# Vulnerabilities published in 2026 - [MAL-2026-13781](https://insights.sbomify.com/MAL-2026-13781/): Malicious code in @noxzacode/libsignal-node (npm) (malicious package) - [MAL-2026-13780](https://insights.sbomify.com/MAL-2026-13780/): Malicious code in @noxzacode/eslint-config (npm) (malicious package) - [MAL-2026-1378](https://insights.sbomify.com/MAL-2026-1378/): Malicious code in f0-service-address-doctor (npm) (malicious package) - [MAL-2026-13779](https://insights.sbomify.com/MAL-2026-13779/): Malicious code in @bikli/cli (npm) (malicious package) - [MAL-2026-13778](https://insights.sbomify.com/MAL-2026-13778/): Malicious code in @bikli/bikli (npm) (malicious package) - [MAL-2026-13777](https://insights.sbomify.com/MAL-2026-13777/): Malicious code in upshift-finance (npm) (malicious package) - [MAL-2026-13776](https://insights.sbomify.com/MAL-2026-13776/): Malicious code in upshift-config (npm) (malicious package) - [MAL-2026-13775](https://insights.sbomify.com/MAL-2026-13775/): Malicious code in permit2 (npm) (malicious package) - [MAL-2026-13774](https://insights.sbomify.com/MAL-2026-13774/): Malicious code in augustdigital-sdk (npm) (malicious package) - [MAL-2026-13773](https://insights.sbomify.com/MAL-2026-13773/): Malicious code in camelot-ammv2-periphery (npm) (malicious package) - [MAL-2026-13772](https://insights.sbomify.com/MAL-2026-13772/): Malicious code in camelot-ammv2-core (npm) (malicious package) - [MAL-2026-13771](https://insights.sbomify.com/MAL-2026-13771/): Malicious code in boring-vault (npm) (malicious package) - [MAL-2026-13770](https://insights.sbomify.com/MAL-2026-13770/): Malicious code in @telekom-ods/react-ui-kit (npm) (malicious package) - [MAL-2026-1377](https://insights.sbomify.com/MAL-2026-1377/): Malicious code in adroit-websdk-server (npm) (malicious package) - [MAL-2026-13769](https://insights.sbomify.com/MAL-2026-13769/): Malicious code in svelte-vim-kit (npm) (malicious package) - [MAL-2026-13768](https://insights.sbomify.com/MAL-2026-13768/): Malicious code in sui-gql-client (npm) (malicious package) - [MAL-2026-13767](https://insights.sbomify.com/MAL-2026-13767/): Malicious code in sui-bcs-codec (npm) (malicious package) - [MAL-2026-13766](https://insights.sbomify.com/MAL-2026-13766/): Malicious code in node-internal-svg-loader (npm) (malicious package) - [MAL-2026-13765](https://insights.sbomify.com/MAL-2026-13765/): Malicious code in lines-columns (npm) (malicious package) - [MAL-2026-13764](https://insights.sbomify.com/MAL-2026-13764/): Malicious code in internallib_v164 (npm) (malicious package) - [MAL-2026-13763](https://insights.sbomify.com/MAL-2026-13763/): Malicious code in fetch-runtime (npm) (malicious package) - [MAL-2026-13762](https://insights.sbomify.com/MAL-2026-13762/): Malicious code in developer-dashboard (npm) (malicious package) - [MAL-2026-13761](https://insights.sbomify.com/MAL-2026-13761/): Malicious code in dakumangalsingh_virus (npm) (malicious package) - [MAL-2026-13760](https://insights.sbomify.com/MAL-2026-13760/): Malicious code in bs58-13 (npm) (malicious package) - [MAL-2026-1376](https://insights.sbomify.com/MAL-2026-1376/): Malicious code in @appleseed-apple/ac-sasskit (npm) (malicious package) - [MAL-2026-13759](https://insights.sbomify.com/MAL-2026-13759/): Malicious code in bs58-12 (npm) (malicious package) - [MAL-2026-13758](https://insights.sbomify.com/MAL-2026-13758/): Malicious code in bs58-11 (npm) (malicious package) - [MAL-2026-13757](https://insights.sbomify.com/MAL-2026-13757/): Malicious code in telebot-pro (PyPI) (malicious package) - [MAL-2026-13756](https://insights.sbomify.com/MAL-2026-13756/): Malicious code in joule-sbx-poc (PyPI) (malicious package) - [MAL-2026-13755](https://insights.sbomify.com/MAL-2026-13755/): Malicious code in ghazaly (npm) (malicious package) - [MAL-2026-13754](https://insights.sbomify.com/MAL-2026-13754/): Malicious code in dependencyfsdsfdsfg (npm) (malicious package) - [MAL-2026-13753](https://insights.sbomify.com/MAL-2026-13753/): Malicious code in dcfarguscert (npm) (malicious package) - [MAL-2026-13752](https://insights.sbomify.com/MAL-2026-13752/): Malicious code in chapters-core (npm) (malicious package) - [MAL-2026-13751](https://insights.sbomify.com/MAL-2026-13751/): Malicious