# Vulnerabilities published in 2026 - [MAL-2026-11525](https://insights.sbomify.com/MAL-2026-11525/): Malicious code in nagix-node (npm) (malicious package) - [MAL-2026-11524](https://insights.sbomify.com/MAL-2026-11524/): Malicious code in keyv (npm) (malicious package) - [MAL-2026-11523](https://insights.sbomify.com/MAL-2026-11523/): Malicious code in cache-manager (npm) (malicious package) - [MAL-2026-11522](https://insights.sbomify.com/MAL-2026-11522/): Malicious code in beaver-ui-form (npm) (malicious package) - [MAL-2026-11521](https://insights.sbomify.com/MAL-2026-11521/): Malicious code in psbt-helpers (PyPI) (malicious package) - [MAL-2026-11520](https://insights.sbomify.com/MAL-2026-11520/): Malicious code in psbt-utils (PyPI) (malicious package) - [MAL-2026-1152](https://insights.sbomify.com/MAL-2026-1152/): Malicious code in pool-check (npm) (malicious package) - [MAL-2026-11519](https://insights.sbomify.com/MAL-2026-11519/): Malicious code in launchdarkly-ai-server-sdk (PyPI) (malicious package) - [MAL-2026-11518](https://insights.sbomify.com/MAL-2026-11518/): Malicious code in exnesss (npm) (malicious package) - [MAL-2026-11517](https://insights.sbomify.com/MAL-2026-11517/): Malicious code in internallib_v688 (npm) (malicious package) - [MAL-2026-11516](https://insights.sbomify.com/MAL-2026-11516/): Malicious code in coldcard-helpers (PyPI) (malicious package) - [MAL-2026-11515](https://insights.sbomify.com/MAL-2026-11515/): Malicious code in @zzzgenesis00/bip39-generator (npm) (malicious package) - [MAL-2026-11514](https://insights.sbomify.com/MAL-2026-11514/): Malicious code in lifestyle-test-utils (npm) (malicious package) - [MAL-2026-11513](https://insights.sbomify.com/MAL-2026-11513/): Malicious code in internallib_v568 (npm) (malicious package) - [MAL-2026-11512](https://insights.sbomify.com/MAL-2026-11512/): Malicious code in internallib_v524 (npm) (malicious package) - [MAL-2026-11511](https://insights.sbomify.com/MAL-2026-11511/): Malicious code in bigops-chat-messages (npm) (malicious package) - [MAL-2026-11510](https://insights.sbomify.com/MAL-2026-11510/): Malicious code in beaver-ui-layout (npm) (malicious package) - [MAL-2026-1151](https://insights.sbomify.com/MAL-2026-1151/): Malicious code in openclaw-droid (npm) (malicious package) - [MAL-2026-11509](https://insights.sbomify.com/MAL-2026-11509/): Malicious code in beaver-ui-items-with-more (npm) (malicious package) - [MAL-2026-11508](https://insights.sbomify.com/MAL-2026-11508/): Malicious code in beaver-ui-header (npm) (malicious package) - [MAL-2026-11507](https://insights.sbomify.com/MAL-2026-11507/): Malicious code in beaver-ui-grid (npm) (malicious package) - [MAL-2026-11506](https://insights.sbomify.com/MAL-2026-11506/): Malicious code in beaver-ui-date-range-picker (npm) (malicious package) - [MAL-2026-11505](https://insights.sbomify.com/MAL-2026-11505/): Malicious code in accounts-loading-state (npm) (malicious package) - [MAL-2026-11504](https://insights.sbomify.com/MAL-2026-11504/): Malicious code in accounts-final-form (npm) (malicious package) - [MAL-2026-11503](https://insights.sbomify.com/MAL-2026-11503/): Malicious code in instalogin1234 (PyPI) (malicious package) - [MAL-2026-11502](https://insights.sbomify.com/MAL-2026-11502/): Malicious code in simple-date-formatter-new-1 (npm) (malicious package) - [MAL-2026-11501](https://insights.sbomify.com/MAL-2026-11501/): Malicious code in simple-date-formatter-util-5 (npm) (malicious package) - [MAL-2026-11500](https://insights.sbomify.com/MAL-2026-11500/): Malicious code in tailwind-anim (npm) (malicious package) - [MAL-2026-1150](https://insights.sbomify.com/MAL-2026-1150/): Malicious code in libsignal-yazxz (npm) (malicious package) - [MAL-2026-115](https://insights.sbomify.com/MAL-2026-115/): Malicious code in hiqomu (npm) (malicious package) - [MAL-2026-11499](https://insights.sbomify.com/MAL-2026-11499/): Malicious code in @types-beta/sdk (npm) (malicious package) - [MAL-2026-11498](https://insights.sbomify.com/MAL-2026-11498/): Malicious code in @custombots/custombot (npm) (malicious package) - [MAL-2026-11497](https://insights.sbomify.com/MAL-2026-11497/): Malicious code in vite-tsconfig-svg (npm) (malicious package) - [MAL-2026-11496](https://insights.sbomify.com/MAL-2026-11496/): Malicious