# Vulnerabilities published in 2026


- [MAL-2026-13691](https://insights.sbomify.com/MAL-2026-13691/): Malicious code in @rblxts/services (npm) (malicious package)
- [MAL-2026-13690](https://insights.sbomify.com/MAL-2026-13690/): Malicious code in @noobaihome/amis-uni-area-widget (npm) (malicious package)
- [MAL-2026-1369](https://insights.sbomify.com/MAL-2026-1369/): Malicious code in kinggupong (npm) (malicious package)
- [MAL-2026-13689](https://insights.sbomify.com/MAL-2026-13689/): Malicious code in @noobaihome/amis-simple-area-widget (npm) (malicious package)
- [MAL-2026-13688](https://insights.sbomify.com/MAL-2026-13688/): Malicious code in @kuperka/chainguard-sdk (npm) (malicious package)
- [MAL-2026-13687](https://insights.sbomify.com/MAL-2026-13687/): Malicious code in tokocrytodev (npm) (malicious package)
- [MAL-2026-13686](https://insights.sbomify.com/MAL-2026-13686/): Malicious code in chaintest (PyPI) (malicious package)
- [MAL-2026-13685](https://insights.sbomify.com/MAL-2026-13685/): Malicious code in pytablute (PyPI) (malicious package)
- [MAL-2026-13684](https://insights.sbomify.com/MAL-2026-13684/): Malicious code in @ssgw/icon (npm) (malicious package)
- [MAL-2026-13683](https://insights.sbomify.com/MAL-2026-13683/): Malicious code in kotoraka (PyPI) (malicious package)
- [MAL-2026-13682](https://insights.sbomify.com/MAL-2026-13682/): Malicious code in btcflx (PyPI) (malicious package)
- [MAL-2026-13681](https://insights.sbomify.com/MAL-2026-13681/): Malicious code in btcflip (PyPI) (malicious package)
- [MAL-2026-13680](https://insights.sbomify.com/MAL-2026-13680/): Malicious code in test-noexist-xyz-99 (npm) (malicious package)
- [MAL-2026-1368](https://insights.sbomify.com/MAL-2026-1368/): Malicious code in json-specparse (npm) (malicious package)
- [MAL-2026-13679](https://insights.sbomify.com/MAL-2026-13679/): Malicious code in svelte-streak-kit (npm) (malicious package)
- [MAL-2026-13678](https://insights.sbomify.com/MAL-2026-13678/): Malicious code in svelte-map-visual (npm) (malicious package)
- [MAL-2026-13677](https://insights.sbomify.com/MAL-2026-13677/): Malicious code in svelte-kit-cache (npm) (malicious package)
- [MAL-2026-13676](https://insights.sbomify.com/MAL-2026-13676/): Malicious code in svelte-cache-kit (npm) (malicious package)
- [MAL-2026-13675](https://insights.sbomify.com/MAL-2026-13675/): Malicious code in statist-browser-typed-client-eventea.projects.tdevice (npm) (malicious package)
- [MAL-2026-13674](https://insights.sbomify.com/MAL-2026-13674/): Malicious code in statist-browser-typed-client-eventea.projects.tdeal (npm) (malicious package)
- [MAL-2026-13673](https://insights.sbomify.com/MAL-2026-13673/): Malicious code in statist-browser-typed-client-eventea.projects.pwakasko (npm) (malicious package)
- [MAL-2026-13672](https://insights.sbomify.com/MAL-2026-13672/): Malicious code in statist-browser-typed-client-eventea.projects.pwainsurance (npm) (malicious package)
- [MAL-2026-13671](https://insights.sbomify.com/MAL-2026-13671/): Malicious code in statist-browser-typed-client-eventea.projects.pwahelp (npm) (malicious package)
- [MAL-2026-13670](https://insights.sbomify.com/MAL-2026-13670/): Malicious code in statist-browser-typed-client-eventea.projects.pwafamily (npm) (malicious package)
- [MAL-2026-1367](https://insights.sbomify.com/MAL-2026-1367/): Malicious code in @kinggupong/libsignal-node (npm) (malicious package)
