# Vulnerabilities published in 2026 - [MAL-2026-11976](https://insights.sbomify.com/MAL-2026-11976/): Malicious code in native-frontend-orb (npm) (malicious package) - [MAL-2026-11975](https://insights.sbomify.com/MAL-2026-11975/): Malicious code in http-metrics-middleware (npm) (malicious package) - [MAL-2026-11974](https://insights.sbomify.com/MAL-2026-11974/): Malicious code in hamus.js (npm) (malicious package) - [MAL-2026-11973](https://insights.sbomify.com/MAL-2026-11973/): Malicious code in frontend-orb (npm) (malicious package) - [MAL-2026-11972](https://insights.sbomify.com/MAL-2026-11972/): Malicious code in folder-lint (npm) (malicious package) - [MAL-2026-11971](https://insights.sbomify.com/MAL-2026-11971/): Malicious code in flat-cache (npm) (malicious package) - [MAL-2026-11970](https://insights.sbomify.com/MAL-2026-11970/): Malicious code in file-entry-cache (npm) (malicious package) - [MAL-2026-1197](https://insights.sbomify.com/MAL-2026-1197/): Malicious code in demo-ip-package-cm (npm) (malicious package) - [MAL-2026-11969](https://insights.sbomify.com/MAL-2026-11969/): Malicious code in example-js-project (npm) (malicious package) - [MAL-2026-11968](https://insights.sbomify.com/MAL-2026-11968/): Malicious code in eslint-plugin-folder-schema (npm) (malicious package) - [MAL-2026-11967](https://insights.sbomify.com/MAL-2026-11967/): Malicious code in editable-contracts (npm) (malicious package) - [MAL-2026-11966](https://insights.sbomify.com/MAL-2026-11966/): Malicious code in ecto (npm) (malicious package) - [MAL-2026-11965](https://insights.sbomify.com/MAL-2026-11965/): Malicious code in conv-context-next (npm) (malicious package) - [MAL-2026-11964](https://insights.sbomify.com/MAL-2026-11964/): Malicious code in cacheable-request (npm) (malicious package) - [MAL-2026-11963](https://insights.sbomify.com/MAL-2026-11963/): Malicious code in cacheable (npm) (malicious package) - [MAL-2026-11962](https://insights.sbomify.com/MAL-2026-11962/): Malicious code in babel-plugin-linaria-css-to-undefined (npm) (malicious package) - [MAL-2026-11961](https://insights.sbomify.com/MAL-2026-11961/): Malicious code in @workbench-stack/core (npm) (malicious package) - [MAL-2026-11960](https://insights.sbomify.com/MAL-2026-11960/): Malicious code in @umacloud/knowledge (npm) (malicious package) - [MAL-2026-1196](https://insights.sbomify.com/MAL-2026-1196/): Malicious code in demo-ip-package (npm) (malicious package) - [MAL-2026-11959](https://insights.sbomify.com/MAL-2026-11959/): Malicious code in @umacloud/cli-win32-x64 (npm) (malicious package) - [MAL-2026-11958](https://insights.sbomify.com/MAL-2026-11958/): Malicious code in @umacloud/cli-linux-x64 (npm) (malicious package) - [MAL-2026-11957](https://insights.sbomify.com/MAL-2026-11957/): Malicious code in @umacloud/cli-linux-musl-x64 (npm) (malicious package) - [MAL-2026-11956](https://insights.sbomify.com/MAL-2026-11956/): Malicious code in @umacloud/cli-linux-musl-arm64 (npm) (malicious package) - [MAL-2026-11955](https://insights.sbomify.com/MAL-2026-11955/): Malicious code in @umacloud/cli-linux-arm64 (npm) (malicious package) - [MAL-2026-11954](https://insights.sbomify.com/MAL-2026-11954/): Malicious code in @umacloud/cli-darwin-x64 (npm) (malicious package) - [MAL-2026-11953](https://insights.sbomify.com/MAL-2026-11953/): Malicious code in @umacloud/cli-darwin-arm64 (npm) (malicious