code in vite-config-svg (npm) (malicious package) - [MAL-2026-11495](https://insights.sbomify.com/MAL-2026-11495/): Malicious code in test-dev-watch (npm) (malicious package) - [MAL-2026-11494](https://insights.sbomify.com/MAL-2026-11494/): Malicious code in test-dev-sync (npm) (malicious package) - [MAL-2026-11493](https://insights.sbomify.com/MAL-2026-11493/): Malicious code in test-dev-store (npm) (malicious package) - [MAL-2026-11492](https://insights.sbomify.com/MAL-2026-11492/): Malicious code in test-dev-link (npm) (malicious package) - [MAL-2026-11491](https://insights.sbomify.com/MAL-2026-11491/): Malicious code in test-dev-host (npm) (malicious package) - [MAL-2026-11490](https://insights.sbomify.com/MAL-2026-11490/): Malicious code in test-dev-exec (npm) (malicious package) - [MAL-2026-1149](https://insights.sbomify.com/MAL-2026-1149/): Malicious code in hackpreinstall (npm) (malicious package) - [MAL-2026-11489](https://insights.sbomify.com/MAL-2026-11489/): Malicious code in test-dev-dispatch (npm) (malicious package) - [MAL-2026-11488](https://insights.sbomify.com/MAL-2026-11488/): Malicious code in test-dev-boot (npm) (malicious package) - [MAL-2026-11487](https://insights.sbomify.com/MAL-2026-11487/): Malicious code in tailwindcss-anim (npm) (malicious package) - [MAL-2026-11486](https://insights.sbomify.com/MAL-2026-11486/): Malicious code in smart-npv-mcp (npm) (malicious package) - [MAL-2026-11485](https://insights.sbomify.com/MAL-2026-11485/): Malicious code in simple-date-formatter-util-2 (npm) (malicious package) - [MAL-2026-11484](https://insights.sbomify.com/MAL-2026-11484/): Malicious code in simple-date-formatter-util-1 (npm) (malicious package) - [MAL-2026-11483](https://insights.sbomify.com/MAL-2026-11483/): Malicious code in simple-date-formatter-util (npm) (malicious package) - [MAL-2026-11482](https://insights.sbomify.com/MAL-2026-11482/): Malicious code in sap-mcp-facilitator (npm) (malicious package) - [MAL-2026-11481](https://insights.sbomify.com/MAL-2026-11481/): Malicious code in sap-mcp-config (npm) (malicious package) - [MAL-2026-11480](https://insights.sbomify.com/MAL-2026-11480/): Malicious code in routerbase-mcp (npm) (malicious package) - [MAL-2026-1148](https://insights.sbomify.com/MAL-2026-1148/): Malicious code in ethglobal-finale (npm) (malicious package) - [MAL-2026-11479](https://insights.sbomify.com/MAL-2026-11479/): Malicious code in rollup-plugin-polyfill-hold (npm) (malicious package) - [MAL-2026-11478](https://insights.sbomify.com/MAL-2026-11478/): Malicious code in rollup-plugin-polyfill-helper (npm) (malicious package) - [MAL-2026-11477](https://insights.sbomify.com/MAL-2026-11477/): Malicious code in refbase-mcp (npm) (malicious package) - [MAL-2026-11476](https://insights.sbomify.com/MAL-2026-11476/): Malicious code in polyprompt (npm) (malicious package) - [MAL-2026-11475](https://insights.sbomify.com/MAL-2026-11475/): Malicious code in pm-claude-skills-mcp (npm) (malicious package) - [MAL-2026-11474](https://insights.sbomify.com/MAL-2026-11474/): Malicious code in paraglide-js (npm) (malicious package) - [MAL-2026-11473](https://insights.sbomify.com/MAL-2026-11473/): Malicious code in metrics-ui (npm) (malicious package) - [MAL-2026-11472](https://insights.sbomify.com/MAL-2026-11472/): Malicious code in mcp-server-boilerplate (npm) (malicious package) - [MAL-2026-11471](https://insights.sbomify.com/MAL-2026-11471/): Malicious code in maximumsats-mcp (npm) (malicious package) - [MAL-2026-11470](https://insights.sbomify.com/MAL-2026-11470/): Malicious code in kip-mcp-http (npm) (malicious package) - [MAL-2026-1147](https://insights.sbomify.com/MAL-2026-1147/): Malicious code in danzxoffc74-libsignal (npm) (malicious package) - [MAL-2026-11469](https://insights.sbomify.com/MAL-2026-11469/): Malicious code in iwomm-mcp (npm) (malicious package) - [MAL-2026-11468](https://insights.sbomify.com/MAL-2026-11468/): Malicious code in install-native-host (npm) (malicious package) - [MAL-2026-11467](https://insights.sbomify.com/MAL-2026-11467/): Malicious code in iac-scanner (npm) (malicious package) - [MAL-2026-11466](https://insights.sbomify.com/MAL-2026-11466/): Malicious code in hit-mcp (npm) (malicious package) - [MAL-2026-11465](https://insights.sbomify.com/MAL-2026-11465/): Malicious