- [MAL-2026-13669](https://insights.sbomify.com/MAL-2026-13669/): Malicious code in specials-resources-server (npm) (malicious package)
- [MAL-2026-13668](https://insights.sbomify.com/MAL-2026-13668/): Malicious code in @lambda-platform/lambda-vue (npm) (malicious package)
- [MAL-2026-13667](https://insights.sbomify.com/MAL-2026-13667/): Malicious code in kotanku (PyPI) (malicious package)
- [MAL-2026-13666](https://insights.sbomify.com/MAL-2026-13666/): Malicious code in cubesat-upstream-driver (PyPI) (malicious package)
- [MAL-2026-13665](https://insights.sbomify.com/MAL-2026-13665/): Malicious code in riakcs (PyPI) (malicious package)
- [MAL-2026-13664](https://insights.sbomify.com/MAL-2026-13664/): Malicious code in titan-exchange-shared-permissions (npm) (malicious package)
- [MAL-2026-13663](https://insights.sbomify.com/MAL-2026-13663/): Malicious code in sme-rko-finance-front-payments-feed-display-list-impl (npm) (malicious package)
- [MAL-2026-13662](https://insights.sbomify.com/MAL-2026-13662/): Malicious code in sme-rko-finance-front-payments-feed-display-list (npm) (malicious package)
- [MAL-2026-13661](https://insights.sbomify.com/MAL-2026-13661/): Malicious code in sme-rko-finance-front-payments-feed-adapter (npm) (malicious package)
- [MAL-2026-13660](https://insights.sbomify.com/MAL-2026-13660/): Malicious code in sme-rko-finance-front-payments-domain (npm) (malicious package)
- [MAL-2026-1366](https://insights.sbomify.com/MAL-2026-1366/): Malicious code in @kinggupong/baileys (npm) (malicious package)
- [MAL-2026-13659](https://insights.sbomify.com/MAL-2026-13659/): Malicious code in sme-rko-finance-front-payments-currency-payment-domain (npm) (malicious package)
- [MAL-2026-13658](https://insights.sbomify.com/MAL-2026-13658/): Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm) (malicious package)
- [MAL-2026-13657](https://insights.sbomify.com/MAL-2026-13657/): Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl (npm) (malicious package)
- [MAL-2026-13656](https://insights.sbomify.com/MAL-2026-13656/): Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models (npm) (malicious package)
- [MAL-2026-13655](https://insights.sbomify.com/MAL-2026-13655/): Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm) (malicious package)
- [MAL-2026-13654](https://insights.sbomify.com/MAL-2026-13654/): Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm) (malicious package)
- [MAL-2026-13653](https://insights.sbomify.com/MAL-2026-13653/): Malicious code in sme-rko-finance-front-payment-registers-operations-domain (npm) (malicious package)
- [MAL-2026-13652](https://insights.sbomify.com/MAL-2026-13652/): Malicious code in sme-rko-finance-front-operations-widget-models (npm) (malicious package)
- [MAL-2026-13651](https://insights.sbomify.com/MAL-2026-13651/): Malicious code in sme-rko-finance-front-operations-widget-impl (npm) (malicious package)
- [MAL-2026-13650](https://insights.sbomify.com/MAL-2026-13650/): Malicious code in sme-rko-finance-front-operations-widget-domain (npm) (malicious package)
- [MAL-2026-1365](https://insights.sbomify.com/MAL-2026-1365/): Malicious code in unibody (npm) (malicious package)
- [MAL-2026-13649](https://insights.sbomify.com/MAL-2026-13649/): Malicious code in sme-rko-finance-front-operations-tax (npm) (malicious package)
- [MAL-2026-13648](https://insights.sbomify.com/MAL-2026-13648/): Malicious code in sme-rko-finance-front-operations-special-payments (npm) (malicious package)
