# Vulnerabilities published in 2026


- [MAL-2026-11255](https://insights.sbomify.com/MAL-2026-11255/): Malicious code in chalk-butons (npm) (malicious package)
- [MAL-2026-11254](https://insights.sbomify.com/MAL-2026-11254/): Malicious code in canvas-to (npm) (malicious package)
- [MAL-2026-11253](https://insights.sbomify.com/MAL-2026-11253/): Malicious code in cancelling (npm) (malicious package)
- [MAL-2026-11252](https://insights.sbomify.com/MAL-2026-11252/): Malicious code in build-time-metrics (npm) (malicious package)
- [MAL-2026-11251](https://insights.sbomify.com/MAL-2026-11251/): Malicious code in broccoli-watcher-siphon (npm) (malicious package)
- [MAL-2026-11250](https://insights.sbomify.com/MAL-2026-11250/): Malicious code in bn.js-5 (npm) (malicious package)
- [MAL-2026-1125](https://insights.sbomify.com/MAL-2026-1125/): Malicious code in @yaoii-bails/libsignall-node (npm) (malicious package)
- [MAL-2026-11249](https://insights.sbomify.com/MAL-2026-11249/): Malicious code in bn.js-4 (npm) (malicious package)
- [MAL-2026-11248](https://insights.sbomify.com/MAL-2026-11248/): Malicious code in blbird (npm) (malicious package)
- [MAL-2026-11247](https://insights.sbomify.com/MAL-2026-11247/): Malicious code in base58-ts (npm) (malicious package)
- [MAL-2026-11246](https://insights.sbomify.com/MAL-2026-11246/): Malicious code in base-x-ts (npm) (malicious package)
- [MAL-2026-11245](https://insights.sbomify.com/MAL-2026-11245/): Malicious code in baofdadbybmqeefeeginweoamxlphrjq (npm) (malicious package)
- [MAL-2026-11244](https://insights.sbomify.com/MAL-2026-11244/): Malicious code in bajkvahzv8allnltvr7x4s5hdxkjvyji (npm) (malicious package)
- [MAL-2026-11243](https://insights.sbomify.com/MAL-2026-11243/): Malicious code in aven_shared (npm) (malicious package)
- [MAL-2026-11242](https://insights.sbomify.com/MAL-2026-11242/): Malicious code in asdsafsafdasdsaasdasda (npm) (malicious package)
- [MAL-2026-11241](https://insights.sbomify.com/MAL-2026-11241/): Malicious code in asdsafsadad (npm) (malicious package)
- [MAL-2026-11240](https://insights.sbomify.com/MAL-2026-11240/): Malicious code in aruda (npm) (malicious package)
- [MAL-2026-1124](https://insights.sbomify.com/MAL-2026-1124/): Malicious code in @yaoii-bails/libsignal-node (npm) (malicious package)
- [MAL-2026-11239](https://insights.sbomify.com/MAL-2026-11239/): Malicious code in apijsclo (npm) (malicious package)
- [MAL-2026-11238](https://insights.sbomify.com/MAL-2026-11238/): Malicious code in apihost (npm) (malicious package)
- [MAL-2026-11237](https://insights.sbomify.com/MAL-2026-11237/): Malicious code in api-gateway-lambda-router (npm) (malicious package)
- [MAL-2026-11236](https://insights.sbomify.com/MAL-2026-11236/): Malicious code in android-web-logger (npm) (malicious package)
- [MAL-2026-11235](https://insights.sbomify.com/MAL-2026-11235/): Malicious code in ag-grid-boost (npm) (malicious package)
- [MAL-2026-11234](https://insights.sbomify.com/MAL-2026-11234/): Malicious code in @web3utils/common (npm) (malicious package)
- [MAL-2026-11233](https://insights.sbomify.com/MAL-2026-11233/): Malicious code in @web3-util/common (npm) (malicious package)
