# Vulnerabilities published in 2026


- [MAL-2026-12065](https://insights.sbomify.com/MAL-2026-12065/): Malicious code in greatcall-customers-commandapi (npm) (malicious package)
- [MAL-2026-12064](https://insights.sbomify.com/MAL-2026-12064/): Malicious code in ckcc-protocol (npm) (malicious package)
- [MAL-2026-12063](https://insights.sbomify.com/MAL-2026-12063/): Malicious code in checkout-create-pos-order-am (npm) (malicious package)
- [MAL-2026-12062](https://insights.sbomify.com/MAL-2026-12062/): Malicious code in boardwalk-js-tests (npm) (malicious package)
- [MAL-2026-12061](https://insights.sbomify.com/MAL-2026-12061/): Malicious code in bigops-eslint (npm) (malicious package)
- [MAL-2026-12060](https://insights.sbomify.com/MAL-2026-12060/): Malicious code in beaver-ui-card-large (npm) (malicious package)
- [MAL-2026-1206](https://insights.sbomify.com/MAL-2026-1206/): Malicious code in polymarket-trade-bot-api (npm) (malicious package)
- [MAL-2026-12059](https://insights.sbomify.com/MAL-2026-12059/): Malicious code in bcore-bravo-eslint-config (npm) (malicious package)
- [MAL-2026-12058](https://insights.sbomify.com/MAL-2026-12058/): Malicious code in @zzzgenesis00/spl-token-utils (npm) (malicious package)
- [MAL-2026-12057](https://insights.sbomify.com/MAL-2026-12057/): Malicious code in @zzzgenesis00/playwrite (npm) (malicious package)
- [MAL-2026-12056](https://insights.sbomify.com/MAL-2026-12056/): Malicious code in @zzzgenesis00/mnemonic-to-key (npm) (malicious package)
- [MAL-2026-12055](https://insights.sbomify.com/MAL-2026-12055/): Malicious code in @zzzgenesis00/docker-api-client (npm) (malicious package)
- [MAL-2026-12054](https://insights.sbomify.com/MAL-2026-12054/): Malicious code in uibabai (npm) (malicious package)
- [MAL-2026-12053](https://insights.sbomify.com/MAL-2026-12053/): Malicious code in tui-react-mobile-styles (npm) (malicious package)
- [MAL-2026-12052](https://insights.sbomify.com/MAL-2026-12052/): Malicious code in tramvai-tinkoff-module-legacy-popup (npm) (malicious package)
- [MAL-2026-12051](https://insights.sbomify.com/MAL-2026-12051/): Malicious code in tinkoff-ui-action (npm) (malicious package)
- [MAL-2026-12050](https://insights.sbomify.com/MAL-2026-12050/): Malicious code in tinkoff-statist-browser-typed-client-sme.reporting.reporting (npm) (malicious package)
- [MAL-2026-1205](https://insights.sbomify.com/MAL-2026-1205/): Malicious code in polymarket-provider (npm) (malicious package)
- [MAL-2026-12049](https://insights.sbomify.com/MAL-2026-12049/): Malicious code in tinkoff-component-infopanel (npm) (malicious package)
- [MAL-2026-12048](https://insights.sbomify.com/MAL-2026-12048/): Malicious code in tinkoff-boxy-desktop-features-banner (npm) (malicious package)
- [MAL-2026-12047](https://insights.sbomify.com/MAL-2026-12047/): Malicious code in streak-day-utils (npm) (malicious package)
- [MAL-2026-12046](https://insights.sbomify.com/MAL-2026-12046/): Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm) (malicious package)
- [MAL-2026-12045](https://insights.sbomify.com/MAL-2026-12045/): Malicious code in statist-browser-typed-client-hra.workplacer.events (npm) (malicious package)
- [MAL-2026-12044](https://insights.sbomify.com/MAL-2026-12044/): Malicious code in specials-mvno-client (npm) (malicious package)
