# Vulnerabilities published in 2026 - [MAL-2026-11345](https://insights.sbomify.com/MAL-2026-11345/): Malicious code in passtpor (npm) (malicious package) - [MAL-2026-11344](https://insights.sbomify.com/MAL-2026-11344/): Malicious code in passsport1 (npm) (malicious package) - [MAL-2026-11343](https://insights.sbomify.com/MAL-2026-11343/): Malicious code in page_colors (npm) (malicious package) - [MAL-2026-11342](https://insights.sbomify.com/MAL-2026-11342/): Malicious code in npum (npm) (malicious package) - [MAL-2026-11341](https://insights.sbomify.com/MAL-2026-11341/): Malicious code in node-logger-winston (npm) (malicious package) - [MAL-2026-11340](https://insights.sbomify.com/MAL-2026-11340/): Malicious code in node-fs-extra-master (npm) (malicious package) - [MAL-2026-1134](https://insights.sbomify.com/MAL-2026-1134/): Malicious code in ts-big-number (npm) (malicious package) - [MAL-2026-11339](https://insights.sbomify.com/MAL-2026-11339/): Malicious code in node-fetch-core (npm) (malicious package) - [MAL-2026-11338](https://insights.sbomify.com/MAL-2026-11338/): Malicious code in ncc-web (npm) (malicious package) - [MAL-2026-11337](https://insights.sbomify.com/MAL-2026-11337/): Malicious code in ncc-hyperapp (npm) (malicious package) - [MAL-2026-11336](https://insights.sbomify.com/MAL-2026-11336/): Malicious code in ncc-fonts (npm) (malicious package) - [MAL-2026-11335](https://insights.sbomify.com/MAL-2026-11335/): Malicious code in n158 (npm) (malicious package) - [MAL-2026-11334](https://insights.sbomify.com/MAL-2026-11334/): Malicious code in moontose (npm) (malicious package) - [MAL-2026-11333](https://insights.sbomify.com/MAL-2026-11333/): Malicious code in mongostose (npm) (malicious package) - [MAL-2026-11332](https://insights.sbomify.com/MAL-2026-11332/): Malicious code in model-data-cache-service (npm) (malicious package) - [MAL-2026-11331](https://insights.sbomify.com/MAL-2026-11331/): Malicious code in merg-descripters (npm) (malicious package) - [MAL-2026-11330](https://insights.sbomify.com/MAL-2026-11330/): Malicious code in malxios (npm) (malicious package) - [MAL-2026-1133](https://insights.sbomify.com/MAL-2026-1133/): Malicious code in sukuna-baileys (npm) (malicious package) - [MAL-2026-11329](https://insights.sbomify.com/MAL-2026-11329/): Malicious code in maalxios (npm) (malicious package) - [MAL-2026-11328](https://insights.sbomify.com/MAL-2026-11328/): Malicious code in logform-core (npm) (malicious package) - [MAL-2026-11327](https://insights.sbomify.com/MAL-2026-11327/): Malicious code in lodash-ex (npm) (malicious package) - [MAL-2026-11326](https://insights.sbomify.com/MAL-2026-11326/): Malicious code in live-reload-on-error (npm) (malicious package) - [MAL-2026-11325](https://insights.sbomify.com/MAL-2026-11325/): Malicious code in kajl (npm) (malicious package) - [MAL-2026-11324](https://insights.sbomify.com/MAL-2026-11324/): Malicious code in js-focus-within (npm) (malicious package) - [MAL-2026-11323](https://insights.sbomify.com/MAL-2026-11323/): Malicious code in isix (npm) (malicious package) - [MAL-2026-11322](https://insights.sbomify.com/MAL-2026-11322/): Malicious code in installreact (npm) (malicious package) - [MAL-2026-11321](https://insights.sbomify.com/MAL-2026-11321/): Malicious code in inkalabs (npm) (malicious package) - [MAL-2026-11320](https://insights.sbomify.com/MAL-2026-11320/): Malicious code in imut-set (npm) (malicious package) - [MAL-2026-1132](https://insights.sbomify.com/MAL-2026-1132/): Malicious code in npm-doc-builder (npm) (malicious package) - [MAL-2026-11319](https://insights.sbomify.com/MAL-2026-11319/): Malicious code in impv (npm) (malicious package) - [MAL-2026-11318](https://insights.sbomify.com/MAL-2026-11318/): Malicious code in ideascloud (npm) (malicious package) - [MAL-2026-11317](https://insights.sbomify.com/MAL-2026-11317/): Malicious code in host-inspector-module (npm) (malicious package) - [MAL-2026-11316](https://insights.sbomify.com/MAL-2026-11316/): Malicious code in hjw-nasa-lib (npm) (malicious package) - [MAL-2026-11315](https://insights.sbomify.com/MAL-2026-11315/): Malicious