- [MAL-2026-11232](https://insights.sbomify.com/MAL-2026-11232/): Malicious code in @spectraltest/loglevel (npm) (malicious package)
- [MAL-2026-11231](https://insights.sbomify.com/MAL-2026-11231/): Malicious code in @sourav_chanduka/oidc-client (npm) (malicious package)
- [MAL-2026-11230](https://insights.sbomify.com/MAL-2026-11230/): Malicious code in @sourav_chanduka/core-no-ngrok (npm) (malicious package)
- [MAL-2026-1123](https://insights.sbomify.com/MAL-2026-1123/): Malicious code in @yaoii-bails/baileys (npm) (malicious package)
- [MAL-2026-11229](https://insights.sbomify.com/MAL-2026-11229/): Malicious code in @sourav_chanduka/core (npm) (malicious package)
- [MAL-2026-11228](https://insights.sbomify.com/MAL-2026-11228/): Malicious code in @solana-utils/common (npm) (malicious package)
- [MAL-2026-11227](https://insights.sbomify.com/MAL-2026-11227/): Malicious code in @solana-sdk/web3.js (npm) (malicious package)
- [MAL-2026-11226](https://insights.sbomify.com/MAL-2026-11226/): Malicious code in @santieich/homebridge-midea-lan (npm) (malicious package)
- [MAL-2026-11225](https://insights.sbomify.com/MAL-2026-11225/): Malicious code in @relforce-dev/console-log (npm) (malicious package)
- [MAL-2026-11224](https://insights.sbomify.com/MAL-2026-11224/): Malicious code in @pumpdot-fun/pump-swap-sdk (npm) (malicious package)
- [MAL-2026-11223](https://insights.sbomify.com/MAL-2026-11223/): Malicious code in @pumpdot-fun/pump-sdk (npm) (malicious package)
- [MAL-2026-11222](https://insights.sbomify.com/MAL-2026-11222/): Malicious code in @patternfly-4/react-tokens (npm) (malicious package)
- [MAL-2026-11221](https://insights.sbomify.com/MAL-2026-11221/): Malicious code in @patternfly-4/react-table (npm) (malicious package)
- [MAL-2026-11220](https://insights.sbomify.com/MAL-2026-11220/): Malicious code in @patternfly-4/react-core (npm) (malicious package)
- [MAL-2026-1122](https://insights.sbomify.com/MAL-2026-1122/): Malicious code in @sanzxcode/libsignal-node (npm) (malicious package)
- [MAL-2026-11219](https://insights.sbomify.com/MAL-2026-11219/): Malicious code in @patternfly-4/quickstarts (npm) (malicious package)
- [MAL-2026-11218](https://insights.sbomify.com/MAL-2026-11218/): Malicious code in @nordea-web/ui (npm) (malicious package)
- [MAL-2026-11217](https://insights.sbomify.com/MAL-2026-11217/): Malicious code in @nordea-web/core (npm) (malicious package)
- [MAL-2026-11216](https://insights.sbomify.com/MAL-2026-11216/): Malicious code in @node-console-log/log (npm) (malicious package)
- [MAL-2026-11215](https://insights.sbomify.com/MAL-2026-11215/): Malicious code in @meteora-sdk/core (npm) (malicious package)
- [MAL-2026-11214](https://insights.sbomify.com/MAL-2026-11214/): Malicious code in @grua/icons (npm) (malicious package)
- [MAL-2026-11213](https://insights.sbomify.com/MAL-2026-11213/): Malicious code in @grua/core (npm) (malicious package)
- [MAL-2026-11212](https://insights.sbomify.com/MAL-2026-11212/): Malicious code in @goodjavascript/dotenv (npm) (malicious package)
- [MAL-2026-11211](https://insights.sbomify.com/MAL-2026-11211/): Malicious code in @ethers-sdk/wallet (npm) (malicious package)
- [MAL-2026-11210](https://insights.sbomify.com/MAL-2026-11210/): Malicious code in @ethers-sdk/ethers (npm) (malicious package)
