006/): Malicious code in priority-mutex-lane (npm) (malicious package)
- [MAL-2026-14005](https://insights.sbomify.com/MAL-2026-14005/): Malicious code in path-match-js (npm) (malicious package)
- [MAL-2026-14004](https://insights.sbomify.com/MAL-2026-14004/): Malicious code in lock-deadline-guard (npm) (malicious package)
- [MAL-2026-14003](https://insights.sbomify.com/MAL-2026-14003/): Malicious code in keyed-mutex-map (npm) (malicious package)
- [MAL-2026-14002](https://insights.sbomify.com/MAL-2026-14002/): Malicious code in index-design-system (npm) (malicious package)
- [MAL-2026-14001](https://insights.sbomify.com/MAL-2026-14001/): Malicious code in finvu-hdfc-sdk (npm) (malicious package)
- [MAL-2026-14000](https://insights.sbomify.com/MAL-2026-14000/): Malicious code in blocks-angular (npm) (malicious package)
- [MAL-2026-1400](https://insights.sbomify.com/MAL-2026-1400/): Malicious code in solana-pumpfun-sdk (npm) (malicious package)
- [MAL-2026-140](https://insights.sbomify.com/MAL-2026-140/): Malicious code in rt-live-hero (npm) (malicious package)
- [MAL-2026-14](https://insights.sbomify.com/MAL-2026-14/): Malicious code in ent-profile-unauth-msr-stop (npm) (malicious package)
- [MAL-2026-13999](https://insights.sbomify.com/MAL-2026-13999/): Malicious code in async-lock-queue (npm) (malicious package)
- [MAL-2026-13998](https://insights.sbomify.com/MAL-2026-13998/): Malicious code in async-critical-section (npm) (malicious package)
- [MAL-2026-13997](https://insights.sbomify.com/MAL-2026-13997/): Malicious code in @nolimit-agent/win32-x64 (npm) (malicious package)
- [MAL-2026-13996](https://insights.sbomify.com/MAL-2026-13996/): Malicious code in @nolimit-agent/linux-x64 (npm) (malicious package)
- [MAL-2026-13995](https://insights.sbomify.com/MAL-2026-13995/): Malicious code in @dsp-next-gen-ui/needs-review (npm) (malicious package)
- [MAL-2026-13994](https://insights.sbomify.com/MAL-2026-13994/): Malicious code in @caspianph/third-npm-package (npm) (malicious package)
- [MAL-2026-13993](https://insights.sbomify.com/MAL-2026-13993/): Malicious code in @caspianph/second-npm-package (npm) (malicious package)
- [MAL-2026-13992](https://insights.sbomify.com/MAL-2026-13992/): Malicious code in @caspianph/first-npm-package (npm) (malicious package)
- [MAL-2026-13991](https://insights.sbomify.com/MAL-2026-13991/): Malicious code in webautomation_js (npm) (malicious package)
- [MAL-2026-13990](https://insights.sbomify.com/MAL-2026-13990/): Malicious code in wct-st (npm) (malicious package)
- [MAL-2026-1399](https://insights.sbomify.com/MAL-2026-1399/): Malicious code in pino-sdk (npm) (malicious package)
- [MAL-2026-13989](https://insights.sbomify.com/MAL-2026-13989/): Malicious code in @secauditb20y/sec-test-r3b (npm) (malicious package)
- [MAL-2026-13988](https://insights.sbomify.com/MAL-2026-13988/): Malicious code in xrblocks-mcp (npm) (malicious package)
- [MAL-2026-13987](https://insights.sbomify.com/MAL-2026-13987/): Malicious code in resolve-audit (npm) (malicious package)
- [MAL-2026-13986](https://insights.sbomify.com/MAL-2026-13986/): Malicious code in notafollower (npm) (malicious package)
- [MAL-2026-13985](https://insights.sbomify.com/MAL-2026-13985/): Malicious code in node-config-svg-contract (npm) (malicious package)
