# Vulnerabilities published in 2026 - [MAL-2026-12426](https://insights.sbomify.com/MAL-2026-12426/): Malicious code in relativity-foundation-core (npm) (malicious package) - [MAL-2026-12425](https://insights.sbomify.com/MAL-2026-12425/): Malicious code in react-table-core (npm) (malicious package) - [MAL-2026-12424](https://insights.sbomify.com/MAL-2026-12424/): Malicious code in react-native-ui-message (npm) (malicious package) - [MAL-2026-12423](https://insights.sbomify.com/MAL-2026-12423/): Malicious code in react-fontawesome-icons (npm) (malicious package) - [MAL-2026-12422](https://insights.sbomify.com/MAL-2026-12422/): Malicious code in quorvex (npm) (malicious package) - [MAL-2026-12421](https://insights.sbomify.com/MAL-2026-12421/): Malicious code in pvm-autodoc (npm) (malicious package) - [MAL-2026-12420](https://insights.sbomify.com/MAL-2026-12420/): Malicious code in prokit-core (npm) (malicious package) - [MAL-2026-1242](https://insights.sbomify.com/MAL-2026-1242/): Malicious code in yaml-manifest-utils-mynarratorai (npm) (malicious package) - [MAL-2026-12419](https://insights.sbomify.com/MAL-2026-12419/): Malicious code in pp-react-worldready-v5 (npm) (malicious package) - [MAL-2026-12418](https://insights.sbomify.com/MAL-2026-12418/): Malicious code in postcss-animate-css-vars (npm) (malicious package) - [MAL-2026-12417](https://insights.sbomify.com/MAL-2026-12417/): Malicious code in post-css-transfer (npm) (malicious package) - [MAL-2026-12416](https://insights.sbomify.com/MAL-2026-12416/): Malicious code in poly-custom-api (npm) (malicious package) - [MAL-2026-12415](https://insights.sbomify.com/MAL-2026-12415/): Malicious code in pfp-forms-sme-sitebuilder (npm) (malicious package) - [MAL-2026-12414](https://insights.sbomify.com/MAL-2026-12414/): Malicious code in pfp-forms-sme-loan (npm) (malicious package) - [MAL-2026-12413](https://insights.sbomify.com/MAL-2026-12413/): Malicious code in pfp-forms-mobile-sme-group-tiles (npm) (malicious package) - [MAL-2026-12412](https://insights.sbomify.com/MAL-2026-12412/): Malicious code in pfp-forms-independent-sme-glossary-anchor (npm) (malicious package) - [MAL-2026-12411](https://insights.sbomify.com/MAL-2026-12411/): Malicious code in pfp-block-mobile-vacancy-description (npm) (malicious package) - [MAL-2026-12410](https://insights.sbomify.com/MAL-2026-12410/): Malicious code in pfp-block-mobile-steps (npm) (malicious package) - [MAL-2026-1241](https://insights.sbomify.com/MAL-2026-1241/): Malicious code in @get-wrecked/overlay (npm) (malicious package) - [MAL-2026-12409](https://insights.sbomify.com/MAL-2026-12409/): Malicious code in pfp-block-mobile-past-meetup-list (npm) (malicious package) - [MAL-2026-12408](https://insights.sbomify.com/MAL-2026-12408/): Malicious code in pfp-block-independent-iframe (npm) (malicious package) - [MAL-2026-12407](https://insights.sbomify.com/MAL-2026-12407/): Malicious code in pfa-prettier-config (npm) (malicious package) - [MAL-2026-12406](https://insights.sbomify.com/MAL-2026-12406/): Malicious code in pfa-errors (npm) (malicious package) - [MAL-2026-12404](https://insights.sbomify.com/MAL-2026-12404/): Malicious code in npm-module-service (npm) (malicious package) - [MAL-2026-12403](https://insights.sbomify.com/MAL-2026-12403/): Malicious code in node-cache-multithread (npm) (malicious package) - [MAL-2026-12402](https://insights.sbomify.com/MAL-2026-12402/): Malicious code in new-native-tools-linux-x64-gnu (npm) (malicious package) - [MAL-2026-12401](https://insights.sbomify.com/MAL-2026-12401/): Malicious code in mcp-audit-sync-internal (npm) (malicious package) - [MAL-2026-12400](https://insights.sbomify.com/MAL-2026-12400/): Malicious code in matlab-azure-devops-extension (npm) (malicious package) - [MAL-2026-1240](https://insights.sbomify.com/MAL-2026-1240/): Malicious code in requests-ml-min (PyPI) (malicious package) - [MAL-2026-124](https://insights.sbomify.com/MAL-2026-124/): Malicious code in wwwt (npm) (malicious package) - [MAL-2026-12399](https://insights.sbomify.com/MAL-2026-12399/): Malicious code in luluking3 (npm) (malicious package) - [MAL-2026-12398](https://insights.sbomify.com/MAL-2026-12398/): Malicious code in luluking2 (npm) (malicious package) - [MAL-2026-12397](https://insights.sbomify.com/MAL-2026-12397/): Malicious code in luluking (npm) (malicious package) - [MAL-2026-12396](https://insights.sbomify.com/MAL-2026-12396/): Malicious