# Vulnerabilities published in 2026 - [MAL-2026-11615](https://insights.sbomify.com/MAL-2026-11615/): Malicious code in @onereach/orest-input-cli (npm) (malicious package) - [MAL-2026-11614](https://insights.sbomify.com/MAL-2026-11614/): Malicious code in @onereach/orest-cli (npm) (malicious package) - [MAL-2026-11613](https://insights.sbomify.com/MAL-2026-11613/): Malicious code in @onereach/or-sdk-agent-cli (npm) (malicious package) - [MAL-2026-11612](https://insights.sbomify.com/MAL-2026-11612/): Malicious code in @onereach/or-pro (npm) (malicious package) - [MAL-2026-11611](https://insights.sbomify.com/MAL-2026-11611/): Malicious code in @onereach/or-file-uploader-next (npm) (malicious package) - [MAL-2026-11610](https://insights.sbomify.com/MAL-2026-11610/): Malicious code in @onereach/or-content-builder-renderer (npm) (malicious package) - [MAL-2026-1161](https://insights.sbomify.com/MAL-2026-1161/): Malicious code in xpack-sui (npm) (malicious package) - [MAL-2026-11609](https://insights.sbomify.com/MAL-2026-11609/): Malicious code in @onereach/or-browser-next (npm) (malicious package) - [MAL-2026-11608](https://insights.sbomify.com/MAL-2026-11608/): Malicious code in @onereach/or-browser (npm) (malicious package) - [MAL-2026-11607](https://insights.sbomify.com/MAL-2026-11607/): Malicious code in @onereach/messengers-infobip-sdk (npm) (malicious package) - [MAL-2026-11606](https://insights.sbomify.com/MAL-2026-11606/): Malicious code in @onereach/lambda-invocation (npm) (malicious package) - [MAL-2026-11605](https://insights.sbomify.com/MAL-2026-11605/): Malicious code in @onereach/idw-ui-components (npm) (malicious package) - [MAL-2026-11604](https://insights.sbomify.com/MAL-2026-11604/): Malicious code in @onereach/idw-sdk (npm) (malicious package) - [MAL-2026-11603](https://insights.sbomify.com/MAL-2026-11603/): Malicious code in @onereach/idw-init-account-resources (npm) (malicious package) - [MAL-2026-11602](https://insights.sbomify.com/MAL-2026-11602/): Malicious code in @onereach/idw-contracts (npm) (malicious package) - [MAL-2026-11601](https://insights.sbomify.com/MAL-2026-11601/): Malicious code in @onereach/idw-apps (npm) (malicious package) - [MAL-2026-11600](https://insights.sbomify.com/MAL-2026-11600/): Malicious code in @onereach/get-version-data (npm) (malicious package) - [MAL-2026-1160](https://insights.sbomify.com/MAL-2026-1160/): Malicious code in xpack-subscription (npm) (malicious package) - [MAL-2026-116](https://insights.sbomify.com/MAL-2026-116/): Malicious code in jh5o (npm) (malicious package) - [MAL-2026-11599](https://insights.sbomify.com/MAL-2026-11599/): Malicious code in @onereach/font-icons (npm) (malicious package) - [MAL-2026-11598](https://insights.sbomify.com/MAL-2026-11598/): Malicious code in @onereach/expression-components (npm) (malicious package) - [MAL-2026-11597](https://insights.sbomify.com/MAL-2026-11597/): Malicious code in @onereach/content-builder-template-compiler (npm) (malicious package) - [MAL-2026-11596](https://insights.sbomify.com/MAL-2026-11596/): Malicious code in @onereach/content-builder (npm) (malicious package) - [MAL-2026-11595](https://insights.sbomify.com/MAL-2026-11595/): Malicious code in @onereach/condition-builder (npm) (malicious package) - [MAL-2026-11594](https://insights.sbomify.com/MAL-2026-11594/): Malicious code in @onereach/ckeditor5-build-classic (npm) (malicious package) - [MAL-2026-11593](https://insights.sbomify.com/MAL-2026-11593/): Malicious code in @onereach/channel-transformers (npm) (malicious package) - [MAL-2026-11592](https://insights.sbomify.com/MAL-2026-11592/): Malicious code in @onereach/channel-transformer (npm) (malicious package) - [MAL-2026-11591](https://insights.sbomify.com/MAL-2026-11591/): Malicious code in @onereach/cb-schema-translator (npm) (malicious package) - [MAL-2026-11590](https://insights.sbomify.com/MAL-2026-11590/): Malicious code in @onereach/billing-shared (npm) (malicious package) - [MAL-2026-1159](https://insights.sbomify.com/MAL-2026-1159/): Malicious code in xpack-per-device (npm) (malicious package) - [MAL-2026-11589](https://insights.sbomify.com/MAL-2026-11589/): Malicious code in @onereach/billing-dto (npm) (malicious package) - [MAL-2026-11588](https://insights.sbomify.com/MAL-2026-11588/): Malicious code in @onereach/bandwidth-steps-voice-bxml (npm) (malicious package) - [MAL-2026-11587](https://insights.sbomify.com/MAL-2026-11587/): Malicious code in @onereach/authorizer-helper (npm) (malicious package) - [MAL-2026-11586](https://insights.sbomify.com/MAL-2026-11586/): Malicious code in @nebula.js/theme (npm) (malicious package) - [MAL-2026-11585](https://insights.sbomify.com/MAL-2026-11585/): Malicious code in @nebula.js/test-utils (npm) (malicious package) - [MAL-2026-11584](https://insights.sbomify.com/MAL-2026-11584/): Malicious code in @nebula.js/stardust (npm) (malicious package) - [MAL-2026-11583](https://insights.sbomify.com/MAL-2026-11583/): Malicious code in @nebula.js/snapshooter (npm) (malicious package) - [MAL-2026-11582](https://insights.sbomify.com/MAL-2026-11582/): Malicious code in @nebula.js/sn-tabbed-container (npm) (malicious package) - [MAL-2026-11581](https://insights.sbomify.com/MAL-2026-11581/): Malicious code in @nebula.js/sn-slider (npm) (malicious package) - [MAL-2026-11580](https://insights.sbomify.com/MAL-2026-11580/): Malicious code in @nebula.js/sn-shape (npm) (malicious package) - [MAL-2026-1158](https://insights.sbomify.com/MAL-2026-1158/): Malicious code in xpack-arc-gateway (npm) (malicious package) - [MAL-2026-11579](https://insights.sbomify.com/MAL-2026-11579/): Malicious code in @nebula.js/sn-org-chart (npm) (malicious package) - [MAL-2026-11578](https://insights.sbomify.com/MAL-2026-11578/): Malicious code in @nebula.js/sn-nav-menu (npm) (malicious package) - [MAL-2026-11577](https://insights.sbomify.com/MAL-2026-11577/): Malicious code in @nebula.js/sn-map (npm) (malicious package) - [MAL-2026-11576](https://insights.sbomify.com/MAL-2026-11576/): Malicious code in @nebula.js/sn-listbox (npm) (malicious package) - [MAL-2026-11575](https://insights.sbomify.com/MAL-2026-11575/): Malicious code in @nebula.js/sn-line-chart (npm) (malicious package) - [MAL-2026-11574](https://insights.sbomify.com/MAL-2026-11574/): Malicious code in @nebula.js/sn-layout-container (npm) (malicious package) - [MAL-2026-11573](https://insights.sbomify.com/MAL-2026-11573/): Malicious code in @nebula.js/sn-distributionplot (npm) (malicious package) - [MAL-2026-11572](https://insights.sbomify.com/MAL-2026-11572/): Malicious code in @nebula.js/sn-animator (npm) (malicious package) - [MAL-2026-11571](https://insights.sbomify.com/MAL-2026-11571/): Malicious