# Vulnerabilities published in 2026 - [MAL-2026-13419](https://insights.sbomify.com/MAL-2026-13419/): Malicious code in @holocronlab/botruntime-runtime (npm) (malicious package) - [MAL-2026-13418](https://insights.sbomify.com/MAL-2026-13418/): Malicious code in @ccfly/setup-linux-x64 (npm) (malicious package) - [MAL-2026-13417](https://insights.sbomify.com/MAL-2026-13417/): Malicious code in @ccfly/setup-linux-arm64 (npm) (malicious package) - [MAL-2026-13416](https://insights.sbomify.com/MAL-2026-13416/): Malicious code in @bananacool467/ui-tools (npm) (malicious package) - [MAL-2026-13415](https://insights.sbomify.com/MAL-2026-13415/): Malicious code in @aubea/mars (npm) (malicious package) - [MAL-2026-13414](https://insights.sbomify.com/MAL-2026-13414/): Malicious code in @atom8n/inspector (npm) (malicious package) - [MAL-2026-13413](https://insights.sbomify.com/MAL-2026-13413/): Malicious code in @astralcore/aura-wb (npm) (malicious package) - [MAL-2026-13412](https://insights.sbomify.com/MAL-2026-13412/): Malicious code in @apicity/meta (npm) (malicious package) - [MAL-2026-13411](https://insights.sbomify.com/MAL-2026-13411/): Malicious code in @addai/node (npm) (malicious package) - [MAL-2026-13410](https://insights.sbomify.com/MAL-2026-13410/): Malicious code in @addai/entity-runtime (npm) (malicious package) - [MAL-2026-1341](https://insights.sbomify.com/MAL-2026-1341/): Malicious code in collects (PyPI) (malicious package) - [MAL-2026-13409](https://insights.sbomify.com/MAL-2026-13409/): Malicious code in @addai/ainode (npm) (malicious package) - [MAL-2026-13408](https://insights.sbomify.com/MAL-2026-13408/): Malicious code in @activepieces/piece-base44 (npm) (malicious package) - [MAL-2026-13407](https://insights.sbomify.com/MAL-2026-13407/): Malicious code in @0l00000l/auth (npm) (malicious package) - [MAL-2026-13406](https://insights.sbomify.com/MAL-2026-13406/): Malicious code in 9remote (npm) (malicious package) - [MAL-2026-13405](https://insights.sbomify.com/MAL-2026-13405/): Malicious code in vitest-preview-pro-all (npm) (malicious package) - [MAL-2026-13404](https://insights.sbomify.com/MAL-2026-13404/): Malicious code in tsihealth-client (npm) (malicious package) - [MAL-2026-13403](https://insights.sbomify.com/MAL-2026-13403/): Malicious code in streak-cache-map (npm) (malicious package) - [MAL-2026-13401](https://insights.sbomify.com/MAL-2026-13401/): Malicious code in helmet-pro (npm) (malicious package) - [MAL-2026-13400](https://insights.sbomify.com/MAL-2026-13400/): Malicious code in agenttunnels (npm) (malicious package) - [MAL-2026-1340](https://insights.sbomify.com/MAL-2026-1340/): Malicious code in safetest123 (PyPI) (malicious package) - [MAL-2026-13399](https://insights.sbomify.com/MAL-2026-13399/): Malicious code in agenthub-multiagent-mcp (npm) (malicious package) - [MAL-2026-13398](https://insights.sbomify.com/MAL-2026-13398/): Malicious code in @xiaohhhh1/canvas-agent (npm) (malicious package) - [MAL-2026-13396](https://insights.sbomify.com/MAL-2026-13396/): Malicious code in @activepieces/piece-google-forms (npm) (malicious package) - [MAL-2026-13395](https://insights.sbomify.com/MAL-2026-13395/): Malicious code in @activepieces/piece-google-contacts (npm) (malicious