# Vulnerabilities published in 2026 - [MAL-2026-13146](https://insights.sbomify.com/MAL-2026-13146/): Malicious code in dolyame-ui-codemods (npm) (malicious package) - [MAL-2026-13145](https://insights.sbomify.com/MAL-2026-13145/): Malicious code in dolyame-ui-clickable (npm) (malicious package) - [MAL-2026-13144](https://insights.sbomify.com/MAL-2026-13144/): Malicious code in dolyame-ui-checkbox (npm) (malicious package) - [MAL-2026-13143](https://insights.sbomify.com/MAL-2026-13143/): Malicious code in dolyame-ui-checkable (npm) (malicious package) - [MAL-2026-13142](https://insights.sbomify.com/MAL-2026-13142/): Malicious code in dolyame-ui-chart (npm) (malicious package) - [MAL-2026-13141](https://insights.sbomify.com/MAL-2026-13141/): Malicious code in dolyame-ui-carousel (npm) (malicious package) - [MAL-2026-13140](https://insights.sbomify.com/MAL-2026-13140/): Malicious code in dolyame-ui-calendar (npm) (malicious package) - [MAL-2026-1314](https://insights.sbomify.com/MAL-2026-1314/): Malicious code in iron-selector (npm) (malicious package) - [MAL-2026-13139](https://insights.sbomify.com/MAL-2026-13139/): Malicious code in dolyame-ui-button (npm) (malicious package) - [MAL-2026-13138](https://insights.sbomify.com/MAL-2026-13138/): Malicious code in dolyame-ui-breadcrumbs (npm) (malicious package) - [MAL-2026-13137](https://insights.sbomify.com/MAL-2026-13137/): Malicious code in dolyame-ui-block (npm) (malicious package) - [MAL-2026-13136](https://insights.sbomify.com/MAL-2026-13136/): Malicious code in dolyame-ui-badge (npm) (malicious package) - [MAL-2026-13135](https://insights.sbomify.com/MAL-2026-13135/): Malicious code in dolyame-ui-avatar (npm) (malicious package) - [MAL-2026-13134](https://insights.sbomify.com/MAL-2026-13134/): Malicious code in dolyame-ui-action (npm) (malicious package) - [MAL-2026-13133](https://insights.sbomify.com/MAL-2026-13133/): Malicious code in dolyame-ui-accordion (npm) (malicious package) - [MAL-2026-13132](https://insights.sbomify.com/MAL-2026-13132/): Malicious code in dolyame-boxy-stories-of-block (npm) (malicious package) - [MAL-2026-13131](https://insights.sbomify.com/MAL-2026-13131/): Malicious code in dolyame-boxy-stories (npm) (malicious package) - [MAL-2026-13130](https://insights.sbomify.com/MAL-2026-13130/): Malicious code in dolyame-boxy-scroll (npm) (malicious package) - [MAL-2026-1313](https://insights.sbomify.com/MAL-2026-1313/): Malicious code in iron-pages (npm) (malicious package) - [MAL-2026-13129](https://insights.sbomify.com/MAL-2026-13129/): Malicious code in dolyame-boxy-mobile-bnpl-title (npm) (malicious package) - [MAL-2026-13128](https://insights.sbomify.com/MAL-2026-13128/): Malicious code in dolyame-boxy-mobile-bnpl-text-block (npm) (malicious package) - [MAL-2026-13127](https://insights.sbomify.com/MAL-2026-13127/): Malicious code in dolyame-boxy-mobile-bnpl-popup (npm) (malicious package) - [MAL-2026-13126](https://insights.sbomify.com/MAL-2026-13126/): Malicious code in dolyame-boxy-mobile-bnpl-picture-gallery (npm) (malicious package) - [MAL-2026-13125](https://insights.sbomify.com/MAL-2026-13125/): Malicious code in dolyame-boxy-mobile-bnpl-image-plus-text (npm) (malicious package) - [MAL-2026-13124](https://insights.sbomify.com/MAL-2026-13124/): Malicious code in