code in @nebula.js/sn-action-button (npm) (malicious package) - [MAL-2026-11570](https://insights.sbomify.com/MAL-2026-11570/): Malicious code in @nebula.js/nucleus (npm) (malicious package) - [MAL-2026-1157](https://insights.sbomify.com/MAL-2026-1157/): Malicious code in token-discord-encryptation (npm) (malicious package) - [MAL-2026-11569](https://insights.sbomify.com/MAL-2026-11569/): Malicious code in @nebula.js/locale (npm) (malicious package) - [MAL-2026-11568](https://insights.sbomify.com/MAL-2026-11568/): Malicious code in @nebula.js/cli-serve (npm) (malicious package) - [MAL-2026-11567](https://insights.sbomify.com/MAL-2026-11567/): Malicious code in @nebula.js/cli-sense (npm) (malicious package) - [MAL-2026-11566](https://insights.sbomify.com/MAL-2026-11566/): Malicious code in @nebula.js/cli-build (npm) (malicious package) - [MAL-2026-11565](https://insights.sbomify.com/MAL-2026-11565/): Malicious code in @nebula.js/cli (npm) (malicious package) - [MAL-2026-11564](https://insights.sbomify.com/MAL-2026-11564/): Malicious code in @hubsync/web-sdk-react (npm) (malicious package) - [MAL-2026-11563](https://insights.sbomify.com/MAL-2026-11563/): Malicious code in @deliveroo/reevent (npm) (malicious package) - [MAL-2026-11562](https://insights.sbomify.com/MAL-2026-11562/): Malicious code in @deliveroo/determinator (npm) (malicious package) - [MAL-2026-11561](https://insights.sbomify.com/MAL-2026-11561/): Malicious code in @cacheable/utils (npm) (malicious package) - [MAL-2026-11560](https://insights.sbomify.com/MAL-2026-11560/): Malicious code in @cacheable/node-cache (npm) (malicious package) - [MAL-2026-1156](https://insights.sbomify.com/MAL-2026-1156/): Malicious code in solongnerds (npm) (malicious package) - [MAL-2026-11559](https://insights.sbomify.com/MAL-2026-11559/): Malicious code in @cacheable/net (npm) (malicious package) - [MAL-2026-11558](https://insights.sbomify.com/MAL-2026-11558/): Malicious code in @cacheable/memory (npm) (malicious package) - [MAL-2026-11557](https://insights.sbomify.com/MAL-2026-11557/): Malicious code in @arv-bedrock/logger (npm) (malicious package) - [MAL-2026-11556](https://insights.sbomify.com/MAL-2026-11556/): Malicious code in @arv-bedrock/auth-sso-backend (npm) (malicious package) - [MAL-2026-11555](https://insights.sbomify.com/MAL-2026-11555/): Malicious code in @arv-bedrock/auth-sso (npm) (malicious package) - [MAL-2026-11554](https://insights.sbomify.com/MAL-2026-11554/): Malicious code in @arv-bedrock/auth-admin (npm) (malicious package) - [MAL-2026-11553](https://insights.sbomify.com/MAL-2026-11553/): Malicious code in @arv-bedrock/auth (npm) (malicious package) - [MAL-2026-11552](https://insights.sbomify.com/MAL-2026-11552/): Malicious code in @adminide-stack/yantra-mobile (npm) (malicious package) - [MAL-2026-11551](https://insights.sbomify.com/MAL-2026-11551/): Malicious code in @adminide-stack/clock-tik-browser (npm) (malicious package) - [MAL-2026-11550](https://insights.sbomify.com/MAL-2026-11550/): Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm) (malicious package) - [MAL-2026-1155](https://insights.sbomify.com/MAL-2026-1155/): Malicious code in rullzdigital-libsignal (npm) (malicious package) - [MAL-2026-11549](https://insights.sbomify.com/MAL-2026-11549/): Malicious code in tinkoff-terminal-kit-carousel (npm) (malicious