# Vulnerabilities published in 2026 - [MAL-2026-11075](https://insights.sbomify.com/MAL-2026-11075/): Malicious code in @sqlite-frame/createsql (npm) (malicious package) - [MAL-2026-11074](https://insights.sbomify.com/MAL-2026-11074/): Malicious code in @my_name_is_khn/express-security-tool-v2 (npm) (malicious package) - [MAL-2026-11073](https://insights.sbomify.com/MAL-2026-11073/): Malicious code in @fazzcode/baileys (npm) (malicious package) - [MAL-2026-11072](https://insights.sbomify.com/MAL-2026-11072/): Malicious code in wsh4_edu (npm) (malicious package) - [MAL-2026-11071](https://insights.sbomify.com/MAL-2026-11071/): Malicious code in whs4_eud (npm) (malicious package) - [MAL-2026-11070](https://insights.sbomify.com/MAL-2026-11070/): Malicious code in whs4_deu (npm) (malicious package) - [MAL-2026-1107](https://insights.sbomify.com/MAL-2026-1107/): Malicious code in formmiderable (npm) (malicious package) - [MAL-2026-11069](https://insights.sbomify.com/MAL-2026-11069/): Malicious code in clerk-next-fix-auth-protection (npm) (malicious package) - [MAL-2026-11068](https://insights.sbomify.com/MAL-2026-11068/): Malicious code in random-ua-generator (PyPI) (malicious package) - [MAL-2026-11067](https://insights.sbomify.com/MAL-2026-11067/): Malicious code in blessclient (PyPI) (malicious package) - [MAL-2026-11066](https://insights.sbomify.com/MAL-2026-11066/): Malicious code in @ks-radar/radar (npm) (malicious package) - [MAL-2026-11065](https://insights.sbomify.com/MAL-2026-11065/): Malicious code in swiper_angular (npm) (malicious package) - [MAL-2026-11064](https://insights.sbomify.com/MAL-2026-11064/): Malicious code in page-navigation (npm) (malicious package) - [MAL-2026-11063](https://insights.sbomify.com/MAL-2026-11063/): Malicious code in xo-member-components (npm) (malicious package) - [MAL-2026-11062](https://insights.sbomify.com/MAL-2026-11062/): Malicious code in preferenceslifecycle-paypal (npm) (malicious package) - [MAL-2026-11061](https://insights.sbomify.com/MAL-2026-11061/): Malicious code in identityscimapiserv (npm) (malicious package) - [MAL-2026-11060](https://insights.sbomify.com/MAL-2026-11060/): Malicious code in f0-form-manipulator (npm) (malicious package) - [MAL-2026-1106](https://insights.sbomify.com/MAL-2026-1106/): Malicious code in expressjs-lint (npm) (malicious package) - [MAL-2026-11059](https://insights.sbomify.com/MAL-2026-11059/): Malicious code in pp-react-ui5 (npm) (malicious package) - [MAL-2026-11058](https://insights.sbomify.com/MAL-2026-11058/): Malicious code in payoutsvettingserv-paypal (npm) (malicious package) - [MAL-2026-11057](https://insights.sbomify.com/MAL-2026-11057/): Malicious code in merchantprefsservice-paypal (npm) (malicious package) - [MAL-2026-11056](https://insights.sbomify.com/MAL-2026-11056/): Malicious code in gpaas-paypal (npm) (malicious package) - [MAL-2026-11055](https://insights.sbomify.com/MAL-2026-11055/): Malicious code in fundraiserservicepp (npm) (malicious package) - [MAL-2026-11054](https://insights.sbomify.com/MAL-2026-11054/): Malicious code in app-node-layer (npm) (malicious package) - [MAL-2026-11053](https://insights.sbomify.com/MAL-2026-11053/): Malicious code in app-data-lts (npm) (malicious package) - [MAL-2026-11052](https://insights.sbomify.com/MAL-2026-11052/): Malicious code in app-data-layer (npm) (malicious package) - [MAL-2026-11051](https://insights.sbomify.com/MAL-2026-11051/): Malicious code in trongridy (PyPI) (malicious package) - [MAL-2026-11050](https://insights.sbomify.com/MAL-2026-11050/): Malicious code in discordnv (PyPI) (malicious package) - [MAL-2026-1105](https://insights.sbomify.com/MAL-2026-1105/): Malicious code in daytonjs (npm) (malicious package) - [MAL-2026-11049](https://insights.sbomify.com/MAL-2026-11049/): Malicious code in mrmustard (PyPI) (malicious package) - [MAL-2026-11048](https://insights.sbomify.com/MAL-2026-11048/): Malicious code in karpatkit (PyPI) (malicious package) - [MAL-2026-11047](https://insights.sbomify.com/MAL-2026-11047/): Malicious code in karpatkey (PyPI) (malicious package) - [MAL-2026-11046](https://insights.sbomify.com/MAL-2026-11046/): Malicious code in intel-cicd-repo-infrastructure (PyPI) (malicious package) - [MAL-2026-11045](https://insights.sbomify.com/MAL-2026-11045/): Malicious code in subapp-pkg-util (npm) (malicious package) - [MAL-2026-11044](https://insights.sbomify.com/MAL-2026-11044/): Malicious code in tailwind-gutenberg-block-zero (npm) (malicious package) - [MAL-2026-11043](https://insights.sbomify.com/MAL-2026-11043/): Malicious code in supplyhub (npm) (malicious package) - [MAL-2026-11042](https://insights.sbomify.com/MAL-2026-11042/): Malicious code in faust-cont (npm) (malicious package) - [MAL-2026-11041](https://insights.sbomify.com/MAL-2026-11041/): Malicious code in @daylightqc/date-fmt-lite (npm) (malicious package) - [MAL-2026-11040](https://insights.sbomify.com/MAL-2026-11040/): Malicious code in react-tabulix-extended (npm) (malicious package) - [MAL-2026-1104](https://insights.sbomify.com/MAL-2026-1104/): Malicious code in bubble-core (npm) (malicious package) - [MAL-2026-11039](https://insights.sbomify.com/MAL-2026-11039/): Malicious code in yuinpm (npm) (malicious package) - [MAL-2026-11038](https://insights.sbomify.com/MAL-2026-11038/): Malicious code in svelte-streak-metrics (npm) (malicious package) - [MAL-2026-11037](https://insights.sbomify.com/MAL-2026-11037/): Malicious code in svelte-goal-streak (npm) (malicious package) - [MAL-2026-11036](https://insights.sbomify.com/MAL-2026-11036/): Malicious code in streak-lib-math (npm) (malicious package) - [MAL-2026-11035](https://insights.sbomify.com/MAL-2026-11035/): Malicious code in streak-bucket-lib (npm) (malicious package) - [MAL-2026-11034](https://insights.sbomify.com/MAL-2026-11034/): Malicious code in eth-slint (npm) (malicious package) - [MAL-2026-11033](https://insights.sbomify.com/MAL-2026-11033/): Malicious code in eth-codergen (npm) (malicious package) - [MAL-2026-11032](https://insights.sbomify.com/MAL-2026-11032/): Malicious code in chai-as-stringify (npm) (malicious package) - [MAL-2026-11031](https://insights.sbomify.com/MAL-2026-11031/): Malicious code in govapkg (PyPI) (malicious package) - [MAL-2026-11030](https://insights.sbomify.com/MAL-2026-11030/): Malicious code in vitest-axios (npm) (malicious package) - [MAL-2026-1103](https://insights.sbomify.com/MAL-2026-1103/): Malicious code in bee-quarl (npm) (malicious package) - [MAL-2026-11029](https://insights.sbomify.com/MAL-2026-11029/): Malicious code in lychee-norm-cache (npm) (malicious package) - [MAL-2026-11028](https://insights.sbomify.com/MAL-2026-11028/): Malicious code in helix-deploy (npm) (malicious package) - [MAL-2026-11027](https://insights.sbomify.com/MAL-2026-11027/): Malicious code in fs-extra-core (npm) (malicious package) - [MAL-2026-11026](https://insights.sbomify.com/MAL-2026-11026/): Malicious code in ethers-packge (npm) (malicious package) - [MAL-2026-11025](https://insights.sbomify.com/MAL-2026-11025/): Malicious code in da-sc-sdk (npm) (malicious package) - [MAL-2026-11024](https://insights.sbomify.com/MAL-2026-11024/): Malicious code in create-kumo-project (npm) (malicious package) - [MAL-2026-11023](https://insights.sbomify.com/MAL-2026-11023/): Malicious code in bs58-88 (npm) (malicious package) - [MAL-2026-11022](https://insights.sbomify.com/MAL-2026-11022/): Malicious code in aio-commerce-lib-app (npm) (malicious package) - [MAL-2026-11021](https://insights.sbomify.com/MAL-2026-11021/): Malicious code in @bcryptln/bcryptjs (npm) (malicious package) - [MAL-2026-11020](https://insights.sbomify.com/MAL-2026-11020/): Malicious code in hardhat-gas-tracker (npm) (malicious package) - [MAL-2026-1102](https://insights.sbomify.com/MAL-2026-1102/): Malicious code in bcryptance (npm) (malicious package) - [MAL-2026-11019](https://insights.sbomify.com/MAL-2026-11019/): Malicious code in veskr (npm) (malicious package) - [MAL-2026-11018](https://insights.sbomify.com/MAL-2026-11018/): Malicious code in veldora (npm) (malicious package) - [MAL-2026-11017](https://insights.sbomify.com/MAL-2026-11017/): Malicious code in vectormark (npm) (malicious package) - [MAL-2026-11016](https://insights.sbomify.com/MAL-2026-11016/): Malicious code in vantora (npm) (malicious package) - [MAL-2026-11015](https://insights.sbomify.com/MAL-2026-11015/): Malicious