ded-aa-liza-ded-aa-liza-core (npm) (malicious package) - [MAL-2026-13123](https://insights.sbomify.com/MAL-2026-13123/): Malicious code in ded-aa-common-ded-aa-common-core (npm) (malicious package) - [MAL-2026-13122](https://insights.sbomify.com/MAL-2026-13122/): Malicious code in bpm-ng-security (npm) (malicious package) - [MAL-2026-13121](https://insights.sbomify.com/MAL-2026-13121/): Malicious code in bpm-foundation-test-jasmine (npm) (malicious package) - [MAL-2026-13120](https://insights.sbomify.com/MAL-2026-13120/): Malicious code in bpm-foundation-tcs-configs (npm) (malicious package) - [MAL-2026-1312](https://insights.sbomify.com/MAL-2026-1312/): Malicious code in iron-overlay-behavior (npm) (malicious package) - [MAL-2026-13119](https://insights.sbomify.com/MAL-2026-13119/): Malicious code in bpm-foundation-storage (npm) (malicious package) - [MAL-2026-13118](https://insights.sbomify.com/MAL-2026-13118/): Malicious code in bpm-foundation-statist-client (npm) (malicious package) - [MAL-2026-13117](https://insights.sbomify.com/MAL-2026-13117/): Malicious code in bpm-foundation-sentry (npm) (malicious package) - [MAL-2026-13116](https://insights.sbomify.com/MAL-2026-13116/): Malicious code in bpm-foundation-renovate (npm) (malicious package) - [MAL-2026-13115](https://insights.sbomify.com/MAL-2026-13115/): Malicious code in bpm-foundation-rate-us (npm) (malicious package) - [MAL-2026-13114](https://insights.sbomify.com/MAL-2026-13114/): Malicious code in bpm-foundation-oauth-client (npm) (malicious package) - [MAL-2026-13113](https://insights.sbomify.com/MAL-2026-13113/): Malicious code in bpm-foundation-nest-keycloak-connect (npm) (malicious package) - [MAL-2026-13112](https://insights.sbomify.com/MAL-2026-13112/): Malicious code in bpm-foundation-linters (npm) (malicious package) - [MAL-2026-13111](https://insights.sbomify.com/MAL-2026-13111/): Malicious code in bpm-foundation-husky (npm) (malicious package) - [MAL-2026-13110](https://insights.sbomify.com/MAL-2026-13110/): Malicious code in bpm-foundation-feedback (npm) (malicious package) - [MAL-2026-1311](https://insights.sbomify.com/MAL-2026-1311/): Malicious code in iron-menu-behavior (npm) (malicious package) - [MAL-2026-13109](https://insights.sbomify.com/MAL-2026-13109/): Malicious code in bpm-foundation-delegate-docs (npm) (malicious package) - [MAL-2026-13108](https://insights.sbomify.com/MAL-2026-13108/): Malicious code in bpm-foundation-date-range (npm) (malicious package) - [MAL-2026-13107](https://insights.sbomify.com/MAL-2026-13107/): Malicious code in bpm-foundation-common (npm) (malicious package) - [MAL-2026-13106](https://insights.sbomify.com/MAL-2026-13106/): Malicious code in bpm-foundation-bundle-optimization (npm) (malicious package) - [MAL-2026-13105](https://insights.sbomify.com/MAL-2026-13105/): Malicious code in bpm-foundation-base-configs (npm) (malicious package) - [MAL-2026-13104](https://insights.sbomify.com/MAL-2026-13104/): Malicious code in bpm-foundation-auth (npm) (malicious package) - [MAL-2026-13103](https://insights.sbomify.com/MAL-2026-13103/): Malicious code in bpm-foundation-app-configs (npm) (malicious package) - [MAL-2026-13102](https://insights.sbomify.com/MAL-2026-13102/): Malicious code in bpm-foundation-api (npm) (malicious