# Vulnerabilities published in 2026


- [MAL-2026-11165](https://insights.sbomify.com/MAL-2026-11165/): Malicious code in cloud-config-fetcher (npm) (malicious package)
- [MAL-2026-11164](https://insights.sbomify.com/MAL-2026-11164/): Malicious code in aone-sandbox (npm) (malicious package)
- [MAL-2026-11163](https://insights.sbomify.com/MAL-2026-11163/): Malicious code in aone-kit-cli (npm) (malicious package)
- [MAL-2026-11162](https://insights.sbomify.com/MAL-2026-11162/): Malicious code in aone-kit (npm) (malicious package)
- [MAL-2026-11161](https://insights.sbomify.com/MAL-2026-11161/): Malicious code in @joyfill/layouts (npm) (malicious package)
- [MAL-2026-11160](https://insights.sbomify.com/MAL-2026-11160/): Malicious code in @joyfill/components (npm) (malicious package)
- [MAL-2026-1116](https://insights.sbomify.com/MAL-2026-1116/): Malicious code in js-nodecat (npm) (malicious package)
- [MAL-2026-11159](https://insights.sbomify.com/MAL-2026-11159/): Malicious code in toll_free (npm) (malicious package)
- [MAL-2026-11158](https://insights.sbomify.com/MAL-2026-11158/): Malicious code in blots (npm) (malicious package)
- [MAL-2026-11157](https://insights.sbomify.com/MAL-2026-11157/): Malicious code in @mypwn/hawkeye (npm) (malicious package)
- [MAL-2026-11156](https://insights.sbomify.com/MAL-2026-11156/): Malicious code in vtranalytic (PyPI) (malicious package)
- [MAL-2026-11155](https://insights.sbomify.com/MAL-2026-11155/): Malicious code in xerohub-discord-voice-v3 (npm) (malicious package)
- [MAL-2026-11154](https://insights.sbomify.com/MAL-2026-11154/): Malicious code in xerohub-discord-voice-v2 (npm) (malicious package)
- [MAL-2026-11153](https://insights.sbomify.com/MAL-2026-11153/): Malicious code in triage_bot_using_sdkv3 (npm) (malicious package)
- [MAL-2026-11152](https://insights.sbomify.com/MAL-2026-11152/): Malicious code in tidal-embed-player (npm) (malicious package)
- [MAL-2026-11151](https://insights.sbomify.com/MAL-2026-11151/): Malicious code in text-line-parser (npm) (malicious package)
- [MAL-2026-11150](https://insights.sbomify.com/MAL-2026-11150/): Malicious code in streak-daily-lib (npm) (malicious package)
- [MAL-2026-1115](https://insights.sbomify.com/MAL-2026-1115/): Malicious code in chai-vest (npm) (malicious package)
- [MAL-2026-11149](https://insights.sbomify.com/MAL-2026-11149/): Malicious code in streak-core-math (npm) (malicious package)
- [MAL-2026-11148](https://insights.sbomify.com/MAL-2026-11148/): Malicious code in streak-core-lib (npm) (malicious package)
- [MAL-2026-11147](https://insights.sbomify.com/MAL-2026-11147/): Malicious code in simple-probe-utils (npm) (malicious package)
- [MAL-2026-11146](https://insights.sbomify.com/MAL-2026-11146/): Malicious code in sigchain-js (npm) (malicious package)
- [MAL-2026-11145](https://insights.sbomify.com/MAL-2026-11145/): Malicious code in rollup-runtime-core-polyfills (npm) (malicious package)
- [MAL-2026-11144](https://insights.sbomify.com/MAL-2026-11144/): Malicious code in react-puller (npm) (malicious package)
- [MAL-2026-11143](https://insights.sbomify.com/MAL-2026-11143/): Malicious code in parallely (npm) (malicious package)
- [MAL-2026-11142](https://insights.sbomify.com/MAL-2026-11142/): Malicious code in node-array-plus (npm) (malicious package)
- [MAL-2026-11141](https://insights.sbomify.com/MAL-2026-11141/): Malicious code in lib-streak-math (npm) (malicious package)
- [MAL-2026-11140](https://insights.sbomify.com/MAL-2026-11140/): Malicious code in korvica (npm) (malicious package)
- [MAL-2026-1114](https://insights.sbomify.com/MAL-2026-1114/): Malicious code in vitetest-lint (npm) (malicious package)
- [MAL-2026-11139](https://insights.sbomify.com/MAL-2026-11139/): Malicious code in kordyn (npm) (malicious package)
- [MAL-2026-11138](https://insights.sbomify.com/MAL-2026-11138/): Malicious code in json-schema-inspector (npm) (malicious package)
- [MAL-2026-11137](https://insights.sbomify.com/MAL-2026-11137/): Malicious code in jobber-app-template-react (npm) (malicious package)
- [MAL-2026-11136](https://insights.sbomify.com/MAL-2026-11136/): Malicious code in fluid-type-ui (npm) (malicious package)
