# Vulnerabilities published in 2026 - [MAL-2026-12245](https://insights.sbomify.com/MAL-2026-12245/): Malicious code in tinkoff-pfp-atom-desktop-carousel (npm) (malicious package) - [MAL-2026-12244](https://insights.sbomify.com/MAL-2026-12244/): Malicious code in tinkoff-mutual-mgm-form (npm) (malicious package) - [MAL-2026-12243](https://insights.sbomify.com/MAL-2026-12243/): Malicious code in tinkoff-fb-service-prefill-profile-contact (npm) (malicious package) - [MAL-2026-12242](https://insights.sbomify.com/MAL-2026-12242/): Malicious code in tinkoff-fb-rf-add-application (npm) (malicious package) - [MAL-2026-12241](https://insights.sbomify.com/MAL-2026-12241/): Malicious code in tinkoff-fb-fieldset-car-reference-kasko (npm) (malicious package) - [MAL-2026-12240](https://insights.sbomify.com/MAL-2026-12240/): Malicious code in tinkoff-fb-app-frame-page-height-dippy (npm) (malicious package) - [MAL-2026-1224](https://insights.sbomify.com/MAL-2026-1224/): Malicious code in spark-ml-utilities (PyPI) (malicious package) - [MAL-2026-12239](https://insights.sbomify.com/MAL-2026-12239/): Malicious code in tinkoff-component-page-loader (npm) (malicious package) - [MAL-2026-12238](https://insights.sbomify.com/MAL-2026-12238/): Malicious code in tinkoff-component-limits (npm) (malicious package) - [MAL-2026-12237](https://insights.sbomify.com/MAL-2026-12237/): Malicious code in tinkoff-codeceptjs-storyshots-alpha (npm) (malicious package) - [MAL-2026-12236](https://insights.sbomify.com/MAL-2026-12236/): Malicious code in tinkoff-codeceptjs-storyshots (npm) (malicious package) - [MAL-2026-12235](https://insights.sbomify.com/MAL-2026-12235/): Malicious code in tinkoff-boxy-mobile-separator (npm) (malicious package) - [MAL-2026-12234](https://insights.sbomify.com/MAL-2026-12234/): Malicious code in tinkoff-boxy-mobile-documents (npm) (malicious package) - [MAL-2026-12233](https://insights.sbomify.com/MAL-2026-12233/): Malicious code in tinkoff-boxy-independent-kasko-form (npm) (malicious package) - [MAL-2026-12232](https://insights.sbomify.com/MAL-2026-12232/): Malicious code in tinkoff-boxy-gitlab-labels (npm) (malicious package) - [MAL-2026-12231](https://insights.sbomify.com/MAL-2026-12231/): Malicious code in tinkoff-boxy-form-desktop-sme-registration-ooo (npm) (malicious package) - [MAL-2026-12230](https://insights.sbomify.com/MAL-2026-12230/): Malicious code in tinkoff-boxy-desktop-two-panel-right-image (npm) (malicious package) - [MAL-2026-1223](https://insights.sbomify.com/MAL-2026-1223/): Malicious code in risk-utilities (PyPI) (malicious package) - [MAL-2026-12229](https://insights.sbomify.com/MAL-2026-12229/): Malicious code in tinkoff-boxy-desktop-mgm-product-filter (npm) (malicious package) - [MAL-2026-12228](https://insights.sbomify.com/MAL-2026-12228/): Malicious code in tinkoff-boxy-desktop-icons-horizontal (npm) (malicious package) - [MAL-2026-12227](https://insights.sbomify.com/MAL-2026-12227/): Malicious code in tinkoff-boxy-atom-text-link (npm) (malicious package) - [MAL-2026-12226](https://insights.sbomify.com/MAL-2026-12226/): Malicious code in time-webkit-tag (npm) (malicious package) - [MAL-2026-12225](https://insights.sbomify.com/MAL-2026-12225/): Malicious code in time-utils-helper (npm) (malicious package) - [MAL-2026-12224](https://insights.sbomify.com/MAL-2026-12224/): Malicious code in tailwindcss-scrollbar-hide (npm) (malicious