package) - [MAL-2026-13101](https://insights.sbomify.com/MAL-2026-13101/): Malicious code in bpm-foundation-analytics (npm) (malicious package) - [MAL-2026-13100](https://insights.sbomify.com/MAL-2026-13100/): Malicious code in bpm-foundation-ai-assistant (npm) (malicious package) - [MAL-2026-1310](https://insights.sbomify.com/MAL-2026-1310/): Malicious code in iron-media-query (npm) (malicious package) - [MAL-2026-131](https://insights.sbomify.com/MAL-2026-131/): Malicious code in awsm-core (npm) (malicious package) - [MAL-2026-13099](https://insights.sbomify.com/MAL-2026-13099/): Malicious code in boxy-wrapper-webpack-plugin (npm) (malicious package) - [MAL-2026-13098](https://insights.sbomify.com/MAL-2026-13098/): Malicious code in boxy-wrapper-rspack-plugin (npm) (malicious package) - [MAL-2026-13097](https://insights.sbomify.com/MAL-2026-13097/): Malicious code in boxy-webpack-test-utils (npm) (malicious package) - [MAL-2026-13096](https://insights.sbomify.com/MAL-2026-13096/): Malicious code in boxy-validate-implicit-deps (npm) (malicious package) - [MAL-2026-13095](https://insights.sbomify.com/MAL-2026-13095/): Malicious code in boxy-use-what-changed (npm) (malicious package) - [MAL-2026-13094](https://insights.sbomify.com/MAL-2026-13094/): Malicious code in boxy-use-calls (npm) (malicious package) - [MAL-2026-13093](https://insights.sbomify.com/MAL-2026-13093/): Malicious code in boxy-tree-providers (npm) (malicious package) - [MAL-2026-13092](https://insights.sbomify.com/MAL-2026-13092/): Malicious code in boxy-tokens (npm) (malicious package) - [MAL-2026-13091](https://insights.sbomify.com/MAL-2026-13091/): Malicious code in boxy-test-maker (npm) (malicious package) - [MAL-2026-13090](https://insights.sbomify.com/MAL-2026-13090/): Malicious code in boxy-test-host (npm) (malicious package) - [MAL-2026-1309](https://insights.sbomify.com/MAL-2026-1309/): Malicious code in iron-localstorage (npm) (malicious package) - [MAL-2026-13089](https://insights.sbomify.com/MAL-2026-13089/): Malicious code in boxy-test-block-fixture (npm) (malicious package) - [MAL-2026-13088](https://insights.sbomify.com/MAL-2026-13088/): Malicious code in boxy-test-block (npm) (malicious package) - [MAL-2026-13087](https://insights.sbomify.com/MAL-2026-13087/): Malicious code in boxy-temper (npm) (malicious package) - [MAL-2026-13086](https://insights.sbomify.com/MAL-2026-13086/): Malicious code in boxy-storybook-addon-changelog (npm) (malicious package) - [MAL-2026-13085](https://insights.sbomify.com/MAL-2026-13085/): Malicious code in boxy-story-header (npm) (malicious package) - [MAL-2026-13084](https://insights.sbomify.com/MAL-2026-13084/): Malicious code in boxy-sticky-providers (npm) (malicious package) - [MAL-2026-13083](https://insights.sbomify.com/MAL-2026-13083/): Malicious code in boxy-sitree (npm) (malicious package) - [MAL-2026-13082](https://insights.sbomify.com/MAL-2026-13082/): Malicious code in boxy-service (npm) (malicious package) - [MAL-2026-13081](https://insights.sbomify.com/MAL-2026-13081/): Malicious code in boxy-semver (npm) (malicious package) - [MAL-2026-13080](https://insights.sbomify.com/MAL-2026-13080/): Malicious code in boxy-search-workspace-substrings (npm) (malicious package) - [MAL-2026-1308](https://insights.sbomify.com/MAL-2026-1308/): Malicious code