# Vulnerabilities published in 2026


- [MAL-2026-10896](https://insights.sbomify.com/MAL-2026-10896/): Malicious code in flow-eslint-oxidized (npm) (malicious package)
- [MAL-2026-10895](https://insights.sbomify.com/MAL-2026-10895/): Malicious code in exodus-payments (npm) (malicious package)
- [MAL-2026-10894](https://insights.sbomify.com/MAL-2026-10894/): Malicious code in exodus-checkout (npm) (malicious package)
- [MAL-2026-10893](https://insights.sbomify.com/MAL-2026-10893/): Malicious code in ecto-cargo-wk1tm59a (npm) (malicious package)
- [MAL-2026-10892](https://insights.sbomify.com/MAL-2026-10892/): Malicious code in claude-code-timer (npm) (malicious package)
- [MAL-2026-10891](https://insights.sbomify.com/MAL-2026-10891/): Malicious code in bytecraft (npm) (malicious package)
- [MAL-2026-10890](https://insights.sbomify.com/MAL-2026-10890/): Malicious code in analysis-chart (npm) (malicious package)
- [MAL-2026-1089](https://insights.sbomify.com/MAL-2026-1089/): Malicious code in randomstringgen (PyPI) (malicious package)
- [MAL-2026-10889](https://insights.sbomify.com/MAL-2026-10889/): Malicious code in @public-for-cdao/utils (npm) (malicious package)
- [MAL-2026-10888](https://insights.sbomify.com/MAL-2026-10888/): Malicious code in @public-for-cdao/signer (npm) (malicious package)
- [MAL-2026-10887](https://insights.sbomify.com/MAL-2026-10887/): Malicious code in @public-for-cdao/sdk (npm) (malicious package)
- [MAL-2026-10886](https://insights.sbomify.com/MAL-2026-10886/): Malicious code in @public-for-cdao/deploy (npm) (malicious package)
- [MAL-2026-10885](https://insights.sbomify.com/MAL-2026-10885/): Malicious code in @public-for-cdao/core (npm) (malicious package)
- [MAL-2026-10884](https://insights.sbomify.com/MAL-2026-10884/): Malicious code in @public-for-cdao/contracts (npm) (malicious package)
- [MAL-2026-10883](https://insights.sbomify.com/MAL-2026-10883/): Malicious code in @public-for-cdao/bot (npm) (malicious package)
- [MAL-2026-10882](https://insights.sbomify.com/MAL-2026-10882/): Malicious code in @public-for-cdao/backend (npm) (malicious package)
- [MAL-2026-10881](https://insights.sbomify.com/MAL-2026-10881/): Malicious code in @irys-solutions/odesa-main (npm) (malicious package)
- [MAL-2026-10880](https://insights.sbomify.com/MAL-2026-10880/): Malicious code in @examplecorptest/hearsay-design-system-test (npm) (malicious package)
- [MAL-2026-1088](https://insights.sbomify.com/MAL-2026-1088/): Malicious code in bladebit (PyPI) (malicious package)
- [MAL-2026-10879](https://insights.sbomify.com/MAL-2026-10879/): Malicious code in @dxcl/user-js (npm) (malicious package)
- [MAL-2026-10878](https://insights.sbomify.com/MAL-2026-10878/): Malicious code in @dxcl/transaction-js (npm) (malicious package)
- [MAL-2026-10877](https://insights.sbomify.com/MAL-2026-10877/): Malicious code in @dxcl/log-function-js (npm) (malicious package)
- [MAL-2026-10876](https://insights.sbomify.com/MAL-2026-10876/): Malicious code in @dxcl/indicators-js (npm) (malicious package)
- [MAL-2026-10875](https://insights.sbomify.com/MAL-2026-10875/): Malicious code in @dxcl/http-common-js (npm) (malicious package)
