# Vulnerabilities published in 2026 - [MAL-2026-11705](https://insights.sbomify.com/MAL-2026-11705/): Malicious code in @or-sdk/knowledge-models (npm) (malicious package) - [MAL-2026-11704](https://insights.sbomify.com/MAL-2026-11704/): Malicious code in @or-sdk/keys (npm) (malicious package) - [MAL-2026-11703](https://insights.sbomify.com/MAL-2026-11703/): Malicious code in @or-sdk/key-value-storage (npm) (malicious package) - [MAL-2026-11702](https://insights.sbomify.com/MAL-2026-11702/): Malicious code in @or-sdk/invitations (npm) (malicious package) - [MAL-2026-11701](https://insights.sbomify.com/MAL-2026-11701/): Malicious code in @or-sdk/idw-skill (npm) (malicious package) - [MAL-2026-11700](https://insights.sbomify.com/MAL-2026-11700/): Malicious code in @or-sdk/idw-public (npm) (malicious package) - [MAL-2026-1170](https://insights.sbomify.com/MAL-2026-1170/): Malicious code in @global-dax-ad-platform/dax-utils (npm) (malicious package) - [MAL-2026-117](https://insights.sbomify.com/MAL-2026-117/): Malicious code in kdb1-demo-v2 (npm) (malicious package) - [MAL-2026-11699](https://insights.sbomify.com/MAL-2026-11699/): Malicious code in @or-sdk/idw (npm) (malicious package) - [MAL-2026-11698](https://insights.sbomify.com/MAL-2026-11698/): Malicious code in @or-sdk/identifiers (npm) (malicious package) - [MAL-2026-11697](https://insights.sbomify.com/MAL-2026-11697/): Malicious code in @or-sdk/hitl (npm) (malicious package) - [MAL-2026-11696](https://insights.sbomify.com/MAL-2026-11696/): Malicious code in @or-sdk/graph (npm) (malicious package) - [MAL-2026-11695](https://insights.sbomify.com/MAL-2026-11695/): Malicious code in @or-sdk/flows (npm) (malicious package) - [MAL-2026-11694](https://insights.sbomify.com/MAL-2026-11694/): Malicious code in @or-sdk/flow-templates (npm) (malicious package) - [MAL-2026-11693](https://insights.sbomify.com/MAL-2026-11693/): Malicious code in @or-sdk/files-sync-node (npm) (malicious package) - [MAL-2026-11692](https://insights.sbomify.com/MAL-2026-11692/): Malicious code in @or-sdk/files (npm) (malicious package) - [MAL-2026-11691](https://insights.sbomify.com/MAL-2026-11691/): Malicious code in @or-sdk/event-manager (npm) (malicious package) - [MAL-2026-11690](https://insights.sbomify.com/MAL-2026-11690/): Malicious code in @or-sdk/druid (npm) (malicious package) - [MAL-2026-1169](https://insights.sbomify.com/MAL-2026-1169/): Malicious code in @global-dax-ad-platform/dax-types (npm) (malicious package) - [MAL-2026-11689](https://insights.sbomify.com/MAL-2026-11689/): Malicious code in @or-sdk/discovery (npm) (malicious package) - [MAL-2026-11688](https://insights.sbomify.com/MAL-2026-11688/): Malicious code in @or-sdk/deployments (npm) (malicious package) - [MAL-2026-11687](https://insights.sbomify.com/MAL-2026-11687/): Malicious code in @or-sdk/deployer (npm) (malicious package) - [MAL-2026-11686](https://insights.sbomify.com/MAL-2026-11686/): Malicious code in @or-sdk/data-hub-svc (npm) (malicious package) - [MAL-2026-11685](https://insights.sbomify.com/MAL-2026-11685/): Malicious code in @or-sdk/data-hub (npm) (malicious package) - [MAL-2026-11684](https://insights.sbomify.com/MAL-2026-11684/): Malicious code in @or-sdk/content-request (npm) (malicious package) - [MAL-2026-11683](https://insights.sbomify.com/MAL-2026-11683/): Malicious