package) - [MAL-2026-13394](https://insights.sbomify.com/MAL-2026-13394/): Malicious code in @activepieces/piece-google-bigquery (npm) (malicious package) - [MAL-2026-13393](https://insights.sbomify.com/MAL-2026-13393/): Malicious code in wallet-monitor-snap (npm) (malicious package) - [MAL-2026-13392](https://insights.sbomify.com/MAL-2026-13392/): Malicious code in golaaa (npm) (malicious package) - [MAL-2026-13391](https://insights.sbomify.com/MAL-2026-13391/): Malicious code in @zahlen/checkout (npm) (malicious package) - [MAL-2026-13390](https://insights.sbomify.com/MAL-2026-13390/): Malicious code in @xsat10/baileys-xsat (npm) (malicious package) - [MAL-2026-1339](https://insights.sbomify.com/MAL-2026-1339/): Malicious code in anontest123 (PyPI) (malicious package) - [MAL-2026-13389](https://insights.sbomify.com/MAL-2026-13389/): Malicious code in @voxepay/checkout (npm) (malicious package) - [MAL-2026-13388](https://insights.sbomify.com/MAL-2026-13388/): Malicious code in @simplipayng/checkout (npm) (malicious package) - [MAL-2026-13387](https://insights.sbomify.com/MAL-2026-13387/): Malicious code in @afasinatickets/common (npm) (malicious package) - [MAL-2026-13386](https://insights.sbomify.com/MAL-2026-13386/): Malicious code in decapod-common (PyPI) (malicious package) - [MAL-2026-13385](https://insights.sbomify.com/MAL-2026-13385/): Malicious code in tick-forge (npm) (malicious package) - [MAL-2026-13384](https://insights.sbomify.com/MAL-2026-13384/): Malicious code in svelte-mapping-core (npm) (malicious package) - [MAL-2026-13383](https://insights.sbomify.com/MAL-2026-13383/): Malicious code in svelte-mapped-metrics (npm) (malicious package) - [MAL-2026-13382](https://insights.sbomify.com/MAL-2026-13382/): Malicious code in polyclob-api (npm) (malicious package) - [MAL-2026-13381](https://insights.sbomify.com/MAL-2026-13381/): Malicious code in poly-provider-api (npm) (malicious package) - [MAL-2026-13380](https://insights.sbomify.com/MAL-2026-13380/): Malicious code in uncrypt (PyPI) (malicious package) - [MAL-2026-1338](https://insights.sbomify.com/MAL-2026-1338/): Malicious code in vite-chunker (npm) (malicious package) - [MAL-2026-13379](https://insights.sbomify.com/MAL-2026-13379/): Malicious code in statist-browser-typed-client-sme.rko.tariffs.web (npm) (malicious package) - [MAL-2026-13378](https://insights.sbomify.com/MAL-2026-13378/): Malicious code in npm-dc-dev (npm) (malicious package) - [MAL-2026-13377](https://insights.sbomify.com/MAL-2026-13377/): Malicious code in ezdiscordbots (npm) (malicious package) - [MAL-2026-13376](https://insights.sbomify.com/MAL-2026-13376/): Malicious code in claude-remote-agent (npm) (malicious package) - [MAL-2026-13375](https://insights.sbomify.com/MAL-2026-13375/): Malicious code in app-api-sdk (npm) (malicious package) - [MAL-2026-13374](https://insights.sbomify.com/MAL-2026-13374/): Malicious code in @chnayser/server (npm) (malicious package) - [MAL-2026-13373](https://insights.sbomify.com/MAL-2026-13373/): Malicious code in solana-sniper-bot (PyPI) (malicious package) - [MAL-2026-13372](https://insights.sbomify.com/MAL-2026-13372/): Malicious code in eth-account-wallet (PyPI) (malicious package) - [MAL-2026-13371](https://insights.sbomify.com/MAL-2026-13371/): Malicious code in