- [MAL-2026-12043](https://insights.sbomify.com/MAL-2026-12043/): Malicious code in sextant-cli-linux-arm64 (npm) (malicious package)
- [MAL-2026-12042](https://insights.sbomify.com/MAL-2026-12042/): Malicious code in platform-ui-island (npm) (malicious package)
- [MAL-2026-12041](https://insights.sbomify.com/MAL-2026-12041/): Malicious code in platform-ui-codemods (npm) (malicious package)
- [MAL-2026-12040](https://insights.sbomify.com/MAL-2026-12040/): Malicious code in forge-extended (npm) (malicious package)
- [MAL-2026-1204](https://insights.sbomify.com/MAL-2026-1204/): Malicious code in polygon-bitquery-api (npm) (malicious package)
- [MAL-2026-12039](https://insights.sbomify.com/MAL-2026-12039/): Malicious code in data-format-helper (npm) (malicious package)
- [MAL-2026-12038](https://insights.sbomify.com/MAL-2026-12038/): Malicious code in bigops-customer (npm) (malicious package)
- [MAL-2026-12037](https://insights.sbomify.com/MAL-2026-12037/): Malicious code in bigops-create-manifest (npm) (malicious package)
- [MAL-2026-12036](https://insights.sbomify.com/MAL-2026-12036/): Malicious code in bigops-chat-tmsg (npm) (malicious package)
- [MAL-2026-12035](https://insights.sbomify.com/MAL-2026-12035/): Malicious code in bigops-auth-utils (npm) (malicious package)
- [MAL-2026-12034](https://insights.sbomify.com/MAL-2026-12034/): Malicious code in beaver-ui-form-modal (npm) (malicious package)
- [MAL-2026-12033](https://insights.sbomify.com/MAL-2026-12033/): Malicious code in aedes_clusters (npm) (malicious package)
- [MAL-2026-12032](https://insights.sbomify.com/MAL-2026-12032/): Malicious code in add-two-numbers-x7q9m (npm) (malicious package)
- [MAL-2026-12031](https://insights.sbomify.com/MAL-2026-12031/): Malicious code in @zzzgenesis00/ethers-wallet (npm) (malicious package)
- [MAL-2026-12030](https://insights.sbomify.com/MAL-2026-12030/): Malicious code in @zzzgenesis00/bip39-mnemonic (npm) (malicious package)
- [MAL-2026-1203](https://insights.sbomify.com/MAL-2026-1203/): Malicious code in polmarket (npm) (malicious package)
- [MAL-2026-12029](https://insights.sbomify.com/MAL-2026-12029/): Malicious code in sextant-cli-linux-amd64 (npm) (malicious package)
- [MAL-2026-12028](https://insights.sbomify.com/MAL-2026-12028/): Malicious code in sextant-cli-darwin-amd64 (npm) (malicious package)
- [MAL-2026-12027](https://insights.sbomify.com/MAL-2026-12027/): Malicious code in tailwind-anime (npm) (malicious package)
- [MAL-2026-12026](https://insights.sbomify.com/MAL-2026-12026/): Malicious code in cors-version (npm) (malicious package)
- [MAL-2026-12025](https://insights.sbomify.com/MAL-2026-12025/): Malicious code in @keyv/valkey (npm) (malicious package)
- [MAL-2026-12024](https://insights.sbomify.com/MAL-2026-12024/): Malicious code in @keyv/test-suite (npm) (malicious package)
- [MAL-2026-12023](https://insights.sbomify.com/MAL-2026-12023/): Malicious code in @keyv/sqlite (npm) (malicious package)
- [MAL-2026-12022](https://insights.sbomify.com/MAL-2026-12022/): Malicious code in @keyv/serialize-superjson (npm) (malicious package)
- [MAL-2026-12021](https://insights.sbomify.com/MAL-2026-12021/): Malicious code in @keyv/serialize-msgpackr (npm) (malicious package)
