# Vulnerabilities published in 2026


- [MAL-2026-11796](https://insights.sbomify.com/MAL-2026-11796/): Malicious code in @qlik/eslint-config-svelte (npm) (malicious package)
- [MAL-2026-11795](https://insights.sbomify.com/MAL-2026-11795/): Malicious code in @qlik/eslint-config-react (npm) (malicious package)
- [MAL-2026-11794](https://insights.sbomify.com/MAL-2026-11794/): Malicious code in @qlik/eslint-config-base (npm) (malicious package)
- [MAL-2026-11793](https://insights.sbomify.com/MAL-2026-11793/): Malicious code in @qlik/eslint-config (npm) (malicious package)
- [MAL-2026-11792](https://insights.sbomify.com/MAL-2026-11792/): Malicious code in @qlik/embed-web-components (npm) (malicious package)
- [MAL-2026-11791](https://insights.sbomify.com/MAL-2026-11791/): Malicious code in @qlik/embed-svelte (npm) (malicious package)
- [MAL-2026-11790](https://insights.sbomify.com/MAL-2026-11790/): Malicious code in @qlik/embed-runtime (npm) (malicious package)
- [MAL-2026-1179](https://insights.sbomify.com/MAL-2026-1179/): Malicious code in magala (npm) (malicious package)
- [MAL-2026-11789](https://insights.sbomify.com/MAL-2026-11789/): Malicious code in @qlik/embed-react (npm) (malicious package)
- [MAL-2026-11788](https://insights.sbomify.com/MAL-2026-11788/): Malicious code in @qlik/dts-bundler (npm) (malicious package)
- [MAL-2026-11787](https://insights.sbomify.com/MAL-2026-11787/): Malicious code in @qlik/design-tokens (npm) (malicious package)
- [MAL-2026-11786](https://insights.sbomify.com/MAL-2026-11786/): Malicious code in @qlik/carboncopy (npm) (malicious package)
- [MAL-2026-11785](https://insights.sbomify.com/MAL-2026-11785/): Malicious code in @qlik/carbon-core (npm) (malicious package)
- [MAL-2026-11784](https://insights.sbomify.com/MAL-2026-11784/): Malicious code in @qlik/browserslist-config (npm) (malicious package)
- [MAL-2026-11783](https://insights.sbomify.com/MAL-2026-11783/): Malicious code in @qlik/api (npm) (malicious package)
- [MAL-2026-11782](https://insights.sbomify.com/MAL-2026-11782/): Malicious code in @picsart/gen-ai (npm) (malicious package)
- [MAL-2026-11781](https://insights.sbomify.com/MAL-2026-11781/): Malicious code in @picsart/ai-sdk (npm) (malicious package)
- [MAL-2026-11780](https://insights.sbomify.com/MAL-2026-11780/): Malicious code in @ornikar/webpack-config (npm) (malicious package)
- [MAL-2026-1178](https://insights.sbomify.com/MAL-2026-1178/): Malicious code in hiagentevilmcp (npm) (malicious package)
- [MAL-2026-11779](https://insights.sbomify.com/MAL-2026-11779/): Malicious code in @ornikar/typed-css-modules-loader (npm) (malicious package)
- [MAL-2026-11778](https://insights.sbomify.com/MAL-2026-11778/): Malicious code in @ornikar/stylelint-config (npm) (malicious package)
- [MAL-2026-11777](https://insights.sbomify.com/MAL-2026-11777/): Malicious code in @ornikar/storybook-config (npm) (malicious package)
- [MAL-2026-11776](https://insights.sbomify.com/MAL-2026-11776/): Malicious code in @ornikar/slate-react-fork (npm) (malicious package)
- [MAL-2026-11775](https://insights.sbomify.com/MAL-2026-11775/): Malicious code in @ornikar/rollup-plugin-postcss (npm) (malicious package)
- [MAL-2026-11774](https://insights.sbomify.com/MAL-2026-11774/): Malicious code in @ornikar/rollup-config (npm) (malicious package)