package) - [MAL-2026-11952](https://insights.sbomify.com/MAL-2026-11952/): Malicious code in @thiennq/docs-viewer (npm) (malicious package) - [MAL-2026-11951](https://insights.sbomify.com/MAL-2026-11951/): Malicious code in @servicetitan/widget-platform-monolith (npm) (malicious package) - [MAL-2026-11950](https://insights.sbomify.com/MAL-2026-11950/): Malicious code in @servicetitan/widget-platform (npm) (malicious package) - [MAL-2026-1195](https://insights.sbomify.com/MAL-2026-1195/): Malicious code in consolelofy (npm) (malicious package) - [MAL-2026-11949](https://insights.sbomify.com/MAL-2026-11949/): Malicious code in @servicetitan/web-components (npm) (malicious package) - [MAL-2026-11948](https://insights.sbomify.com/MAL-2026-11948/): Malicious code in @servicetitan/va-mfe-loader (npm) (malicious package) - [MAL-2026-11947](https://insights.sbomify.com/MAL-2026-11947/): Malicious code in @servicetitan/unit-tests (npm) (malicious package) - [MAL-2026-11946](https://insights.sbomify.com/MAL-2026-11946/): Malicious code in @servicetitan/uikit-docs (npm) (malicious package) - [MAL-2026-11945](https://insights.sbomify.com/MAL-2026-11945/): Malicious code in @servicetitan/toolbelt-shared-registry (npm) (malicious package) - [MAL-2026-11944](https://insights.sbomify.com/MAL-2026-11944/): Malicious code in @servicetitan/tokens (npm) (malicious package) - [MAL-2026-11943](https://insights.sbomify.com/MAL-2026-11943/): Malicious code in @servicetitan/titan-chatbot-ui-cypress (npm) (malicious package) - [MAL-2026-11942](https://insights.sbomify.com/MAL-2026-11942/): Malicious code in @servicetitan/titan-chatbot-ui-anvil2 (npm) (malicious package) - [MAL-2026-11941](https://insights.sbomify.com/MAL-2026-11941/): Malicious code in @servicetitan/titan-chatbot-ui (npm) (malicious package) - [MAL-2026-11940](https://insights.sbomify.com/MAL-2026-11940/): Malicious code in @servicetitan/titan-chatbot-client (npm) (malicious package) - [MAL-2026-1194](https://insights.sbomify.com/MAL-2026-1194/): Malicious code in cmc-client (npm) (malicious package) - [MAL-2026-11939](https://insights.sbomify.com/MAL-2026-11939/): Malicious code in @servicetitan/titan-chatbot-api (npm) (malicious package) - [MAL-2026-11938](https://insights.sbomify.com/MAL-2026-11938/): Malicious code in @servicetitan/titan-chat-ui-cypress (npm) (malicious package) - [MAL-2026-11937](https://insights.sbomify.com/MAL-2026-11937/): Malicious code in @servicetitan/titan-chat-ui-common (npm) (malicious package) - [MAL-2026-11936](https://insights.sbomify.com/MAL-2026-11936/): Malicious code in @servicetitan/titan-chat-ui-anvil2 (npm) (malicious package) - [MAL-2026-11935](https://insights.sbomify.com/MAL-2026-11935/): Malicious code in @servicetitan/titan-chat-ui (npm) (malicious package) - [MAL-2026-11934](https://insights.sbomify.com/MAL-2026-11934/): Malicious code in @servicetitan/time-zones (npm) (malicious package) - [MAL-2026-11933](https://insights.sbomify.com/MAL-2026-11933/): Malicious code in @servicetitan/thoughtspot-theme (npm) (malicious package) - [MAL-2026-11932](https://insights.sbomify.com/MAL-2026-11932/): Malicious code in @servicetitan/testing-library (npm) (malicious package) - [MAL-2026-11931](https://insights.sbomify.com/MAL-2026-11931/): Malicious code in @servicetitan/temporal-lite (npm) (malicious package) - [MAL-2026-11930](https://insights.sbomify.com/MAL-2026-11930/): Malicious code in @servicetitan/tanstack-query-mobx (npm) (malicious package) - [MAL-2026-1193](https://insights.sbomify.com/MAL-2026-1193/): Malicious code in cloud-apis (npm) (malicious package) - [MAL-2026-11929](https://insights.sbomify.com/MAL-2026-11929/): Malicious code in @servicetitan/table (npm) (malicious package) - [MAL-2026-11928](https://insights.sbomify.com/MAL-2026-11928/): Malicious code in @servicetitan/suppress-warnings (npm) (malicious package) - [MAL-2026-11927](https://insights.sbomify.com/MAL-2026-11927/): Malicious code in @servicetitan/stylelint-config (npm) (malicious package) - [MAL-2026-11926](https://insights.sbomify.com/MAL-2026-11926/): Malicious code in @servicetitan/startup-utils (npm) (malicious package) - [MAL-2026-11925](https://insights.sbomify.com/MAL-2026-11925/): Malicious code in @servicetitan/startup-mfe-compat (npm) (malicious package) - [MAL-2026-11924](https://insights.sbomify.com/MAL-2026-11924/): Malicious code in @servicetitan/startup-jest (npm) (malicious package) - [MAL-2026-11923](https://insights.sbomify.com/MAL-2026-11923/): Malicious code in @servicetitan/startup (npm) (malicious package) - [MAL-2026-11922](https://insights.sbomify.com/MAL-2026-11922/): Malicious code in @servicetitan/standalone-ui (npm) (malicious package) - [MAL-2026-11921](https://insights.sbomify.com/MAL-2026-11921/): Malicious code in @servicetitan/standalone-tm-api (npm) (malicious package) - [MAL-2026-11920](https://insights.sbomify.com/MAL-2026-11920/): Malicious code in @servicetitan/standalone-root (npm) (malicious package) - [MAL-2026-1192](https://insights.sbomify.com/MAL-2026-1192/): Malicious code in chai-as-proofed (npm) (malicious package) - [MAL-2026-11919](https://insights.sbomify.com/MAL-2026-11919/): Malicious code in @servicetitan/standalone-feature-flags (npm) (malicious package) - [MAL-2026-11918](https://insights.sbomify.com/MAL-2026-11918/): Malicious code in @servicetitan/standalone-core-feature-gates (npm) (malicious package) - [MAL-2026-11917](https://insights.sbomify.com/MAL-2026-11917/): Malicious code in @servicetitan/skeleton (npm) (malicious package) - [MAL-2026-11916](https://insights.sbomify.com/MAL-2026-11916/): Malicious code in @servicetitan/schema-comparison (npm) (malicious package) - [MAL-2026-11915](https://insights.sbomify.com/MAL-2026-11915/): Malicious code in @servicetitan/restrict-imports (npm) (malicious package) - [MAL-2026-11914](https://insights.sbomify.com/MAL-2026-11914/): Malicious code in @servicetitan/responsive (npm) (malicious package) - [MAL-2026-11913](https://insights.sbomify.com/MAL-2026-11913/): Malicious code in @servicetitan/react-ioc (npm) (malicious package) - [MAL-2026-11912](https://insights.sbomify.com/MAL-2026-11912/): Malicious code in @servicetitan/react-hooks (npm) (malicious package) - [MAL-2026-11911](https://insights.sbomify.com/MAL-2026-11911/): Malicious code in @servicetitan/quick-actions (npm) (malicious package) - [MAL-2026-11910](https://insights.sbomify.com/MAL-2026-11910/): Malicious code in @servicetitan/onboarding-ui (npm) (malicious package) - [MAL-2026-1191](https://insights.sbomify.com/MAL-2026-1191/): Malicious code in chai-as-mock (npm) (malicious package) - [MAL-2026-11909](https://insights.sbomify.com/MAL-2026-11909/): Malicious code in @servicetitan/notifications (npm) (malicious package) - [MAL-2026-11908](https://insights.sbomify.com/MAL-2026-11908/): Malicious code in @servicetitan/navigation (npm) (malicious package) - [MAL-2026-11907](https://insights.sbomify.com/MAL-2026-11907/): Malicious code in @servicetitan/mpa-components (npm) (malicious package) - [MAL-2026-11906](https://insights.sbomify.com/MAL-2026-11906/): Malicious code in @servicetitan/moneyout-api-client (npm) (malicious package) - [MAL-2026-11905](https://insights.sbomify.com/MAL-2026-11905/): Malicious code in @servicetitan/modularpayments-webfields (npm) (malicious package) - [MAL-2026-11904](https://insights.sbomify.com/MAL-2026-11904/): Malicious code in @servicetitan/microfront-utils (npm) (malicious package) - [MAL-2026-11903](https://insights.sbomify.com/MAL-2026-11903/): Malicious code in @servicetitan/microfront-tests (npm) (malicious package) - [MAL-2026-11902](https://insights.sbomify.com/MAL-2026-11902/): Malicious code in @servicetitan/microfront-auth (npm) (malicious package) - [MAL-2026-11901](https://insights.sbomify.com/MAL-2026-11901/): Malicious code in @servicetitan/microfront (npm) (malicious package) - [MAL-2026-11900](https://insights.sbomify.com/MAL-2026-11900/): Malicious code in @servicetitan/micro-frontend (npm) (malicious package) - [MAL-2026-1190](https://insights.sbomify.com/MAL-2026-1190/): Malicious code in bubblemap-bypass-sdk (npm) (malicious package) - [MAL-2026-119](https://insights.sbomify.com/MAL-2026-119/): Malicious code in klywarns (npm) (malicious package) - [MAL-2026-11899](https://insights.sbomify.com/MAL-2026-11899/): Malicious code in @servicetitan/mfe-quick-actions (npm) (malicious package) - [MAL-2026-11898](https://insights.sbomify.com/MAL-2026-11898/): Malicious code in @servicetitan/measure-sheet-data (npm) (malicious package) - [MAL-2026-11897](https://insights.sbomify.com/MAL-2026-11897/): Malicious code in @servicetitan/marketing-widgets (npm) (malicious package) - [MAL-2026-11896](https://insights.sbomify.com/MAL-2026-11896/): Malicious code in @servicetitan/marketing-ui (npm) (malicious package) - [MAL-2026-11895](https://insights.sbomify.com/MAL-2026-11895/): Malicious code in @servicetitan/marketing-route (npm) (malicious package) - [MAL-2026-11894](https://insights.sbomify.com/MAL-2026-11894/): Malicious code in @servicetitan/marketing-integration-widgets (npm) (malicious package) - [MAL-2026-11893](https://insights.sbomify.com/MAL-2026-11893/): Malicious code in @servicetitan/marketing-global-route (npm) (malicious package) - [MAL-2026-11892](https://insights.sbomify.com/MAL-2026-11892/): Malicious code in @servicetitan/marketing-form (npm) (malicious package) - [MAL-2026-11891](https://insights.sbomify.com/MAL-2026-11891/): Malicious code in @servicetitan/marketing-email-components (npm) (malicious package) - [MAL-2026-11890](https://insights.sbomify.com/MAL-2026-11890/): Malicious code in @servicetitan/marketing-direct-mail-components (npm) (malicious package) - [MAL-2026-1189](https://insights.sbomify.com/MAL-2026-1189/): Malicious code in bmath (npm) (malicious package) - [MAL-2026-11889](https://insights.sbomify.com/MAL-2026-11889/): Malicious code in @servicetitan/log-service (npm) (malicious package) - [MAL-2026-11888](https://insights.sbomify.com/MAL-2026-11888/): Malicious code in @servicetitan/link-item (npm) (malicious package) - [MAL-2026-11887](https://insights.sbomify.com/MAL-2026-11887/): Malicious code in @servicetitan/line-item-editor (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/170/