# Vulnerabilities published in 2026 - [MAL-2026-13056](https://insights.sbomify.com/MAL-2026-13056/): Malicious code in boxy-make-tokens-map (npm) (malicious package) - [MAL-2026-13055](https://insights.sbomify.com/MAL-2026-13055/): Malicious code in boxy-loader (npm) (malicious package) - [MAL-2026-13054](https://insights.sbomify.com/MAL-2026-13054/): Malicious code in boxy-live (npm) (malicious package) - [MAL-2026-13053](https://insights.sbomify.com/MAL-2026-13053/): Malicious code in boxy-legacy-providers (npm) (malicious package) - [MAL-2026-13052](https://insights.sbomify.com/MAL-2026-13052/): Malicious code in boxy-lcd (npm) (malicious package) - [MAL-2026-13051](https://insights.sbomify.com/MAL-2026-13051/): Malicious code in boxy-lazy-loader (npm) (malicious package) - [MAL-2026-13050](https://insights.sbomify.com/MAL-2026-13050/): Malicious code in boxy-global-modules-webpack-plugin (npm) (malicious package) - [MAL-2026-1305](https://insights.sbomify.com/MAL-2026-1305/): Malicious code in collab-library (npm) (malicious package) - [MAL-2026-13049](https://insights.sbomify.com/MAL-2026-13049/): Malicious code in boxy-get-retry-url (npm) (malicious package) - [MAL-2026-13048](https://insights.sbomify.com/MAL-2026-13048/): Malicious code in boxy-fixture-sb (npm) (malicious package) - [MAL-2026-13047](https://insights.sbomify.com/MAL-2026-13047/): Malicious code in boxy-fixture-pfa (npm) (malicious package) - [MAL-2026-13046](https://insights.sbomify.com/MAL-2026-13046/): Malicious code in boxy-fixture-pendel (npm) (malicious package) - [MAL-2026-13045](https://insights.sbomify.com/MAL-2026-13045/): Malicious code in boxy-fixture-paperclip (npm) (malicious package) - [MAL-2026-13044](https://insights.sbomify.com/MAL-2026-13044/): Malicious code in boxy-fixture (npm) (malicious package) - [MAL-2026-13043](https://insights.sbomify.com/MAL-2026-13043/): Malicious code in boxy-expander-contract (npm) (malicious package) - [MAL-2026-13042](https://insights.sbomify.com/MAL-2026-13042/): Malicious code in boxy-esm-shims (npm) (malicious package) - [MAL-2026-13041](https://insights.sbomify.com/MAL-2026-13041/): Malicious code in boxy-docusaurus-plugin-content-docs-light (npm) (malicious package) - [MAL-2026-13040](https://insights.sbomify.com/MAL-2026-13040/): Malicious code in boxy-devtools-tokens (npm) (malicious package) - [MAL-2026-1304](https://insights.sbomify.com/MAL-2026-1304/): Malicious code in amt-package-united-icons (npm) (malicious package) - [MAL-2026-13039](https://insights.sbomify.com/MAL-2026-13039/): Malicious code in boxy-devtools (npm) (malicious package) - [MAL-2026-13038](https://insights.sbomify.com/MAL-2026-13038/): Malicious code in boxy-deps-calculator (npm) (malicious package) - [MAL-2026-13037](https://insights.sbomify.com/MAL-2026-13037/): Malicious code in boxy-demo-tokens (npm) (malicious package) - [MAL-2026-13036](https://insights.sbomify.com/MAL-2026-13036/): Malicious code in boxy-debugger (npm) (malicious package) - [MAL-2026-13035](https://insights.sbomify.com/MAL-2026-13035/): Malicious code in boxy-cook (npm) (malicious package) - [MAL-2026-13034](https://insights.sbomify.com/MAL-2026-13034/): Malicious code in boxy-contract (npm) (malicious package) - [MAL-2026-13033](https://insights.sbomify.com/MAL-2026-13033/): Malicious code in boxy-constants (npm) (malicious package) - [MAL-2026-13032](https://insights.sbomify.com/MAL-2026-13032/): Malicious