# Vulnerabilities published in 2026 - [MAL-2026-12335](https://insights.sbomify.com/MAL-2026-12335/): Malicious code in aegis-runtime (npm) (malicious package) - [MAL-2026-12334](https://insights.sbomify.com/MAL-2026-12334/): Malicious code in ach-detail (npm) (malicious package) - [MAL-2026-12333](https://insights.sbomify.com/MAL-2026-12333/): Malicious code in @zahlen/checkout-react (npm) (malicious package) - [MAL-2026-12332](https://insights.sbomify.com/MAL-2026-12332/): Malicious code in @zahlen/checkout-angular (npm) (malicious package) - [MAL-2026-12331](https://insights.sbomify.com/MAL-2026-12331/): Malicious code in @wololasod/tiny-id (npm) (malicious package) - [MAL-2026-12330](https://insights.sbomify.com/MAL-2026-12330/): Malicious code in @vboxdev/common (npm) (malicious package) - [MAL-2026-1233](https://insights.sbomify.com/MAL-2026-1233/): Malicious code in projectrtert (npm) (malicious package) - [MAL-2026-12329](https://insights.sbomify.com/MAL-2026-12329/): Malicious code in @shiftmarkets/shift-sdk-v4 (npm) (malicious package) - [MAL-2026-12328](https://insights.sbomify.com/MAL-2026-12328/): Malicious code in @rentwise/common (npm) (malicious package) - [MAL-2026-12327](https://insights.sbomify.com/MAL-2026-12327/): Malicious code in @offa-uwk/offa-uwk (npm) (malicious package) - [MAL-2026-12326](https://insights.sbomify.com/MAL-2026-12326/): Malicious code in @offa/offa-uwk (npm) (malicious package) - [MAL-2026-12325](https://insights.sbomify.com/MAL-2026-12325/): Malicious code in @nextco/utils (npm) (malicious package) - [MAL-2026-12324](https://insights.sbomify.com/MAL-2026-12324/): Malicious code in @nasdtickets/common (npm) (malicious package) - [MAL-2026-12323](https://insights.sbomify.com/MAL-2026-12323/): Malicious code in @nasddatax/common (npm) (malicious package) - [MAL-2026-12322](https://insights.sbomify.com/MAL-2026-12322/): Malicious code in @mgor/fw-canary-3333 (npm) (malicious package) - [MAL-2026-12321](https://insights.sbomify.com/MAL-2026-12321/): Malicious code in @mgor/fw-canary-20260725-394b024b (npm) (malicious package) - [MAL-2026-12320](https://insights.sbomify.com/MAL-2026-12320/): Malicious code in @lizhao1/memorax-code-internal (npm) (malicious package) - [MAL-2026-1232](https://insights.sbomify.com/MAL-2026-1232/): Malicious code in @schedaero/yukon (npm) (malicious package) - [MAL-2026-12319](https://insights.sbomify.com/MAL-2026-12319/): Malicious code in @kite-js-tools/core (npm) (malicious package) - [MAL-2026-12318](https://insights.sbomify.com/MAL-2026-12318/): Malicious code in @hoteldev/common (npm) (malicious package) - [MAL-2026-12317](https://insights.sbomify.com/MAL-2026-12317/): Malicious code in @cryptosrvc/shift-sdk-v4 (npm) (malicious package) - [MAL-2026-12316](https://insights.sbomify.com/MAL-2026-12316/): Malicious code in @cryptosrvc/shift-exchange-root (npm) (malicious package) - [MAL-2026-12315](https://insights.sbomify.com/MAL-2026-12315/): Malicious code in @cryptosrvc/no-brainer-sdk (npm) (malicious package) - [MAL-2026-12314](https://insights.sbomify.com/MAL-2026-12314/): Malicious code in @copilot-mcp/apex (npm) (malicious package) - [MAL-2026-12313](https://insights.sbomify.com/MAL-2026-12313/): Malicious code in @ccfly/setup-darwin-x64 (npm) (malicious package) - [MAL-2026-12312](https://insights.sbomify.com/MAL-2026-12312/): Malicious code in @agenthub-ai/agent (npm) (malicious package) - [MAL-2026-12311](https://insights.sbomify.com/MAL-2026-12311/): Malicious code in streak-calc-metrics (npm) (malicious package) - [MAL-2026-12310](https://insights.sbomify.com/MAL-2026-12310/): Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm) (malicious