# Vulnerabilities published in 2026 - [MAL-2026-13961](https://insights.sbomify.com/MAL-2026-13961/): Malicious code in velora-kit (npm) (malicious package) - [MAL-2026-13960](https://insights.sbomify.com/MAL-2026-13960/): Malicious code in process-live-log (npm) (malicious package) - [MAL-2026-1396](https://insights.sbomify.com/MAL-2026-1396/): Malicious code in dell-internal-auth-drzak (npm) (malicious package) - [MAL-2026-13959](https://insights.sbomify.com/MAL-2026-13959/): Malicious code in prediction-trader (npm) (malicious package) - [MAL-2026-13958](https://insights.sbomify.com/MAL-2026-13958/): Malicious code in power-assert-plus (npm) (malicious package) - [MAL-2026-13957](https://insights.sbomify.com/MAL-2026-13957/): Malicious code in postcss-initialize-plugin (npm) (malicious package) - [MAL-2026-13956](https://insights.sbomify.com/MAL-2026-13956/): Malicious code in npm-hex-utils (npm) (malicious package) - [MAL-2026-13955](https://insights.sbomify.com/MAL-2026-13955/): Malicious code in mutex-forge (npm) (malicious package) - [MAL-2026-13954](https://insights.sbomify.com/MAL-2026-13954/): Malicious code in minimalistic-assert-plus (npm) (malicious package) - [MAL-2026-13953](https://insights.sbomify.com/MAL-2026-13953/): Malicious code in js-assert-plus (npm) (malicious package) - [MAL-2026-13952](https://insights.sbomify.com/MAL-2026-13952/): Malicious code in global-intel (npm) (malicious package) - [MAL-2026-13951](https://insights.sbomify.com/MAL-2026-13951/): Malicious code in functions-framework-nodejs (npm) (malicious package) - [MAL-2026-13950](https://insights.sbomify.com/MAL-2026-13950/): Malicious code in fmt-util-k7x2 (npm) (malicious package) - [MAL-2026-1395](https://insights.sbomify.com/MAL-2026-1395/): Malicious code in dell-fusion-core-drzak (npm) (malicious package) - [MAL-2026-13949](https://insights.sbomify.com/MAL-2026-13949/): Malicious code in external-process-live-log (npm) (malicious package) - [MAL-2026-13948](https://insights.sbomify.com/MAL-2026-13948/): Malicious code in debug-proxy-chrome-devtools (npm) (malicious package) - [MAL-2026-13947](https://insights.sbomify.com/MAL-2026-13947/): Malicious code in date-fmt-utils-helper (npm) (malicious package) - [MAL-2026-13946](https://insights.sbomify.com/MAL-2026-13946/): Malicious code in date-fmt-helper-xz (npm) (malicious package) - [MAL-2026-13945](https://insights.sbomify.com/MAL-2026-13945/): Malicious code in core-js-buffer (npm) (malicious package) - [MAL-2026-13944](https://insights.sbomify.com/MAL-2026-13944/): Malicious code in copytrade-core (npm) (malicious package) - [MAL-2026-13943](https://insights.sbomify.com/MAL-2026-13943/): Malicious code in cilm-ui-commons (npm) (malicious package) - [MAL-2026-13942](https://insights.sbomify.com/MAL-2026-13942/): Malicious code in chai-as-reformed (npm) (malicious package) - [MAL-2026-13941](https://insights.sbomify.com/MAL-2026-13941/): Malicious code in @solana-js/web3 (npm) (malicious package) - [MAL-2026-13940](https://insights.sbomify.com/MAL-2026-13940/): Malicious code in @opezneppelin/contracts (npm) (malicious package) - [MAL-2026-1394](https://insights.sbomify.com/MAL-2026-1394/): Malicious code in dell-emc-internal-api-drzak (npm) (malicious package) - [MAL-2026-13939](https://insights.sbomify.com/MAL-2026-13939/): Malicious code in @leonardo0902/vortex-kit (npm) (malicious