- [MAL-2026-12020](https://insights.sbomify.com/MAL-2026-12020/): Malicious code in @keyv/redis (npm) (malicious package)
- [MAL-2026-1202](https://insights.sbomify.com/MAL-2026-1202/): Malicious code in mvn-runtime (npm) (malicious package)
- [MAL-2026-12019](https://insights.sbomify.com/MAL-2026-12019/): Malicious code in @keyv/postgres (npm) (malicious package)
- [MAL-2026-12018](https://insights.sbomify.com/MAL-2026-12018/): Malicious code in @keyv/mysql (npm) (malicious package)
- [MAL-2026-12017](https://insights.sbomify.com/MAL-2026-12017/): Malicious code in @keyv/mongo (npm) (malicious package)
- [MAL-2026-12016](https://insights.sbomify.com/MAL-2026-12016/): Malicious code in @keyv/memcache (npm) (malicious package)
- [MAL-2026-12015](https://insights.sbomify.com/MAL-2026-12015/): Malicious code in @keyv/etcd (npm) (malicious package)
- [MAL-2026-12014](https://insights.sbomify.com/MAL-2026-12014/): Malicious code in @keyv/encrypt-web (npm) (malicious package)
- [MAL-2026-12013](https://insights.sbomify.com/MAL-2026-12013/): Malicious code in @keyv/encrypt-node (npm) (malicious package)
- [MAL-2026-12012](https://insights.sbomify.com/MAL-2026-12012/): Malicious code in @keyv/dynamo (npm) (malicious package)
- [MAL-2026-12011](https://insights.sbomify.com/MAL-2026-12011/): Malicious code in @keyv/compress-lz4 (npm) (malicious package)
- [MAL-2026-12010](https://insights.sbomify.com/MAL-2026-12010/): Malicious code in @keyv/compress-gzip (npm) (malicious package)
- [MAL-2026-1201](https://insights.sbomify.com/MAL-2026-1201/): Malicious code in mongos-api (npm) (malicious package)
- [MAL-2026-12009](https://insights.sbomify.com/MAL-2026-12009/): Malicious code in @keyv/compress-brotli (npm) (malicious package)
- [MAL-2026-12008](https://insights.sbomify.com/MAL-2026-12008/): Malicious code in @keyv/cloudflare-kv (npm) (malicious package)
- [MAL-2026-12007](https://insights.sbomify.com/MAL-2026-12007/): Malicious code in @keyv/bigmap (npm) (malicious package)
- [MAL-2026-12006](https://insights.sbomify.com/MAL-2026-12006/): Malicious code in @jsimplify/errno (npm) (malicious package)
- [MAL-2026-12005](https://insights.sbomify.com/MAL-2026-12005/): Malicious code in webdev-conf (npm) (malicious package)
- [MAL-2026-12004](https://insights.sbomify.com/MAL-2026-12004/): Malicious code in vitest-preview-pro (npm) (malicious package)
- [MAL-2026-12003](https://insights.sbomify.com/MAL-2026-12003/): Malicious code in streak-test-mathcore (npm) (malicious package)
- [MAL-2026-12002](https://insights.sbomify.com/MAL-2026-12002/): Malicious code in streak-metricsazb (npm) (malicious package)
- [MAL-2026-12001](https://insights.sbomify.com/MAL-2026-12001/): Malicious code in streak-metricazbd (npm) (malicious package)
- [MAL-2026-12000](https://insights.sbomify.com/MAL-2026-12000/): Malicious code in streak-math-metrics (npm) (malicious package)
- [MAL-2026-1200](https://insights.sbomify.com/MAL-2026-1200/): Malicious code in mongoose-apis (npm) (malicious package)
- [MAL-2026-120](https://insights.sbomify.com/MAL-2026-120/): Malicious code in qyxb (npm) (malicious package)
- [MAL-2026-12](https://insights.sbomify.com/MAL-2026-12/): Malicious code in datatables-editor (npm) (malicious package)