- [MAL-2026-11773](https://insights.sbomify.com/MAL-2026-11773/): Malicious code in @ornikar/repo-config-react-legacy-css (npm) (malicious package)
- [MAL-2026-11772](https://insights.sbomify.com/MAL-2026-11772/): Malicious code in @ornikar/repo-config-react (npm) (malicious package)
- [MAL-2026-11771](https://insights.sbomify.com/MAL-2026-11771/): Malicious code in @ornikar/repo-config (npm) (malicious package)
- [MAL-2026-11770](https://insights.sbomify.com/MAL-2026-11770/): Malicious code in @ornikar/renovate-config (npm) (malicious package)
- [MAL-2026-1177](https://insights.sbomify.com/MAL-2026-1177/): Malicious code in graph-dynamic (npm) (malicious package)
- [MAL-2026-11769](https://insights.sbomify.com/MAL-2026-11769/): Malicious code in @ornikar/react-native-svg-transformer (npm) (malicious package)
- [MAL-2026-11768](https://insights.sbomify.com/MAL-2026-11768/): Malicious code in @ornikar/react-modern-calendar-datepicker (npm) (malicious package)
- [MAL-2026-11767](https://insights.sbomify.com/MAL-2026-11767/): Malicious code in @ornikar/prismic-components (npm) (malicious package)
- [MAL-2026-11766](https://insights.sbomify.com/MAL-2026-11766/): Malicious code in @ornikar/prettier-config (npm) (malicious package)
- [MAL-2026-11765](https://insights.sbomify.com/MAL-2026-11765/): Malicious code in @ornikar/postcss-config (npm) (malicious package)
- [MAL-2026-11764](https://insights.sbomify.com/MAL-2026-11764/): Malicious code in @ornikar/monorepo-config (npm) (malicious package)
- [MAL-2026-11763](https://insights.sbomify.com/MAL-2026-11763/): Malicious code in @ornikar/lerna-config (npm) (malicious package)
- [MAL-2026-11762](https://insights.sbomify.com/MAL-2026-11762/): Malicious code in @ornikar/kitt2 (npm) (malicious package)
- [MAL-2026-11761](https://insights.sbomify.com/MAL-2026-11761/): Malicious code in @ornikar/jest-config-react-native-web (npm) (malicious package)
- [MAL-2026-11760](https://insights.sbomify.com/MAL-2026-11760/): Malicious code in @ornikar/jest-config-react-native (npm) (malicious package)
- [MAL-2026-1176](https://insights.sbomify.com/MAL-2026-1176/): Malicious code in gabby-types (npm) (malicious package)
- [MAL-2026-11759](https://insights.sbomify.com/MAL-2026-11759/): Malicious code in @ornikar/jest-config-react (npm) (malicious package)
- [MAL-2026-11758](https://insights.sbomify.com/MAL-2026-11758/): Malicious code in @ornikar/jest-config (npm) (malicious package)
- [MAL-2026-11757](https://insights.sbomify.com/MAL-2026-11757/): Malicious code in @ornikar/intl-config (npm) (malicious package)
- [MAL-2026-11756](https://insights.sbomify.com/MAL-2026-11756/): Malicious code in @ornikar/graphql-config (npm) (malicious package)
- [MAL-2026-11755](https://insights.sbomify.com/MAL-2026-11755/): Malicious code in @ornikar/eslint-plugin-ornikar (npm) (malicious package)
- [MAL-2026-11754](https://insights.sbomify.com/MAL-2026-11754/): Malicious code in @ornikar/eslint-plugin-neverthrow (npm) (malicious package)
- [MAL-2026-11753](https://insights.sbomify.com/MAL-2026-11753/): Malicious code in @ornikar/eslint-config-typescript-react (npm) (malicious package)
- [MAL-2026-11752](https://insights.sbomify.com/MAL-2026-11752/): Malicious code in @ornikar/eslint-config-typescript-nestjs (npm) (malicious package)
