# Vulnerabilities published in 2026 - [MAL-2026-12787](https://insights.sbomify.com/MAL-2026-12787/): Malicious code in dynstrg-howto (npm) (malicious package) - [MAL-2026-12786](https://insights.sbomify.com/MAL-2026-12786/): Malicious code in dust-helpers (npm) (malicious package) - [MAL-2026-12785](https://insights.sbomify.com/MAL-2026-12785/): Malicious code in devplatform-spa-tokens (npm) (malicious package) - [MAL-2026-12784](https://insights.sbomify.com/MAL-2026-12784/): Malicious code in devplatform-spa-testing (npm) (malicious package) - [MAL-2026-12783](https://insights.sbomify.com/MAL-2026-12783/): Malicious code in devplatform-spa-route-tree (npm) (malicious package) - [MAL-2026-12782](https://insights.sbomify.com/MAL-2026-12782/): Malicious code in devplatform-spa-plugin-thermostat (npm) (malicious package) - [MAL-2026-12781](https://insights.sbomify.com/MAL-2026-12781/): Malicious code in devplatform-spa-plugin-suspense (npm) (malicious package) - [MAL-2026-12780](https://insights.sbomify.com/MAL-2026-12780/): Malicious code in devplatform-spa-plugin-sentry (npm) (malicious package) - [MAL-2026-1278](https://insights.sbomify.com/MAL-2026-1278/): Malicious code in chat-xdk (PyPI) (malicious package) - [MAL-2026-12779](https://insights.sbomify.com/MAL-2026-12779/): Malicious code in devplatform-spa-plugin-s3-module-loader (npm) (malicious package) - [MAL-2026-12778](https://insights.sbomify.com/MAL-2026-12778/): Malicious code in devplatform-spa-plugin-s3-feature-toggle (npm) (malicious package) - [MAL-2026-12777](https://insights.sbomify.com/MAL-2026-12777/): Malicious code in devplatform-spa-plugin-router (npm) (malicious package) - [MAL-2026-12776](https://insights.sbomify.com/MAL-2026-12776/): Malicious code in devplatform-spa-plugin-root-sentry (npm) (malicious package) - [MAL-2026-12775](https://insights.sbomify.com/MAL-2026-12775/): Malicious code in devplatform-spa-plugin-root-devtools (npm) (malicious package) - [MAL-2026-12774](https://insights.sbomify.com/MAL-2026-12774/): Malicious code in devplatform-spa-plugin-query (npm) (malicious package) - [MAL-2026-12773](https://insights.sbomify.com/MAL-2026-12773/): Malicious code in devplatform-spa-plugin-notifier (npm) (malicious package) - [MAL-2026-12772](https://insights.sbomify.com/MAL-2026-12772/): Malicious code in devplatform-spa-plugin-module-loader (npm) (malicious package) - [MAL-2026-12771](https://insights.sbomify.com/MAL-2026-12771/): Malicious code in devplatform-spa-plugin-module (npm) (malicious package) - [MAL-2026-12770](https://insights.sbomify.com/MAL-2026-12770/): Malicious code in devplatform-spa-plugin-location (npm) (malicious package) - [MAL-2026-1277](https://insights.sbomify.com/MAL-2026-1277/): Malicious code in prateek-yadav23 (PyPI) (malicious package) - [MAL-2026-12769](https://insights.sbomify.com/MAL-2026-12769/): Malicious code in devplatform-spa-plugin-i18next-instance (npm) (malicious package) - [MAL-2026-12768](https://insights.sbomify.com/MAL-2026-12768/): Malicious code in devplatform-spa-plugin-i18next (npm) (malicious package) - [MAL-2026-12767](https://insights.sbomify.com/MAL-2026-12767/): Malicious code in devplatform-spa-plugin-history (npm) (malicious package) - [MAL-2026-12766](https://insights.sbomify.com/MAL-2026-12766/): Malicious code in devplatform-spa-plugin-error-boundary (npm) (malicious package) - [MAL-2026-12765](https://insights.sbomify.com/MAL-2026-12765/): Malicious