code in gatorhelper (npm) (malicious package) - [MAL-2026-11314](https://insights.sbomify.com/MAL-2026-11314/): Malicious code in fwf (npm) (malicious package) - [MAL-2026-11313](https://insights.sbomify.com/MAL-2026-11313/): Malicious code in fsextrra (npm) (malicious package) - [MAL-2026-11312](https://insights.sbomify.com/MAL-2026-11312/): Malicious code in fs-extra-master (npm) (malicious package) - [MAL-2026-11311](https://insights.sbomify.com/MAL-2026-11311/): Malicious code in files-bucket-server (npm) (malicious package) - [MAL-2026-11310](https://insights.sbomify.com/MAL-2026-11310/): Malicious code in fcogvspgigatanzcydfyvgtjhvxibyau (npm) (malicious package) - [MAL-2026-1131](https://insights.sbomify.com/MAL-2026-1131/): Malicious code in ngaturkids (npm) (malicious package) - [MAL-2026-11309](https://insights.sbomify.com/MAL-2026-11309/): Malicious code in famshot (npm) (malicious package) - [MAL-2026-11308](https://insights.sbomify.com/MAL-2026-11308/): Malicious code in express.jd (npm) (malicious package) - [MAL-2026-11307](https://insights.sbomify.com/MAL-2026-11307/): Malicious code in express.ja (npm) (malicious package) - [MAL-2026-11306](https://insights.sbomify.com/MAL-2026-11306/): Malicious code in express-wrapper (npm) (malicious package) - [MAL-2026-11305](https://insights.sbomify.com/MAL-2026-11305/): Malicious code in express-test-dependency (npm) (malicious package) - [MAL-2026-11304](https://insights.sbomify.com/MAL-2026-11304/): Malicious code in express-sequelize-wrapper (npm) (malicious package) - [MAL-2026-11303](https://insights.sbomify.com/MAL-2026-11303/): Malicious code in express-bubble (npm) (malicious package) - [MAL-2026-11302](https://insights.sbomify.com/MAL-2026-11302/): Malicious code in expres.js (npm) (malicious package) - [MAL-2026-11301](https://insights.sbomify.com/MAL-2026-11301/): Malicious code in etwl (npm) (malicious package) - [MAL-2026-11300](https://insights.sbomify.com/MAL-2026-11300/): Malicious code in ethersss (npm) (malicious package) - [MAL-2026-1130](https://insights.sbomify.com/MAL-2026-1130/): Malicious code in kazumarii (npm) (malicious package) - [MAL-2026-113](https://insights.sbomify.com/MAL-2026-113/): Malicious code in garfield000 (npm) (malicious package) - [MAL-2026-11299](https://insights.sbomify.com/MAL-2026-11299/): Malicious code in ethers.jsonn (npm) (malicious package) - [MAL-2026-11298](https://insights.sbomify.com/MAL-2026-11298/): Malicious code in ethers.json (npm) (malicious package) - [MAL-2026-11297](https://insights.sbomify.com/MAL-2026-11297/): Malicious code in ethers-v6 (npm) (malicious package) - [MAL-2026-11296](https://insights.sbomify.com/MAL-2026-11296/): Malicious code in ethers-io-ethers (npm) (malicious package) - [MAL-2026-11295](https://insights.sbomify.com/MAL-2026-11295/): Malicious code in ethe.json (npm) (malicious package) - [MAL-2026-11294](https://insights.sbomify.com/MAL-2026-11294/): Malicious code in ethe (npm) (malicious package) - [MAL-2026-11293](https://insights.sbomify.com/MAL-2026-11293/): Malicious code in eth.json (npm) (malicious package) - [MAL-2026-11292](https://insights.sbomify.com/MAL-2026-11292/): Malicious code in equiviewer (npm) (malicious package) - [MAL-2026-11291](https://insights.sbomify.com/MAL-2026-11291/): Malicious code in ember-livereload-indicator (npm) (malicious package) - [MAL-2026-11290](https://insights.sbomify.com/MAL-2026-11290/): Malicious code in ember-cli-deploy-secrets (npm) (malicious package) - [MAL-2026-1129](https://insights.sbomify.com/MAL-2026-1129/): Malicious code in danzxz (npm) (malicious package) - [MAL-2026-11289](https://insights.sbomify.com/MAL-2026-11289/): Malicious code in ember-cli-deploy-derploy (npm) (malicious package) - [MAL-2026-11288](https://insights.sbomify.com/MAL-2026-11288/): Malicious code in ekspress (npm) (malicious package) - [MAL-2026-11287](https://insights.sbomify.com/MAL-2026-11287/): Malicious code in ecto-logger (npm) (malicious package) - [MAL-2026-11286](https://insights.sbomify.com/MAL-2026-11286/): Malicious code in easyinstaller (npm) (malicious