- [MAL-2026-1121](https://insights.sbomify.com/MAL-2026-1121/): Malicious code in @sanzxcode/baileys (npm) (malicious package)
- [MAL-2026-11209](https://insights.sbomify.com/MAL-2026-11209/): Malicious code in @dotconf-pro/dotenv (npm) (malicious package)
- [MAL-2026-11208](https://insights.sbomify.com/MAL-2026-11208/): Malicious code in @dotconf-pro/dotconf-pro (npm) (malicious package)
- [MAL-2026-11207](https://insights.sbomify.com/MAL-2026-11207/): Malicious code in @404c3s4r/testxxx (npm) (malicious package)
- [MAL-2026-11206](https://insights.sbomify.com/MAL-2026-11206/): Malicious code in 1apijs (npm) (malicious package)
- [MAL-2026-11205](https://insights.sbomify.com/MAL-2026-11205/): Malicious code in redis-type-xyz (npm) (malicious package)
- [MAL-2026-11204](https://insights.sbomify.com/MAL-2026-11204/): Malicious code in nano-perf (npm) (malicious package)
- [MAL-2026-11203](https://insights.sbomify.com/MAL-2026-11203/): Malicious code in @dexwilt/node-fetch (npm) (malicious package)
- [MAL-2026-11202](https://insights.sbomify.com/MAL-2026-11202/): Malicious code in ml-shared (PyPI) (malicious package)
- [MAL-2026-11201](https://insights.sbomify.com/MAL-2026-11201/): Malicious code in ml-nps-shared (PyPI) (malicious package)
- [MAL-2026-11200](https://insights.sbomify.com/MAL-2026-11200/): Malicious code in ml-fdbk-shared (PyPI) (malicious package)
- [MAL-2026-1120](https://insights.sbomify.com/MAL-2026-1120/): Malicious code in @nazi-team/libsignal-node (npm) (malicious package)
- [MAL-2026-112](https://insights.sbomify.com/MAL-2026-112/): Malicious code in fbfu (npm) (malicious package)
- [MAL-2026-11199](https://insights.sbomify.com/MAL-2026-11199/): Malicious code in ml-data-shared (PyPI) (malicious package)
- [MAL-2026-11198](https://insights.sbomify.com/MAL-2026-11198/): Malicious code in mcp-search-server (PyPI) (malicious package)
- [MAL-2026-11197](https://insights.sbomify.com/MAL-2026-11197/): Malicious code in ai-perf-toolkit (PyPI) (malicious package)
- [MAL-2026-11196](https://insights.sbomify.com/MAL-2026-11196/): Malicious code in @wbnr/design (npm) (malicious package)
- [MAL-2026-11195](https://insights.sbomify.com/MAL-2026-11195/): Malicious code in phabricator-client (PyPI) (malicious package)
- [MAL-2026-11194](https://insights.sbomify.com/MAL-2026-11194/): Malicious code in n8n-nodes-trust-me-im-totally-safe (npm) (malicious package)
- [MAL-2026-11193](https://insights.sbomify.com/MAL-2026-11193/): Malicious code in litespeed-cache (npm) (malicious package)
- [MAL-2026-11192](https://insights.sbomify.com/MAL-2026-11192/): Malicious code in test2221 (npm) (malicious package)
- [MAL-2026-11191](https://insights.sbomify.com/MAL-2026-11191/): Malicious code in zer0code (npm) (malicious package)
- [MAL-2026-11190](https://insights.sbomify.com/MAL-2026-11190/): Malicious code in uniapi-bridge (npm) (malicious package)
- [MAL-2026-1119](https://insights.sbomify.com/MAL-2026-1119/): Malicious code in @nazi-team/baileys (npm) (malicious package)
- [MAL-2026-11189](https://insights.sbomify.com/MAL-2026-11189/): Malicious code in test-skill-zip (npm) (malicious package)