- [MAL-2026-11135](https://insights.sbomify.com/MAL-2026-11135/): Malicious code in ethers-secure (npm) (malicious package)
- [MAL-2026-11134](https://insights.sbomify.com/MAL-2026-11134/): Malicious code in color-convert-helper (npm) (malicious package)
- [MAL-2026-11133](https://insights.sbomify.com/MAL-2026-11133/): Malicious code in chain-analyze (npm) (malicious package)
- [MAL-2026-11132](https://insights.sbomify.com/MAL-2026-11132/): Malicious code in bianira-ui (npm) (malicious package)
- [MAL-2026-11131](https://insights.sbomify.com/MAL-2026-11131/): Malicious code in basic-vite (npm) (malicious package)
- [MAL-2026-11130](https://insights.sbomify.com/MAL-2026-11130/): Malicious code in array-node-utils (npm) (malicious package)
- [MAL-2026-1113](https://insights.sbomify.com/MAL-2026-1113/): Malicious code in typoriem (npm) (malicious package)
- [MAL-2026-11129](https://insights.sbomify.com/MAL-2026-11129/): Malicious code in app-svm-layer (npm) (malicious package)
- [MAL-2026-11128](https://insights.sbomify.com/MAL-2026-11128/): Malicious code in app-soda-layer (npm) (malicious package)
- [MAL-2026-11127](https://insights.sbomify.com/MAL-2026-11127/): Malicious code in app-sima-layer (npm) (malicious package)
- [MAL-2026-11126](https://insights.sbomify.com/MAL-2026-11126/): Malicious code in app-sim-layer (npm) (malicious package)
- [MAL-2026-11125](https://insights.sbomify.com/MAL-2026-11125/): Malicious code in api-rust-sdk (npm) (malicious package)
- [MAL-2026-11124](https://insights.sbomify.com/MAL-2026-11124/): Malicious code in api-node-sdk (npm) (malicious package)
- [MAL-2026-11123](https://insights.sbomify.com/MAL-2026-11123/): Malicious code in @yancyyu/agentcli (npm) (malicious package)
- [MAL-2026-11122](https://insights.sbomify.com/MAL-2026-11122/): Malicious code in @crbrc/xbt (npm) (malicious package)
- [MAL-2026-11121](https://insights.sbomify.com/MAL-2026-11121/): Malicious code in @apexfnd/apex (npm) (malicious package)
- [MAL-2026-11120](https://insights.sbomify.com/MAL-2026-11120/): Malicious code in @ai_/autoprefixers (npm) (malicious package)
- [MAL-2026-1112](https://insights.sbomify.com/MAL-2026-1112/): Malicious code in sequelization (npm) (malicious package)
- [MAL-2026-11119](https://insights.sbomify.com/MAL-2026-11119/): Malicious code in json-to-table-util (npm) (malicious package)
- [MAL-2026-11118](https://insights.sbomify.com/MAL-2026-11118/): Malicious code in array-sort-helper (npm) (malicious package)
- [MAL-2026-11117](https://insights.sbomify.com/MAL-2026-11117/): Malicious code in @wagni_bot/web3 (npm) (malicious package)
- [MAL-2026-11116](https://insights.sbomify.com/MAL-2026-11116/): Malicious code in @wagni_bot/wagni (npm) (malicious package)
- [MAL-2026-11115](https://insights.sbomify.com/MAL-2026-11115/): Malicious code in @wagni_bot/polymarket (npm) (malicious package)
- [MAL-2026-11114](https://insights.sbomify.com/MAL-2026-11114/): Malicious code in @wagni_bot/polygon (npm) (malicious package)
- [MAL-2026-11113](https://insights.sbomify.com/MAL-2026-11113/): Malicious code in @wagni_bot/opensea (npm) (malicious package)
- [MAL-2026-11112](https://insights.sbomify.com/MAL-2026-11112/): Malicious code in @wagni_bot/metamask (npm) (malicious package)
- [MAL-2026-11111](https://insights.sbomify.com/MAL-2026-11111/): Malicious code in @wagni_bot/hyperliquid (npm) (malicious package)
- [MAL-2026-11110](https://insights.sbomify.com/MAL-2026-11110/): Malicious code in @wagni_bot/eth (npm) (malicious package)
- [MAL-2026-1111](https://insights.sbomify.com/MAL-2026-1111/): Malicious code in mqttoken (npm) (malicious package)
- [MAL-2026-11109](https://insights.sbomify.com/MAL-2026-11109/): Malicious code in @wagni_bot/bsc (npm) (malicious package)
- [MAL-2026-11108](https://insights.sbomify.com/MAL-2026-11108/): Malicious code in string-format-kit (npm) (malicious package)
- [MAL-2026-11107](https://insights.sbomify.com/MAL-2026-11107/): Malicious code in num-format-helper (npm) (malicious package)
- [MAL-2026-11106](https://insights.sbomify.com/MAL-2026-11106/): Malicious code in date-sanitize-helper (npm) (malicious package)
- [MAL-2026-11105](https://insights.sbomify.com/MAL-2026-11105/): Malicious code in xo-twofa (npm) (malicious package)