package) - [MAL-2026-1231](https://insights.sbomify.com/MAL-2026-1231/): Malicious code in @schedaero/shared (npm) (malicious package) - [MAL-2026-12309](https://insights.sbomify.com/MAL-2026-12309/): Malicious code in statist-browser-typed-client-jumptaxi.feature.contacts (npm) (malicious package) - [MAL-2026-12308](https://insights.sbomify.com/MAL-2026-12308/): Malicious code in vvvedernikov-test-another-test (npm) (malicious package) - [MAL-2026-12307](https://insights.sbomify.com/MAL-2026-12307/): Malicious code in twork-products-taiga2-products-timeline (npm) (malicious package) - [MAL-2026-12306](https://insights.sbomify.com/MAL-2026-12306/): Malicious code in twork-products-taiga2-products-mobile (npm) (malicious package) - [MAL-2026-12305](https://insights.sbomify.com/MAL-2026-12305/): Malicious code in twork-products-taiga2-products-investment (npm) (malicious package) - [MAL-2026-12304](https://insights.sbomify.com/MAL-2026-12304/): Malicious code in twork-mf-sandbox (npm) (malicious package) - [MAL-2026-12303](https://insights.sbomify.com/MAL-2026-12303/): Malicious code in twork-mf-e2e-nitro (npm) (malicious package) - [MAL-2026-12302](https://insights.sbomify.com/MAL-2026-12302/): Malicious code in twork-data-services-sme-operations-authorizations (npm) (malicious package) - [MAL-2026-12301](https://insights.sbomify.com/MAL-2026-12301/): Malicious code in twork-data-services-sme-agent-company-relation (npm) (malicious package) - [MAL-2026-12300](https://insights.sbomify.com/MAL-2026-12300/): Malicious code in twork-data-services-role-app (npm) (malicious package) - [MAL-2026-1230](https://insights.sbomify.com/MAL-2026-1230/): Malicious code in @schedaero/react-core (npm) (malicious package) - [MAL-2026-123](https://insights.sbomify.com/MAL-2026-123/): Malicious code in wifzap (npm) (malicious package) - [MAL-2026-12299](https://insights.sbomify.com/MAL-2026-12299/): Malicious code in twork-data-services-proxy-prime-api-v1-account-overdraft-info (npm) (malicious package) - [MAL-2026-12298](https://insights.sbomify.com/MAL-2026-12298/): Malicious code in twork-data-services-proxy-invest-symbols-list (npm) (malicious package) - [MAL-2026-12297](https://insights.sbomify.com/MAL-2026-12297/): Malicious code in twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info (npm) (malicious package) - [MAL-2026-12296](https://insights.sbomify.com/MAL-2026-12296/): Malicious code in twork-data-services-product-design-data (npm) (malicious package) - [MAL-2026-12295](https://insights.sbomify.com/MAL-2026-12295/): Malicious code in twork-data-services-procedure-engine-api-v1-procedure-info (npm) (malicious package) - [MAL-2026-12294](https://insights.sbomify.com/MAL-2026-12294/): Malicious code in twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config (npm) (malicious package) - [MAL-2026-12293](https://insights.sbomify.com/MAL-2026-12293/): Malicious code in twork-data-services-invest-box-account (npm) (malicious package) - [MAL-2026-12292](https://insights.sbomify.com/MAL-2026-12292/): Malicious code in twork-data-services-getting-arrests (npm) (malicious package) - [MAL-2026-12291](https://insights.sbomify.com/MAL-2026-12291/): Malicious code in twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm (npm) (malicious package) - [MAL-2026-12290](https://insights.sbomify.com/MAL-2026-12290/): Malicious code in twork-data-services-customer-api-v2-customer-vip-status (npm) (malicious package) - [MAL-2026-1229](https://insights.sbomify.com/MAL-2026-1229/): Malicious code in @schedaero/net-common (npm) (malicious package) - [MAL-2026-12289](https://insights.sbomify.com/MAL-2026-12289/): Malicious code in twork-data-services-counterfree (npm) (malicious