# Vulnerabilities published in 2026 - [MAL-2026-13509](https://insights.sbomify.com/MAL-2026-13509/): Malicious code in dolyame-ui-lazyrender (npm) (malicious package) - [MAL-2026-13508](https://insights.sbomify.com/MAL-2026-13508/): Malicious code in dolyame-ui-inputpassword (npm) (malicious package) - [MAL-2026-13507](https://insights.sbomify.com/MAL-2026-13507/): Malicious code in dolyame-ui-inputcolor (npm) (malicious package) - [MAL-2026-13506](https://insights.sbomify.com/MAL-2026-13506/): Malicious code in dolyame-ui-inputbox (npm) (malicious package) - [MAL-2026-13505](https://insights.sbomify.com/MAL-2026-13505/): Malicious code in dolyame-ui-iconloaderhoc (npm) (malicious package) - [MAL-2026-13504](https://insights.sbomify.com/MAL-2026-13504/): Malicious code in dolyame-ui-attachfile (npm) (malicious package) - [MAL-2026-13503](https://insights.sbomify.com/MAL-2026-13503/): Malicious code in distributorblock (npm) (malicious package) - [MAL-2026-13502](https://insights.sbomify.com/MAL-2026-13502/): Malicious code in devplatform-react-mcp (npm) (malicious package) - [MAL-2026-13501](https://insights.sbomify.com/MAL-2026-13501/): Malicious code in delivery-ci-jira-rnd (npm) (malicious package) - [MAL-2026-13500](https://insights.sbomify.com/MAL-2026-13500/): Malicious code in delivery-ci-dpat (npm) (malicious package) - [MAL-2026-1350](https://insights.sbomify.com/MAL-2026-1350/): Malicious code in falador (PyPI) (malicious package) - [MAL-2026-135](https://insights.sbomify.com/MAL-2026-135/): Malicious code in npe-toolkit-faves (npm) (malicious package) - [MAL-2026-13499](https://insights.sbomify.com/MAL-2026-13499/): Malicious code in delivery-ci-codeceptjs-fork (npm) (malicious package) - [MAL-2026-13498](https://insights.sbomify.com/MAL-2026-13498/): Malicious code in ded-pwa-ded-pwa-core (npm) (malicious package) - [MAL-2026-13497](https://insights.sbomify.com/MAL-2026-13497/): Malicious code in ded-pwa-c-page-maker-props (npm) (malicious package) - [MAL-2026-13496](https://insights.sbomify.com/MAL-2026-13496/): Malicious code in ded-pwa-c-cms (npm) (malicious package) - [MAL-2026-13495](https://insights.sbomify.com/MAL-2026-13495/): Malicious code in blekit (npm) (malicious package) - [MAL-2026-13494](https://insights.sbomify.com/MAL-2026-13494/): Malicious code in bigops-telephony-mock (npm) (malicious package) - [MAL-2026-13493](https://insights.sbomify.com/MAL-2026-13493/): Malicious code in velabuild (npm) (malicious package) - [MAL-2026-13492](https://insights.sbomify.com/MAL-2026-13492/): Malicious code in rdfxvela-build (npm) (malicious package) - [MAL-2026-13491](https://insights.sbomify.com/MAL-2026-13491/): Malicious code in rdfxvela (npm) (malicious package) - [MAL-2026-13490](https://insights.sbomify.com/MAL-2026-13490/): Malicious code in fast-hashes (PyPI) (malicious package) - [MAL-2026-1349](https://insights.sbomify.com/MAL-2026-1349/): Malicious code in mabibilabub (npm) (malicious package) - [MAL-2026-13489](https://insights.sbomify.com/MAL-2026-13489/): Malicious code in pydanticc (PyPI) (malicious package) - [MAL-2026-13488](https://insights.sbomify.com/MAL-2026-13488/): Malicious code in idnna (PyPI) (malicious package) - [MAL-2026-13487](https://insights.sbomify.com/MAL-2026-13487/): Malicious code in flasq (PyPI) (malicious package) - [MAL-2026-13486](https://insights.sbomify.com/MAL-2026-13486/): Malicious code in fastapii (PyPI) (malicious package) - [MAL-2026-13485](https://insights.sbomify.com/MAL-2026-13485/): Malicious code in weight2loss (npm) (malicious package) - [MAL-2026-13484](https://insights.sbomify.com/MAL-2026-13484/): Malicious code in merge-grid-stats (npm) (malicious package) - [MAL-2026-13483](https://insights.sbomify.com/MAL-2026-13483/): Malicious code in internallib_v514 (npm) (malicious package) - [MAL-2026-13482](https://insights.sbomify.com/MAL-2026-13482/): Malicious code in diezyclutch-baileys (npm) (malicious package) - [MAL-2026-13481](https://insights.sbomify.com/MAL-2026-13481/): Malicious code in cdf-tag-commander-helper (npm) (malicious package) - [MAL-2026-13480](https://insights.sbomify.com/MAL-2026-13480/): Malicious code in @prototypevip/baileys (npm) (malicious package) - [MAL-2026-1348](https://insights.sbomify.com/MAL-2026-1348/): Malicious