package) - [MAL-2026-11548](https://insights.sbomify.com/MAL-2026-11548/): Malicious code in streak-math-abz (npm) (malicious package) - [MAL-2026-11547](https://insights.sbomify.com/MAL-2026-11547/): Malicious code in simple-date-formatter-util-9 (npm) (malicious package) - [MAL-2026-11546](https://insights.sbomify.com/MAL-2026-11546/): Malicious code in simple-date-formatter-util-6 (npm) (malicious package) - [MAL-2026-11545](https://insights.sbomify.com/MAL-2026-11545/): Malicious code in simple-date-formatter-util-15 (npm) (malicious package) - [MAL-2026-11544](https://insights.sbomify.com/MAL-2026-11544/): Malicious code in simple-date-formatter-util-10 (npm) (malicious package) - [MAL-2026-11543](https://insights.sbomify.com/MAL-2026-11543/): Malicious code in simple-date-formatter-new-5 (npm) (malicious package) - [MAL-2026-11542](https://insights.sbomify.com/MAL-2026-11542/): Malicious code in osinthell (npm) (malicious package) - [MAL-2026-11541](https://insights.sbomify.com/MAL-2026-11541/): Malicious code in nagixjs (npm) (malicious package) - [MAL-2026-11540](https://insights.sbomify.com/MAL-2026-11540/): Malicious code in hubert-application-get-document-preview-am (npm) (malicious package) - [MAL-2026-1154](https://insights.sbomify.com/MAL-2026-1154/): Malicious code in rullzdigital (npm) (malicious package) - [MAL-2026-11539](https://insights.sbomify.com/MAL-2026-11539/): Malicious code in entropyeasybots (npm) (malicious package) - [MAL-2026-11538](https://insights.sbomify.com/MAL-2026-11538/): Malicious code in eacq-payform-core (npm) (malicious package) - [MAL-2026-11537](https://insights.sbomify.com/MAL-2026-11537/): Malicious code in discord-vibegrations-api-natives (npm) (malicious package) - [MAL-2026-11536](https://insights.sbomify.com/MAL-2026-11536/): Malicious code in discord-vibegrations-api-helpers (npm) (malicious package) - [MAL-2026-11535](https://insights.sbomify.com/MAL-2026-11535/): Malicious code in bigops-backend (npm) (malicious package) - [MAL-2026-11534](https://insights.sbomify.com/MAL-2026-11534/): Malicious code in @zzzgenesis00/xrp-lib (npm) (malicious package) - [MAL-2026-11533](https://insights.sbomify.com/MAL-2026-11533/): Malicious code in @zzzgenesis00/solana-web3 (npm) (malicious package) - [MAL-2026-11532](https://insights.sbomify.com/MAL-2026-11532/): Malicious code in @zzzgenesis00/solana-wallet-adapter (npm) (malicious package) - [MAL-2026-11531](https://insights.sbomify.com/MAL-2026-11531/): Malicious code in @zzzgenesis00/hdkey-wallet (npm) (malicious package) - [MAL-2026-11530](https://insights.sbomify.com/MAL-2026-11530/): Malicious code in @zzzgenesis00/etherjs (npm) (malicious package) - [MAL-2026-1153](https://insights.sbomify.com/MAL-2026-1153/): Malicious code in primexuu-libsignal (npm) (malicious package) - [MAL-2026-11529](https://insights.sbomify.com/MAL-2026-11529/): Malicious code in @zzzgenesis00/crypto-config (npm) (malicious package) - [MAL-2026-11528](https://insights.sbomify.com/MAL-2026-11528/): Malicious code in @ks-openclaw/kim (npm) (malicious package) - [MAL-2026-11527](https://insights.sbomify.com/MAL-2026-11527/): Malicious code in streak-metricsaz (npm) (malicious package) - [MAL-2026-11526](https://insights.sbomify.com/MAL-2026-11526/): Malicious code in nagix-nodejs (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/174/