code in boxy-client-loader (npm) (malicious package) - [MAL-2026-13031](https://insights.sbomify.com/MAL-2026-13031/): Malicious code in boxy-bus-providers (npm) (malicious package) - [MAL-2026-13030](https://insights.sbomify.com/MAL-2026-13030/): Malicious code in boxy-add-script (npm) (malicious package) - [MAL-2026-1303](https://insights.sbomify.com/MAL-2026-1303/): Malicious code in @rothaus/falcologgerinternalstate (npm) (malicious package) - [MAL-2026-13029](https://insights.sbomify.com/MAL-2026-13029/): Malicious code in boxy-add-link (npm) (malicious package) - [MAL-2026-13028](https://insights.sbomify.com/MAL-2026-13028/): Malicious code in boxy-adapter-tramvai (npm) (malicious package) - [MAL-2026-13027](https://insights.sbomify.com/MAL-2026-13027/): Malicious code in book-collect (npm) (malicious package) - [MAL-2026-13026](https://insights.sbomify.com/MAL-2026-13026/): Malicious code in bnpl-molecule-mobile-bnpl-selector (npm) (malicious package) - [MAL-2026-13025](https://insights.sbomify.com/MAL-2026-13025/): Malicious code in bnpl-molecule-mobile-bnpl-onboarding (npm) (malicious package) - [MAL-2026-13024](https://insights.sbomify.com/MAL-2026-13024/): Malicious code in bnpl-forms-test-utils (npm) (malicious package) - [MAL-2026-13023](https://insights.sbomify.com/MAL-2026-13023/): Malicious code in bnpl-core (npm) (malicious package) - [MAL-2026-13022](https://insights.sbomify.com/MAL-2026-13022/): Malicious code in bnpl-blocks-utils (npm) (malicious package) - [MAL-2026-13021](https://insights.sbomify.com/MAL-2026-13021/): Malicious code in bnpl-blocks-types-gen (npm) (malicious package) - [MAL-2026-13020](https://insights.sbomify.com/MAL-2026-13020/): Malicious code in bnpl-blocks-types (npm) (malicious package) - [MAL-2026-1302](https://insights.sbomify.com/MAL-2026-1302/): Malicious code in @platform-growth/guidance-channel-provider (npm) (malicious package) - [MAL-2026-13019](https://insights.sbomify.com/MAL-2026-13019/): Malicious code in bnpl-blocks-stories-of-block (npm) (malicious package) - [MAL-2026-13018](https://insights.sbomify.com/MAL-2026-13018/): Malicious code in bnpl-blocks-stories (npm) (malicious package) - [MAL-2026-13017](https://insights.sbomify.com/MAL-2026-13017/): Malicious code in bnpl-blocks-shops-api (npm) (malicious package) - [MAL-2026-13016](https://insights.sbomify.com/MAL-2026-13016/): Malicious code in bnpl-blocks-seo-tools (npm) (malicious package) - [MAL-2026-13015](https://insights.sbomify.com/MAL-2026-13015/): Malicious code in bnpl-blocks-scroll (npm) (malicious package) - [MAL-2026-13014](https://insights.sbomify.com/MAL-2026-13014/): Malicious code in bnpl-blocks-sanitizer (npm) (malicious package) - [MAL-2026-13013](https://insights.sbomify.com/MAL-2026-13013/): Malicious code in bnpl-blocks-post-css (npm) (malicious package) - [MAL-2026-13012](https://insights.sbomify.com/MAL-2026-13012/): Malicious code in bnpl-blocks-playwright (npm) (malicious package) - [MAL-2026-13011](https://insights.sbomify.com/MAL-2026-13011/): Malicious code in bnpl-blocks-mobile-large-bnpl-reviews (npm) (malicious package) - [MAL-2026-13010](https://insights.sbomify.com/MAL-2026-13010/): Malicious code in bnpl-blocks-mobile-bnpl-title (npm) (malicious package) - [MAL-2026-1301](https://insights.sbomify.com/MAL-2026-1301/): Malicious code in @mmm-otrade/transaction-adapter (npm) (malicious