code in devplatform-spa-plugin-dom-render (npm) (malicious package) - [MAL-2026-12764](https://insights.sbomify.com/MAL-2026-12764/): Malicious code in devplatform-spa-plugin-devtools (npm) (malicious package) - [MAL-2026-12763](https://insights.sbomify.com/MAL-2026-12763/): Malicious code in devplatform-spa-plugin-cobrowsing (npm) (malicious package) - [MAL-2026-12762](https://insights.sbomify.com/MAL-2026-12762/): Malicious code in devplatform-spa-plugin-beaver (npm) (malicious package) - [MAL-2026-12761](https://insights.sbomify.com/MAL-2026-12761/): Malicious code in devplatform-spa-plugin-auth (npm) (malicious package) - [MAL-2026-12760](https://insights.sbomify.com/MAL-2026-12760/): Malicious code in devplatform-spa-plugin-analytics (npm) (malicious package) - [MAL-2026-1276](https://insights.sbomify.com/MAL-2026-1276/): Malicious code in flowfix (PyPI) (malicious package) - [MAL-2026-12759](https://insights.sbomify.com/MAL-2026-12759/): Malicious code in devplatform-spa-plugin-ability (npm) (malicious package) - [MAL-2026-12758](https://insights.sbomify.com/MAL-2026-12758/): Malicious code in devplatform-spa-feature-toggle (npm) (malicious package) - [MAL-2026-12757](https://insights.sbomify.com/MAL-2026-12757/): Malicious code in devplatform-spa-di (npm) (malicious package) - [MAL-2026-12756](https://insights.sbomify.com/MAL-2026-12756/): Malicious code in devplatform-spa-devtools (npm) (malicious package) - [MAL-2026-12755](https://insights.sbomify.com/MAL-2026-12755/): Malicious code in devplatform-spa-cli (npm) (malicious package) - [MAL-2026-12754](https://insights.sbomify.com/MAL-2026-12754/): Malicious code in devplatform-spa (npm) (malicious package) - [MAL-2026-12753](https://insights.sbomify.com/MAL-2026-12753/): Malicious code in devplatform-snarkdown (npm) (malicious package) - [MAL-2026-12752](https://insights.sbomify.com/MAL-2026-12752/): Malicious code in devplatform-select-user (npm) (malicious package) - [MAL-2026-12751](https://insights.sbomify.com/MAL-2026-12751/): Malicious code in devplatform-select-fields (npm) (malicious package) - [MAL-2026-12750](https://insights.sbomify.com/MAL-2026-12750/): Malicious code in devplatform-sdk (npm) (malicious package) - [MAL-2026-1275](https://insights.sbomify.com/MAL-2026-1275/): Malicious code in hostlists-plugins-default (PyPI) (malicious package) - [MAL-2026-12749](https://insights.sbomify.com/MAL-2026-12749/): Malicious code in devplatform-s3-uploader (npm) (malicious package) - [MAL-2026-12748](https://insights.sbomify.com/MAL-2026-12748/): Malicious code in devplatform-s3-resources (npm) (malicious package) - [MAL-2026-12747](https://insights.sbomify.com/MAL-2026-12747/): Malicious code in devplatform-s3-client (npm) (malicious package) - [MAL-2026-12746](https://insights.sbomify.com/MAL-2026-12746/): Malicious code in devplatform-rest-resources-v2 (npm) (malicious package) - [MAL-2026-12745](https://insights.sbomify.com/MAL-2026-12745/): Malicious code in devplatform-rest-resources-v1 (npm) (malicious package) - [MAL-2026-12744](https://insights.sbomify.com/MAL-2026-12744/): Malicious code in devplatform-rest-client (npm) (malicious package) - [MAL-2026-12743](https://insights.sbomify.com/MAL-2026-12743/): Malicious code in devplatform-react-utils (npm) (malicious package) - [MAL-2026-12742](https://insights.sbomify.com/MAL-2026-12742/): Malicious