code in @or-sdk/contacts (npm) (malicious package) - [MAL-2026-11682](https://insights.sbomify.com/MAL-2026-11682/): Malicious code in @or-sdk/chat (npm) (malicious package) - [MAL-2026-11681](https://insights.sbomify.com/MAL-2026-11681/): Malicious code in @or-sdk/ccp (npm) (malicious package) - [MAL-2026-11680](https://insights.sbomify.com/MAL-2026-11680/): Malicious code in @or-sdk/cards (npm) (malicious package) - [MAL-2026-1168](https://insights.sbomify.com/MAL-2026-1168/): Malicious code in @global-dax-ad-platform/dax-styles (npm) (malicious package) - [MAL-2026-11679](https://insights.sbomify.com/MAL-2026-11679/): Malicious code in @or-sdk/card-templates (npm) (malicious package) - [MAL-2026-11678](https://insights.sbomify.com/MAL-2026-11678/): Malicious code in @or-sdk/bots (npm) (malicious package) - [MAL-2026-11677](https://insights.sbomify.com/MAL-2026-11677/): Malicious code in @or-sdk/bot-templates (npm) (malicious package) - [MAL-2026-11676](https://insights.sbomify.com/MAL-2026-11676/): Malicious code in @or-sdk/billing-internal (npm) (malicious package) - [MAL-2026-11675](https://insights.sbomify.com/MAL-2026-11675/): Malicious code in @or-sdk/billing (npm) (malicious package) - [MAL-2026-11674](https://insights.sbomify.com/MAL-2026-11674/): Malicious code in @or-sdk/base (npm) (malicious package) - [MAL-2026-11673](https://insights.sbomify.com/MAL-2026-11673/): Malicious code in @or-sdk/authorizer (npm) (malicious package) - [MAL-2026-11672](https://insights.sbomify.com/MAL-2026-11672/): Malicious code in @or-sdk/auth (npm) (malicious package) - [MAL-2026-11671](https://insights.sbomify.com/MAL-2026-11671/): Malicious code in @or-sdk/apps (npm) (malicious package) - [MAL-2026-11670](https://insights.sbomify.com/MAL-2026-11670/): Malicious code in @or-sdk/api-tokens-lambda (npm) (malicious package) - [MAL-2026-1167](https://insights.sbomify.com/MAL-2026-1167/): Malicious code in @global-dax-ad-platform/dax-modules (npm) (malicious package) - [MAL-2026-11669](https://insights.sbomify.com/MAL-2026-11669/): Malicious code in @or-sdk/api-tokens (npm) (malicious package) - [MAL-2026-11668](https://insights.sbomify.com/MAL-2026-11668/): Malicious code in @or-sdk/agents (npm) (malicious package) - [MAL-2026-11667](https://insights.sbomify.com/MAL-2026-11667/): Malicious code in @or-sdk/adapters (npm) (malicious package) - [MAL-2026-11666](https://insights.sbomify.com/MAL-2026-11666/): Malicious code in @or-sdk/accounts (npm) (malicious package) - [MAL-2026-11665](https://insights.sbomify.com/MAL-2026-11665/): Malicious code in @or-sdk/account-settings (npm) (malicious package) - [MAL-2026-11664](https://insights.sbomify.com/MAL-2026-11664/): Malicious code in @onereach/webform (npm) (malicious package) - [MAL-2026-11663](https://insights.sbomify.com/MAL-2026-11663/): Malicious code in @onereach/v-event-calendar (npm) (malicious package) - [MAL-2026-11662](https://insights.sbomify.com/MAL-2026-11662/): Malicious code in @onereach/ui-components-vue2 (npm) (malicious package) - [MAL-2026-11661](https://insights.sbomify.com/MAL-2026-11661/): Malicious code in @onereach/ui-components-common (npm) (malicious package) - [MAL-2026-11660](https://insights.sbomify.com/MAL-2026-11660/): Malicious code in @onereach/ui-components (npm) (malicious