- [MAL-2026-11751](https://insights.sbomify.com/MAL-2026-11751/): Malicious code in @ornikar/eslint-config-typescript (npm) (malicious package)
- [MAL-2026-11750](https://insights.sbomify.com/MAL-2026-11750/): Malicious code in @ornikar/eslint-config-react (npm) (malicious package)
- [MAL-2026-1175](https://insights.sbomify.com/MAL-2026-1175/): Malicious code in ethersnog (npm) (malicious package)
- [MAL-2026-11749](https://insights.sbomify.com/MAL-2026-11749/): Malicious code in @ornikar/eslint-config-node (npm) (malicious package)
- [MAL-2026-11748](https://insights.sbomify.com/MAL-2026-11748/): Malicious code in @ornikar/eslint-config-formatjs (npm) (malicious package)
- [MAL-2026-11747](https://insights.sbomify.com/MAL-2026-11747/): Malicious code in @ornikar/eslint-config-babel-use (npm) (malicious package)
- [MAL-2026-11746](https://insights.sbomify.com/MAL-2026-11746/): Malicious code in @ornikar/eslint-config-babel (npm) (malicious package)
- [MAL-2026-11745](https://insights.sbomify.com/MAL-2026-11745/): Malicious code in @ornikar/eslint-config (npm) (malicious package)
- [MAL-2026-11744](https://insights.sbomify.com/MAL-2026-11744/): Malicious code in @ornikar/commitlint-config (npm) (malicious package)
- [MAL-2026-11743](https://insights.sbomify.com/MAL-2026-11743/): Malicious code in @ornikar/browserslist-config (npm) (malicious package)
- [MAL-2026-11742](https://insights.sbomify.com/MAL-2026-11742/): Malicious code in @ornikar/babel-preset-react (npm) (malicious package)
- [MAL-2026-11741](https://insights.sbomify.com/MAL-2026-11741/): Malicious code in @ornikar/babel-preset-kitt-universal (npm) (malicious package)
- [MAL-2026-11740](https://insights.sbomify.com/MAL-2026-11740/): Malicious code in @ornikar/babel-preset-base (npm) (malicious package)
- [MAL-2026-1174](https://insights.sbomify.com/MAL-2026-1174/): Malicious code in ethersnode (npm) (malicious package)
- [MAL-2026-11739](https://insights.sbomify.com/MAL-2026-11739/): Malicious code in @ornikar/apollo-link-timeout (npm) (malicious package)
- [MAL-2026-11738](https://insights.sbomify.com/MAL-2026-11738/): Malicious code in @or-sdk/web-search (npm) (malicious package)
- [MAL-2026-11737](https://insights.sbomify.com/MAL-2026-11737/): Malicious code in @or-sdk/views (npm) (malicious package)
- [MAL-2026-11736](https://insights.sbomify.com/MAL-2026-11736/): Malicious code in @or-sdk/view-templates (npm) (malicious package)
- [MAL-2026-11735](https://insights.sbomify.com/MAL-2026-11735/): Malicious code in @or-sdk/users (npm) (malicious package)
- [MAL-2026-11734](https://insights.sbomify.com/MAL-2026-11734/): Malicious code in @or-sdk/transcripts (npm) (malicious package)
- [MAL-2026-11733](https://insights.sbomify.com/MAL-2026-11733/): Malicious code in @or-sdk/tickets (npm) (malicious package)
- [MAL-2026-11732](https://insights.sbomify.com/MAL-2026-11732/): Malicious code in @or-sdk/tags (npm) (malicious package)
- [MAL-2026-11731](https://insights.sbomify.com/MAL-2026-11731/): Malicious code in @or-sdk/tables (npm) (malicious package)
- [MAL-2026-11730](https://insights.sbomify.com/MAL-2026-11730/): Malicious code in @or-sdk/store (npm) (malicious package)
- [MAL-2026-1173](https://insights.sbomify.com/MAL-2026-1173/): Malicious code in eslint-verify-plugin (npm) (malicious package)