package) - [MAL-2026-12223](https://insights.sbomify.com/MAL-2026-12223/): Malicious code in tailwindcss-form-components (npm) (malicious package) - [MAL-2026-12222](https://insights.sbomify.com/MAL-2026-12222/): Malicious code in tailwind-opentype (npm) (malicious package) - [MAL-2026-12221](https://insights.sbomify.com/MAL-2026-12221/): Malicious code in tailwind-custom-forms (npm) (malicious package) - [MAL-2026-12220](https://insights.sbomify.com/MAL-2026-12220/): Malicious code in tailwind-animationpack (npm) (malicious package) - [MAL-2026-1222](https://insights.sbomify.com/MAL-2026-1222/): Malicious code in optimal-spark-config (PyPI) (malicious package) - [MAL-2026-12219](https://insights.sbomify.com/MAL-2026-12219/): Malicious code in tailwind-animationgroup (npm) (malicious package) - [MAL-2026-12218](https://insights.sbomify.com/MAL-2026-12218/): Malicious code in tailwind-animation-founder (npm) (malicious package) - [MAL-2026-12217](https://insights.sbomify.com/MAL-2026-12217/): Malicious code in tailwind-animate-plugin (npm) (malicious package) - [MAL-2026-12216](https://insights.sbomify.com/MAL-2026-12216/): Malicious code in stellarfix (npm) (malicious package) - [MAL-2026-12215](https://insights.sbomify.com/MAL-2026-12215/): Malicious code in statist-browser-typed-client-sme.salary.web.metrics (npm) (malicious package) - [MAL-2026-12214](https://insights.sbomify.com/MAL-2026-12214/): Malicious code in statist-browser-typed-client-sme.platform.web.productsnavigation.events (npm) (malicious package) - [MAL-2026-12213](https://insights.sbomify.com/MAL-2026-12213/): Malicious code in statist-browser-typed-client-mb.product.sme.cards (npm) (malicious package) - [MAL-2026-12212](https://insights.sbomify.com/MAL-2026-12212/): Malicious code in statist-browser-typed-client-mb.product.payments (npm) (malicious package) - [MAL-2026-12211](https://insights.sbomify.com/MAL-2026-12211/): Malicious code in statist-browser-typed-client-mb.product.analytics (npm) (malicious package) - [MAL-2026-12210](https://insights.sbomify.com/MAL-2026-12210/): Malicious code in statist-browser-typed-client-investing.product.loginandauthorization (npm) (malicious package) - [MAL-2026-1221](https://insights.sbomify.com/MAL-2026-1221/): Malicious code in xrpl-dev-portal (npm) (malicious package) - [MAL-2026-12209](https://insights.sbomify.com/MAL-2026-12209/): Malicious code in statist-browser-typed-client-ddp.mentat.ui.web (npm) (malicious package) - [MAL-2026-12208](https://insights.sbomify.com/MAL-2026-12208/): Malicious code in sme-scripts-cli (npm) (malicious package) - [MAL-2026-12207](https://insights.sbomify.com/MAL-2026-12207/): Malicious code in sme-auth-core (npm) (malicious package) - [MAL-2026-12206](https://insights.sbomify.com/MAL-2026-12206/): Malicious code in simple-date-formatter-util-8 (npm) (malicious package) - [MAL-2026-12205](https://insights.sbomify.com/MAL-2026-12205/): Malicious code in simple-date-formatter-util-4 (npm) (malicious package) - [MAL-2026-12204](https://insights.sbomify.com/MAL-2026-12204/): Malicious code in simple-date-formatter-util-16 (npm) (malicious package) - [MAL-2026-12203](https://insights.sbomify.com/MAL-2026-12203/): Malicious code in simple-date-formatter-util-14 (npm) (malicious package) - [MAL-2026-12202](https://insights.sbomify.com/MAL-2026-12202/): Malicious code in simple-date-formatter-util-13 (npm) (malicious package) - [MAL-2026-12201](https://insights.sbomify.com/MAL-2026-12201/): Malicious