package) - [MAL-2026-13009](https://insights.sbomify.com/MAL-2026-13009/): Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm) (malicious package) - [MAL-2026-13008](https://insights.sbomify.com/MAL-2026-13008/): Malicious code in bnpl-blocks-mobile-bnpl-table (npm) (malicious package) - [MAL-2026-13007](https://insights.sbomify.com/MAL-2026-13007/): Malicious code in bnpl-blocks-mobile-bnpl-tab-buttons (npm) (malicious package) - [MAL-2026-13006](https://insights.sbomify.com/MAL-2026-13006/): Malicious code in bnpl-blocks-mobile-bnpl-shopping-header (npm) (malicious package) - [MAL-2026-13005](https://insights.sbomify.com/MAL-2026-13005/): Malicious code in bnpl-blocks-mobile-bnpl-shopping-banner (npm) (malicious package) - [MAL-2026-13004](https://insights.sbomify.com/MAL-2026-13004/): Malicious code in bnpl-blocks-mobile-bnpl-separator (npm) (malicious package) - [MAL-2026-13003](https://insights.sbomify.com/MAL-2026-13003/): Malicious code in bnpl-blocks-mobile-bnpl-reviews (npm) (malicious package) - [MAL-2026-13002](https://insights.sbomify.com/MAL-2026-13002/): Malicious code in bnpl-blocks-mobile-bnpl-popup (npm) (malicious package) - [MAL-2026-13001](https://insights.sbomify.com/MAL-2026-13001/): Malicious code in bnpl-blocks-mobile-bnpl-picture-gallery (npm) (malicious package) - [MAL-2026-13000](https://insights.sbomify.com/MAL-2026-13000/): Malicious code in bnpl-blocks-mobile-bnpl-partners (npm) (malicious package) - [MAL-2026-1300](https://insights.sbomify.com/MAL-2026-1300/): Malicious code in @mmm-otrade/transaction (npm) (malicious package) - [MAL-2026-130](https://insights.sbomify.com/MAL-2026-130/): Malicious code in awsm-acslibs (npm) (malicious package) - [MAL-2026-13](https://insights.sbomify.com/MAL-2026-13/): Malicious code in ent-file-upload-widget-v2 (npm) (malicious package) - [MAL-2026-12999](https://insights.sbomify.com/MAL-2026-12999/): Malicious code in bnpl-blocks-mobile-bnpl-notification (npm) (malicious package) - [MAL-2026-12998](https://insights.sbomify.com/MAL-2026-12998/): Malicious code in bnpl-blocks-mobile-bnpl-news-cards (npm) (malicious package) - [MAL-2026-12997](https://insights.sbomify.com/MAL-2026-12997/): Malicious code in bnpl-blocks-mobile-bnpl-navigation (npm) (malicious package) - [MAL-2026-12996](https://insights.sbomify.com/MAL-2026-12996/): Malicious code in bnpl-blocks-mobile-bnpl-link-group (npm) (malicious package) - [MAL-2026-12995](https://insights.sbomify.com/MAL-2026-12995/): Malicious code in bnpl-blocks-mobile-bnpl-info-slider (npm) (malicious package) - [MAL-2026-12994](https://insights.sbomify.com/MAL-2026-12994/): Malicious code in bnpl-blocks-mobile-bnpl-image-with-caption (npm) (malicious package) - [MAL-2026-12993](https://insights.sbomify.com/MAL-2026-12993/): Malicious code in bnpl-blocks-mobile-bnpl-image-plus-text (npm) (malicious package) - [MAL-2026-12992](https://insights.sbomify.com/MAL-2026-12992/): Malicious code in bnpl-blocks-mobile-bnpl-header-search (npm) (malicious package) - [MAL-2026-12991](https://insights.sbomify.com/MAL-2026-12991/): Malicious code in bnpl-blocks-mobile-bnpl-header (npm) (malicious package) - [MAL-2026-12990](https://insights.sbomify.com/MAL-2026-12990/): Malicious code in bnpl-blocks-mobile-bnpl-grid-container (npm) (malicious package) - [MAL-2026-1299](https://insights.sbomify.com/MAL-2026-1299/): Malicious code in monoping (npm) (malicious package) - [MAL-2026-12989](https://insights.sbomify.com/MAL-2026-12989/): Malicious