code in devplatform-react-sentry (npm) (malicious package) - [MAL-2026-12741](https://insights.sbomify.com/MAL-2026-12741/): Malicious code in devplatform-react-scripts (npm) (malicious package) - [MAL-2026-12740](https://insights.sbomify.com/MAL-2026-12740/): Malicious code in devplatform-react-rest-client (npm) (malicious package) - [MAL-2026-1274](https://insights.sbomify.com/MAL-2026-1274/): Malicious code in test-mal-npm-pkg-not-local (npm) (malicious package) - [MAL-2026-12739](https://insights.sbomify.com/MAL-2026-12739/): Malicious code in devplatform-react-query-s3-client (npm) (malicious package) - [MAL-2026-12738](https://insights.sbomify.com/MAL-2026-12738/): Malicious code in devplatform-react-query-clients (npm) (malicious package) - [MAL-2026-12737](https://insights.sbomify.com/MAL-2026-12737/): Malicious code in devplatform-react-micro-frontend (npm) (malicious package) - [MAL-2026-12736](https://insights.sbomify.com/MAL-2026-12736/): Malicious code in devplatform-react-hooks (npm) (malicious package) - [MAL-2026-12735](https://insights.sbomify.com/MAL-2026-12735/): Malicious code in devplatform-react-form (npm) (malicious package) - [MAL-2026-12734](https://insights.sbomify.com/MAL-2026-12734/): Malicious code in devplatform-prettier-config (npm) (malicious package) - [MAL-2026-12733](https://insights.sbomify.com/MAL-2026-12733/): Malicious code in devplatform-po-transformer (npm) (malicious package) - [MAL-2026-12732](https://insights.sbomify.com/MAL-2026-12732/): Malicious code in devplatform-po-loader (npm) (malicious package) - [MAL-2026-12731](https://insights.sbomify.com/MAL-2026-12731/): Malicious code in devplatform-po-declaration-generator (npm) (malicious package) - [MAL-2026-12730](https://insights.sbomify.com/MAL-2026-12730/): Malicious code in devplatform-nx-ts (npm) (malicious package) - [MAL-2026-1273](https://insights.sbomify.com/MAL-2026-1273/): Malicious code in test-mal-npm-pkg-local (npm) (malicious package) - [MAL-2026-12729](https://insights.sbomify.com/MAL-2026-12729/): Malicious code in devplatform-nx-svelte (npm) (malicious package) - [MAL-2026-12728](https://insights.sbomify.com/MAL-2026-12728/): Malicious code in devplatform-nx-stylelint (npm) (malicious package) - [MAL-2026-12727](https://insights.sbomify.com/MAL-2026-12727/): Malicious code in devplatform-nx-spa (npm) (malicious package) - [MAL-2026-12726](https://insights.sbomify.com/MAL-2026-12726/): Malicious code in devplatform-nx-react (npm) (malicious package) - [MAL-2026-12725](https://insights.sbomify.com/MAL-2026-12725/): Malicious code in devplatform-nx-pvm (npm) (malicious package) - [MAL-2026-12724](https://insights.sbomify.com/MAL-2026-12724/): Malicious code in devplatform-nx-husky (npm) (malicious package) - [MAL-2026-12723](https://insights.sbomify.com/MAL-2026-12723/): Malicious code in devplatform-nx-gle (npm) (malicious package) - [MAL-2026-12722](https://insights.sbomify.com/MAL-2026-12722/): Malicious code in devplatform-nx-devkit (npm) (malicious package) - [MAL-2026-12721](https://insights.sbomify.com/MAL-2026-12721/): Malicious code in devplatform-npm-versions-checker (npm) (malicious package) - [MAL-2026-12720](https://insights.sbomify.com/MAL-2026-12720/): Malicious code in devplatform-markdown (npm) (malicious package) - [MAL-2026-1272](https://insights.sbomify.com/MAL-2026-1272/): Malicious code in test-mal-npm-pkg-2 (npm) (malicious