# Vulnerabilities published in 2026


- [MAL-2026-12606](https://insights.sbomify.com/MAL-2026-12606/): Malicious code in claims-api-clients-shared (npm) (malicious package)
- [MAL-2026-12605](https://insights.sbomify.com/MAL-2026-12605/): Malicious code in claims-api-adapters (npm) (malicious package)
- [MAL-2026-12604](https://insights.sbomify.com/MAL-2026-12604/): Malicious code in claims-accounts-lib (npm) (malicious package)
- [MAL-2026-12603](https://insights.sbomify.com/MAL-2026-12603/): Malicious code in checkout-use-toasts (npm) (malicious package)
- [MAL-2026-12602](https://insights.sbomify.com/MAL-2026-12602/): Malicious code in checkout-use-notifications (npm) (malicious package)
- [MAL-2026-12601](https://insights.sbomify.com/MAL-2026-12601/): Malicious code in checkout-use-disable-interaction (npm) (malicious package)
- [MAL-2026-12600](https://insights.sbomify.com/MAL-2026-12600/): Malicious code in checkout-use-boolean (npm) (malicious package)
- [MAL-2026-1260](https://insights.sbomify.com/MAL-2026-1260/): Malicious code in webmd-url (npm) (malicious package)
- [MAL-2026-126](https://insights.sbomify.com/MAL-2026-126/): Malicious code in codefrequencychecker (PyPI) (malicious package)
- [MAL-2026-12599](https://insights.sbomify.com/MAL-2026-12599/): Malicious code in checkout-types (npm) (malicious package)
- [MAL-2026-12598](https://insights.sbomify.com/MAL-2026-12598/): Malicious code in checkout-total-logic (npm) (malicious package)
- [MAL-2026-12597](https://insights.sbomify.com/MAL-2026-12597/): Malicious code in checkout-todo-test (npm) (malicious package)
- [MAL-2026-12596](https://insights.sbomify.com/MAL-2026-12596/): Malicious code in checkout-test-utils (npm) (malicious package)
- [MAL-2026-12595](https://insights.sbomify.com/MAL-2026-12595/): Malicious code in checkout-test-component (npm) (malicious package)
- [MAL-2026-12594](https://insights.sbomify.com/MAL-2026-12594/): Malicious code in checkout-subscription-holder (npm) (malicious package)
- [MAL-2026-12593](https://insights.sbomify.com/MAL-2026-12593/): Malicious code in checkout-storybook-default (npm) (malicious package)
- [MAL-2026-12592](https://insights.sbomify.com/MAL-2026-12592/): Malicious code in checkout-storage-service (npm) (malicious package)
- [MAL-2026-12591](https://insights.sbomify.com/MAL-2026-12591/): Malicious code in checkout-select-pos-offer-am (npm) (malicious package)
- [MAL-2026-12590](https://insights.sbomify.com/MAL-2026-12590/): Malicious code in checkout-resend-pos-order-sms-am (npm) (malicious package)
- [MAL-2026-1259](https://insights.sbomify.com/MAL-2026-1259/): Malicious code in pino-sdk-v2 (npm) (malicious package)
- [MAL-2026-12589](https://insights.sbomify.com/MAL-2026-12589/): Malicious code in checkout-public-tokens (npm) (malicious package)
- [MAL-2026-12588](https://insights.sbomify.com/MAL-2026-12588/): Malicious code in checkout-promocode-logic (npm) (malicious package)
- [MAL-2026-12587](https://insights.sbomify.com/MAL-2026-12587/): Malicious code in checkout-postpone-until-render (npm) (malicious package)
- [MAL-2026-12586](https://insights.sbomify.com/MAL-2026-12586/): Malicious code in checkout-post-installment-client-agreement-accept-am (npm) (malicious package)
- [MAL-2026-12585](https://insights.sbomify.com/MAL-2026-12585/): Malicious code in checkout-pay-widget-logic (npm) (malicious package)