- [MAL-2026-11188](https://insights.sbomify.com/MAL-2026-11188/): Malicious code in open-worker-cli (npm) (malicious package)
- [MAL-2026-11187](https://insights.sbomify.com/MAL-2026-11187/): Malicious code in lzd-unified-station-sdk (npm) (malicious package)
- [MAL-2026-11186](https://insights.sbomify.com/MAL-2026-11186/): Malicious code in lwp-web-client (npm) (malicious package)
- [MAL-2026-11185](https://insights.sbomify.com/MAL-2026-11185/): Malicious code in flight-compare-analyzer (npm) (malicious package)
- [MAL-2026-11184](https://insights.sbomify.com/MAL-2026-11184/): Malicious code in feedback-ai-sdk (npm) (malicious package)
- [MAL-2026-11183](https://insights.sbomify.com/MAL-2026-11183/): Malicious code in def-open-client (npm) (malicious package)
- [MAL-2026-11182](https://insights.sbomify.com/MAL-2026-11182/): Malicious code in colder-cli (npm) (malicious package)
- [MAL-2026-11181](https://insights.sbomify.com/MAL-2026-11181/): Malicious code in chain-manager (npm) (malicious package)
- [MAL-2026-11180](https://insights.sbomify.com/MAL-2026-11180/): Malicious code in aone-cloud-cli (npm) (malicious package)
- [MAL-2026-1118](https://insights.sbomify.com/MAL-2026-1118/): Malicious code in @daffadeveloper/libsignal-node (npm) (malicious package)
- [MAL-2026-11179](https://insights.sbomify.com/MAL-2026-11179/): Malicious code in @zannstore/baileys (npm) (malicious package)
- [MAL-2026-11178](https://insights.sbomify.com/MAL-2026-11178/): Malicious code in @peptide-unit/peptide-modify (npm) (malicious package)
- [MAL-2026-11177](https://insights.sbomify.com/MAL-2026-11177/): Malicious code in @peptide-unit/js-unimode (npm) (malicious package)
- [MAL-2026-11176](https://insights.sbomify.com/MAL-2026-11176/): Malicious code in @bowozzz/baileys (npm) (malicious package)
- [MAL-2026-11175](https://insights.sbomify.com/MAL-2026-11175/): Malicious code in @ai-plus/de-agent-sdk (npm) (malicious package)
- [MAL-2026-11174](https://insights.sbomify.com/MAL-2026-11174/): Malicious code in @ai-plus/de-agent (npm) (malicious package)
- [MAL-2026-11173](https://insights.sbomify.com/MAL-2026-11173/): Malicious code in @ai-agent-node/nodesql (npm) (malicious package)
- [MAL-2026-11172](https://insights.sbomify.com/MAL-2026-11172/): Malicious code in @ai-agent-node/createnode (npm) (malicious package)
- [MAL-2026-11171](https://insights.sbomify.com/MAL-2026-11171/): Malicious code in @ai-agent-node/agent-node (npm) (malicious package)
- [MAL-2026-11170](https://insights.sbomify.com/MAL-2026-11170/): Malicious code in @finxsecdemo/utils (npm) (malicious package)
- [MAL-2026-1117](https://insights.sbomify.com/MAL-2026-1117/): Malicious code in @daffadeveloper/baileys (npm) (malicious package)
- [MAL-2026-11169](https://insights.sbomify.com/MAL-2026-11169/): Malicious code in smart-config-manager (npm) (malicious package)
- [MAL-2026-11168](https://insights.sbomify.com/MAL-2026-11168/): Malicious code in postcss-motion-utils (npm) (malicious package)
- [MAL-2026-11167](https://insights.sbomify.com/MAL-2026-11167/): Malicious code in local-config-parser (npm) (malicious package)
- [MAL-2026-11166](https://insights.sbomify.com/MAL-2026-11166/): Malicious code in lib-mtop (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/178/