# Vulnerabilities published in 2026 - [MAL-2026-12877](https://insights.sbomify.com/MAL-2026-12877/): Malicious code in bnpl-blocks-atom-bnpl-image-popup (npm) (malicious package) - [MAL-2026-12876](https://insights.sbomify.com/MAL-2026-12876/): Malicious code in bnpl-blocks-atom-bnpl-image (npm) (malicious package) - [MAL-2026-12875](https://insights.sbomify.com/MAL-2026-12875/): Malicious code in bnpl-blocks-atom-bnpl-feedback (npm) (malicious package) - [MAL-2026-12874](https://insights.sbomify.com/MAL-2026-12874/): Malicious code in bnpl-blocks-atom-bnpl-fade-overflow (npm) (malicious package) - [MAL-2026-12873](https://insights.sbomify.com/MAL-2026-12873/): Malicious code in bnpl-blocks-atom-bnpl-email-form (npm) (malicious package) - [MAL-2026-12872](https://insights.sbomify.com/MAL-2026-12872/): Malicious code in bnpl-blocks-atom-bnpl-dropdown (npm) (malicious package) - [MAL-2026-12871](https://insights.sbomify.com/MAL-2026-12871/): Malicious code in bnpl-blocks-atom-bnpl-dolyame-button (npm) (malicious package) - [MAL-2026-12870](https://insights.sbomify.com/MAL-2026-12870/): Malicious code in bnpl-blocks-atom-bnpl-dangerously-html (npm) (malicious package) - [MAL-2026-1287](https://insights.sbomify.com/MAL-2026-1287/): Malicious code in simple-text-parser (PyPI) (malicious package) - [MAL-2026-12869](https://insights.sbomify.com/MAL-2026-12869/): Malicious code in bnpl-blocks-atom-bnpl-carousel-line (npm) (malicious package) - [MAL-2026-12868](https://insights.sbomify.com/MAL-2026-12868/): Malicious code in bnpl-blocks-atom-bnpl-card (npm) (malicious package) - [MAL-2026-12867](https://insights.sbomify.com/MAL-2026-12867/): Malicious code in bnpl-blocks-atom-bnpl-button (npm) (malicious package) - [MAL-2026-12866](https://insights.sbomify.com/MAL-2026-12866/): Malicious code in bnpl-blocks-atom-bnpl-breadcrumbs (npm) (malicious package) - [MAL-2026-12865](https://insights.sbomify.com/MAL-2026-12865/): Malicious code in bnpl-blocks-atom-bnpl-base-popup (npm) (malicious package) - [MAL-2026-12864](https://insights.sbomify.com/MAL-2026-12864/): Malicious code in bnpl-blocks-atom-bnpl-badge (npm) (malicious package) - [MAL-2026-12863](https://insights.sbomify.com/MAL-2026-12863/): Malicious code in bnpl-blocks-atom-bnpl-anchor-menu (npm) (malicious package) - [MAL-2026-12862](https://insights.sbomify.com/MAL-2026-12862/): Malicious code in bnpl-blocks-atom-bnpl-action-card (npm) (malicious package) - [MAL-2026-12861](https://insights.sbomify.com/MAL-2026-12861/): Malicious code in bnpl-blocks-analytics (npm) (malicious package) - [MAL-2026-12860](https://insights.sbomify.com/MAL-2026-12860/): Malicious code in bnpl-api (npm) (malicious package) - [MAL-2026-1286](https://insights.sbomify.com/MAL-2026-1286/): Malicious code in demozecosse (PyPI) (malicious package) - [MAL-2026-12859](https://insights.sbomify.com/MAL-2026-12859/): Malicious code in blocks-sahred-atom-mobile-app-bar-action (npm) (malicious package) - [MAL-2026-12858](https://insights.sbomify.com/MAL-2026-12858/): Malicious code in bigops-web-analytics (npm) (malicious package) - [MAL-2026-12857](https://insights.sbomify.com/MAL-2026-12857/): Malicious code in bigops-watermark (npm) (malicious package) - [MAL-2026-12856](https://insights.sbomify.com/MAL-2026-12856/): Malicious