package) - [MAL-2026-12288](https://insights.sbomify.com/MAL-2026-12288/): Malicious code in twork-data-services-aggregator-sme-task-info (npm) (malicious package) - [MAL-2026-12287](https://insights.sbomify.com/MAL-2026-12287/): Malicious code in twork-data-services-aggregator-company-sme-main-timeline-loader-with-customers (npm) (malicious package) - [MAL-2026-12286](https://insights.sbomify.com/MAL-2026-12286/): Malicious code in trapp-check-logs (npm) (malicious package) - [MAL-2026-12285](https://insights.sbomify.com/MAL-2026-12285/): Malicious code in tramvai-module-feature-toggle (npm) (malicious package) - [MAL-2026-12284](https://insights.sbomify.com/MAL-2026-12284/): Malicious code in tinkoff-volna-zustate (npm) (malicious package) - [MAL-2026-12283](https://insights.sbomify.com/MAL-2026-12283/): Malicious code in tinkoff-ui-angular-addon-wysiwyg (npm) (malicious package) - [MAL-2026-12282](https://insights.sbomify.com/MAL-2026-12282/): Malicious code in tinkoff-test-app-child-app (npm) (malicious package) - [MAL-2026-12281](https://insights.sbomify.com/MAL-2026-12281/): Malicious code in tinkoff-terminal-kit-test-commons (npm) (malicious package) - [MAL-2026-12280](https://insights.sbomify.com/MAL-2026-12280/): Malicious code in tinkoff-terminal-kit-datetime (npm) (malicious package) - [MAL-2026-1228](https://insights.sbomify.com/MAL-2026-1228/): Malicious code in @schedaero/bacon (npm) (malicious package) - [MAL-2026-12279](https://insights.sbomify.com/MAL-2026-12279/): Malicious code in tinkoff-statist-web-typed-client-test.golden.retriever (npm) (malicious package) - [MAL-2026-12278](https://insights.sbomify.com/MAL-2026-12278/): Malicious code in tinkoff-statist-browser-typed-client-test.softwarecenter.metrics (npm) (malicious package) - [MAL-2026-12277](https://insights.sbomify.com/MAL-2026-12277/): Malicious code in tinkoff-statist-browser-typed-client-sme.users.origination.web (npm) (malicious package) - [MAL-2026-12276](https://insights.sbomify.com/MAL-2026-12276/): Malicious code in tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events (npm) (malicious package) - [MAL-2026-12275](https://insights.sbomify.com/MAL-2026-12275/): Malicious code in tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events (npm) (malicious package) - [MAL-2026-12274](https://insights.sbomify.com/MAL-2026-12274/): Malicious code in tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web (npm) (malicious package) - [MAL-2026-12273](https://insights.sbomify.com/MAL-2026-12273/): Malicious code in tinkoff-statist-browser-typed-client-sme.rko.authorization.common (npm) (malicious package) - [MAL-2026-12272](https://insights.sbomify.com/MAL-2026-12272/): Malicious code in tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics (npm) (malicious package) - [MAL-2026-12271](https://insights.sbomify.com/MAL-2026-12271/): Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm) (malicious package) - [MAL-2026-12270](https://insights.sbomify.com/MAL-2026-12270/): Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.dynamicteasers.common (npm) (malicious package) - [MAL-2026-1227](https://insights.sbomify.com/MAL-2026-1227/): Malicious code in gaia-marionette (npm) (malicious package) - [MAL-2026-12269](https://insights.sbomify.com/MAL-2026-12269/): Malicious code in tinkoff-statist-browser-typed-client-mb.reliability.android.events (npm) (malicious package) - [MAL-2026-12268](https://insights.sbomify.com/MAL-2026-12268/): Malicious code in tinkoff-statist-browser-typed-client-mb.product.tgeofencing (npm) (malicious package) - [MAL-2026-12267](https://insights.sbomify.com/MAL-2026-12267/): Malicious code in tinkoff-statist-browser-typed-client-mb.product.restrictions.arrestments (npm) (malicious package) - [MAL-2026-12266](https://insights.sbomify.com/MAL-2026-12266/): Malicious code in tinkoff-statist-browser-typed-client-leasing.admin.events (npm) (malicious package) - [MAL-2026-12265](https://insights.sbomify.com/MAL-2026-12265/): Malicious code in tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts (npm) (malicious package) - [MAL-2026-12264](https://insights.sbomify.com/MAL-2026-12264/): Malicious code in tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events (npm) (malicious package) - [MAL-2026-12263](https://insights.sbomify.com/MAL-2026-12263/): Malicious code in tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events (npm) (malicious package) - [MAL-2026-12262](https://insights.sbomify.com/MAL-2026-12262/): Malicious code in tinkoff-statist-browser-typed-client-investing.product.pulse (npm) (malicious package) - [MAL-2026-12261](https://insights.sbomify.com/MAL-2026-12261/): Malicious code in tinkoff-statist-browser-typed-client-investaccounting.events.templatepage.mainpage (npm) (malicious package) - [MAL-2026-12260](https://insights.sbomify.com/MAL-2026-12260/): Malicious code in tinkoff-statist-browser-typed-client-eventea.projects.smartcam (npm) (malicious package) - [MAL-2026-1226](https://insights.sbomify.com/MAL-2026-1226/): Malicious code in qwery-core (PyPI) (malicious package) - [MAL-2026-12259](https://insights.sbomify.com/MAL-2026-12259/): Malicious code in tinkoff-statist-browser-typed-client-eventea.projects.finhealthwebmicroblocks (npm) (malicious package) - [MAL-2026-12258](https://insights.sbomify.com/MAL-2026-12258/): Malicious code in tinkoff-statist-browser-typed-client-dwh.chimera.base (npm) (malicious package) - [MAL-2026-12257](https://insights.sbomify.com/MAL-2026-12257/): Malicious code in tinkoff-statist-browser-typed-client-dss.insurance.service (npm) (malicious package) - [MAL-2026-12256](https://insights.sbomify.com/MAL-2026-12256/): Malicious code in tinkoff-statist-browser-typed-client-coretech.statist.mobile.ci (npm) (malicious package) - [MAL-2026-12255](https://insights.sbomify.com/MAL-2026-12255/): Malicious code in tinkoff-statist-browser-typed-client-cardsmobile.events.promotest (npm) (malicious package) - [MAL-2026-12254](https://insights.sbomify.com/MAL-2026-12254/): Malicious code in tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica (npm) (malicious package) - [MAL-2026-12253](https://insights.sbomify.com/MAL-2026-12253/): Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm) (malicious package) - [MAL-2026-12252](https://insights.sbomify.com/MAL-2026-12252/): Malicious code in tinkoff-pwa-confac-types (npm) (malicious package) - [MAL-2026-12251](https://insights.sbomify.com/MAL-2026-12251/): Malicious code in tinkoff-pfpa-tools (npm) (malicious package) - [MAL-2026-12250](https://insights.sbomify.com/MAL-2026-12250/): Malicious code in tinkoff-pfp-integration-mobile-slider-icons (npm) (malicious package) - [MAL-2026-1225](https://insights.sbomify.com/MAL-2026-1225/): Malicious code in urllib-slim (PyPI) (malicious package) - [MAL-2026-12249](https://insights.sbomify.com/MAL-2026-12249/): Malicious code in tinkoff-pfp-block-mobile-panels (npm) (malicious package) - [MAL-2026-12248](https://insights.sbomify.com/MAL-2026-12248/): Malicious code in tinkoff-pfp-block-mobile-advert-footer (npm) (malicious package) - [MAL-2026-12247](https://insights.sbomify.com/MAL-2026-12247/): Malicious code in tinkoff-pfp-block-desktop-tabs (npm) (malicious package) - [MAL-2026-12246](https://insights.sbomify.com/MAL-2026-12246/): Malicious code in tinkoff-pfp-atom-styles-tiles (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/166/