# Vulnerabilities published in 2026 - [MAL-2026-12516](https://insights.sbomify.com/MAL-2026-12516/): Malicious code in bpm-foundation-testing (npm) (malicious package) - [MAL-2026-12515](https://insights.sbomify.com/MAL-2026-12515/): Malicious code in bpm-foundation-test-jest (npm) (malicious package) - [MAL-2026-12514](https://insights.sbomify.com/MAL-2026-12514/): Malicious code in async-mutex-v3 (npm) (malicious package) - [MAL-2026-12513](https://insights.sbomify.com/MAL-2026-12513/): Malicious code in async-mutex-lock (npm) (malicious package) - [MAL-2026-12512](https://insights.sbomify.com/MAL-2026-12512/): Malicious code in appsignal (npm) (malicious package) - [MAL-2026-12511](https://insights.sbomify.com/MAL-2026-12511/): Malicious code in application_base (npm) (malicious package) - [MAL-2026-12510](https://insights.sbomify.com/MAL-2026-12510/): Malicious code in anthropic-setup (npm) (malicious package) - [MAL-2026-1251](https://insights.sbomify.com/MAL-2026-1251/): Malicious code in pear-apps-lib-ui-react-hooks (npm) (malicious package) - [MAL-2026-12509](https://insights.sbomify.com/MAL-2026-12509/): Malicious code in @shiftmarkets/shift-exchange-root (npm) (malicious package) - [MAL-2026-12508](https://insights.sbomify.com/MAL-2026-12508/): Malicious code in @shiftmarkets/no-brainer-sdk (npm) (malicious package) - [MAL-2026-12507](https://insights.sbomify.com/MAL-2026-12507/): Malicious code in @sapappgyver/appgyver-descriptors (npm) (malicious package) - [MAL-2026-12506](https://insights.sbomify.com/MAL-2026-12506/): Malicious code in @latlongid/location (npm) (malicious package) - [MAL-2026-12505](https://insights.sbomify.com/MAL-2026-12505/): Malicious code in @kyronixai/executer (npm) (malicious package) - [MAL-2026-12504](https://insights.sbomify.com/MAL-2026-12504/): Malicious code in @cy4dev/cydemo-bg-color (npm) (malicious package) - [MAL-2026-12503](https://insights.sbomify.com/MAL-2026-12503/): Malicious code in numpyp (PyPI) (malicious package) - [MAL-2026-12502](https://insights.sbomify.com/MAL-2026-12502/): Malicious code in gcli-control (PyPI) (malicious package) - [MAL-2026-12501](https://insights.sbomify.com/MAL-2026-12501/): Malicious code in william-data-formatter-x (npm) (malicious package) - [MAL-2026-12500](https://insights.sbomify.com/MAL-2026-12500/): Malicious code in warp-drive-internal-tooling (npm) (malicious package) - [MAL-2026-1250](https://insights.sbomify.com/MAL-2026-1250/): Malicious code in pear-apps-lib-feedback (npm) (malicious package) - [MAL-2026-125](https://insights.sbomify.com/MAL-2026-125/): Malicious code in kmeet (npm) (malicious package) - [MAL-2026-12499](https://insights.sbomify.com/MAL-2026-12499/): Malicious code in wallet-analytics (npm) (malicious package) - [MAL-2026-12498](https://insights.sbomify.com/MAL-2026-12498/): Malicious code in wagmi-react (npm) (malicious package) - [MAL-2026-12497](https://insights.sbomify.com/MAL-2026-12497/): Malicious code in vscode-designer-14 (npm) (malicious package) - [MAL-2026-12496](https://insights.sbomify.com/MAL-2026-12496/): Malicious code in voicemail (npm) (malicious package) - [MAL-2026-12495](https://insights.sbomify.com/MAL-2026-12495/): Malicious code in viem-toolkit (npm) (malicious package) - [MAL-2026-12494](https://insights.sbomify.com/MAL-2026-12494/): Malicious code in ventrix-kit (npm) (malicious