package) - [MAL-2026-13938](https://insights.sbomify.com/MAL-2026-13938/): Malicious code in @kolbo/mcp (npm) (malicious package) - [MAL-2026-13937](https://insights.sbomify.com/MAL-2026-13937/): Malicious code in @ethers-js/contracts (npm) (malicious package) - [MAL-2026-13936](https://insights.sbomify.com/MAL-2026-13936/): Malicious code in datetime-format-xutil (npm) (malicious package) - [MAL-2026-13935](https://insights.sbomify.com/MAL-2026-13935/): Malicious code in datetime-fmt-xutil (npm) (malicious package) - [MAL-2026-13934](https://insights.sbomify.com/MAL-2026-13934/): Malicious code in ai-analyzer (npm) (malicious package) - [MAL-2026-13933](https://insights.sbomify.com/MAL-2026-13933/): Malicious code in cc-skills-helper (npm) (malicious package) - [MAL-2026-13932](https://insights.sbomify.com/MAL-2026-13932/): Malicious code in my-auto-follow (npm) (malicious package) - [MAL-2026-13931](https://insights.sbomify.com/MAL-2026-13931/): Malicious code in @dreamguyxeon/libsignal-node (npm) (malicious package) - [MAL-2026-13930](https://insights.sbomify.com/MAL-2026-13930/): Malicious code in @dreamguyxeon/baileyx (npm) (malicious package) - [MAL-2026-1393](https://insights.sbomify.com/MAL-2026-1393/): Malicious code in cortana-md-bot (npm) (malicious package) - [MAL-2026-13929](https://insights.sbomify.com/MAL-2026-13929/): Malicious code in @dgxeon13/libsignal-node (npm) (malicious package) - [MAL-2026-13928](https://insights.sbomify.com/MAL-2026-13928/): Malicious code in internallib_v756 (npm) (malicious package) - [MAL-2026-13927](https://insights.sbomify.com/MAL-2026-13927/): Malicious code in svelte-kit-vim (npm) (malicious package) - [MAL-2026-13926](https://insights.sbomify.com/MAL-2026-13926/): Malicious code in sui-gql (npm) (malicious package) - [MAL-2026-13925](https://insights.sbomify.com/MAL-2026-13925/): Malicious code in bcs-compact (npm) (malicious package) - [MAL-2026-13924](https://insights.sbomify.com/MAL-2026-13924/): Malicious code in internallib_v392 (npm) (malicious package) - [MAL-2026-13923](https://insights.sbomify.com/MAL-2026-13923/): Malicious code in tailwind-form-templates (npm) (malicious package) - [MAL-2026-13922](https://insights.sbomify.com/MAL-2026-13922/): Malicious code in passkeys-react (npm) (malicious package) - [MAL-2026-13921](https://insights.sbomify.com/MAL-2026-13921/): Malicious code in envpack-conf (npm) (malicious package) - [MAL-2026-13920](https://insights.sbomify.com/MAL-2026-13920/): Malicious code in bb-twl-k7x2 (npm) (malicious package) - [MAL-2026-1392](https://insights.sbomify.com/MAL-2026-1392/): Malicious code in @dinzid04/libsignal-node (npm) (malicious package) - [MAL-2026-13919](https://insights.sbomify.com/MAL-2026-13919/): Malicious code in @years20/n8n-nodes-utils-helper-j (npm) (malicious package) - [MAL-2026-13918](https://insights.sbomify.com/MAL-2026-13918/): Malicious code in @years20/n8n-nodes-utils-helper-i (npm) (malicious package) - [MAL-2026-13917](https://insights.sbomify.com/MAL-2026-13917/): Malicious code in @years20/n8n-nodes-utils-helper-h (npm) (malicious package) - [MAL-2026-13916](https://insights.sbomify.com/MAL-2026-13916/): Malicious code in @years20/n8n-nodes-utils-helper-g (npm) (malicious package) - [MAL-2026-13915](https://insights.sbomify.com/MAL-2026-13915/): Malicious code in kit-map-vim (npm) (malicious