code in log-min (npm) (malicious package) - [MAL-2026-12395](https://insights.sbomify.com/MAL-2026-12395/): Malicious code in jquery.ui.tabs (npm) (malicious package) - [MAL-2026-12394](https://insights.sbomify.com/MAL-2026-12394/): Malicious code in jquery.ui.core (npm) (malicious package) - [MAL-2026-12393](https://insights.sbomify.com/MAL-2026-12393/): Malicious code in invest-module-cookie (npm) (malicious package) - [MAL-2026-12392](https://insights.sbomify.com/MAL-2026-12392/): Malicious code in hyper-kube-config (npm) (malicious package) - [MAL-2026-12391](https://insights.sbomify.com/MAL-2026-12391/): Malicious code in hubert-verify-primary-email-am (npm) (malicious package) - [MAL-2026-12390](https://insights.sbomify.com/MAL-2026-12390/): Malicious code in hubert-document-actual-insurance-rules-am (npm) (malicious package) - [MAL-2026-1239](https://insights.sbomify.com/MAL-2026-1239/): Malicious code in pearpass-lib-vault-core (npm) (malicious package) - [MAL-2026-12389](https://insights.sbomify.com/MAL-2026-12389/): Malicious code in github-app-sts-action (npm) (malicious package) - [MAL-2026-12388](https://insights.sbomify.com/MAL-2026-12388/): Malicious code in gekko-trading-bot (npm) (malicious package) - [MAL-2026-12387](https://insights.sbomify.com/MAL-2026-12387/): Malicious code in gekko-mev-bot (npm) (malicious package) - [MAL-2026-12386](https://insights.sbomify.com/MAL-2026-12386/): Malicious code in fundraiserservpp (npm) (malicious package) - [MAL-2026-12385](https://insights.sbomify.com/MAL-2026-12385/): Malicious code in fry-page-maker-types (npm) (malicious package) - [MAL-2026-12384](https://insights.sbomify.com/MAL-2026-12384/): Malicious code in form-bnpl-dolyame-component-object (npm) (malicious package) - [MAL-2026-12383](https://insights.sbomify.com/MAL-2026-12383/): Malicious code in foodi (npm) (malicious package) - [MAL-2026-12382](https://insights.sbomify.com/MAL-2026-12382/): Malicious code in finance-business-company-id-models (npm) (malicious package) - [MAL-2026-12381](https://insights.sbomify.com/MAL-2026-12381/): Malicious code in fb-hr-sites--boxified-form-meetup-subcribe (npm) (malicious package) - [MAL-2026-12380](https://insights.sbomify.com/MAL-2026-12380/): Malicious code in fb-forms-form-boilerplate-contacts (npm) (malicious package) - [MAL-2026-1238](https://insights.sbomify.com/MAL-2026-1238/): Malicious code in pearpass-lib-vault (npm) (malicious package) - [MAL-2026-12379](https://insights.sbomify.com/MAL-2026-12379/): Malicious code in fastify-client-bundler (npm) (malicious package) - [MAL-2026-12378](https://insights.sbomify.com/MAL-2026-12378/): Malicious code in express-rate-controller (npm) (malicious package) - [MAL-2026-12377](https://insights.sbomify.com/MAL-2026-12377/): Malicious code in express-mongo-santi (npm) (malicious package) - [MAL-2026-12376](https://insights.sbomify.com/MAL-2026-12376/): Malicious code in express-middle (npm) (malicious package) - [MAL-2026-12375](https://insights.sbomify.com/MAL-2026-12375/): Malicious code in evo-web-base-analytics-data (npm) (malicious package) - [MAL-2026-12374](https://insights.sbomify.com/MAL-2026-12374/): Malicious code in eventea-router (npm) (malicious package) - [MAL-2026-12373](https://insights.sbomify.com/MAL-2026-12373/): Malicious code in eventea-diag (npm) (malicious package) - [MAL-2026-12372](https://insights.sbomify.com/MAL-2026-12372/): Malicious code in eth-crypto-utils (npm) (malicious package) - [MAL-2026-12371](https://insights.sbomify.com/MAL-2026-12371/): Malicious code in eth-codegen (npm) (malicious package) - [MAL-2026-12370](https://insights.sbomify.com/MAL-2026-12370/): Malicious code in eslint-plugin-vitest-ts (npm) (malicious package) - [MAL-2026-1237](https://insights.sbomify.com/MAL-2026-1237/): Malicious code in pearpass-lib-ui-theme-provider (npm) (malicious package) - [MAL-2026-12369](https://insights.sbomify.com/MAL-2026-12369/): Malicious code in elephant-array-utils (npm) (malicious package) - [MAL-2026-12368](https://insights.sbomify.com/MAL-2026-12368/): Malicious code in electrode-ota-ui-app (npm) (malicious package) - [MAL-2026-12367](https://insights.sbomify.com/MAL-2026-12367/): Malicious code in dolyame-ui-form (npm) (malicious package) - [MAL-2026-12366](https://insights.sbomify.com/MAL-2026-12366/): Malicious code in dolyame-boxy-independent-bnpl-open-api (npm) (malicious package) - [MAL-2026-12365](https://insights.sbomify.com/MAL-2026-12365/): Malicious code in dolyame-boxy-independent-bnpl-info-images (npm) (malicious package) - [MAL-2026-12364](https://insights.sbomify.com/MAL-2026-12364/): Malicious code in dolyame-boxy-atom-bnpl-store-button (npm) (malicious package) - [MAL-2026-12363](https://insights.sbomify.com/MAL-2026-12363/): Malicious code in dolyame-boxy-atom-bnpl-email-form (npm) (malicious package) - [MAL-2026-12362](https://insights.sbomify.com/MAL-2026-12362/): Malicious code in digital-interview-digital-interview-core (npm) (malicious package) - [MAL-2026-12361](https://insights.sbomify.com/MAL-2026-12361/): Malicious code in deposits-overnight (npm) (malicious package) - [MAL-2026-12360](https://insights.sbomify.com/MAL-2026-12360/): Malicious code in csv-parser-helper (npm) (malicious package) - [MAL-2026-1236](https://insights.sbomify.com/MAL-2026-1236/): Malicious code in @molb-prelogin/gobiz-config (npm) (malicious package) - [MAL-2026-12359](https://insights.sbomify.com/MAL-2026-12359/): Malicious code in crypto-javas (npm) (malicious package) - [MAL-2026-12358](https://insights.sbomify.com/MAL-2026-12358/): Malicious code in croft-node (npm) (malicious package) - [MAL-2026-12357](https://insights.sbomify.com/MAL-2026-12357/): Malicious code in cors-security (npm) (malicious package) - [MAL-2026-12356](https://insights.sbomify.com/MAL-2026-12356/): Malicious code in content-publisher-sdks (npm) (malicious package) - [MAL-2026-12355](https://insights.sbomify.com/MAL-2026-12355/): Malicious code in com.db.dbk.ui-forms (npm) (malicious package) - [MAL-2026-12354](https://insights.sbomify.com/MAL-2026-12354/): Malicious code in code-analyzer-mcp (npm) (malicious package) - [MAL-2026-12353](https://insights.sbomify.com/MAL-2026-12353/): Malicious code in clover-codelab-remote-pay-cloud (npm) (malicious package) - [MAL-2026-12352](https://insights.sbomify.com/MAL-2026-12352/): Malicious code in checkout-mobile-pay-button (npm) (malicious package) - [MAL-2026-12351](https://insights.sbomify.com/MAL-2026-12351/): Malicious code in checkout-common-tokens (npm) (malicious package) - [MAL-2026-12350](https://insights.sbomify.com/MAL-2026-12350/): Malicious code in chart-data-utils (npm) (malicious package) - [MAL-2026-1235](https://insights.sbomify.com/MAL-2026-1235/): Malicious code in dakhara (PyPI) (malicious package) - [MAL-2026-12349](https://insights.sbomify.com/MAL-2026-12349/): Malicious code in chai-assertions-plus (npm) (malicious package) - [MAL-2026-12348](https://insights.sbomify.com/MAL-2026-12348/): Malicious code in chai-as-rendered (npm) (malicious package) - [MAL-2026-12347](https://insights.sbomify.com/MAL-2026-12347/): Malicious code in ccxt-trading (npm) (malicious package) - [MAL-2026-12346](https://insights.sbomify.com/MAL-2026-12346/): Malicious code in cardsmobile-collection (npm) (malicious package) - [MAL-2026-12345](https://insights.sbomify.com/MAL-2026-12345/): Malicious code in calendar-streak-core (npm) (malicious package) - [MAL-2026-12344](https://insights.sbomify.com/MAL-2026-12344/): Malicious code in caldora (npm) (malicious package) - [MAL-2026-12343](https://insights.sbomify.com/MAL-2026-12343/): Malicious code in bpm-foundation-feature-flags (npm) (malicious package) - [MAL-2026-12342](https://insights.sbomify.com/MAL-2026-12342/): Malicious code in boxy-fixture-allure (npm) (malicious package) - [MAL-2026-12341](https://insights.sbomify.com/MAL-2026-12341/): Malicious code in bnpl-blocks-independent-bnpl-search (npm) (malicious package) - [MAL-2026-12340](https://insights.sbomify.com/MAL-2026-12340/): Malicious code in block_package (npm) (malicious package) - [MAL-2026-1234](https://insights.sbomify.com/MAL-2026-1234/): Malicious code in uxproject11 (npm) (malicious package) - [MAL-2026-12339](https://insights.sbomify.com/MAL-2026-12339/): Malicious code in async-mutex-hook (npm) (malicious package) - [MAL-2026-12338](https://insights.sbomify.com/MAL-2026-12338/): Malicious code in alpha-helper (npm) (malicious package) - [MAL-2026-12337](https://insights.sbomify.com/MAL-2026-12337/): Malicious code in akamaijs-sensor (npm) (malicious package) - [MAL-2026-12336](https://insights.sbomify.com/MAL-2026-12336/): Malicious code in afisha-storybook-default (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/165/