# Vulnerabilities published in 2026 - [MAL-2026-10986](https://insights.sbomify.com/MAL-2026-10986/): Malicious code in comp-colors (PyPI) (malicious package) - [MAL-2026-10985](https://insights.sbomify.com/MAL-2026-10985/): Malicious code in animated-octo-spoon (PyPI) (malicious package) - [MAL-2026-10984](https://insights.sbomify.com/MAL-2026-10984/): Malicious code in veskra (npm) (malicious package) - [MAL-2026-10983](https://insights.sbomify.com/MAL-2026-10983/): Malicious code in svelte-streaks (npm) (malicious package) - [MAL-2026-10982](https://insights.sbomify.com/MAL-2026-10982/): Malicious code in streak-daycount (npm) (malicious package) - [MAL-2026-10981](https://insights.sbomify.com/MAL-2026-10981/): Malicious code in streak-calendar (npm) (malicious package) - [MAL-2026-10980](https://insights.sbomify.com/MAL-2026-10980/): Malicious code in nolby (npm) (malicious package) - [MAL-2026-1098](https://insights.sbomify.com/MAL-2026-1098/): Malicious code in noteasonfnsource (PyPI) (malicious package) - [MAL-2026-10979](https://insights.sbomify.com/MAL-2026-10979/): Malicious code in @apexfdn/apex (npm) (malicious package) - [MAL-2026-10978](https://insights.sbomify.com/MAL-2026-10978/): Malicious code in reimagined-broccoli (PyPI) (malicious package) - [MAL-2026-10977](https://insights.sbomify.com/MAL-2026-10977/): Malicious code in lebinfmt (PyPI) (malicious package) - [MAL-2026-10976](https://insights.sbomify.com/MAL-2026-10976/): Malicious code in colorstack (PyPI) (malicious package) - [MAL-2026-10975](https://insights.sbomify.com/MAL-2026-10975/): Malicious code in rasterkit-demo (PyPI) (malicious package) - [MAL-2026-10974](https://insights.sbomify.com/MAL-2026-10974/): Malicious code in rasterkit (PyPI) (malicious package) - [MAL-2026-10973](https://insights.sbomify.com/MAL-2026-10973/): Malicious code in fluffy-octo-broccoli (PyPI) (malicious package) - [MAL-2026-10972](https://insights.sbomify.com/MAL-2026-10972/): Malicious code in signzy-field-level-encrypter (npm) (malicious package) - [MAL-2026-10971](https://insights.sbomify.com/MAL-2026-10971/): Malicious code in cxpw-offers (npm) (malicious package) - [MAL-2026-10970](https://insights.sbomify.com/MAL-2026-10970/): Malicious code in consumerweb-calurls (npm) (malicious package) - [MAL-2026-1097](https://insights.sbomify.com/MAL-2026-1097/): Malicious code in botbooster (PyPI) (malicious package) - [MAL-2026-10969](https://insights.sbomify.com/MAL-2026-10969/): Malicious code in commonweb-wallet (npm) (malicious package) - [MAL-2026-10968](https://insights.sbomify.com/MAL-2026-10968/): Malicious code in commonweb-rewards (npm) (malicious package) - [MAL-2026-10967](https://insights.sbomify.com/MAL-2026-10967/): Malicious code in commonweb-moneymovement (npm) (malicious package) - [MAL-2026-10966](https://insights.sbomify.com/MAL-2026-10966/): Malicious code in commonweb-card (npm) (malicious package) - [MAL-2026-10965](https://insights.sbomify.com/MAL-2026-10965/): Malicious code in requestor-util (npm) (malicious package) - [MAL-2026-10964](https://insights.sbomify.com/MAL-2026-10964/): Malicious code in markscan-utils (npm) (malicious package) - [MAL-2026-10963](https://insights.sbomify.com/MAL-2026-10963/): Malicious code in markscan-reports (npm) (malicious package) - [MAL-2026-10962](https://insights.sbomify.com/MAL-2026-10962/): Malicious code in markscan-core (npm) (malicious package) - [MAL-2026-10961](https://insights.sbomify.com/MAL-2026-10961/): Malicious code in markscan-api (npm) (malicious package) - [MAL-2026-10960](https://insights.sbomify.com/MAL-2026-10960/): Malicious code in markscan (npm) (malicious package) - [MAL-2026-1096](https://insights.sbomify.com/MAL-2026-1096/): Malicious code in sketch-measure (npm) (malicious package) - [MAL-2026-10959](https://insights.sbomify.com/MAL-2026-10959/): Malicious code in iphouse-core (npm) (malicious package) - [MAL-2026-10958](https://insights.sbomify.com/MAL-2026-10958/): Malicious code in iphouse-api (npm) (malicious package) - [MAL-2026-10957](https://insights.sbomify.com/MAL-2026-10957/): Malicious code in iphouse (npm) (malicious package) - [MAL-2026-10956](https://insights.sbomify.com/MAL-2026-10956/): Malicious