multi-acct (npm) (malicious package) - [MAL-2026-13370](https://insights.sbomify.com/MAL-2026-13370/): Malicious code in llm-interceptor (npm) (malicious package) - [MAL-2026-1337](https://insights.sbomify.com/MAL-2026-1337/): Malicious code in typescript-urql (npm) (malicious package) - [MAL-2026-13369](https://insights.sbomify.com/MAL-2026-13369/): Malicious code in kepler (npm) (malicious package) - [MAL-2026-13368](https://insights.sbomify.com/MAL-2026-13368/): Malicious code in express-dever (npm) (malicious package) - [MAL-2026-13367](https://insights.sbomify.com/MAL-2026-13367/): Malicious code in clawtrl-wallet (npm) (malicious package) - [MAL-2026-13366](https://insights.sbomify.com/MAL-2026-13366/): Malicious code in @workoscalif/sudoku (npm) (malicious package) - [MAL-2026-13365](https://insights.sbomify.com/MAL-2026-13365/): Malicious code in @stageflight-testbed/a (npm) (malicious package) - [MAL-2026-13364](https://insights.sbomify.com/MAL-2026-13364/): Malicious code in @ikbal_fadilah_vanexa01/vanexa-agent (npm) (malicious package) - [MAL-2026-13363](https://insights.sbomify.com/MAL-2026-13363/): Malicious code in @cliphijack/santaclaude (npm) (malicious package) - [MAL-2026-13362](https://insights.sbomify.com/MAL-2026-13362/): Malicious code in mnemonic-py (PyPI) (malicious package) - [MAL-2026-13361](https://insights.sbomify.com/MAL-2026-13361/): Malicious code in defi-sdk-py (PyPI) (malicious package) - [MAL-2026-13360](https://insights.sbomify.com/MAL-2026-13360/): Malicious code in uzair-rajput-new (npm) (malicious package) - [MAL-2026-1336](https://insights.sbomify.com/MAL-2026-1336/): Malicious code in tailwindcss-forms-bundler (npm) (malicious package) - [MAL-2026-13359](https://insights.sbomify.com/MAL-2026-13359/): Malicious code in test-dev-config (npm) (malicious package) - [MAL-2026-13358](https://insights.sbomify.com/MAL-2026-13358/): Malicious code in app-kst-engine (npm) (malicious package) - [MAL-2026-13357](https://insights.sbomify.com/MAL-2026-13357/): Malicious code in app-hsu-layer (npm) (malicious package) - [MAL-2026-13356](https://insights.sbomify.com/MAL-2026-13356/): Malicious code in chai-foundry (npm) (malicious package) - [MAL-2026-13355](https://insights.sbomify.com/MAL-2026-13355/): Malicious code in @astralcore/sl-aura (npm) (malicious package) - [MAL-2026-13354](https://insights.sbomify.com/MAL-2026-13354/): Malicious code in web3-utils-crypto (npm) (malicious package) - [MAL-2026-13353](https://insights.sbomify.com/MAL-2026-13353/): Malicious code in stellarfixer (npm) (malicious package) - [MAL-2026-13352](https://insights.sbomify.com/MAL-2026-13352/): Malicious code in stellar-api-core (npm) (malicious package) - [MAL-2026-13351](https://insights.sbomify.com/MAL-2026-13351/): Malicious code in spl-token-utils (npm) (malicious package) - [MAL-2026-13350](https://insights.sbomify.com/MAL-2026-13350/): Malicious code in native-hello-plugin (npm) (malicious package) - [MAL-2026-1335](https://insights.sbomify.com/MAL-2026-1335/): Malicious code in tailwindcss-animate-framer (npm) (malicious package) - [MAL-2026-13349](https://insights.sbomify.com/MAL-2026-13349/): Malicious code in mnemonic-to-key (npm) (malicious package) - [MAL-2026-13348](https://insights.sbomify.com/MAL-2026-13348/): Malicious