package) - [MAL-2026-11285](https://insights.sbomify.com/MAL-2026-11285/): Malicious code in easycommons (npm) (malicious package) - [MAL-2026-11284](https://insights.sbomify.com/MAL-2026-11284/): Malicious code in dwa-tridion-webapp (npm) (malicious package) - [MAL-2026-11283](https://insights.sbomify.com/MAL-2026-11283/): Malicious code in dsilva-react-module-seed (npm) (malicious package) - [MAL-2026-11282](https://insights.sbomify.com/MAL-2026-11282/): Malicious code in dotex-plugin (npm) (malicious package) - [MAL-2026-11281](https://insights.sbomify.com/MAL-2026-11281/): Malicious code in dotenv-core (npm) (malicious package) - [MAL-2026-11280](https://insights.sbomify.com/MAL-2026-11280/): Malicious code in discord-starter (npm) (malicious package) - [MAL-2026-1128](https://insights.sbomify.com/MAL-2026-1128/): Malicious code in colorize-console (npm) (malicious package) - [MAL-2026-11279](https://insights.sbomify.com/MAL-2026-11279/): Malicious code in discord-rsc (npm) (malicious package) - [MAL-2026-11278](https://insights.sbomify.com/MAL-2026-11278/): Malicious code in discord-ms (npm) (malicious package) - [MAL-2026-11277](https://insights.sbomify.com/MAL-2026-11277/): Malicious code in discord-csr (npm) (malicious package) - [MAL-2026-11276](https://insights.sbomify.com/MAL-2026-11276/): Malicious code in decline (npm) (malicious package) - [MAL-2026-11275](https://insights.sbomify.com/MAL-2026-11275/): Malicious code in datdbs (npm) (malicious package) - [MAL-2026-11274](https://insights.sbomify.com/MAL-2026-11274/): Malicious code in dash-merge (npm) (malicious package) - [MAL-2026-11273](https://insights.sbomify.com/MAL-2026-11273/): Malicious code in d3-bbox (npm) (malicious package) - [MAL-2026-11272](https://insights.sbomify.com/MAL-2026-11272/): Malicious code in curse-dependent (npm) (malicious package) - [MAL-2026-11271](https://insights.sbomify.com/MAL-2026-11271/): Malicious code in cross-sell (npm) (malicious package) - [MAL-2026-11270](https://insights.sbomify.com/MAL-2026-11270/): Malicious code in create-backend-scaffold (npm) (malicious package) - [MAL-2026-1127](https://insights.sbomify.com/MAL-2026-1127/): Malicious code in @yaoii-bails/yaoii-baileys (npm) (malicious package) - [MAL-2026-11269](https://insights.sbomify.com/MAL-2026-11269/): Malicious code in consumerweb-risk (npm) (malicious package) - [MAL-2026-11268](https://insights.sbomify.com/MAL-2026-11268/): Malicious code in confetti-rebuilds (npm) (malicious package) - [MAL-2026-11267](https://insights.sbomify.com/MAL-2026-11267/): Malicious code in compose-logger-stand (npm) (malicious package) - [MAL-2026-11266](https://insights.sbomify.com/MAL-2026-11266/): Malicious code in columns_changed (npm) (malicious package) - [MAL-2026-11265](https://insights.sbomify.com/MAL-2026-11265/): Malicious code in cocktail-lib (npm) (malicious package) - [MAL-2026-11264](https://insights.sbomify.com/MAL-2026-11264/): Malicious code in cmd-auth (npm) (malicious package) - [MAL-2026-11263](https://insights.sbomify.com/MAL-2026-11263/): Malicious code in clotest (npm) (malicious package) - [MAL-2026-11262](https://insights.sbomify.com/MAL-2026-11262/): Malicious code in clo321-server (npm) (malicious package) - [MAL-2026-11261](https://insights.sbomify.com/MAL-2026-11261/): Malicious code in clo321 (npm) (malicious package) - [MAL-2026-11260](https://insights.sbomify.com/MAL-2026-11260/): Malicious code in clo2 (npm) (malicious package) - [MAL-2026-1126](https://insights.sbomify.com/MAL-2026-1126/): Malicious code in @yaoii-bails/socket (npm) (malicious package) - [MAL-2026-11259](https://insights.sbomify.com/MAL-2026-11259/): Malicious code in clo-adspect (npm) (malicious package) - [MAL-2026-11258](https://insights.sbomify.com/MAL-2026-11258/): Malicious code in chalk-helper (npm) (malicious package) - [MAL-2026-11257](https://insights.sbomify.com/MAL-2026-11257/): Malicious code in chalk-buttons (npm) (malicious package) - [MAL-2026-11256](https://insights.sbomify.com/MAL-2026-11256/): Malicious code in chalk-button (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/177/