code in akrai-report-new (npm) (malicious package) - [MAL-2026-10955](https://insights.sbomify.com/MAL-2026-10955/): Malicious code in akrai-report (npm) (malicious package) - [MAL-2026-10954](https://insights.sbomify.com/MAL-2026-10954/): Malicious code in @markscan/utils (npm) (malicious package) - [MAL-2026-10953](https://insights.sbomify.com/MAL-2026-10953/): Malicious code in @markscan/reports (npm) (malicious package) - [MAL-2026-10952](https://insights.sbomify.com/MAL-2026-10952/): Malicious code in @markscan/core (npm) (malicious package) - [MAL-2026-10951](https://insights.sbomify.com/MAL-2026-10951/): Malicious code in @markscan/api (npm) (malicious package) - [MAL-2026-10950](https://insights.sbomify.com/MAL-2026-10950/): Malicious code in @iphouse/core (npm) (malicious package) - [MAL-2026-1095](https://insights.sbomify.com/MAL-2026-1095/): Malicious code in jquery-display (npm) (malicious package) - [MAL-2026-10949](https://insights.sbomify.com/MAL-2026-10949/): Malicious code in @iphouse/api (npm) (malicious package) - [MAL-2026-10948](https://insights.sbomify.com/MAL-2026-10948/): Malicious code in @akrai/report_new (npm) (malicious package) - [MAL-2026-10947](https://insights.sbomify.com/MAL-2026-10947/): Malicious code in @akrai/report (npm) (malicious package) - [MAL-2026-10946](https://insights.sbomify.com/MAL-2026-10946/): Malicious code in @akrai/core (npm) (malicious package) - [MAL-2026-10945](https://insights.sbomify.com/MAL-2026-10945/): Malicious code in zer0onetencent2 (npm) (malicious package) - [MAL-2026-10944](https://insights.sbomify.com/MAL-2026-10944/): Malicious code in zer0onetencent (npm) (malicious package) - [MAL-2026-10943](https://insights.sbomify.com/MAL-2026-10943/): Malicious code in aftermathfi (npm) (malicious package) - [MAL-2026-10942](https://insights.sbomify.com/MAL-2026-10942/): Malicious code in aftermath-sui (npm) (malicious package) - [MAL-2026-10941](https://insights.sbomify.com/MAL-2026-10941/): Malicious code in aftermath-finance (npm) (malicious package) - [MAL-2026-10940](https://insights.sbomify.com/MAL-2026-10940/): Malicious code in chai-leaf (npm) (malicious package) - [MAL-2026-1094](https://insights.sbomify.com/MAL-2026-1094/): Malicious code in dc-web-app (npm) (malicious package) - [MAL-2026-10939](https://insights.sbomify.com/MAL-2026-10939/): Malicious code in chai-as-reddit (npm) (malicious package) - [MAL-2026-10938](https://insights.sbomify.com/MAL-2026-10938/): Malicious code in twiliointernal-messaging-toolbox (npm) (malicious package) - [MAL-2026-10937](https://insights.sbomify.com/MAL-2026-10937/): Malicious code in twilio-serverless (npm) (malicious package) - [MAL-2026-10936](https://insights.sbomify.com/MAL-2026-10936/): Malicious code in twilio-platform-request (npm) (malicious package) - [MAL-2026-10935](https://insights.sbomify.com/MAL-2026-10935/): Malicious code in twilio-platform-async-data-fetch (npm) (malicious package) - [MAL-2026-10934](https://insights.sbomify.com/MAL-2026-10934/): Malicious code in twilio-internal (npm) (malicious package) - [MAL-2026-10933](https://insights.sbomify.com/MAL-2026-10933/): Malicious code in twilio-deploy (npm) (malicious package) - [MAL-2026-10932](https://insights.sbomify.com/MAL-2026-10932/): Malicious code in twilio-assets (npm) (malicious package) - [MAL-2026-10931](https://insights.sbomify.com/MAL-2026-10931/): Malicious code in org-twilio-phone-numbers-utils (npm) (malicious package) - [MAL-2026-10930](https://insights.sbomify.com/MAL-2026-10930/): Malicious code in trongridmy (PyPI) (malicious package) - [MAL-2026-1093](https://insights.sbomify.com/MAL-2026-1093/): Malicious code in naughty-package (npm) (malicious package) - [MAL-2026-10929](https://insights.sbomify.com/MAL-2026-10929/): Malicious code in trongrider (PyPI) (malicious package) - [MAL-2026-10928](https://insights.sbomify.com/MAL-2026-10928/): Malicious code in upjsma (npm) (malicious package) - [MAL-2026-10927](https://insights.sbomify.com/MAL-2026-10927/): Malicious code in roles-royce (PyPI) (malicious package) - [MAL-2026-10926](https://insights.sbomify.com/MAL-2026-10926/): Malicious code in defi-kit (PyPI) (malicious package) - [MAL-2026-10925](https://insights.sbomify.com/MAL-2026-10925/): Malicious