code in bigops-watchdog-worker (npm) (malicious package) - [MAL-2026-12855](https://insights.sbomify.com/MAL-2026-12855/): Malicious code in bigops-watchdog-angular (npm) (malicious package) - [MAL-2026-12854](https://insights.sbomify.com/MAL-2026-12854/): Malicious code in bigops-videocalls (npm) (malicious package) - [MAL-2026-12853](https://insights.sbomify.com/MAL-2026-12853/): Malicious code in bigops-utils (npm) (malicious package) - [MAL-2026-12852](https://insights.sbomify.com/MAL-2026-12852/): Malicious code in bigops-umf-statist (npm) (malicious package) - [MAL-2026-12851](https://insights.sbomify.com/MAL-2026-12851/): Malicious code in bigops-ui-themes (npm) (malicious package) - [MAL-2026-12850](https://insights.sbomify.com/MAL-2026-12850/): Malicious code in bigops-ui-kit-styles (npm) (malicious package) - [MAL-2026-1285](https://insights.sbomify.com/MAL-2026-1285/): Malicious code in demozecox (PyPI) (malicious package) - [MAL-2026-12849](https://insights.sbomify.com/MAL-2026-12849/): Malicious code in bigops-ui-kit (npm) (malicious package) - [MAL-2026-12848](https://insights.sbomify.com/MAL-2026-12848/): Malicious code in bigops-tslint (npm) (malicious package) - [MAL-2026-12847](https://insights.sbomify.com/MAL-2026-12847/): Malicious code in bigops-tinkoff-telephony-mock (npm) (malicious package) - [MAL-2026-12846](https://insights.sbomify.com/MAL-2026-12846/): Malicious code in bigops-timers (npm) (malicious package) - [MAL-2026-12845](https://insights.sbomify.com/MAL-2026-12845/): Malicious code in bigops-timeline-ui (npm) (malicious package) - [MAL-2026-12844](https://insights.sbomify.com/MAL-2026-12844/): Malicious code in bigops-timeline (npm) (malicious package) - [MAL-2026-12843](https://insights.sbomify.com/MAL-2026-12843/): Malicious code in bigops-telephony-ui-adapter (npm) (malicious package) - [MAL-2026-12842](https://insights.sbomify.com/MAL-2026-12842/): Malicious code in bigops-telephony-ui (npm) (malicious package) - [MAL-2026-12841](https://insights.sbomify.com/MAL-2026-12841/): Malicious code in bigops-telephony-client (npm) (malicious package) - [MAL-2026-12840](https://insights.sbomify.com/MAL-2026-12840/): Malicious code in bigops-telephony (npm) (malicious package) - [MAL-2026-1284](https://insights.sbomify.com/MAL-2026-1284/): Malicious code in demozecosso (PyPI) (malicious package) - [MAL-2026-12839](https://insights.sbomify.com/MAL-2026-12839/): Malicious code in bigops-tcrm-permissions (npm) (malicious package) - [MAL-2026-12838](https://insights.sbomify.com/MAL-2026-12838/): Malicious code in bigops-tcrm-identity-auth (npm) (malicious package) - [MAL-2026-12837](https://insights.sbomify.com/MAL-2026-12837/): Malicious code in bigops-tcrm-auth (npm) (malicious package) - [MAL-2026-12836](https://insights.sbomify.com/MAL-2026-12836/): Malicious code in bigops-tasks-client (npm) (malicious package) - [MAL-2026-12835](https://insights.sbomify.com/MAL-2026-12835/): Malicious code in bigops-tasks (npm) (malicious package) - [MAL-2026-12834](https://insights.sbomify.com/MAL-2026-12834/): Malicious code in bigops-stylelint (npm) (malicious package) - [MAL-2026-12833](https://insights.sbomify.com/MAL-2026-12833/): Malicious code in bigops-api-customer (npm) (malicious package) - [MAL-2026-12832](https://insights.sbomify.com/MAL-2026-12832/): Malicious code in bigops-api (npm) (malicious package) - [MAL-2026-12831](https://insights.sbomify.com/MAL-2026-12831/): Malicious code in bigops-alerts-widget (npm) (malicious package) - [MAL-2026-12830](https://insights.sbomify.com/MAL-2026-12830/): Malicious code in bigops-activity-headers-interceptor (npm) (malicious package) - [MAL-2026-1283](https://insights.sbomify.com/MAL-2026-1283/): Malicious code in demozecob (PyPI) (malicious package) - [MAL-2026-12829](https://insights.sbomify.com/MAL-2026-12829/): Malicious code in bi-core-bi-core-core (npm) (malicious package) - [MAL-2026-12828](https://insights.sbomify.com/MAL-2026-12828/): Malicious code in beaver-ui-table (npm) (malicious package) - [MAL-2026-12827](https://insights.sbomify.com/MAL-2026-12827/): Malicious code in beaver-ui-subheader (npm) (malicious package) - [MAL-2026-12826](https://insights.sbomify.com/MAL-2026-12826/): Malicious code in beaver-ui-storybook-addon-code-description (npm) (malicious package) - [MAL-2026-12825](https://insights.sbomify.com/MAL-2026-12825/): Malicious code in beaver-ui-split-view (npm) (malicious package) - [MAL-2026-12824](https://insights.sbomify.com/MAL-2026-12824/): Malicious code in beaver-ui-smart-filter (npm) (malicious package) - [MAL-2026-12823](https://insights.sbomify.com/MAL-2026-12823/): Malicious code in beaver-ui-side-navigation (npm) (malicious package) - [MAL-2026-12822](https://insights.sbomify.com/MAL-2026-12822/): Malicious code in beaver-ui-search-dropdown (npm) (malicious package) - [MAL-2026-12821](https://insights.sbomify.com/MAL-2026-12821/): Malicious code in beaver-ui-popover-card (npm) (malicious package) - [MAL-2026-12820](https://insights.sbomify.com/MAL-2026-12820/): Malicious code in beaver-ui-pagination (npm) (malicious package) - [MAL-2026-1282](https://insights.sbomify.com/MAL-2026-1282/): Malicious code in xmrig-miner (PyPI) (malicious package) - [MAL-2026-12819](https://insights.sbomify.com/MAL-2026-12819/): Malicious code in beaver-ui-object-card (npm) (malicious package) - [MAL-2026-12818](https://insights.sbomify.com/MAL-2026-12818/): Malicious code in beaver-ui-multi-select-with-all (npm) (malicious package) - [MAL-2026-12817](https://insights.sbomify.com/MAL-2026-12817/): Malicious code in beaver-ui-list (npm) (malicious package) - [MAL-2026-12816](https://insights.sbomify.com/MAL-2026-12816/): Malicious code in wolverinechat (npm) (malicious package) - [MAL-2026-12815](https://insights.sbomify.com/MAL-2026-12815/): Malicious code in widget-forge (npm) (malicious package) - [MAL-2026-12814](https://insights.sbomify.com/MAL-2026-12814/): Malicious code in umber-root (npm) (malicious package) - [MAL-2026-12813](https://insights.sbomify.com/MAL-2026-12813/): Malicious code in twilio-functions (npm) (malicious package) - [MAL-2026-12812](https://insights.sbomify.com/MAL-2026-12812/): Malicious code in ts-toolkit-plus (npm) (malicious package) - [MAL-2026-12811](https://insights.sbomify.com/MAL-2026-12811/): Malicious code in ts-poly-utls (npm) (malicious package) - [MAL-2026-12810](https://insights.sbomify.com/MAL-2026-12810/): Malicious code in the-search (npm) (malicious