- [MAL-2026-12584](https://insights.sbomify.com/MAL-2026-12584/): Malicious code in checkout-pay-button-logic (npm) (malicious package)
- [MAL-2026-12583](https://insights.sbomify.com/MAL-2026-12583/): Malicious code in checkout-parameters (npm) (malicious package)
- [MAL-2026-12582](https://insights.sbomify.com/MAL-2026-12582/): Malicious code in checkout-molecule-mobile-status-sheet (npm) (malicious package)
- [MAL-2026-12581](https://insights.sbomify.com/MAL-2026-12581/): Malicious code in checkout-molecule-desktop-status-modal (npm) (malicious package)
- [MAL-2026-12580](https://insights.sbomify.com/MAL-2026-12580/): Malicious code in checkout-mobile-total (npm) (malicious package)
- [MAL-2026-1258](https://insights.sbomify.com/MAL-2026-1258/): Malicious code in tether-dev-docs (npm) (malicious package)
- [MAL-2026-12579](https://insights.sbomify.com/MAL-2026-12579/): Malicious code in checkout-mobile-promocode (npm) (malicious package)
- [MAL-2026-12578](https://insights.sbomify.com/MAL-2026-12578/): Malicious code in checkout-mobile-pay-widget (npm) (malicious package)
- [MAL-2026-12577](https://insights.sbomify.com/MAL-2026-12577/): Malicious code in checkout-mobile-legal (npm) (malicious package)
- [MAL-2026-12576](https://insights.sbomify.com/MAL-2026-12576/): Malicious code in checkout-mobile-input-email (npm) (malicious package)
- [MAL-2026-12575](https://insights.sbomify.com/MAL-2026-12575/): Malicious code in checkout-mobile-input-card (npm) (malicious package)
- [MAL-2026-12574](https://insights.sbomify.com/MAL-2026-12574/): Malicious code in checkout-mobile-dolyame (npm) (malicious package)
- [MAL-2026-12573](https://insights.sbomify.com/MAL-2026-12573/): Malicious code in checkout-mobile-cashback (npm) (malicious package)
- [MAL-2026-12572](https://insights.sbomify.com/MAL-2026-12572/): Malicious code in checkout-mobile-bnpl (npm) (malicious package)
- [MAL-2026-12571](https://insights.sbomify.com/MAL-2026-12571/): Malicious code in checkout-mobile-accounts-old (npm) (malicious package)
- [MAL-2026-12570](https://insights.sbomify.com/MAL-2026-12570/): Malicious code in checkout-mobile-accounts (npm) (malicious package)
- [MAL-2026-1257](https://insights.sbomify.com/MAL-2026-1257/): Malicious code in pdfjs-dist-fourth (npm) (malicious package)
- [MAL-2026-12569](https://insights.sbomify.com/MAL-2026-12569/): Malicious code in checkout-legal-logic (npm) (malicious package)
- [MAL-2026-12568](https://insights.sbomify.com/MAL-2026-12568/): Malicious code in checkout-input-email-logic (npm) (malicious package)
- [MAL-2026-12567](https://insights.sbomify.com/MAL-2026-12567/): Malicious code in checkout-input-card-logic (npm) (malicious package)
- [MAL-2026-12566](https://insights.sbomify.com/MAL-2026-12566/): Malicious code in checkout-iframe (npm) (malicious package)
- [MAL-2026-12565](https://insights.sbomify.com/MAL-2026-12565/): Malicious code in checkout-get-pos-documents-am (npm) (malicious package)
- [MAL-2026-12564](https://insights.sbomify.com/MAL-2026-12564/): Malicious code in checkout-get-installment-client-agreement-am (npm) (malicious package)
- [MAL-2026-12563](https://insights.sbomify.com/MAL-2026-12563/): Malicious code in checkout-format-money (npm) (malicious package)
- [MAL-2026-12562](https://insights.sbomify.com/MAL-2026-12562/): Malicious code in checkout-dolyame-logic (npm) (malicious package)