- [MAL-2026-11729](https://insights.sbomify.com/MAL-2026-11729/): Malicious code in @or-sdk/step-templates (npm) (malicious package)
- [MAL-2026-11728](https://insights.sbomify.com/MAL-2026-11728/): Malicious code in @or-sdk/source-api (npm) (malicious package)
- [MAL-2026-11727](https://insights.sbomify.com/MAL-2026-11727/): Malicious code in @or-sdk/source (npm) (malicious package)
- [MAL-2026-11726](https://insights.sbomify.com/MAL-2026-11726/): Malicious code in @or-sdk/sku-builder (npm) (malicious package)
- [MAL-2026-11725](https://insights.sbomify.com/MAL-2026-11725/): Malicious code in @or-sdk/settings (npm) (malicious package)
- [MAL-2026-11724](https://insights.sbomify.com/MAL-2026-11724/): Malicious code in @or-sdk/sdk-api (npm) (malicious package)
- [MAL-2026-11723](https://insights.sbomify.com/MAL-2026-11723/): Malicious code in @or-sdk/queue-manager (npm) (malicious package)
- [MAL-2026-11722](https://insights.sbomify.com/MAL-2026-11722/): Malicious code in @or-sdk/qna (npm) (malicious package)
- [MAL-2026-11721](https://insights.sbomify.com/MAL-2026-11721/): Malicious code in @or-sdk/providers (npm) (malicious package)
- [MAL-2026-11720](https://insights.sbomify.com/MAL-2026-11720/): Malicious code in @or-sdk/pgsql (npm) (malicious package)
- [MAL-2026-1172](https://insights.sbomify.com/MAL-2026-1172/): Malicious code in @zakhaevv/envai (npm) (malicious package)
- [MAL-2026-11719](https://insights.sbomify.com/MAL-2026-11719/): Malicious code in @or-sdk/permissions-lambda (npm) (malicious package)
- [MAL-2026-11718](https://insights.sbomify.com/MAL-2026-11718/): Malicious code in @or-sdk/permissions-cli (npm) (malicious package)
- [MAL-2026-11717](https://insights.sbomify.com/MAL-2026-11717/): Malicious code in @or-sdk/permissions (npm) (malicious package)
- [MAL-2026-11716](https://insights.sbomify.com/MAL-2026-11716/): Malicious code in @or-sdk/payments (npm) (malicious package)
- [MAL-2026-11715](https://insights.sbomify.com/MAL-2026-11715/): Malicious code in @or-sdk/password (npm) (malicious package)
- [MAL-2026-11714](https://insights.sbomify.com/MAL-2026-11714/): Malicious code in @or-sdk/notifications (npm) (malicious package)
- [MAL-2026-11713](https://insights.sbomify.com/MAL-2026-11713/): Malicious code in @or-sdk/mcp-tools (npm) (malicious package)
- [MAL-2026-11712](https://insights.sbomify.com/MAL-2026-11712/): Malicious code in @or-sdk/markdowner (npm) (malicious package)
- [MAL-2026-11711](https://insights.sbomify.com/MAL-2026-11711/): Malicious code in @or-sdk/lookup (npm) (malicious package)
- [MAL-2026-11710](https://insights.sbomify.com/MAL-2026-11710/): Malicious code in @or-sdk/library-types-v2 (npm) (malicious package)
- [MAL-2026-1171](https://insights.sbomify.com/MAL-2026-1171/): Malicious code in @snazaah/davey (npm) (malicious package)
- [MAL-2026-11709](https://insights.sbomify.com/MAL-2026-11709/): Malicious code in @or-sdk/library-types-v1 (npm) (malicious package)
- [MAL-2026-11708](https://insights.sbomify.com/MAL-2026-11708/): Malicious code in @or-sdk/library-source (npm) (malicious package)
- [MAL-2026-11707](https://insights.sbomify.com/MAL-2026-11707/): Malicious code in @or-sdk/library-categories (npm) (malicious package)
- [MAL-2026-11706](https://insights.sbomify.com/MAL-2026-11706/): Malicious code in @or-sdk/library (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/172/