code in bjm-low-code-components (npm) (malicious package) - [MAL-2026-13750](https://insights.sbomify.com/MAL-2026-13750/): Malicious code in base65-77x (npm) (malicious package) - [MAL-2026-1375](https://insights.sbomify.com/MAL-2026-1375/): Malicious code in @adamallana0909/apple-research-test (npm) (malicious package) - [MAL-2026-13749](https://insights.sbomify.com/MAL-2026-13749/): Malicious code in base65-33x (npm) (malicious package) - [MAL-2026-13748](https://insights.sbomify.com/MAL-2026-13748/): Malicious code in base65-15x (npm) (malicious package) - [MAL-2026-13747](https://insights.sbomify.com/MAL-2026-13747/): Malicious code in base65-13x (npm) (malicious package) - [MAL-2026-13746](https://insights.sbomify.com/MAL-2026-13746/): Malicious code in base65-12x (npm) (malicious package) - [MAL-2026-13745](https://insights.sbomify.com/MAL-2026-13745/): Malicious code in base65-11x (npm) (malicious package) - [MAL-2026-13744](https://insights.sbomify.com/MAL-2026-13744/): Malicious code in @dgn-src-click-to-pay-org/srcdcfreleasecert (npm) (malicious package) - [MAL-2026-13743](https://insights.sbomify.com/MAL-2026-13743/): Malicious code in whs4_ued (npm) (malicious package) - [MAL-2026-13742](https://insights.sbomify.com/MAL-2026-13742/): Malicious code in zeal-rq-hooks (npm) (malicious package) - [MAL-2026-13741](https://insights.sbomify.com/MAL-2026-13741/): Malicious code in safe-local-env-loader (npm) (malicious package) - [MAL-2026-13740](https://insights.sbomify.com/MAL-2026-13740/): Malicious code in kit-vim-map (npm) (malicious package) - [MAL-2026-1374](https://insights.sbomify.com/MAL-2026-1374/): Malicious code in spectral-corsair-my-backdoor (npm) (malicious package) - [MAL-2026-13739](https://insights.sbomify.com/MAL-2026-13739/): Malicious code in ethereum-vault-connector (npm) (malicious package) - [MAL-2026-13738](https://insights.sbomify.com/MAL-2026-13738/): Malicious code in @openzeppelin-5/contracts (npm) (malicious package) - [MAL-2026-13737](https://insights.sbomify.com/MAL-2026-13737/): Malicious code in @openzeppelin-4/contracts (npm) (malicious package) - [MAL-2026-13736](https://insights.sbomify.com/MAL-2026-13736/): Malicious code in @nzeros/codebreak (npm) (malicious package) - [MAL-2026-13735](https://insights.sbomify.com/MAL-2026-13735/): Malicious code in @aerodrome-finance/slipstream (npm) (malicious package) - [MAL-2026-13734](https://insights.sbomify.com/MAL-2026-13734/): Malicious code in @aerodrome-finance/contracts (npm) (malicious package) - [MAL-2026-13733](https://insights.sbomify.com/MAL-2026-13733/): Malicious code in newtun (npm) (malicious package) - [MAL-2026-13732](https://insights.sbomify.com/MAL-2026-13732/): Malicious code in joule-btp-extension (PyPI) (malicious package) - [MAL-2026-13731](https://insights.sbomify.com/MAL-2026-13731/): Malicious code in morpho-sdk (PyPI) (malicious package) - [MAL-2026-13730](https://insights.sbomify.com/MAL-2026-13730/): Malicious code in euler-sdk (PyPI) (malicious package) - [MAL-2026-1373](https://insights.sbomify.com/MAL-2026-1373/): Malicious code in @sky-it-livedata-libraries/livedata-commons-client (npm) (malicious package) - [MAL-2026-13729](https://insights.sbomify.com/MAL-2026-13729/): Malicious code in dlmm-sdk (PyPI) (malicious package) - [MAL-2026-13728](https://insights.sbomify.com/MAL-2026-13728/): Malicious code in dlmm (PyPI) (malicious package) - [MAL-2026-13727](https://insights.sbomify.com/MAL-2026-13727/): Malicious code in tailwind-elements-ui (npm) (malicious package) - [MAL-2026-13726](https://insights.sbomify.com/MAL-2026-13726/): Malicious code in svelte-kit-streak (npm) (malicious package) - [MAL-2026-13725](https://insights.sbomify.com/MAL-2026-13725/): Malicious code in spoint (npm) (malicious package) - [MAL-2026-13724](https://insights.sbomify.com/MAL-2026-13724/): Malicious code in kit-map-streak (npm) (malicious package) - [MAL-2026-13723](https://insights.sbomify.com/MAL-2026-13723/): Malicious code in godot-kit (npm) (malicious package) - [MAL-2026-13722](https://insights.sbomify.com/MAL-2026-13722/): Malicious code in fsbrowse (npm) (malicious package) - [MAL-2026-13721](https://insights.sbomify.com/MAL-2026-13721/): Malicious code in eth-library-utils (npm) (malicious