- [MAL-2026-11104](https://insights.sbomify.com/MAL-2026-11104/): Malicious code in tailwind-motionkit (npm) (malicious package)
- [MAL-2026-11103](https://insights.sbomify.com/MAL-2026-11103/): Malicious code in stargateproxyserv (npm) (malicious package)
- [MAL-2026-11102](https://insights.sbomify.com/MAL-2026-11102/): Malicious code in riskunifiedgatewayserv (npm) (malicious package)
- [MAL-2026-11101](https://insights.sbomify.com/MAL-2026-11101/): Malicious code in motion-forge-css (npm) (malicious package)
- [MAL-2026-11100](https://insights.sbomify.com/MAL-2026-11100/): Malicious code in identityauthorizationserv (npm) (malicious package)
- [MAL-2026-1110](https://insights.sbomify.com/MAL-2026-1110/): Malicious code in loadash-lint (npm) (malicious package)
- [MAL-2026-111](https://insights.sbomify.com/MAL-2026-111/): Malicious code in aog3 (npm) (malicious package)
- [MAL-2026-11099](https://insights.sbomify.com/MAL-2026-11099/): Malicious code in demo-awesome-date-parser-test (npm) (malicious package)
- [MAL-2026-11098](https://insights.sbomify.com/MAL-2026-11098/): Malicious code in crm-reportinsightserv-paypal (npm) (malicious package)
- [MAL-2026-11097](https://insights.sbomify.com/MAL-2026-11097/): Malicious code in @vaultflow/update-flow (npm) (malicious package)
- [MAL-2026-11096](https://insights.sbomify.com/MAL-2026-11096/): Malicious code in @vaultflow/create-flow (npm) (malicious package)
- [MAL-2026-11095](https://insights.sbomify.com/MAL-2026-11095/): Malicious code in @array-util/subsearch (npm) (malicious package)
- [MAL-2026-11094](https://insights.sbomify.com/MAL-2026-11094/): Malicious code in cfgzen (PyPI) (malicious package)
- [MAL-2026-11093](https://insights.sbomify.com/MAL-2026-11093/): Malicious code in @heartlandone-private/fontawesome-pro (npm) (malicious package)
- [MAL-2026-11092](https://insights.sbomify.com/MAL-2026-11092/): Malicious code in txs-sdk-lib (npm) (malicious package)
- [MAL-2026-11091](https://insights.sbomify.com/MAL-2026-11091/): Malicious code in txs-runner-lib (npm) (malicious package)
- [MAL-2026-11090](https://insights.sbomify.com/MAL-2026-11090/): Malicious code in txs-random-lib (npm) (malicious package)
- [MAL-2026-1109](https://insights.sbomify.com/MAL-2026-1109/): Malicious code in jsnwebapptoken (npm) (malicious package)
- [MAL-2026-11089](https://insights.sbomify.com/MAL-2026-11089/): Malicious code in txs-builder (npm) (malicious package)
- [MAL-2026-11088](https://insights.sbomify.com/MAL-2026-11088/): Malicious code in sixbails (npm) (malicious package)
- [MAL-2026-11087](https://insights.sbomify.com/MAL-2026-11087/): Malicious code in kalipto-runtime (npm) (malicious package)
- [MAL-2026-11086](https://insights.sbomify.com/MAL-2026-11086/): Malicious code in fazzgram (npm) (malicious package)
- [MAL-2026-11085](https://insights.sbomify.com/MAL-2026-11085/): Malicious code in fazzanime (npm) (malicious package)
- [MAL-2026-11084](https://insights.sbomify.com/MAL-2026-11084/): Malicious code in express-self-destruct1 (npm) (malicious package)
- [MAL-2026-11083](https://insights.sbomify.com/MAL-2026-11083/): Malicious code in edu-npm-helper-beta (npm) (malicious package)
- [MAL-2026-11082](https://insights.sbomify.com/MAL-2026-11082/): Malicious code in edu-npm-helper-alpha (npm) (malicious package)
- [MAL-2026-11081](https://insights.sbomify.com/MAL-2026-11081/): Malicious code in amanexzyra-baileys (npm) (malicious package)
- [MAL-2026-11080](https://insights.sbomify.com/MAL-2026-11080/): Malicious code in @vinnxcode/xbailsync (npm) (malicious package)
- [MAL-2026-1108](https://insights.sbomify.com/MAL-2026-1108/): Malicious code in hapi-lint (npm) (malicious package)
- [MAL-2026-11079](https://insights.sbomify.com/MAL-2026-11079/): Malicious code in @vinnxcode/libsignal-node (npm) (malicious package)
- [MAL-2026-11078](https://insights.sbomify.com/MAL-2026-11078/): Malicious code in @thone33/react-helpers (npm) (malicious package)
- [MAL-2026-11077](https://insights.sbomify.com/MAL-2026-11077/): Malicious code in @sqlite-tag/sql-creator (npm) (malicious package)
- [MAL-2026-11076](https://insights.sbomify.com/MAL-2026-11076/): Malicious code in @sqlite-tag/schema-generator (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/179/