code in bnpl-blocks-mobile-bnpl-floating-button (npm) (malicious package) - [MAL-2026-12988](https://insights.sbomify.com/MAL-2026-12988/): Malicious code in bnpl-blocks-mobile-bnpl-feedback (npm) (malicious package) - [MAL-2026-12987](https://insights.sbomify.com/MAL-2026-12987/): Malicious code in bnpl-blocks-mobile-bnpl-faq (npm) (malicious package) - [MAL-2026-12986](https://insights.sbomify.com/MAL-2026-12986/): Malicious code in bnpl-blocks-mobile-bnpl-documents (npm) (malicious package) - [MAL-2026-12985](https://insights.sbomify.com/MAL-2026-12985/): Malicious code in bnpl-blocks-mobile-bnpl-container (npm) (malicious package) - [MAL-2026-12984](https://insights.sbomify.com/MAL-2026-12984/): Malicious code in bnpl-blocks-mobile-bnpl-category-gallery (npm) (malicious package) - [MAL-2026-12983](https://insights.sbomify.com/MAL-2026-12983/): Malicious code in bnpl-blocks-mobile-bnpl-card-panel (npm) (malicious package) - [MAL-2026-12982](https://insights.sbomify.com/MAL-2026-12982/): Malicious code in bnpl-blocks-mobile-bnpl-card-gallery (npm) (malicious package) - [MAL-2026-12981](https://insights.sbomify.com/MAL-2026-12981/): Malicious code in bnpl-blocks-mobile-bnpl-button-set (npm) (malicious package) - [MAL-2026-12980](https://insights.sbomify.com/MAL-2026-12980/): Malicious code in bnpl-blocks-mobile-bnpl-breadcrumbs (npm) (malicious package) - [MAL-2026-1298](https://insights.sbomify.com/MAL-2026-1298/): Malicious code in jsonify-core (npm) (malicious package) - [MAL-2026-12979](https://insights.sbomify.com/MAL-2026-12979/): Malicious code in bnpl-blocks-mobile-bnpl-article-author (npm) (malicious package) - [MAL-2026-12978](https://insights.sbomify.com/MAL-2026-12978/): Malicious code in bnpl-blocks-mobile-bnpl-anchor-title (npm) (malicious package) - [MAL-2026-12977](https://insights.sbomify.com/MAL-2026-12977/): Malicious code in bnpl-blocks-mobile-bnpl-action-panel (npm) (malicious package) - [MAL-2026-12976](https://insights.sbomify.com/MAL-2026-12976/): Malicious code in bnpl-blocks-markdown (npm) (malicious package) - [MAL-2026-12975](https://insights.sbomify.com/MAL-2026-12975/): Malicious code in bnpl-blocks-independent-bnpl-video (npm) (malicious package) - [MAL-2026-12974](https://insights.sbomify.com/MAL-2026-12974/): Malicious code in bnpl-blocks-independent-bnpl-title (npm) (malicious package) - [MAL-2026-12973](https://insights.sbomify.com/MAL-2026-12973/): Malicious code in bnpl-blocks-independent-bnpl-tiles (npm) (malicious package) - [MAL-2026-12972](https://insights.sbomify.com/MAL-2026-12972/): Malicious code in bnpl-blocks-independent-bnpl-text-block (npm) (malicious package) - [MAL-2026-12971](https://insights.sbomify.com/MAL-2026-12971/): Malicious code in bnpl-blocks-independent-bnpl-table (npm) (malicious package) - [MAL-2026-12970](https://insights.sbomify.com/MAL-2026-12970/): Malicious code in bnpl-blocks-independent-bnpl-swagger (npm) (malicious package) - [MAL-2026-1297](https://insights.sbomify.com/MAL-2026-1297/): Malicious code in json-merge-tool (npm) (malicious package) - [MAL-2026-12969](https://insights.sbomify.com/MAL-2026-12969/): Malicious code in bnpl-blocks-independent-bnpl-separator (npm) (malicious package) - [MAL-2026-12968](https://insights.sbomify.com/MAL-2026-12968/): Malicious code in bnpl-blocks-independent-bnpl-scheme (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/158/