code in simple-date-formatter-util-12 (npm) (malicious package) - [MAL-2026-12200](https://insights.sbomify.com/MAL-2026-12200/): Malicious code in simple-date-formatter-util-11 (npm) (malicious package) - [MAL-2026-1220](https://insights.sbomify.com/MAL-2026-1220/): Malicious code in corp-build-utils-poc (npm) (malicious package) - [MAL-2026-122](https://insights.sbomify.com/MAL-2026-122/): Malicious code in vjri (npm) (malicious package) - [MAL-2026-12199](https://insights.sbomify.com/MAL-2026-12199/): Malicious code in simple-date-formatter-new-8 (npm) (malicious package) - [MAL-2026-12198](https://insights.sbomify.com/MAL-2026-12198/): Malicious code in simple-date-formatter-new-7 (npm) (malicious package) - [MAL-2026-12197](https://insights.sbomify.com/MAL-2026-12197/): Malicious code in simple-date-formatter-new-6 (npm) (malicious package) - [MAL-2026-12196](https://insights.sbomify.com/MAL-2026-12196/): Malicious code in simple-date-formatter-new-4 (npm) (malicious package) - [MAL-2026-12195](https://insights.sbomify.com/MAL-2026-12195/): Malicious code in simple-date-formatter-new-3 (npm) (malicious package) - [MAL-2026-12194](https://insights.sbomify.com/MAL-2026-12194/): Malicious code in simple-date-formatter-new-2 (npm) (malicious package) - [MAL-2026-12193](https://insights.sbomify.com/MAL-2026-12193/): Malicious code in sextant-relay-darwin-arm64 (npm) (malicious package) - [MAL-2026-12192](https://insights.sbomify.com/MAL-2026-12192/): Malicious code in scrollbar-hide-plugin (npm) (malicious package) - [MAL-2026-12191](https://insights.sbomify.com/MAL-2026-12191/): Malicious code in scandoc-scandoc-core (npm) (malicious package) - [MAL-2026-12190](https://insights.sbomify.com/MAL-2026-12190/): Malicious code in retracfix (npm) (malicious package) - [MAL-2026-1219](https://insights.sbomify.com/MAL-2026-1219/): Malicious code in demo-pipelinetest (npm) (malicious package) - [MAL-2026-12189](https://insights.sbomify.com/MAL-2026-12189/): Malicious code in react-scroll-disable (npm) (malicious package) - [MAL-2026-12188](https://insights.sbomify.com/MAL-2026-12188/): Malicious code in pfp-integration-mobile-heading (npm) (malicious package) - [MAL-2026-12187](https://insights.sbomify.com/MAL-2026-12187/): Malicious code in pfp-forms-sme-registration-ooo (npm) (malicious package) - [MAL-2026-12186](https://insights.sbomify.com/MAL-2026-12186/): Malicious code in pfp-forms-insurance-health (npm) (malicious package) - [MAL-2026-12185](https://insights.sbomify.com/MAL-2026-12185/): Malicious code in pfa-autotests-reporter (npm) (malicious package) - [MAL-2026-12184](https://insights.sbomify.com/MAL-2026-12184/): Malicious code in peter-desktop-peter-big-column (npm) (malicious package) - [MAL-2026-12183](https://insights.sbomify.com/MAL-2026-12183/): Malicious code in nolimit-agent (npm) (malicious package) - [MAL-2026-12182](https://insights.sbomify.com/MAL-2026-12182/): Malicious code in json-validator-utils (npm) (malicious package) - [MAL-2026-12181](https://insights.sbomify.com/MAL-2026-12181/): Malicious code in hubert-react-query (npm) (malicious package) - [MAL-2026-12180](https://insights.sbomify.com/MAL-2026-12180/): Malicious code in geocode-quick (npm) (malicious package) - [MAL-2026-1218](https://insights.sbomify.com/MAL-2026-1218/): Malicious code in chai-as-confirmed (npm) (malicious