- [MAL-2026-11999](https://insights.sbomify.com/MAL-2026-11999/): Malicious code in streak-map-metrics (npm) (malicious package)
- [MAL-2026-11998](https://insights.sbomify.com/MAL-2026-11998/): Malicious code in simple-date-formatter-util-7 (npm) (malicious package)
- [MAL-2026-11997](https://insights.sbomify.com/MAL-2026-11997/): Malicious code in sextant-cli-darwin-arm64 (npm) (malicious package)
- [MAL-2026-11996](https://insights.sbomify.com/MAL-2026-11996/): Malicious code in emulative (npm) (malicious package)
- [MAL-2026-11995](https://insights.sbomify.com/MAL-2026-11995/): Malicious code in approval-guardian (npm) (malicious package)
- [MAL-2026-11994](https://insights.sbomify.com/MAL-2026-11994/): Malicious code in @zzzgenesis00/web3-provider-engine (npm) (malicious package)
- [MAL-2026-11993](https://insights.sbomify.com/MAL-2026-11993/): Malicious code in @tuluax/errb (npm) (malicious package)
- [MAL-2026-11992](https://insights.sbomify.com/MAL-2026-11992/): Malicious code in workbench-browser-server (npm) (malicious package)
- [MAL-2026-11991](https://insights.sbomify.com/MAL-2026-11991/): Malicious code in verdaccio-tarball-local-storage (npm) (malicious package)
- [MAL-2026-11990](https://insights.sbomify.com/MAL-2026-11990/): Malicious code in verdaccio-okta-oauth (npm) (malicious package)
- [MAL-2026-1199](https://insights.sbomify.com/MAL-2026-1199/): Malicious code in fps-logger (npm) (malicious package)
- [MAL-2026-11989](https://insights.sbomify.com/MAL-2026-11989/): Malicious code in umadev (npm) (malicious package)
- [MAL-2026-11988](https://insights.sbomify.com/MAL-2026-11988/): Malicious code in tslint-folder-schema (npm) (malicious package)
- [MAL-2026-11987](https://insights.sbomify.com/MAL-2026-11987/): Malicious code in sn-listbox (npm) (malicious package)
- [MAL-2026-11986](https://insights.sbomify.com/MAL-2026-11986/): Malicious code in server-hemera-mongo (npm) (malicious package)
- [MAL-2026-11985](https://insights.sbomify.com/MAL-2026-11985/): Malicious code in rwc-client (npm) (malicious package)
- [MAL-2026-11984](https://insights.sbomify.com/MAL-2026-11984/): Malicious code in qlik-object-conversion (npm) (malicious package)
- [MAL-2026-11983](https://insights.sbomify.com/MAL-2026-11983/): Malicious code in qlik-modifiers (npm) (malicious package)
- [MAL-2026-11982](https://insights.sbomify.com/MAL-2026-11982/): Malicious code in qlik-chart-modules (npm) (malicious package)
- [MAL-2026-11981](https://insights.sbomify.com/MAL-2026-11981/): Malicious code in pob-test-typescript-package-in-monorepo (npm) (malicious package)
- [MAL-2026-11980](https://insights.sbomify.com/MAL-2026-11980/): Malicious code in pob-test-package-in-monorepo (npm) (malicious package)
- [MAL-2026-1198](https://insights.sbomify.com/MAL-2026-1198/): Malicious code in flycord (npm) (malicious package)
- [MAL-2026-11979](https://insights.sbomify.com/MAL-2026-11979/): Malicious code in picasso.js (npm) (malicious package)
- [MAL-2026-11978](https://insights.sbomify.com/MAL-2026-11978/): Malicious code in picasso-plugin-q (npm) (malicious package)
- [MAL-2026-11977](https://insights.sbomify.com/MAL-2026-11977/): Malicious code in picasso-plugin-hammer (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/169/