code in react-tabulix-query (npm) (malicious package) - [MAL-2026-11014](https://insights.sbomify.com/MAL-2026-11014/): Malicious code in kijai (npm) (malicious package) - [MAL-2026-11013](https://insights.sbomify.com/MAL-2026-11013/): Malicious code in encryptstringadmincore (npm) (malicious package) - [MAL-2026-11012](https://insights.sbomify.com/MAL-2026-11012/): Malicious code in encryptstringadmin (npm) (malicious package) - [MAL-2026-11011](https://insights.sbomify.com/MAL-2026-11011/): Malicious code in encrypt-string-ttak (npm) (malicious package) - [MAL-2026-11010](https://insights.sbomify.com/MAL-2026-11010/): Malicious code in calvora (npm) (malicious package) - [MAL-2026-1101](https://insights.sbomify.com/MAL-2026-1101/): Malicious code in argonist (npm) (malicious package) - [MAL-2026-11009](https://insights.sbomify.com/MAL-2026-11009/): Malicious code in calmora (npm) (malicious package) - [MAL-2026-11008](https://insights.sbomify.com/MAL-2026-11008/): Malicious code in caldryn (npm) (malicious package) - [MAL-2026-11007](https://insights.sbomify.com/MAL-2026-11007/): Malicious code in web3-terminal (npm) (malicious package) - [MAL-2026-11006](https://insights.sbomify.com/MAL-2026-11006/): Malicious code in n8n-nodes-utils-helper (npm) (malicious package) - [MAL-2026-11005](https://insights.sbomify.com/MAL-2026-11005/): Malicious code in n8n-nodes-quick-utils (npm) (malicious package) - [MAL-2026-11004](https://insights.sbomify.com/MAL-2026-11004/): Malicious code in n8n-nodes-pwn (npm) (malicious package) - [MAL-2026-11003](https://insights.sbomify.com/MAL-2026-11003/): Malicious code in n8n-nodes-net-utils (npm) (malicious package) - [MAL-2026-11002](https://insights.sbomify.com/MAL-2026-11002/): Malicious code in habinger (npm) (malicious package) - [MAL-2026-11001](https://insights.sbomify.com/MAL-2026-11001/): Malicious code in date-format-utils-xz (npm) (malicious package) - [MAL-2026-11000](https://insights.sbomify.com/MAL-2026-11000/): Malicious code in application-util (npm) (malicious package) - [MAL-2026-1100](https://insights.sbomify.com/MAL-2026-1100/): Malicious code in ng-vzbootstrap (npm) (malicious package) - [MAL-2026-110](https://insights.sbomify.com/MAL-2026-110/): Malicious code in @nestor_hexom/qyxb (npm) (malicious package) - [MAL-2026-11](https://insights.sbomify.com/MAL-2026-11/): Malicious code in cc-double-1 (npm) (malicious package) - [MAL-2026-10999](https://insights.sbomify.com/MAL-2026-10999/): Malicious code in n8n-nodes-task-runner (npm) (malicious package) - [MAL-2026-10998](https://insights.sbomify.com/MAL-2026-10998/): Malicious code in n8n-nodes-port-scanner (npm) (malicious package) - [MAL-2026-10997](https://insights.sbomify.com/MAL-2026-10997/): Malicious code in n8n-nodes-http-probe (npm) (malicious package) - [MAL-2026-10996](https://insights.sbomify.com/MAL-2026-10996/): Malicious code in init-js-examples (npm) (malicious package) - [MAL-2026-10995](https://insights.sbomify.com/MAL-2026-10995/): Malicious code in habingeer (npm) (malicious package) - [MAL-2026-10994](https://insights.sbomify.com/MAL-2026-10994/): Malicious code in app-data-ist (npm) (malicious package) - [MAL-2026-10993](https://insights.sbomify.com/MAL-2026-10993/): Malicious code in torch-musa (PyPI) (malicious package) - [MAL-2026-10992](https://insights.sbomify.com/MAL-2026-10992/): Malicious code in dev-helper-bg (PyPI) (malicious package) - [MAL-2026-10991](https://insights.sbomify.com/MAL-2026-10991/): Malicious code in make-helper (PyPI) (malicious package) - [MAL-2026-10990](https://insights.sbomify.com/MAL-2026-10990/): Malicious code in ts-vitest (npm) (malicious package) - [MAL-2026-1099](https://insights.sbomify.com/MAL-2026-1099/): Malicious code in pyclogger (PyPI) (malicious package) - [MAL-2026-10989](https://insights.sbomify.com/MAL-2026-10989/): Malicious code in react-tabulix-virtual (npm) (malicious package) - [MAL-2026-10988](https://insights.sbomify.com/MAL-2026-10988/): Malicious code in react-tabulix-ui (npm) (malicious package) - [MAL-2026-10987](https://insights.sbomify.com/MAL-2026-10987/): Malicious code in react-tabulix-core (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/180/