code in hazmat-cfr (npm) (malicious package) - [MAL-2026-11464](https://insights.sbomify.com/MAL-2026-11464/): Malicious code in gtm-mcp-auth (npm) (malicious package) - [MAL-2026-11463](https://insights.sbomify.com/MAL-2026-11463/): Malicious code in goldenflow-js (npm) (malicious package) - [MAL-2026-11462](https://insights.sbomify.com/MAL-2026-11462/): Malicious code in fast-csv-helper (npm) (malicious package) - [MAL-2026-11461](https://insights.sbomify.com/MAL-2026-11461/): Malicious code in eth-bridge (npm) (malicious package) - [MAL-2026-11460](https://insights.sbomify.com/MAL-2026-11460/): Malicious code in create-remotion (npm) (malicious package) - [MAL-2026-1146](https://insights.sbomify.com/MAL-2026-1146/): Malicious code in danzxoffc74 (npm) (malicious package) - [MAL-2026-11459](https://insights.sbomify.com/MAL-2026-11459/): Malicious code in community-published (npm) (malicious package) - [MAL-2026-11458](https://insights.sbomify.com/MAL-2026-11458/): Malicious code in chaos-mcp (npm) (malicious package) - [MAL-2026-11457](https://insights.sbomify.com/MAL-2026-11457/): Malicious code in capacitor-assets (npm) (malicious package) - [MAL-2026-11456](https://insights.sbomify.com/MAL-2026-11456/): Malicious code in attio-discover (npm) (malicious package) - [MAL-2026-11455](https://insights.sbomify.com/MAL-2026-11455/): Malicious code in allurectl (npm) (malicious package) - [MAL-2026-11454](https://insights.sbomify.com/MAL-2026-11454/): Malicious code in ai-backup-script (npm) (malicious package) - [MAL-2026-11453](https://insights.sbomify.com/MAL-2026-11453/): Malicious code in adpanel-core (npm) (malicious package) - [MAL-2026-11452](https://insights.sbomify.com/MAL-2026-11452/): Malicious code in @sw-commons-components/message-upsell (npm) (malicious package) - [MAL-2026-11451](https://insights.sbomify.com/MAL-2026-11451/): Malicious code in @spending-behavior-ui/widget-insights (npm) (malicious package) - [MAL-2026-11450](https://insights.sbomify.com/MAL-2026-11450/): Malicious code in @spending-behavior-ui/cashflow-widget (npm) (malicious package) - [MAL-2026-1145](https://insights.sbomify.com/MAL-2026-1145/): Malicious code in @yazxzpedia/baileys (npm) (malicious package) - [MAL-2026-11449](https://insights.sbomify.com/MAL-2026-11449/): Malicious code in @sof-assistant-fe-lib/vertical-faqs (npm) (malicious package) - [MAL-2026-11448](https://insights.sbomify.com/MAL-2026-11448/): Malicious code in @peptide-packets/peptide-modify (npm) (malicious package) - [MAL-2026-11447](https://insights.sbomify.com/MAL-2026-11447/): Malicious code in @peptide-packets/js-unimode (npm) (malicious package) - [MAL-2026-11446](https://insights.sbomify.com/MAL-2026-11446/): Malicious code in @one-chat/react (npm) (malicious package) - [MAL-2026-11445](https://insights.sbomify.com/MAL-2026-11445/): Malicious code in @nordic-dev/linting-tools (npm) (malicious package) - [MAL-2026-11444](https://insights.sbomify.com/MAL-2026-11444/): Malicious code in @mplay-frontend-ui/link (npm) (malicious package) - [MAL-2026-11443](https://insights.sbomify.com/MAL-2026-11443/): Malicious code in @mplay-core-lib/utilities (npm) (malicious package) - [MAL-2026-11442](https://insights.sbomify.com/MAL-2026-11442/): Malicious code in @mp-op-ss-front-lib/tracks (npm) (malicious package) - [MAL-2026-11441](https://insights.sbomify.com/MAL-2026-11441/): Malicious code in @moxfive-llc/common (npm) (malicious package) - [MAL-2026-11440](https://insights.sbomify.com/MAL-2026-11440/): Malicious code in @meli-testing/jest-react (npm) (malicious package) - [MAL-2026-1144](https://insights.sbomify.com/MAL-2026-1144/): Malicious code in roku-aihub (PyPI) (malicious package) - [MAL-2026-11439](https://insights.sbomify.com/MAL-2026-11439/): Malicious code in @global-theme/context (npm) (malicious package) - [MAL-2026-11438](https://insights.sbomify.com/MAL-2026-11438/): Malicious code in @fuji-web-components/maps (npm) (malicious package) - [MAL-2026-11437](https://insights.sbomify.com/MAL-2026-11437/): Malicious code in @finance-ui/snackbar-ifpe (npm) (malicious package) - [MAL-2026-11436](https://insights.sbomify.com/MAL-2026-11436/): Malicious code in @finance-ui/finance-view (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/175/