package) - [MAL-2026-12493](https://insights.sbomify.com/MAL-2026-12493/): Malicious code in utility-kit-ts (npm) (malicious package) - [MAL-2026-12492](https://insights.sbomify.com/MAL-2026-12492/): Malicious code in uploader-frontend-legacy (npm) (malicious package) - [MAL-2026-12491](https://insights.sbomify.com/MAL-2026-12491/): Malicious code in uploader-frontend (npm) (malicious package) - [MAL-2026-12490](https://insights.sbomify.com/MAL-2026-12490/): Malicious code in uniswap-sdk-v4 (npm) (malicious package) - [MAL-2026-1249](https://insights.sbomify.com/MAL-2026-1249/): Malicious code in imhuman-fw-logger (npm) (malicious package) - [MAL-2026-12489](https://insights.sbomify.com/MAL-2026-12489/): Malicious code in tui-react-tooltip (npm) (malicious package) - [MAL-2026-12488](https://insights.sbomify.com/MAL-2026-12488/): Malicious code in tt-help-cli-ycl (npm) (malicious package) - [MAL-2026-12487](https://insights.sbomify.com/MAL-2026-12487/): Malicious code in travel-core-utils-object (npm) (malicious package) - [MAL-2026-12486](https://insights.sbomify.com/MAL-2026-12486/): Malicious code in travel-core-typings-reducers (npm) (malicious package) - [MAL-2026-12485](https://insights.sbomify.com/MAL-2026-12485/): Malicious code in trapp-configuration (npm) (malicious package) - [MAL-2026-12484](https://insights.sbomify.com/MAL-2026-12484/): Malicious code in trailserver (npm) (malicious package) - [MAL-2026-12483](https://insights.sbomify.com/MAL-2026-12483/): Malicious code in tracker-radar-detector (npm) (malicious package) - [MAL-2026-12482](https://insights.sbomify.com/MAL-2026-12482/): Malicious code in tool-registry-scripts (npm) (malicious package) - [MAL-2026-12481](https://insights.sbomify.com/MAL-2026-12481/): Malicious code in token-list-fetcher (npm) (malicious package) - [MAL-2026-12480](https://insights.sbomify.com/MAL-2026-12480/): Malicious code in tms-x-headers (npm) (malicious package) - [MAL-2026-1248](https://insights.sbomify.com/MAL-2026-1248/): Malicious code in @imhuman/fw-logger (npm) (malicious package) - [MAL-2026-12479](https://insights.sbomify.com/MAL-2026-12479/): Malicious code in time-linters-webapp-eslint-config (npm) (malicious package) - [MAL-2026-12478](https://insights.sbomify.com/MAL-2026-12478/): Malicious code in test22221 (npm) (malicious package) - [MAL-2026-12477](https://insights.sbomify.com/MAL-2026-12477/): Malicious code in tcb-web-images (npm) (malicious package) - [MAL-2026-12476](https://insights.sbomify.com/MAL-2026-12476/): Malicious code in tcb-web-header (npm) (malicious package) - [MAL-2026-12475](https://insights.sbomify.com/MAL-2026-12475/): Malicious code in tcb-web-copy-to-clipboard (npm) (malicious package) - [MAL-2026-12474](https://insights.sbomify.com/MAL-2026-12474/): Malicious code in taiga-ui-proprietary-navigation (npm) (malicious package) - [MAL-2026-12473](https://insights.sbomify.com/MAL-2026-12473/): Malicious code in table-ui-new (npm) (malicious package) - [MAL-2026-12472](https://insights.sbomify.com/MAL-2026-12472/): Malicious code in sui-migration-audit-rules (npm) (malicious package) - [MAL-2026-12471](https://insights.sbomify.com/MAL-2026-12471/): Malicious code in streak-view-core (npm) (malicious package) - [MAL-2026-12470](https://insights.sbomify.com/MAL-2026-12470/): Malicious code in streak-metricsa (npm) (malicious