- [MAL-2026-10874](https://insights.sbomify.com/MAL-2026-10874/): Malicious code in @dxcl/fund-js (npm) (malicious package)
- [MAL-2026-10873](https://insights.sbomify.com/MAL-2026-10873/): Malicious code in @dxcl/customer-js (npm) (malicious package)
- [MAL-2026-10872](https://insights.sbomify.com/MAL-2026-10872/): Malicious code in @dxcl/account-js (npm) (malicious package)
- [MAL-2026-10871](https://insights.sbomify.com/MAL-2026-10871/): Malicious code in @azure-lab-services/ml-ts (npm) (malicious package)
- [MAL-2026-10870](https://insights.sbomify.com/MAL-2026-10870/): Malicious code in @atlaskit-internal_.smart-card/hover-card (npm) (malicious package)
- [MAL-2026-1087](https://insights.sbomify.com/MAL-2026-1087/): Malicious code in bps-design-system (npm) (malicious package)
- [MAL-2026-10869](https://insights.sbomify.com/MAL-2026-10869/): Malicious code in paperclip-ai (PyPI) (malicious package)
- [MAL-2026-10868](https://insights.sbomify.com/MAL-2026-10868/): Malicious code in neroteam-v1 (PyPI) (malicious package)
- [MAL-2026-10867](https://insights.sbomify.com/MAL-2026-10867/): Malicious code in vantrala (PyPI) (malicious package)
- [MAL-2026-10866](https://insights.sbomify.com/MAL-2026-10866/): Malicious code in nemopush (PyPI) (malicious package)
- [MAL-2026-10865](https://insights.sbomify.com/MAL-2026-10865/): Malicious code in kimitalk (PyPI) (malicious package)
- [MAL-2026-10864](https://insights.sbomify.com/MAL-2026-10864/): Malicious code in kimichat (PyPI) (malicious package)
- [MAL-2026-10863](https://insights.sbomify.com/MAL-2026-10863/): Malicious code in telebot-bot-run (PyPI) (malicious package)
- [MAL-2026-10862](https://insights.sbomify.com/MAL-2026-10862/): Malicious code in @gocortexio/npmgremlinbox-wxwindows (npm) (malicious package)
- [MAL-2026-10861](https://insights.sbomify.com/MAL-2026-10861/): Malicious code in @gocortexio/npmgremlinbox-unlicense (npm) (malicious package)
- [MAL-2026-10860](https://insights.sbomify.com/MAL-2026-10860/): Malicious code in @gocortexio/npmgremlinbox-ucl-1-0 (npm) (malicious package)
- [MAL-2026-1086](https://insights.sbomify.com/MAL-2026-1086/): Malicious code in tchap-bot (PyPI) (malicious package)
- [MAL-2026-10859](https://insights.sbomify.com/MAL-2026-10859/): Malicious code in @gocortexio/npmgremlinbox-typosquat-webpack (npm) (malicious package)
- [MAL-2026-10858](https://insights.sbomify.com/MAL-2026-10858/): Malicious code in @gocortexio/npmgremlinbox-typosquat-react (npm) (malicious package)
- [MAL-2026-10857](https://insights.sbomify.com/MAL-2026-10857/): Malicious code in @gocortexio/npmgremlinbox-typosquat-moment (npm) (malicious package)
- [MAL-2026-10856](https://insights.sbomify.com/MAL-2026-10856/): Malicious code in @gocortexio/npmgremlinbox-typosquat-lodash (npm) (malicious package)
- [MAL-2026-10855](https://insights.sbomify.com/MAL-2026-10855/): Malicious code in @gocortexio/npmgremlinbox-typosquat-express (npm) (malicious package)
- [MAL-2026-10854](https://insights.sbomify.com/MAL-2026-10854/): Malicious code in @gocortexio/npmgremlinbox-typosquat-commander (npm) (malicious package)
- [MAL-2026-10853](https://insights.sbomify.com/MAL-2026-10853/): Malicious code in @gocortexio/npmgremlinbox-typosquat-chalk (npm) (malicious package)