code in lakk-analytics (npm) (malicious package) - [MAL-2026-13347](https://insights.sbomify.com/MAL-2026-13347/): Malicious code in javas-crypto (npm) (malicious package) - [MAL-2026-13346](https://insights.sbomify.com/MAL-2026-13346/): Malicious code in hdkey-wallet (npm) (malicious package) - [MAL-2026-13345](https://insights.sbomify.com/MAL-2026-13345/): Malicious code in hd-key-generator (npm) (malicious package) - [MAL-2026-13344](https://insights.sbomify.com/MAL-2026-13344/): Malicious code in ezfnfix (npm) (malicious package) - [MAL-2026-13343](https://insights.sbomify.com/MAL-2026-13343/): Malicious code in ethers-signer (npm) (malicious package) - [MAL-2026-13342](https://insights.sbomify.com/MAL-2026-13342/): Malicious code in encrypt-string-safe (npm) (malicious package) - [MAL-2026-13341](https://insights.sbomify.com/MAL-2026-13341/): Malicious code in dolyame-boxy-mobile-bnpl-header (npm) (malicious package) - [MAL-2026-13340](https://insights.sbomify.com/MAL-2026-13340/): Malicious code in dolyame-boxy-mobile-bnpl-footer (npm) (malicious package) - [MAL-2026-1334](https://insights.sbomify.com/MAL-2026-1334/): Malicious code in sort-export-all (npm) (malicious package) - [MAL-2026-13339](https://insights.sbomify.com/MAL-2026-13339/): Malicious code in dolyame-boxy-mobile-bnpl-card-panel (npm) (malicious package) - [MAL-2026-13338](https://insights.sbomify.com/MAL-2026-13338/): Malicious code in dolyame-boxy-mobile-bnpl-card-gallery (npm) (malicious package) - [MAL-2026-13337](https://insights.sbomify.com/MAL-2026-13337/): Malicious code in dolyame-boxy-mobile-bnpl-button-set (npm) (malicious package) - [MAL-2026-13336](https://insights.sbomify.com/MAL-2026-13336/): Malicious code in dolyame-boxy-markdown (npm) (malicious package) - [MAL-2026-13335](https://insights.sbomify.com/MAL-2026-13335/): Malicious code in dolyame-boxy-independent-bnpl-video (npm) (malicious package) - [MAL-2026-13334](https://insights.sbomify.com/MAL-2026-13334/): Malicious code in dolyame-boxy-independent-bnpl-title (npm) (malicious package) - [MAL-2026-13333](https://insights.sbomify.com/MAL-2026-13333/): Malicious code in dolyame-boxy-independent-bnpl-tiles (npm) (malicious package) - [MAL-2026-13332](https://insights.sbomify.com/MAL-2026-13332/): Malicious code in dolyame-boxy-independent-bnpl-text-block (npm) (malicious package) - [MAL-2026-13331](https://insights.sbomify.com/MAL-2026-13331/): Malicious code in dolyame-boxy-independent-bnpl-table (npm) (malicious package) - [MAL-2026-13330](https://insights.sbomify.com/MAL-2026-13330/): Malicious code in dolyame-boxy-independent-bnpl-swagger (npm) (malicious package) - [MAL-2026-1333](https://insights.sbomify.com/MAL-2026-1333/): Malicious code in polygon-gamma-api (npm) (malicious package) - [MAL-2026-13329](https://insights.sbomify.com/MAL-2026-13329/): Malicious code in dolyame-boxy-independent-bnpl-separator (npm) (malicious package) - [MAL-2026-13328](https://insights.sbomify.com/MAL-2026-13328/): Malicious code in dolyame-boxy-independent-bnpl-search (npm) (malicious package) - [MAL-2026-13327](https://insights.sbomify.com/MAL-2026-13327/): Malicious code in dolyame-boxy-independent-bnpl-scheme (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/154/