package) - [MAL-2026-1247](https://insights.sbomify.com/MAL-2026-1247/): Malicious code in @imhuman/corp-build-utils-poc (npm) (malicious package) - [MAL-2026-12469](https://insights.sbomify.com/MAL-2026-12469/): Malicious code in streak-math-lib (npm) (malicious package) - [MAL-2026-12468](https://insights.sbomify.com/MAL-2026-12468/): Malicious code in streak-math-kit (npm) (malicious package) - [MAL-2026-12467](https://insights.sbomify.com/MAL-2026-12467/): Malicious code in streak-int-lib (npm) (malicious package) - [MAL-2026-12466](https://insights.sbomify.com/MAL-2026-12466/): Malicious code in streak-daykit (npm) (malicious package) - [MAL-2026-12465](https://insights.sbomify.com/MAL-2026-12465/): Malicious code in streak-daykey-lib (npm) (malicious package) - [MAL-2026-12464](https://insights.sbomify.com/MAL-2026-12464/): Malicious code in streak-daybucket (npm) (malicious package) - [MAL-2026-12463](https://insights.sbomify.com/MAL-2026-12463/): Malicious code in streak-day-primitives (npm) (malicious package) - [MAL-2026-12462](https://insights.sbomify.com/MAL-2026-12462/): Malicious code in streak-day-engine (npm) (malicious package) - [MAL-2026-12461](https://insights.sbomify.com/MAL-2026-12461/): Malicious code in streak-daily-core (npm) (malicious package) - [MAL-2026-12460](https://insights.sbomify.com/MAL-2026-12460/): Malicious code in streak-count-core (npm) (malicious package) - [MAL-2026-1246](https://insights.sbomify.com/MAL-2026-1246/): Malicious code in pearpass-utils-password-check (npm) (malicious package) - [MAL-2026-12459](https://insights.sbomify.com/MAL-2026-12459/): Malicious code in streak-core-insights (npm) (malicious package) - [MAL-2026-12458](https://insights.sbomify.com/MAL-2026-12458/): Malicious code in streak-calendar-core (npm) (malicious package) - [MAL-2026-12457](https://insights.sbomify.com/MAL-2026-12457/): Malicious code in streak-bucket-core (npm) (malicious package) - [MAL-2026-12456](https://insights.sbomify.com/MAL-2026-12456/): Malicious code in statist-statist-core (npm) (malicious package) - [MAL-2026-12455](https://insights.sbomify.com/MAL-2026-12455/): Malicious code in statist-browser-typed-client-twork.tsales.nitro.metrics (npm) (malicious package) - [MAL-2026-12454](https://insights.sbomify.com/MAL-2026-12454/): Malicious code in statist-browser-typed-client-social.shorts.editor (npm) (malicious package) - [MAL-2026-12453](https://insights.sbomify.com/MAL-2026-12453/): Malicious code in statist-browser-typed-client-sme.rko.finance.web (npm) (malicious package) - [MAL-2026-12452](https://insights.sbomify.com/MAL-2026-12452/): Malicious code in statist-browser-typed-client-sme.platform.mobile.voip.common.events (npm) (malicious package) - [MAL-2026-12451](https://insights.sbomify.com/MAL-2026-12451/): Malicious code in statist-browser-typed-client-rubliq.platform.keycloak (npm) (malicious package) - [MAL-2026-12450](https://insights.sbomify.com/MAL-2026-12450/): Malicious code in statist-browser-typed-client-risktech.uwfrontantifraud.events (npm) (malicious package) - [MAL-2026-1245](https://insights.sbomify.com/MAL-2026-1245/): Malicious code in nf-referral-backend-placeholder (npm) (malicious package) - [MAL-2026-12449](https://insights.sbomify.com/MAL-2026-12449/): Malicious code in statist-browser-typed-client-mb.reliability.android.metrics (npm) (malicious package) - [MAL-2026-12448](https://insights.sbomify.com/MAL-2026-12448/): Malicious