in iron-image (npm) (malicious package) - [MAL-2026-13079](https://insights.sbomify.com/MAL-2026-13079/): Malicious code in boxy-scroll-providers (npm) (malicious package) - [MAL-2026-13078](https://insights.sbomify.com/MAL-2026-13078/): Malicious code in boxy-rspack-optimize-sharing-runtime (npm) (malicious package) - [MAL-2026-13077](https://insights.sbomify.com/MAL-2026-13077/): Malicious code in boxy-render-unwrap (npm) (malicious package) - [MAL-2026-13076](https://insights.sbomify.com/MAL-2026-13076/): Malicious code in boxy-pkg-path (npm) (malicious package) - [MAL-2026-13075](https://insights.sbomify.com/MAL-2026-13075/): Malicious code in boxy-pkg-deps-hash (npm) (malicious package) - [MAL-2026-13074](https://insights.sbomify.com/MAL-2026-13074/): Malicious code in boxy-page-story (npm) (malicious package) - [MAL-2026-13073](https://insights.sbomify.com/MAL-2026-13073/): Malicious code in boxy-mops (npm) (malicious package) - [MAL-2026-13072](https://insights.sbomify.com/MAL-2026-13072/): Malicious code in boxy-mmb-types (npm) (malicious package) - [MAL-2026-13071](https://insights.sbomify.com/MAL-2026-13071/): Malicious code in boxy-mmb-deps-pvm-plugin (npm) (malicious package) - [MAL-2026-13070](https://insights.sbomify.com/MAL-2026-13070/): Malicious code in boxy-mm-server-loader (npm) (malicious package) - [MAL-2026-1307](https://insights.sbomify.com/MAL-2026-1307/): Malicious code in iron-fit-behavior (npm) (malicious package) - [MAL-2026-13069](https://insights.sbomify.com/MAL-2026-13069/): Malicious code in boxy-mm-advisor (npm) (malicious package) - [MAL-2026-13068](https://insights.sbomify.com/MAL-2026-13068/): Malicious code in boxy-mif-tokens (npm) (malicious package) - [MAL-2026-13067](https://insights.sbomify.com/MAL-2026-13067/): Malicious code in boxy-micro-story (npm) (malicious package) - [MAL-2026-13066](https://insights.sbomify.com/MAL-2026-13066/): Malicious code in boxy-maker-wave (npm) (malicious package) - [MAL-2026-13065](https://insights.sbomify.com/MAL-2026-13065/): Malicious code in boxy-maker-sticky (npm) (malicious package) - [MAL-2026-13064](https://insights.sbomify.com/MAL-2026-13064/): Malicious code in boxy-maker-skeleton (npm) (malicious package) - [MAL-2026-13063](https://insights.sbomify.com/MAL-2026-13063/): Malicious code in boxy-maker-scroll (npm) (malicious package) - [MAL-2026-13062](https://insights.sbomify.com/MAL-2026-13062/): Malicious code in boxy-maker-readiness (npm) (malicious package) - [MAL-2026-13061](https://insights.sbomify.com/MAL-2026-13061/): Malicious code in boxy-maker-page-readiness (npm) (malicious package) - [MAL-2026-13060](https://insights.sbomify.com/MAL-2026-13060/): Malicious code in boxy-maker-legacy (npm) (malicious package) - [MAL-2026-1306](https://insights.sbomify.com/MAL-2026-1306/): Malicious code in falcologgerinternalstate (npm) (malicious package) - [MAL-2026-13059](https://insights.sbomify.com/MAL-2026-13059/): Malicious code in boxy-maker-extendable-minihost (npm) (malicious package) - [MAL-2026-13058](https://insights.sbomify.com/MAL-2026-13058/): Malicious code in boxy-maker-bus (npm) (malicious package) - [MAL-2026-13057](https://insights.sbomify.com/MAL-2026-13057/): Malicious code in boxy-maker (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/157/