- [MAL-2026-12561](https://insights.sbomify.com/MAL-2026-12561/): Malicious code in checkout-desktop-total (npm) (malicious package)
- [MAL-2026-12560](https://insights.sbomify.com/MAL-2026-12560/): Malicious code in checkout-desktop-promocode (npm) (malicious package)
- [MAL-2026-1256](https://insights.sbomify.com/MAL-2026-1256/): Malicious code in pearpass-lib-data-import (npm) (malicious package)
- [MAL-2026-12559](https://insights.sbomify.com/MAL-2026-12559/): Malicious code in checkout-desktop-pay-widget (npm) (malicious package)
- [MAL-2026-12558](https://insights.sbomify.com/MAL-2026-12558/): Malicious code in checkout-desktop-pay-button (npm) (malicious package)
- [MAL-2026-12557](https://insights.sbomify.com/MAL-2026-12557/): Malicious code in checkout-desktop-legal (npm) (malicious package)
- [MAL-2026-12556](https://insights.sbomify.com/MAL-2026-12556/): Malicious code in checkout-desktop-input-card (npm) (malicious package)
- [MAL-2026-12555](https://insights.sbomify.com/MAL-2026-12555/): Malicious code in checkout-desktop-cashback (npm) (malicious package)
- [MAL-2026-12554](https://insights.sbomify.com/MAL-2026-12554/): Malicious code in checkout-desktop-bnpl (npm) (malicious package)
- [MAL-2026-12553](https://insights.sbomify.com/MAL-2026-12553/): Malicious code in checkout-desktop-accounts (npm) (malicious package)
- [MAL-2026-12552](https://insights.sbomify.com/MAL-2026-12552/): Malicious code in checkout-create-token (npm) (malicious package)
- [MAL-2026-12551](https://insights.sbomify.com/MAL-2026-12551/): Malicious code in checkout-create-draft-agreement-am (npm) (malicious package)
- [MAL-2026-12550](https://insights.sbomify.com/MAL-2026-12550/): Malicious code in checkout-context (npm) (malicious package)
- [MAL-2026-1255](https://insights.sbomify.com/MAL-2026-1255/): Malicious code in pearpass-lib-data-export (npm) (malicious package)
- [MAL-2026-12549](https://insights.sbomify.com/MAL-2026-12549/): Malicious code in checkout-confirm-pos-order-sms-am (npm) (malicious package)
- [MAL-2026-12548](https://insights.sbomify.com/MAL-2026-12548/): Malicious code in checkout-commit-pos-order-am (npm) (malicious package)
- [MAL-2026-12547](https://insights.sbomify.com/MAL-2026-12547/): Malicious code in checkout-checkout-test-block-aff (npm) (malicious package)
- [MAL-2026-12546](https://insights.sbomify.com/MAL-2026-12546/): Malicious code in checkout-cashback-logic (npm) (malicious package)
- [MAL-2026-12545](https://insights.sbomify.com/MAL-2026-12545/): Malicious code in checkout-bnpl-logic (npm) (malicious package)
- [MAL-2026-12544](https://insights.sbomify.com/MAL-2026-12544/): Malicious code in checkout-base-test (npm) (malicious package)
- [MAL-2026-12543](https://insights.sbomify.com/MAL-2026-12543/): Malicious code in checkout-base-analytics-data (npm) (malicious package)
- [MAL-2026-12542](https://insights.sbomify.com/MAL-2026-12542/): Malicious code in checkout-accounts-logic (npm) (malicious package)
- [MAL-2026-12541](https://insights.sbomify.com/MAL-2026-12541/): Malicious code in checkout-accounts-holder (npm) (malicious package)
- [MAL-2026-12540](https://insights.sbomify.com/MAL-2026-12540/): Malicious code in chai-as-inspired (npm) (malicious package)
- [MAL-2026-1254](https://insights.sbomify.com/MAL-2026-1254/): Malicious code in pear-apps-utils-qr (npm) (malicious package)