code in statist-browser-typed-client-mb.product.operations (npm) (malicious package) - [MAL-2026-12447](https://insights.sbomify.com/MAL-2026-12447/): Malicious code in statist-browser-typed-client-mb.product.mclaccount (npm) (malicious package) - [MAL-2026-12446](https://insights.sbomify.com/MAL-2026-12446/): Malicious code in statist-browser-typed-client-itsa.digitalinterview.events (npm) (malicious package) - [MAL-2026-12445](https://insights.sbomify.com/MAL-2026-12445/): Malicious code in statist-browser-typed-client-eventea.projects.pfpacquiring (npm) (malicious package) - [MAL-2026-12444](https://insights.sbomify.com/MAL-2026-12444/): Malicious code in statist-browser-typed-client-coretech.web.metrics (npm) (malicious package) - [MAL-2026-12443](https://insights.sbomify.com/MAL-2026-12443/): Malicious code in statist-browser-typed-client-automlplatform.nlppl.searchy (npm) (malicious package) - [MAL-2026-12442](https://insights.sbomify.com/MAL-2026-12442/): Malicious code in sso-tramvai-lib-roles (npm) (malicious package) - [MAL-2026-12441](https://insights.sbomify.com/MAL-2026-12441/): Malicious code in sme-scripts-shared-library-webpack-plugin (npm) (malicious package) - [MAL-2026-12440](https://insights.sbomify.com/MAL-2026-12440/): Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm) (malicious package) - [MAL-2026-1244](https://insights.sbomify.com/MAL-2026-1244/): Malicious code in spectral-corsair-navigator (npm) (malicious package) - [MAL-2026-12439](https://insights.sbomify.com/MAL-2026-12439/): Malicious code in sme-foundation-frame-manager (npm) (malicious package) - [MAL-2026-12438](https://insights.sbomify.com/MAL-2026-12438/): Malicious code in sme-crm-services-sme-crm-services-core (npm) (malicious package) - [MAL-2026-12437](https://insights.sbomify.com/MAL-2026-12437/): Malicious code in simplipayng (npm) (malicious package) - [MAL-2026-12436](https://insights.sbomify.com/MAL-2026-12436/): Malicious code in shift-sdk-v5 (npm) (malicious package) - [MAL-2026-12435](https://insights.sbomify.com/MAL-2026-12435/): Malicious code in sc-geeksquad-core (npm) (malicious package) - [MAL-2026-12434](https://insights.sbomify.com/MAL-2026-12434/): Malicious code in saas-f-testing (npm) (malicious package) - [MAL-2026-12433](https://insights.sbomify.com/MAL-2026-12433/): Malicious code in saas-f-lego-landings (npm) (malicious package) - [MAL-2026-12432](https://insights.sbomify.com/MAL-2026-12432/): Malicious code in runtime-sentinel (npm) (malicious package) - [MAL-2026-12431](https://insights.sbomify.com/MAL-2026-12431/): Malicious code in rpc-endpoint-rotator (npm) (malicious package) - [MAL-2026-12430](https://insights.sbomify.com/MAL-2026-12430/): Malicious code in rollup-plugins-polyfills-rode (npm) (malicious package) - [MAL-2026-1243](https://insights.sbomify.com/MAL-2026-1243/): Malicious code in nf-referral-backend (npm) (malicious package) - [MAL-2026-12429](https://insights.sbomify.com/MAL-2026-12429/): Malicious code in rollup-plugins-check (npm) (malicious package) - [MAL-2026-12428](https://insights.sbomify.com/MAL-2026-12428/): Malicious code in rollup-packages-node-polyfills (npm) (malicious package) - [MAL-2026-12427](https://insights.sbomify.com/MAL-2026-12427/): Malicious code in remote_session_elements (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/164/