- [MAL-2026-13647](https://insights.sbomify.com/MAL-2026-13647/): Malicious code in sme-rko-finance-front-operations-shared (npm) (malicious package)
- [MAL-2026-13646](https://insights.sbomify.com/MAL-2026-13646/): Malicious code in sme-rko-finance-front-operations-providers (npm) (malicious package)
- [MAL-2026-13645](https://insights.sbomify.com/MAL-2026-13645/): Malicious code in sme-rko-finance-front-operations-penalty (npm) (malicious package)
- [MAL-2026-13644](https://insights.sbomify.com/MAL-2026-13644/): Malicious code in sme-rko-finance-front-operations-pegasus (npm) (malicious package)
- [MAL-2026-13643](https://insights.sbomify.com/MAL-2026-13643/): Malicious code in sme-rko-finance-front-operations-overnight (npm) (malicious package)
- [MAL-2026-13642](https://insights.sbomify.com/MAL-2026-13642/): Malicious code in sme-rko-finance-front-operations-other (npm) (malicious package)
- [MAL-2026-13641](https://insights.sbomify.com/MAL-2026-13641/): Malicious code in sme-rko-finance-front-operations-notifications-models (npm) (malicious package)
- [MAL-2026-13640](https://insights.sbomify.com/MAL-2026-13640/): Malicious code in sme-rko-finance-front-operations-notifications-impl (npm) (malicious package)
- [MAL-2026-1364](https://insights.sbomify.com/MAL-2026-1364/): Malicious code in svg-safety-tool (npm) (malicious package)
- [MAL-2026-13639](https://insights.sbomify.com/MAL-2026-13639/): Malicious code in sme-rko-finance-front-operations-income (npm) (malicious package)
- [MAL-2026-13638](https://insights.sbomify.com/MAL-2026-13638/): Malicious code in sme-rko-finance-front-operations-holding-domain (npm) (malicious package)
- [MAL-2026-13637](https://insights.sbomify.com/MAL-2026-13637/): Malicious code in sme-rko-finance-front-operations-feed-models (npm) (malicious package)
- [MAL-2026-13636](https://insights.sbomify.com/MAL-2026-13636/): Malicious code in sme-rko-finance-front-operations-feed-impl (npm) (malicious package)
- [MAL-2026-13635](https://insights.sbomify.com/MAL-2026-13635/): Malicious code in sme-rko-finance-front-operations-fee (npm) (malicious package)
- [MAL-2026-13634](https://insights.sbomify.com/MAL-2026-13634/): Malicious code in sme-rko-finance-front-operations-domain (npm) (malicious package)
- [MAL-2026-13633](https://insights.sbomify.com/MAL-2026-13633/): Malicious code in modern-localization (npm) (malicious package)
- [MAL-2026-13632](https://insights.sbomify.com/MAL-2026-13632/): Malicious code in map-streak-kit (npm) (malicious package)
- [MAL-2026-13631](https://insights.sbomify.com/MAL-2026-13631/): Malicious code in localization-fixer (npm) (malicious package)
- [MAL-2026-13630](https://insights.sbomify.com/MAL-2026-13630/): Malicious code in @rbx-ts/services (npm) (malicious package)
- [MAL-2026-1363](https://insights.sbomify.com/MAL-2026-1363/): Malicious code in react-svg-anchor (npm) (malicious package)
- [MAL-2026-13629](https://insights.sbomify.com/MAL-2026-13629/): Malicious code in @coralxyz/anchor (npm) (malicious package)
- [MAL-2026-13628](https://insights.sbomify.com/MAL-2026-13628/): Malicious code in streak-map-kit (npm) (malicious package)
- [MAL-2026-13627](https://insights.sbomify.com/MAL-2026-13627/): Malicious code in @nestjs-passport/jwt (npm) (malicious package)
- [MAL-2026-13626](https://insights.sbomify.com/MAL-2026-13626/): Malicious code in @mrbenty8jf1p9y5/oidc-bind-canary (npm) (malicious package)