code in locale-clamp-middleware (npm) (malicious package) - [MAL-2026-13479](https://insights.sbomify.com/MAL-2026-13479/): Malicious code in @cats-cdf/browser-metrics-meter (npm) (malicious package) - [MAL-2026-13478](https://insights.sbomify.com/MAL-2026-13478/): Malicious code in @cats-cdf/authentication (npm) (malicious package) - [MAL-2026-13477](https://insights.sbomify.com/MAL-2026-13477/): Malicious code in svelte-visual-map (npm) (malicious package) - [MAL-2026-13476](https://insights.sbomify.com/MAL-2026-13476/): Malicious code in sui-migration-audit-cli (npm) (malicious package) - [MAL-2026-13475](https://insights.sbomify.com/MAL-2026-13475/): Malicious code in sui-graphql-client (npm) (malicious package) - [MAL-2026-13474](https://insights.sbomify.com/MAL-2026-13474/): Malicious code in @diezyyasha/libsignal-node (npm) (malicious package) - [MAL-2026-13473](https://insights.sbomify.com/MAL-2026-13473/): Malicious code in alphalend-layouts (PyPI) (malicious package) - [MAL-2026-13472](https://insights.sbomify.com/MAL-2026-13472/): Malicious code in alphalend-abi (PyPI) (malicious package) - [MAL-2026-13471](https://insights.sbomify.com/MAL-2026-13471/): Malicious code in zyr-agent (npm) (malicious package) - [MAL-2026-13470](https://insights.sbomify.com/MAL-2026-13470/): Malicious code in ynastore-baileys (npm) (malicious package) - [MAL-2026-1347](https://insights.sbomify.com/MAL-2026-1347/): Malicious code in f0-abstraction-resolver (npm) (malicious package) - [MAL-2026-13469](https://insights.sbomify.com/MAL-2026-13469/): Malicious code in xxdxax (npm) (malicious package) - [MAL-2026-13468](https://insights.sbomify.com/MAL-2026-13468/): Malicious code in xdaxx (npm) (malicious package) - [MAL-2026-13467](https://insights.sbomify.com/MAL-2026-13467/): Malicious code in wos-library-ui (npm) (malicious package) - [MAL-2026-13466](https://insights.sbomify.com/MAL-2026-13466/): Malicious code in wormgpt-cli (npm) (malicious package) - [MAL-2026-13465](https://insights.sbomify.com/MAL-2026-13465/): Malicious code in vite-vue-path-map (npm) (malicious package) - [MAL-2026-13464](https://insights.sbomify.com/MAL-2026-13464/): Malicious code in vite-svg-parse (npm) (malicious package) - [MAL-2026-13463](https://insights.sbomify.com/MAL-2026-13463/): Malicious code in vite-plugin-cleaner (npm) (malicious package) - [MAL-2026-13462](https://insights.sbomify.com/MAL-2026-13462/): Malicious code in trimprompt (npm) (malicious package) - [MAL-2026-13461](https://insights.sbomify.com/MAL-2026-13461/): Malicious code in supersig (npm) (malicious package) - [MAL-2026-13460](https://insights.sbomify.com/MAL-2026-13460/): Malicious code in stretchshop (npm) (malicious package) - [MAL-2026-1346](https://insights.sbomify.com/MAL-2026-1346/): Malicious code in ts-lint-builder (npm) (malicious package) - [MAL-2026-13459](https://insights.sbomify.com/MAL-2026-13459/): Malicious code in streak-map-cache (npm) (malicious package) - [MAL-2026-13458](https://insights.sbomify.com/MAL-2026-13458/): Malicious code in squeez (npm) (malicious package) - [MAL-2026-13457](https://insights.sbomify.com/MAL-2026-13457/): Malicious code in shadowx-fca (npm) (malicious package) - [MAL-2026-13456](https://insights.sbomify.com/MAL-2026-13456/): Malicious code in santana-baileys (npm) (malicious package) - [MAL-2026-13455](https://insights.sbomify.com/MAL-2026-13455/): Malicious code in remote-claude-daemon (npm) (malicious package) - [MAL-2026-13454](https://insights.sbomify.com/MAL-2026-13454/): Malicious code in poc-ch4rlygr (npm) (malicious package) - [MAL-2026-13453](https://insights.sbomify.com/MAL-2026-13453/): Malicious code in pilgrimage-portal-client (npm) (malicious package) - [MAL-2026-13452](https://insights.sbomify.com/MAL-2026-13452/): Malicious code in opencode-optimised-toolings (npm) (malicious package) - [MAL-2026-13451](https://insights.sbomify.com/MAL-2026-13451/): Malicious code in nms-dashboard-js (npm) (malicious package) - [MAL-2026-13450](https://insights.sbomify.com/MAL-2026-13450/): Malicious code in move-bcs-codec (npm) (malicious package) - [MAL-2026-1345](https://insights.sbomify.com/MAL-2026-1345/): Malicious code in npm-builders (npm) (malicious package) - [MAL-2026-13449](https://insights.sbomify.com/MAL-2026-13449/): Malicious