code in tilaver-mfa (npm) (malicious package) - [MAL-2026-10924](https://insights.sbomify.com/MAL-2026-10924/): Malicious code in s3-lambda-dynamodb-cdk (npm) (malicious package) - [MAL-2026-10923](https://insights.sbomify.com/MAL-2026-10923/): Malicious code in lwc-slds-lbc (npm) (malicious package) - [MAL-2026-10922](https://insights.sbomify.com/MAL-2026-10922/): Malicious code in lambda-cloudwatch-cdk (npm) (malicious package) - [MAL-2026-10921](https://insights.sbomify.com/MAL-2026-10921/): Malicious code in iot-kfh-s3 (npm) (malicious package) - [MAL-2026-10920](https://insights.sbomify.com/MAL-2026-10920/): Malicious code in alb-lambda-cdk (npm) (malicious package) - [MAL-2026-1092](https://insights.sbomify.com/MAL-2026-1092/): Malicious code in jwrincident (PyPI) (malicious package) - [MAL-2026-10919](https://insights.sbomify.com/MAL-2026-10919/): Malicious code in ml-core-airflow-auth (PyPI) (malicious package) - [MAL-2026-10918](https://insights.sbomify.com/MAL-2026-10918/): Malicious code in automatic-octo-invention (PyPI) (malicious package) - [MAL-2026-10917](https://insights.sbomify.com/MAL-2026-10917/): Malicious code in tinkoff-cloud-apis-internal (PyPI) (malicious package) - [MAL-2026-10916](https://insights.sbomify.com/MAL-2026-10916/): Malicious code in python-devplatform-client (PyPI) (malicious package) - [MAL-2026-10915](https://insights.sbomify.com/MAL-2026-10915/): Malicious code in dwh-kafka-client (PyPI) (malicious package) - [MAL-2026-10914](https://insights.sbomify.com/MAL-2026-10914/): Malicious code in my_shoaib_gem (RubyGems) (malicious package) - [MAL-2026-10913](https://insights.sbomify.com/MAL-2026-10913/): Malicious code in ike-artifactory-ruby (RubyGems) (malicious package) - [MAL-2026-10912](https://insights.sbomify.com/MAL-2026-10912/): Malicious code in shark-e2e-bnsneo (PyPI) (malicious package) - [MAL-2026-10911](https://insights.sbomify.com/MAL-2026-10911/): Malicious code in mysuperlicense (PyPI) (malicious package) - [MAL-2026-10910](https://insights.sbomify.com/MAL-2026-10910/): Malicious code in mysupergoodpython (PyPI) (malicious package) - [MAL-2026-1091](https://insights.sbomify.com/MAL-2026-1091/): Malicious code in myproject-bola (PyPI) (malicious package) - [MAL-2026-10909](https://insights.sbomify.com/MAL-2026-10909/): Malicious code in ibreak (PyPI) (malicious package) - [MAL-2026-10908](https://insights.sbomify.com/MAL-2026-10908/): Malicious code in hello-world-test-mh3 (PyPI) (malicious package) - [MAL-2026-10907](https://insights.sbomify.com/MAL-2026-10907/): Malicious code in hello-world-test-mh2 (PyPI) (malicious package) - [MAL-2026-10906](https://insights.sbomify.com/MAL-2026-10906/): Malicious code in your-unique-package-name1337 (npm) (malicious package) - [MAL-2026-10905](https://insights.sbomify.com/MAL-2026-10905/): Malicious code in win-build-utils (npm) (malicious package) - [MAL-2026-10904](https://insights.sbomify.com/MAL-2026-10904/): Malicious code in solana-web3-v1 (npm) (malicious package) - [MAL-2026-10903](https://insights.sbomify.com/MAL-2026-10903/): Malicious code in solana-web3-stable (npm) (malicious package) - [MAL-2026-10902](https://insights.sbomify.com/MAL-2026-10902/): Malicious code in solana-web3-patched (npm) (malicious package) - [MAL-2026-10901](https://insights.sbomify.com/MAL-2026-10901/): Malicious code in solana-web3-lts (npm) (malicious package) - [MAL-2026-10900](https://insights.sbomify.com/MAL-2026-10900/): Malicious code in solana-web3-fork (npm) (malicious package) - [MAL-2026-1090](https://insights.sbomify.com/MAL-2026-1090/): Malicious code in isb (PyPI) (malicious package) - [MAL-2026-109](https://insights.sbomify.com/MAL-2026-109/): Malicious code in @nestor_hexom/garfield1 (npm) (malicious package) - [MAL-2026-10899](https://insights.sbomify.com/MAL-2026-10899/): Malicious code in solana-web3-fixed (npm) (malicious package) - [MAL-2026-10898](https://insights.sbomify.com/MAL-2026-10898/): Malicious code in solana-rpc-client (npm) (malicious package) - [MAL-2026-10897](https://insights.sbomify.com/MAL-2026-10897/): Malicious code in golan125-homepage-test (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/181/