- [MAL-2026-13625](https://insights.sbomify.com/MAL-2026-13625/): Malicious code in @depup/nuxt (npm) (malicious package)
- [MAL-2026-13624](https://insights.sbomify.com/MAL-2026-13624/): Malicious code in @depup/memfs (npm) (malicious package)
- [MAL-2026-13623](https://insights.sbomify.com/MAL-2026-13623/): Malicious code in @depup/aws-sdk__credential-provider-process (npm) (malicious package)
- [MAL-2026-13622](https://insights.sbomify.com/MAL-2026-13622/): Malicious code in @depup/astro (npm) (malicious package)
- [MAL-2026-13621](https://insights.sbomify.com/MAL-2026-13621/): Malicious code in @decido/backend-core (npm) (malicious package)
- [MAL-2026-13620](https://insights.sbomify.com/MAL-2026-13620/): Malicious code in @catamania/front-components (npm) (malicious package)
- [MAL-2026-1362](https://insights.sbomify.com/MAL-2026-1362/): Malicious code in praxis-scripts (npm) (malicious package)
- [MAL-2026-13619](https://insights.sbomify.com/MAL-2026-13619/): Malicious code in atlas-internal (PyPI) (malicious package)
- [MAL-2026-13618](https://insights.sbomify.com/MAL-2026-13618/): Malicious code in w-screenctl (npm) (malicious package)
- [MAL-2026-13617](https://insights.sbomify.com/MAL-2026-13617/): Malicious code in ts-utility-plus (npm) (malicious package)
- [MAL-2026-13616](https://insights.sbomify.com/MAL-2026-13616/): Malicious code in hardhat-cap (npm) (malicious package)
- [MAL-2026-13615](https://insights.sbomify.com/MAL-2026-13615/): Malicious code in agenthub-ai (npm) (malicious package)
- [MAL-2026-13614](https://insights.sbomify.com/MAL-2026-13614/): Malicious code in aclade-agent (npm) (malicious package)
- [MAL-2026-13613](https://insights.sbomify.com/MAL-2026-13613/): Malicious code in big-tss (npm) (malicious package)
- [MAL-2026-13612](https://insights.sbomify.com/MAL-2026-13612/): Malicious code in transform-es2015-unicode-regex (npm) (malicious package)
- [MAL-2026-13611](https://insights.sbomify.com/MAL-2026-13611/): Malicious code in mangomind-agent (npm) (malicious package)
- [MAL-2026-13610](https://insights.sbomify.com/MAL-2026-13610/): Malicious code in f-termx (npm) (malicious package)
- [MAL-2026-1361](https://insights.sbomify.com/MAL-2026-1361/): Malicious code in pcl-build-docroot (npm) (malicious package)
- [MAL-2026-13609](https://insights.sbomify.com/MAL-2026-13609/): Malicious code in hardhat-set (npm) (malicious package)
- [MAL-2026-13608](https://insights.sbomify.com/MAL-2026-13608/): Malicious code in @vertexa/prisma-fetch-engine (npm) (malicious package)
- [MAL-2026-13607](https://insights.sbomify.com/MAL-2026-13607/): Malicious code in speed-hashes (PyPI) (malicious package)
- [MAL-2026-13605](https://insights.sbomify.com/MAL-2026-13605/): Malicious code in yakuza0 (npm) (malicious package)
- [MAL-2026-13604](https://insights.sbomify.com/MAL-2026-13604/): Malicious code in tailwindcss-motion-advanced (npm) (malicious package)
- [MAL-2026-13603](https://insights.sbomify.com/MAL-2026-13603/): Malicious code in platform-ui-colors (npm) (malicious package)
- [MAL-2026-13602](https://insights.sbomify.com/MAL-2026-13602/): Malicious code in dolyame-ui-tabslayout (npm) (malicious package)
- [MAL-2026-13601](https://insights.sbomify.com/MAL-2026-13601/): Malicious code in dolyame-ui-tablemobile (npm) (malicious package)
- [MAL-2026-13600](https://insights.sbomify.com/MAL-2026-13600/): Malicious code in dolyame-ui-tableinline (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/151/