code in merchantweb-lang-cookie-reset (npm) (malicious package) - [MAL-2026-13448](https://insights.sbomify.com/MAL-2026-13448/): Malicious code in lib-frontsga (npm) (malicious package) - [MAL-2026-13447](https://insights.sbomify.com/MAL-2026-13447/): Malicious code in gpt-terminal-cli (npm) (malicious package) - [MAL-2026-13446](https://insights.sbomify.com/MAL-2026-13446/): Malicious code in express-chai (npm) (malicious package) - [MAL-2026-13445](https://insights.sbomify.com/MAL-2026-13445/): Malicious code in elephant-tusk-runner (npm) (malicious package) - [MAL-2026-13444](https://insights.sbomify.com/MAL-2026-13444/): Malicious code in dpdgroup-css (npm) (malicious package) - [MAL-2026-13443](https://insights.sbomify.com/MAL-2026-13443/): Malicious code in diezyyasha-baileys (npm) (malicious package) - [MAL-2026-13442](https://insights.sbomify.com/MAL-2026-13442/): Malicious code in content-common (npm) (malicious package) - [MAL-2026-13441](https://insights.sbomify.com/MAL-2026-13441/): Malicious code in consumerweb-creditcollection (npm) (malicious package) - [MAL-2026-13440](https://insights.sbomify.com/MAL-2026-13440/): Malicious code in connect-contingency (npm) (malicious package) - [MAL-2026-1344](https://insights.sbomify.com/MAL-2026-1344/): Malicious code in bignum-ts (npm) (malicious package) - [MAL-2026-13439](https://insights.sbomify.com/MAL-2026-13439/): Malicious code in commonweb-balance (npm) (malicious package) - [MAL-2026-13438](https://insights.sbomify.com/MAL-2026-13438/): Malicious code in cewe-npm-cops (npm) (malicious package) - [MAL-2026-13437](https://insights.sbomify.com/MAL-2026-13437/): Malicious code in aitable-workflow-server (npm) (malicious package) - [MAL-2026-13436](https://insights.sbomify.com/MAL-2026-13436/): Malicious code in @wbnr/frontend-shared (npm) (malicious package) - [MAL-2026-13435](https://insights.sbomify.com/MAL-2026-13435/): Malicious code in @united-airlines-org/atmos-design-system (npm) (malicious package) - [MAL-2026-13434](https://insights.sbomify.com/MAL-2026-13434/): Malicious code in @lyxa.ai/core (npm) (malicious package) - [MAL-2026-13433](https://insights.sbomify.com/MAL-2026-13433/): Malicious code in @ks-video/kwai-player-web (npm) (malicious package) - [MAL-2026-13432](https://insights.sbomify.com/MAL-2026-13432/): Malicious code in @junyoung-kim/reins (npm) (malicious package) - [MAL-2026-13431](https://insights.sbomify.com/MAL-2026-13431/): Malicious code in @itsreduxtm/unpkg-xss-test (npm) (malicious package) - [MAL-2026-13430](https://insights.sbomify.com/MAL-2026-13430/): Malicious code in @ch4acko3/frontal-lobe (npm) (malicious package) - [MAL-2026-1343](https://insights.sbomify.com/MAL-2026-1343/): Malicious code in chai-as-flex (npm) (malicious package) - [MAL-2026-13429](https://insights.sbomify.com/MAL-2026-13429/): Malicious code in @avi892nash/aegis-grid-runner (npm) (malicious package) - [MAL-2026-13428](https://insights.sbomify.com/MAL-2026-13428/): Malicious code in @love-moon/conductor-cli (npm) (malicious package) - [MAL-2026-13427](https://insights.sbomify.com/MAL-2026-13427/): Malicious code in @leejungkiin/awkit (npm) (malicious package) - [MAL-2026-13426](https://insights.sbomify.com/MAL-2026-13426/): Malicious code in xayoub-xctxteam (PyPI) (malicious package) - [MAL-2026-13425](https://insights.sbomify.com/MAL-2026-13425/): Malicious code in typst-resume-cli (npm) (malicious package) - [MAL-2026-13424](https://insights.sbomify.com/MAL-2026-13424/): Malicious code in tailwindcss-hide-scrollbar (npm) (malicious package) - [MAL-2026-13423](https://insights.sbomify.com/MAL-2026-13423/): Malicious code in fetchrtds (npm) (malicious package) - [MAL-2026-13422](https://insights.sbomify.com/MAL-2026-13422/): Malicious code in beautiful-ui-monitoring (npm) (malicious package) - [MAL-2026-13421](https://insights.sbomify.com/MAL-2026-13421/): Malicious code in @trackunit/iris-app-sdk-vite (npm) (malicious package) - [MAL-2026-13420](https://insights.sbomify.com/MAL-2026-13420/): Malicious code in @innocarpe/deepseek-build (npm) (malicious package) - [MAL-2026-1342](https://insights.sbomify.com/MAL-2026-1342/): Malicious code in collectables (PyPI) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/153/