package) - [MAL-2026-1166](https://insights.sbomify.com/MAL-2026-1166/): Malicious code in @global-dax-ad-platform/dax-hooks (npm) (malicious package) - [MAL-2026-11659](https://insights.sbomify.com/MAL-2026-11659/): Malicious code in @onereach/types-contacts-api (npm) (malicious package) - [MAL-2026-11658](https://insights.sbomify.com/MAL-2026-11658/): Malicious code in @onereach/ts-memoize (npm) (malicious package) - [MAL-2026-11657](https://insights.sbomify.com/MAL-2026-11657/): Malicious code in @onereach/time-interpreter (npm) (malicious package) - [MAL-2026-11656](https://insights.sbomify.com/MAL-2026-11656/): Malicious code in @onereach/styles (npm) (malicious package) - [MAL-2026-11655](https://insights.sbomify.com/MAL-2026-11655/): Malicious code in @onereach/step-voice (npm) (malicious package) - [MAL-2026-11654](https://insights.sbomify.com/MAL-2026-11654/): Malicious code in @onereach/step-run-snowflake-query (npm) (malicious package) - [MAL-2026-11653](https://insights.sbomify.com/MAL-2026-11653/): Malicious code in @onereach/step-conversation (npm) (malicious package) - [MAL-2026-11652](https://insights.sbomify.com/MAL-2026-11652/): Malicious code in @onereach/step-components (npm) (malicious package) - [MAL-2026-11651](https://insights.sbomify.com/MAL-2026-11651/): Malicious code in @onereach/ssml-editor (npm) (malicious package) - [MAL-2026-11650](https://insights.sbomify.com/MAL-2026-11650/): Malicious code in @onereach/slack-helpers (npm) (malicious package) - [MAL-2026-1165](https://insights.sbomify.com/MAL-2026-1165/): Malicious code in @global-dax-ad-platform/dax-components (npm) (malicious package) - [MAL-2026-11649](https://insights.sbomify.com/MAL-2026-11649/): Malicious code in @onereach/si-validated-timestring-input (npm) (malicious package) - [MAL-2026-11648](https://insights.sbomify.com/MAL-2026-11648/): Malicious code in @onereach/si-textinput (npm) (malicious package) - [MAL-2026-11647](https://insights.sbomify.com/MAL-2026-11647/): Malicious code in @onereach/si-text-message (npm) (malicious package) - [MAL-2026-11646](https://insights.sbomify.com/MAL-2026-11646/): Malicious code in @onereach/si-switch (npm) (malicious package) - [MAL-2026-11645](https://insights.sbomify.com/MAL-2026-11645/): Malicious code in @onereach/si-step-chooser (npm) (malicious package) - [MAL-2026-11644](https://insights.sbomify.com/MAL-2026-11644/): Malicious code in @onereach/si-select (npm) (malicious package) - [MAL-2026-11643](https://insights.sbomify.com/MAL-2026-11643/): Malicious code in @onereach/si-root (npm) (malicious package) - [MAL-2026-11642](https://insights.sbomify.com/MAL-2026-11642/): Malicious code in @onereach/si-radio-group (npm) (malicious package) - [MAL-2026-11641](https://insights.sbomify.com/MAL-2026-11641/): Malicious code in @onereach/si-merge-tag-input (npm) (malicious package) - [MAL-2026-11640](https://insights.sbomify.com/MAL-2026-11640/): Malicious code in @onereach/si-list (npm) (malicious package) - [MAL-2026-1164](https://insights.sbomify.com/MAL-2026-1164/): Malicious code in yazxzpedia-libsignal (npm) (malicious package) - [MAL-2026-11639](https://insights.sbomify.com/MAL-2026-11639/): Malicious code in @onereach/si-header (npm) (malicious package) - [MAL-2026-11638](https://insights.sbomify.com/MAL-2026-11638/): Malicious code in @onereach/si-dropdown-simple (npm) (malicious package) - [MAL-2026-11637](https://insights.sbomify.com/MAL-2026-11637/): Malicious code in @onereach/si-dropdown-advanced (npm) (malicious package) - [MAL-2026-11636](https://insights.sbomify.com/MAL-2026-11636/): Malicious code in @onereach/si-divider (npm) (malicious package) - [MAL-2026-11635](https://insights.sbomify.com/MAL-2026-11635/): Malicious code in @onereach/si-datepicker (npm) (malicious package) - [MAL-2026-11634](https://insights.sbomify.com/MAL-2026-11634/): Malicious code in @onereach/si-copyable-text (npm) (malicious package) - [MAL-2026-11633](https://insights.sbomify.com/MAL-2026-11633/): Malicious code in @onereach/si-collapsible-group (npm) (malicious package) - [MAL-2026-11632](https://insights.sbomify.com/MAL-2026-11632/): Malicious code in @onereach/si-code (npm) (malicious package) - [MAL-2026-11631](https://insights.sbomify.com/MAL-2026-11631/): Malicious code in @onereach/si-checkbox-group (npm) (malicious package) - [MAL-2026-11630](https://insights.sbomify.com/MAL-2026-11630/): Malicious code in @onereach/si-checkbox (npm) (malicious package) - [MAL-2026-1163](https://insights.sbomify.com/MAL-2026-1163/): Malicious code in xpack-video-submission (npm) (malicious package) - [MAL-2026-11629](https://insights.sbomify.com/MAL-2026-11629/): Malicious code in @onereach/si-alert (npm) (malicious package) - [MAL-2026-11628](https://insights.sbomify.com/MAL-2026-11628/): Malicious code in @onereach/si-a-button (npm) (malicious package) - [MAL-2026-11627](https://insights.sbomify.com/MAL-2026-11627/): Malicious code in @onereach/salesforce-miaw-client (npm) (malicious package) - [MAL-2026-11626](https://insights.sbomify.com/MAL-2026-11626/): Malicious code in @onereach/rwc-client (npm) (malicious package) - [MAL-2026-11625](https://insights.sbomify.com/MAL-2026-11625/): Malicious code in @onereach/regular-expressions-test (npm) (malicious package) - [MAL-2026-11624](https://insights.sbomify.com/MAL-2026-11624/): Malicious code in @onereach/regular-expressions (npm) (malicious package) - [MAL-2026-11623](https://insights.sbomify.com/MAL-2026-11623/): Malicious code in @onereach/regex-helper (npm) (malicious package) - [MAL-2026-11622](https://insights.sbomify.com/MAL-2026-11622/): Malicious code in @onereach/postcss-scoped-selector (npm) (malicious package) - [MAL-2026-11621](https://insights.sbomify.com/MAL-2026-11621/): Malicious code in @onereach/pnpm-audit-junit (npm) (malicious package) - [MAL-2026-11620](https://insights.sbomify.com/MAL-2026-11620/): Malicious code in @onereach/phonenumber-interpreter (npm) (malicious package) - [MAL-2026-1162](https://insights.sbomify.com/MAL-2026-1162/): Malicious code in xpack-test-3.0 (npm) (malicious package) - [MAL-2026-11619](https://insights.sbomify.com/MAL-2026-11619/): Malicious code in @onereach/orest-vue3 (npm) (malicious package) - [MAL-2026-11618](https://insights.sbomify.com/MAL-2026-11618/): Malicious code in @onereach/orest-vue-demi-vue3 (npm) (malicious package) - [MAL-2026-11617](https://insights.sbomify.com/MAL-2026-11617/): Malicious code in @onereach/orest-vue-demi-vue2 (npm) (malicious package) - [MAL-2026-11616](https://insights.sbomify.com/MAL-2026-11616/): Malicious code in @onereach/orest-jest-presets (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/173/