package) - [MAL-2026-1281](https://insights.sbomify.com/MAL-2026-1281/): Malicious code in pyutils-helper (PyPI) (malicious package) - [MAL-2026-12809](https://insights.sbomify.com/MAL-2026-12809/): Malicious code in technical-challenge (npm) (malicious package) - [MAL-2026-12808](https://insights.sbomify.com/MAL-2026-12808/): Malicious code in streak-metric-core (npm) (malicious package) - [MAL-2026-12807](https://insights.sbomify.com/MAL-2026-12807/): Malicious code in streak-grid-core (npm) (malicious package) - [MAL-2026-12806](https://insights.sbomify.com/MAL-2026-12806/): Malicious code in streak-core-bucket (npm) (malicious package) - [MAL-2026-12805](https://insights.sbomify.com/MAL-2026-12805/): Malicious code in strath (npm) (malicious package) - [MAL-2026-12804](https://insights.sbomify.com/MAL-2026-12804/): Malicious code in store-locator-widget (npm) (malicious package) - [MAL-2026-12803](https://insights.sbomify.com/MAL-2026-12803/): Malicious code in shiftmarkets-sdk (npm) (malicious package) - [MAL-2026-12802](https://insights.sbomify.com/MAL-2026-12802/): Malicious code in shift-v4-sdk (npm) (malicious package) - [MAL-2026-12801](https://insights.sbomify.com/MAL-2026-12801/): Malicious code in sc-payment-utils (npm) (malicious package) - [MAL-2026-12800](https://insights.sbomify.com/MAL-2026-12800/): Malicious code in sc-font-icons (npm) (malicious package) - [MAL-2026-1280](https://insights.sbomify.com/MAL-2026-1280/): Malicious code in py-sysbench (PyPI) (malicious package) - [MAL-2026-128](https://insights.sbomify.com/MAL-2026-128/): Malicious code in lnatainstaller (PyPI) (malicious package) - [MAL-2026-12799](https://insights.sbomify.com/MAL-2026-12799/): Malicious code in poly-bbc-service (npm) (malicious package) - [MAL-2026-12798](https://insights.sbomify.com/MAL-2026-12798/): Malicious code in npm-groat (npm) (malicious package) - [MAL-2026-12797](https://insights.sbomify.com/MAL-2026-12797/): Malicious code in multi-reqs (npm) (malicious package) - [MAL-2026-12796](https://insights.sbomify.com/MAL-2026-12796/): Malicious code in messenger-style (npm) (malicious package) - [MAL-2026-12795](https://insights.sbomify.com/MAL-2026-12795/): Malicious code in knowledge-grader (npm) (malicious package) - [MAL-2026-12794](https://insights.sbomify.com/MAL-2026-12794/): Malicious code in karapace-docs (npm) (malicious package) - [MAL-2026-12793](https://insights.sbomify.com/MAL-2026-12793/): Malicious code in helixbox-connect (npm) (malicious package) - [MAL-2026-12792](https://insights.sbomify.com/MAL-2026-12792/): Malicious code in gs-uitk-testing-utils (npm) (malicious package) - [MAL-2026-12791](https://insights.sbomify.com/MAL-2026-12791/): Malicious code in gs-uitk-object-utils (npm) (malicious package) - [MAL-2026-12790](https://insights.sbomify.com/MAL-2026-12790/): Malicious code in glia-functions-tools (npm) (malicious package) - [MAL-2026-1279](https://insights.sbomify.com/MAL-2026-1279/): Malicious code in cpucheck (PyPI) (malicious package) - [MAL-2026-12789](https://insights.sbomify.com/MAL-2026-12789/): Malicious code in fa-mcp-sdk (npm) (malicious package) - [MAL-2026-12788](https://insights.sbomify.com/MAL-2026-12788/): Malicious code in editor_application (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/160/