package) - [MAL-2026-12719](https://insights.sbomify.com/MAL-2026-12719/): Malicious code in devplatform-jscodeshift-utils (npm) (malicious package) - [MAL-2026-12718](https://insights.sbomify.com/MAL-2026-12718/): Malicious code in devplatform-jscodeshift-transforms (npm) (malicious package) - [MAL-2026-12717](https://insights.sbomify.com/MAL-2026-12717/): Malicious code in devplatform-jscodeshift-plugin (npm) (malicious package) - [MAL-2026-12716](https://insights.sbomify.com/MAL-2026-12716/): Malicious code in devplatform-integrations-tests-lib (npm) (malicious package) - [MAL-2026-12715](https://insights.sbomify.com/MAL-2026-12715/): Malicious code in devplatform-iam-client (npm) (malicious package) - [MAL-2026-12714](https://insights.sbomify.com/MAL-2026-12714/): Malicious code in devplatform-i18n (npm) (malicious package) - [MAL-2026-12713](https://insights.sbomify.com/MAL-2026-12713/): Malicious code in devplatform-humanize-network-error (npm) (malicious package) - [MAL-2026-12712](https://insights.sbomify.com/MAL-2026-12712/): Malicious code in devplatform-http-client (npm) (malicious package) - [MAL-2026-12711](https://insights.sbomify.com/MAL-2026-12711/): Malicious code in devplatform-hooks (npm) (malicious package) - [MAL-2026-12710](https://insights.sbomify.com/MAL-2026-12710/): Malicious code in devplatform-eslint-plugin-nx (npm) (malicious package) - [MAL-2026-1271](https://insights.sbomify.com/MAL-2026-1271/): Malicious code in qq-console (npm) (malicious package) - [MAL-2026-12709](https://insights.sbomify.com/MAL-2026-12709/): Malicious code in devplatform-di (npm) (malicious package) - [MAL-2026-12708](https://insights.sbomify.com/MAL-2026-12708/): Malicious code in devplatform-data-table (npm) (malicious package) - [MAL-2026-12707](https://insights.sbomify.com/MAL-2026-12707/): Malicious code in devplatform-create-nx-spa (npm) (malicious package) - [MAL-2026-12706](https://insights.sbomify.com/MAL-2026-12706/): Malicious code in devplatform-cra-template (npm) (malicious package) - [MAL-2026-12705](https://insights.sbomify.com/MAL-2026-12705/): Malicious code in devplatform-confirm-input (npm) (malicious package) - [MAL-2026-12704](https://insights.sbomify.com/MAL-2026-12704/): Malicious code in devplatform-cli-spa (npm) (malicious package) - [MAL-2026-12703](https://insights.sbomify.com/MAL-2026-12703/): Malicious code in devplatform-cli-plugin-test (npm) (malicious package) - [MAL-2026-12702](https://insights.sbomify.com/MAL-2026-12702/): Malicious code in devplatform-cli-plugin-lint (npm) (malicious package) - [MAL-2026-12701](https://insights.sbomify.com/MAL-2026-12701/): Malicious code in devplatform-cli-plugin-generator (npm) (malicious package) - [MAL-2026-12700](https://insights.sbomify.com/MAL-2026-12700/): Malicious code in devplatform-cli-contracts (npm) (malicious package) - [MAL-2026-1270](https://insights.sbomify.com/MAL-2026-1270/): Malicious code in @wgu-edu/wgu-icons (npm) (malicious package) - [MAL-2026-127](https://insights.sbomify.com/MAL-2026-127/): Malicious code in @bingads-webui-component-legacy/storage (npm) (malicious package) - [MAL-2026-12699](https://insights.sbomify.com/MAL-2026-12699/): Malicious code in devplatform-cli (npm) (malicious package) - [MAL-2026-12698](https://insights.sbomify.com/MAL-2026-12698/): Malicious code in devplatform-auth-client (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/161/