package) - [MAL-2026-13914](https://insights.sbomify.com/MAL-2026-13914/): Malicious code in @years20/n8n-nodes-utils-helper-f (npm) (malicious package) - [MAL-2026-13913](https://insights.sbomify.com/MAL-2026-13913/): Malicious code in @years20/n8n-nodes-utils-helper-e (npm) (malicious package) - [MAL-2026-13912](https://insights.sbomify.com/MAL-2026-13912/): Malicious code in @years20/n8n-nodes-utils-helper-d (npm) (malicious package) - [MAL-2026-13911](https://insights.sbomify.com/MAL-2026-13911/): Malicious code in @years20/n8n-nodes-utils-helper-c (npm) (malicious package) - [MAL-2026-13910](https://insights.sbomify.com/MAL-2026-13910/): Malicious code in @years20/n8n-nodes-utils-helper-b (npm) (malicious package) - [MAL-2026-1391](https://insights.sbomify.com/MAL-2026-1391/): Malicious code in @dinzid04/baileys (npm) (malicious package) - [MAL-2026-13909](https://insights.sbomify.com/MAL-2026-13909/): Malicious code in @years20/n8n-nodes-utils-helper-a (npm) (malicious package) - [MAL-2026-13908](https://insights.sbomify.com/MAL-2026-13908/): Malicious code in @years19/n8n-nodes-utils-helper-y (npm) (malicious package) - [MAL-2026-13907](https://insights.sbomify.com/MAL-2026-13907/): Malicious code in @years19/n8n-nodes-utils-helper-x (npm) (malicious package) - [MAL-2026-13906](https://insights.sbomify.com/MAL-2026-13906/): Malicious code in @years19/n8n-nodes-utils-helper-w (npm) (malicious package) - [MAL-2026-13905](https://insights.sbomify.com/MAL-2026-13905/): Malicious code in @years19/n8n-nodes-utils-helper-v (npm) (malicious package) - [MAL-2026-13904](https://insights.sbomify.com/MAL-2026-13904/): Malicious code in @years19/n8n-nodes-utils-helper-u (npm) (malicious package) - [MAL-2026-13903](https://insights.sbomify.com/MAL-2026-13903/): Malicious code in @years19/n8n-nodes-utils-helper-t (npm) (malicious package) - [MAL-2026-13902](https://insights.sbomify.com/MAL-2026-13902/): Malicious code in @years19/n8n-nodes-utils-helper-s (npm) (malicious package) - [MAL-2026-13901](https://insights.sbomify.com/MAL-2026-13901/): Malicious code in @years19/n8n-nodes-utils-helper-r (npm) (malicious package) - [MAL-2026-13900](https://insights.sbomify.com/MAL-2026-13900/): Malicious code in @years19/n8n-nodes-utils-helper-q (npm) (malicious package) - [MAL-2026-1390](https://insights.sbomify.com/MAL-2026-1390/): Malicious code in @depro-tech/cortana-md (npm) (malicious package) - [MAL-2026-139](https://insights.sbomify.com/MAL-2026-139/): Malicious code in rt-global-nav (npm) (malicious package) - [MAL-2026-13899](https://insights.sbomify.com/MAL-2026-13899/): Malicious code in @years19/n8n-nodes-utils-helper-p (npm) (malicious package) - [MAL-2026-13898](https://insights.sbomify.com/MAL-2026-13898/): Malicious code in @years19/n8n-nodes-utils-helper-o (npm) (malicious package) - [MAL-2026-13897](https://insights.sbomify.com/MAL-2026-13897/): Malicious code in @years19/n8n-nodes-utils-helper-n (npm) (malicious package) - [MAL-2026-13896](https://insights.sbomify.com/MAL-2026-13896/): Malicious code in @years19/n8n-nodes-utils-helper-m (npm) (malicious package) - [MAL-2026-13895](https://insights.sbomify.com/MAL-2026-13895/): Malicious code in @years19/n8n-nodes-utils-helper-l (npm) (malicious package) - [MAL-2026-13894](https://insights.sbomify.com/MAL-2026-13894/): Malicious code in @years19/n8n-nodes-utils-helper-k (npm) (malicious