package) - [MAL-2026-13720](https://insights.sbomify.com/MAL-2026-13720/): Malicious code in eth-library-toolkit (npm) (malicious package) - [MAL-2026-1372](https://insights.sbomify.com/MAL-2026-1372/): Malicious code in @sky-it-livedata-libraries/livedata-commons (npm) (malicious package) - [MAL-2026-13719](https://insights.sbomify.com/MAL-2026-13719/): Malicious code in commonjs-assertion (npm) (malicious package) - [MAL-2026-13718](https://insights.sbomify.com/MAL-2026-13718/): Malicious code in @sqlite-table/sql-creator (npm) (malicious package) - [MAL-2026-13717](https://insights.sbomify.com/MAL-2026-13717/): Malicious code in @sqlite-table/schema-generator (npm) (malicious package) - [MAL-2026-13716](https://insights.sbomify.com/MAL-2026-13716/): Malicious code in @sqlite-prime/nodesql (npm) (malicious package) - [MAL-2026-13715](https://insights.sbomify.com/MAL-2026-13715/): Malicious code in @sqlite-prime/createsql (npm) (malicious package) - [MAL-2026-13714](https://insights.sbomify.com/MAL-2026-13714/): Malicious code in @sqlite-labs/nodesql (npm) (malicious package) - [MAL-2026-13713](https://insights.sbomify.com/MAL-2026-13713/): Malicious code in @sqlite-labs/createsql (npm) (malicious package) - [MAL-2026-13712](https://insights.sbomify.com/MAL-2026-13712/): Malicious code in bigtime (PyPI) (malicious package) - [MAL-2026-13711](https://insights.sbomify.com/MAL-2026-13711/): Malicious code in plp-contract (PyPI) (malicious package) - [MAL-2026-13710](https://insights.sbomify.com/MAL-2026-13710/): Malicious code in neutrl-core (PyPI) (malicious package) - [MAL-2026-1371](https://insights.sbomify.com/MAL-2026-1371/): Malicious code in collecters (PyPI) (malicious package) - [MAL-2026-13709](https://insights.sbomify.com/MAL-2026-13709/): Malicious code in neutrl-contracts (PyPI) (malicious package) - [MAL-2026-13708](https://insights.sbomify.com/MAL-2026-13708/): Malicious code in xerohub-discord-voice (npm) (malicious package) - [MAL-2026-13707](https://insights.sbomify.com/MAL-2026-13707/): Malicious code in polymarket-stake-mathss (npm) (malicious package) - [MAL-2026-13706](https://insights.sbomify.com/MAL-2026-13706/): Malicious code in neverthrow-js (npm) (malicious package) - [MAL-2026-13705](https://insights.sbomify.com/MAL-2026-13705/): Malicious code in iconova-react (npm) (malicious package) - [MAL-2026-13704](https://insights.sbomify.com/MAL-2026-13704/): Malicious code in chai-tracker (npm) (malicious package) - [MAL-2026-13703](https://insights.sbomify.com/MAL-2026-13703/): Malicious code in chai-as-promised-plus (npm) (malicious package) - [MAL-2026-13702](https://insights.sbomify.com/MAL-2026-13702/): Malicious code in chai-as-map (npm) (malicious package) - [MAL-2026-13701](https://insights.sbomify.com/MAL-2026-13701/): Malicious code in chai-as-format (npm) (malicious package) - [MAL-2026-13700](https://insights.sbomify.com/MAL-2026-13700/): Malicious code in chai-as-deployer (npm) (malicious package) - [MAL-2026-1370](https://insights.sbomify.com/MAL-2026-1370/): Malicious code in mezukabil (npm) (malicious package) - [MAL-2026-137](https://insights.sbomify.com/MAL-2026-137/): Malicious code in rt-da-classic-card-collection (npm) (malicious package) - [MAL-2026-13699](https://insights.sbomify.com/MAL-2026-13699/): Malicious code in chai-as-bench (npm) (malicious package) - [MAL-2026-13698](https://insights.sbomify.com/MAL-2026-13698/): Malicious code in simple-date-formatter-new-9 (npm) (malicious package) - [MAL-2026-13697](https://insights.sbomify.com/MAL-2026-13697/): Malicious code in simple-date-formatter-new-10 (npm) (malicious package) - [MAL-2026-13696](https://insights.sbomify.com/MAL-2026-13696/): Malicious code in postcss-initial-provider (npm) (malicious package) - [MAL-2026-13695](https://insights.sbomify.com/MAL-2026-13695/): Malicious code in hex-encode-utils (npm) (malicious package) - [MAL-2026-13694](https://insights.sbomify.com/MAL-2026-13694/): Malicious code in env-local (npm) (malicious package) - [MAL-2026-13693](https://insights.sbomify.com/MAL-2026-13693/): Malicious code in cryptostock (npm) (malicious package) - [MAL-2026-13692](https://insights.sbomify.com/MAL-2026-13692/): Malicious code in chai-jsonss (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/150/