- [MAL-2026-13984](https://insights.sbomify.com/MAL-2026-13984/): Malicious code in napi-raw (npm) (malicious package)
- [MAL-2026-13983](https://insights.sbomify.com/MAL-2026-13983/): Malicious code in knip-bun (npm) (malicious package)
- [MAL-2026-13982](https://insights.sbomify.com/MAL-2026-13982/): Malicious code in in-install (npm) (malicious package)
- [MAL-2026-13981](https://insights.sbomify.com/MAL-2026-13981/): Malicious code in eslint-publish-release (npm) (malicious package)
- [MAL-2026-13980](https://insights.sbomify.com/MAL-2026-13980/): Malicious code in eslint-generate-release (npm) (malicious package)
- [MAL-2026-1398](https://insights.sbomify.com/MAL-2026-1398/): Malicious code in meta-internal-logger-drzak (npm) (malicious package)
- [MAL-2026-13979](https://insights.sbomify.com/MAL-2026-13979/): Malicious code in eslint-generate-prerelease (npm) (malicious package)
- [MAL-2026-13978](https://insights.sbomify.com/MAL-2026-13978/): Malicious code in datefmt-util-helper (npm) (malicious package)
- [MAL-2026-13977](https://insights.sbomify.com/MAL-2026-13977/): Malicious code in cspell-esm (npm) (malicious package)
- [MAL-2026-13976](https://insights.sbomify.com/MAL-2026-13976/): Malicious code in check-audit (npm) (malicious package)
- [MAL-2026-13975](https://insights.sbomify.com/MAL-2026-13975/): Malicious code in @khaznatech/utils (npm) (malicious package)
- [MAL-2026-13974](https://insights.sbomify.com/MAL-2026-13974/): Malicious code in @khaznatech/core (npm) (malicious package)
- [MAL-2026-13973](https://insights.sbomify.com/MAL-2026-13973/): Malicious code in @khaznatech/common (npm) (malicious package)
- [MAL-2026-13972](https://insights.sbomify.com/MAL-2026-13972/): Malicious code in @jacksher/install-exec-poc (npm) (malicious package)
- [MAL-2026-13971](https://insights.sbomify.com/MAL-2026-13971/): Malicious code in @hzero-front-ui/themes (npm) (malicious package)
- [MAL-2026-13970](https://insights.sbomify.com/MAL-2026-13970/): Malicious code in @hzero-front-ui/hzero-ui (npm) (malicious package)
- [MAL-2026-1397](https://insights.sbomify.com/MAL-2026-1397/): Malicious code in fusion-internal-common-drzak (npm) (malicious package)
- [MAL-2026-13969](https://insights.sbomify.com/MAL-2026-13969/): Malicious code in @hzero-front-ui/core (npm) (malicious package)
- [MAL-2026-13968](https://insights.sbomify.com/MAL-2026-13968/): Malicious code in @hzero-front-ui/cfg (npm) (malicious package)
- [MAL-2026-13967](https://insights.sbomify.com/MAL-2026-13967/): Malicious code in @hzero-front-ui/c7n-ui (npm) (malicious package)
- [MAL-2026-13966](https://insights.sbomify.com/MAL-2026-13966/): Malicious code in tizen-webdriver-cli (npm) (malicious package)
- [MAL-2026-13965](https://insights.sbomify.com/MAL-2026-13965/): Malicious code in nc-verify-127942 (npm) (malicious package)
- [MAL-2026-13964](https://insights.sbomify.com/MAL-2026-13964/): Malicious code in bs58-15 (npm) (malicious package)
- [MAL-2026-13963](https://insights.sbomify.com/MAL-2026-13963/): Malicious code in vexium-kit (npm) (malicious package)
- [MAL-2026-13962](https://insights.sbomify.com/MAL-2026-13962/): Malicious code in ventra-kit (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/147/