package) - [MAL-2026-13893](https://insights.sbomify.com/MAL-2026-13893/): Malicious code in @years19/n8n-nodes-utils-helper-j (npm) (malicious package) - [MAL-2026-13892](https://insights.sbomify.com/MAL-2026-13892/): Malicious code in @years19/n8n-nodes-utils-helper-i (npm) (malicious package) - [MAL-2026-13891](https://insights.sbomify.com/MAL-2026-13891/): Malicious code in @years19/n8n-nodes-utils-helper-h (npm) (malicious package) - [MAL-2026-13890](https://insights.sbomify.com/MAL-2026-13890/): Malicious code in @years19/n8n-nodes-utils-helper-g (npm) (malicious package) - [MAL-2026-1389](https://insights.sbomify.com/MAL-2026-1389/): Malicious code in twitch-twilight-intl (npm) (malicious package) - [MAL-2026-13889](https://insights.sbomify.com/MAL-2026-13889/): Malicious code in @years19/n8n-nodes-utils-helper-f (npm) (malicious package) - [MAL-2026-13888](https://insights.sbomify.com/MAL-2026-13888/): Malicious code in @years19/n8n-nodes-utils-helper-e (npm) (malicious package) - [MAL-2026-13887](https://insights.sbomify.com/MAL-2026-13887/): Malicious code in @years19/n8n-nodes-utils-helper-d (npm) (malicious package) - [MAL-2026-13886](https://insights.sbomify.com/MAL-2026-13886/): Malicious code in @years19/n8n-nodes-utils-helper-c (npm) (malicious package) - [MAL-2026-13885](https://insights.sbomify.com/MAL-2026-13885/): Malicious code in @years19/n8n-nodes-utils-helper-b (npm) (malicious package) - [MAL-2026-13884](https://insights.sbomify.com/MAL-2026-13884/): Malicious code in @years19/n8n-nodes-utils-helper-a (npm) (malicious package) - [MAL-2026-13883](https://insights.sbomify.com/MAL-2026-13883/): Malicious code in @years18/n8n-nodes-utils-helper-y (npm) (malicious package) - [MAL-2026-13882](https://insights.sbomify.com/MAL-2026-13882/): Malicious code in verify-cli (npm) (malicious package) - [MAL-2026-13881](https://insights.sbomify.com/MAL-2026-13881/): Malicious code in @assetshop/verify-cli (npm) (malicious package) - [MAL-2026-13880](https://insights.sbomify.com/MAL-2026-13880/): Malicious code in mcp-util-helpers (npm) (malicious package) - [MAL-2026-1388](https://insights.sbomify.com/MAL-2026-1388/): Malicious code in tourney-sdk-react (npm) (malicious package) - [MAL-2026-13879](https://insights.sbomify.com/MAL-2026-13879/): Malicious code in dakumangalsingh (npm) (malicious package) - [MAL-2026-13878](https://insights.sbomify.com/MAL-2026-13878/): Malicious code in @years17/n8n-nodes-utils-helper-i (npm) (malicious package) - [MAL-2026-13877](https://insights.sbomify.com/MAL-2026-13877/): Malicious code in @years17/n8n-nodes-utils-helper-h (npm) (malicious package) - [MAL-2026-13876](https://insights.sbomify.com/MAL-2026-13876/): Malicious code in @years17/n8n-nodes-utils-helper-g (npm) (malicious package) - [MAL-2026-13875](https://insights.sbomify.com/MAL-2026-13875/): Malicious code in @years17/n8n-nodes-utils-helper-f (npm) (malicious package) - [MAL-2026-13874](https://insights.sbomify.com/MAL-2026-13874/): Malicious code in @years17/n8n-nodes-utils-helper-e (npm) (malicious package) - [MAL-2026-13873](https://insights.sbomify.com/MAL-2026-13873/): Malicious code in @years17/n8n-nodes-utils-helper-d (npm) (malicious package) - [MAL-2026-13872](https://insights.sbomify.com/MAL-2026-13872/): Malicious code in @years17/n8n-nodes-utils-helper-c (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/148/