package) - [MAL-2026-12179](https://insights.sbomify.com/MAL-2026-12179/): Malicious code in fb-insurance--boxified-form-vzr-test (npm) (malicious package) - [MAL-2026-12178](https://insights.sbomify.com/MAL-2026-12178/): Malicious code in fb-cards-form-no-resident-information (npm) (malicious package) - [MAL-2026-12177](https://insights.sbomify.com/MAL-2026-12177/): Malicious code in devpack-conf (npm) (malicious package) - [MAL-2026-12176](https://insights.sbomify.com/MAL-2026-12176/): Malicious code in dateuuidv2 (npm) (malicious package) - [MAL-2026-12175](https://insights.sbomify.com/MAL-2026-12175/): Malicious code in datefmt-pro (npm) (malicious package) - [MAL-2026-12174](https://insights.sbomify.com/MAL-2026-12174/): Malicious code in cors-update (npm) (malicious package) - [MAL-2026-12173](https://insights.sbomify.com/MAL-2026-12173/): Malicious code in bnpl-blocks-desktop-bnpl-documents (npm) (malicious package) - [MAL-2026-12172](https://insights.sbomify.com/MAL-2026-12172/): Malicious code in bigops-voximplant (npm) (malicious package) - [MAL-2026-12171](https://insights.sbomify.com/MAL-2026-12171/): Malicious code in bigops-informer (npm) (malicious package) - [MAL-2026-12170](https://insights.sbomify.com/MAL-2026-12170/): Malicious code in bigops-info-notices (npm) (malicious package) - [MAL-2026-1217](https://insights.sbomify.com/MAL-2026-1217/): Malicious code in @vk-cloud-billing/common (npm) (malicious package) - [MAL-2026-12169](https://insights.sbomify.com/MAL-2026-12169/): Malicious code in bigops-header-tabs (npm) (malicious package) - [MAL-2026-12168](https://insights.sbomify.com/MAL-2026-12168/): Malicious code in bigops-frontend-bigops-frontend-core (npm) (malicious package) - [MAL-2026-12167](https://insights.sbomify.com/MAL-2026-12167/): Malicious code in bigops-file-storage (npm) (malicious package) - [MAL-2026-12166](https://insights.sbomify.com/MAL-2026-12166/): Malicious code in bigops-figma-to-html (npm) (malicious package) - [MAL-2026-12165](https://insights.sbomify.com/MAL-2026-12165/): Malicious code in bigops-external-auth (npm) (malicious package) - [MAL-2026-12164](https://insights.sbomify.com/MAL-2026-12164/): Malicious code in bigops-eslint-config (npm) (malicious package) - [MAL-2026-12163](https://insights.sbomify.com/MAL-2026-12163/): Malicious code in bigops-data-storage (npm) (malicious package) - [MAL-2026-12162](https://insights.sbomify.com/MAL-2026-12162/): Malicious code in bigops-customer-processing-client (npm) (malicious package) - [MAL-2026-12161](https://insights.sbomify.com/MAL-2026-12161/): Malicious code in bigops-communication-client (npm) (malicious package) - [MAL-2026-12160](https://insights.sbomify.com/MAL-2026-12160/): Malicious code in bigops-cobrowsing-client (npm) (malicious package) - [MAL-2026-1216](https://insights.sbomify.com/MAL-2026-1216/): Malicious code in pdfjs-dist-v5 (npm) (malicious package) - [MAL-2026-12159](https://insights.sbomify.com/MAL-2026-12159/): Malicious code in bigops-cobrowsing (npm) (malicious package) - [MAL-2026-12158](https://insights.sbomify.com/MAL-2026-12158/): Malicious code in bigops-chats-client (npm) (malicious package) - [MAL-2026-12157](https://insights.sbomify.com/MAL-2026-12157/): Malicious code in bigops-chats (npm) (malicious package) - [MAL-2026-12156](https://insights.sbomify.com/MAL-2026-12156/): Malicious code in bigops-chat-transfer (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/167/