- [MAL-2026-12539](https://insights.sbomify.com/MAL-2026-12539/): Malicious code in certificates-revocation-utils (npm) (malicious package)
- [MAL-2026-12538](https://insights.sbomify.com/MAL-2026-12538/): Malicious code in certificates-revocation-sw (npm) (malicious package)
- [MAL-2026-12537](https://insights.sbomify.com/MAL-2026-12537/): Malicious code in cbp-exchange-government-cbp-exchange-government-core (npm) (malicious package)
- [MAL-2026-12536](https://insights.sbomify.com/MAL-2026-12536/): Malicious code in cardsmobile-storage (npm) (malicious package)
- [MAL-2026-12535](https://insights.sbomify.com/MAL-2026-12535/): Malicious code in cardsmobile-rs-api (npm) (malicious package)
- [MAL-2026-12534](https://insights.sbomify.com/MAL-2026-12534/): Malicious code in cardsmobile-notifications (npm) (malicious package)
- [MAL-2026-12533](https://insights.sbomify.com/MAL-2026-12533/): Malicious code in cardsmobile-http (npm) (malicious package)
- [MAL-2026-12532](https://insights.sbomify.com/MAL-2026-12532/): Malicious code in cardsmobile-event-emitter (npm) (malicious package)
- [MAL-2026-12531](https://insights.sbomify.com/MAL-2026-12531/): Malicious code in cardsmobile-data-utils (npm) (malicious package)
- [MAL-2026-12530](https://insights.sbomify.com/MAL-2026-12530/): Malicious code in cardsmobile-command-utils (npm) (malicious package)
- [MAL-2026-1253](https://insights.sbomify.com/MAL-2026-1253/): Malicious code in pear-apps-utils-date (npm) (malicious package)
- [MAL-2026-12529](https://insights.sbomify.com/MAL-2026-12529/): Malicious code in cardsmobile-cardsmobile-core (npm) (malicious package)
- [MAL-2026-12528](https://insights.sbomify.com/MAL-2026-12528/): Malicious code in cards-forms-debit-clone (npm) (malicious package)
- [MAL-2026-12527](https://insights.sbomify.com/MAL-2026-12527/): Malicious code in cards-forms-credit-clone (npm) (malicious package)
- [MAL-2026-12526](https://insights.sbomify.com/MAL-2026-12526/): Malicious code in cards-forms-clone-debit-clone (npm) (malicious package)
- [MAL-2026-12525](https://insights.sbomify.com/MAL-2026-12525/): Malicious code in cards-forms-clone-credit-clone (npm) (malicious package)
- [MAL-2026-12524](https://insights.sbomify.com/MAL-2026-12524/): Malicious code in cards-forms-clone-cards-core-clone (npm) (malicious package)
- [MAL-2026-12523](https://insights.sbomify.com/MAL-2026-12523/): Malicious code in cards-forms-cards-core-clone (npm) (malicious package)
- [MAL-2026-12522](https://insights.sbomify.com/MAL-2026-12522/): Malicious code in capacity-capacity-core (npm) (malicious package)
- [MAL-2026-12521](https://insights.sbomify.com/MAL-2026-12521/): Malicious code in candy-candy-core (npm) (malicious package)
- [MAL-2026-12520](https://insights.sbomify.com/MAL-2026-12520/): Malicious code in caen-caen-core (npm) (malicious package)
- [MAL-2026-1252](https://insights.sbomify.com/MAL-2026-1252/): Malicious code in pear-apps-utils-avatar-initials (npm) (malicious package)
- [MAL-2026-12519](https://insights.sbomify.com/MAL-2026-12519/): Malicious code in bs-bs-core (npm) (malicious package)
- [MAL-2026-12518](https://insights.sbomify.com/MAL-2026-12518/): Malicious code in break-after (npm) (malicious package)
- [MAL-2026-12517](https://insights.sbomify.com/MAL-2026-12517/): Malicious code in bpm-renovate-renovate-config (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/163/