- [MAL-2026-10852](https://insights.sbomify.com/MAL-2026-10852/): Malicious code in @gocortexio/npmgremlinbox-typosquat-axios (npm) (malicious package)
- [MAL-2026-10851](https://insights.sbomify.com/MAL-2026-10851/): Malicious code in @gocortexio/npmgremlinbox-tpl-1-0 (npm) (malicious package)
- [MAL-2026-10850](https://insights.sbomify.com/MAL-2026-10850/): Malicious code in @gocortexio/npmgremlinbox-tapr-ohl-1-0 (npm) (malicious package)
- [MAL-2026-1085](https://insights.sbomify.com/MAL-2026-1085/): Malicious code in ctf-toolkit (PyPI) (malicious package)
- [MAL-2026-10849](https://insights.sbomify.com/MAL-2026-10849/): Malicious code in @gocortexio/npmgremlinbox-sspl-1-0 (npm) (malicious package)
- [MAL-2026-10848](https://insights.sbomify.com/MAL-2026-10848/): Malicious code in @gocortexio/npmgremlinbox-simpl-2-0 (npm) (malicious package)
- [MAL-2026-10847](https://insights.sbomify.com/MAL-2026-10847/): Malicious code in @gocortexio/npmgremlinbox-sendmail-8-23 (npm) (malicious package)
- [MAL-2026-10846](https://insights.sbomify.com/MAL-2026-10846/): Malicious code in @gocortexio/npmgremlinbox-qpl-1-0-inria-2004 (npm) (malicious package)
- [MAL-2026-10845](https://insights.sbomify.com/MAL-2026-10845/): Malicious code in @gocortexio/npmgremlinbox-polyform-small-business-1-0-0 (npm) (malicious package)
- [MAL-2026-10844](https://insights.sbomify.com/MAL-2026-10844/): Malicious code in @gocortexio/npmgremlinbox-polyform-noncommercial-1-0-0 (npm) (malicious package)
- [MAL-2026-10843](https://insights.sbomify.com/MAL-2026-10843/): Malicious code in @gocortexio/npmgremlinbox-osl-3-0 (npm) (malicious package)
- [MAL-2026-10842](https://insights.sbomify.com/MAL-2026-10842/): Malicious code in @gocortexio/npmgremlinbox-openpbs-2-3 (npm) (malicious package)
- [MAL-2026-10841](https://insights.sbomify.com/MAL-2026-10841/): Malicious code in @gocortexio/npmgremlinbox-ncgl-uk-2-0 (npm) (malicious package)
- [MAL-2026-10840](https://insights.sbomify.com/MAL-2026-10840/): Malicious code in @gocortexio/npmgremlinbox-ms-lpl (npm) (malicious package)
- [MAL-2026-1084](https://insights.sbomify.com/MAL-2026-1084/): Malicious code in socketxio (PyPI) (malicious package)
- [MAL-2026-10839](https://insights.sbomify.com/MAL-2026-10839/): Malicious code in @gocortexio/npmgremlinbox-mpl-2-0 (npm) (malicious package)
- [MAL-2026-10838](https://insights.sbomify.com/MAL-2026-10838/): Malicious code in @gocortexio/npmgremlinbox-mpl-1-1 (npm) (malicious package)
- [MAL-2026-10837](https://insights.sbomify.com/MAL-2026-10837/): Malicious code in @gocortexio/npmgremlinbox-malware-network-indicators (npm) (malicious package)
- [MAL-2026-10836](https://insights.sbomify.com/MAL-2026-10836/): Malicious code in @gocortexio/npmgremlinbox-malware-install-execution (npm) (malicious package)
- [MAL-2026-10835](https://insights.sbomify.com/MAL-2026-10835/): Malicious code in @gocortexio/npmgremlinbox-malware-cryptomining-indicators (npm) (malicious package)
- [MAL-2026-10834](https://insights.sbomify.com/MAL-2026-10834/): Malicious code in @gocortexio/npmgremlinbox-malware-credential-harvesting (npm) (malicious package)
- [MAL-2026-10833](https://insights.sbomify.com/MAL-2026-10833/): Malicious code in @gocortexio/npmgremlinbox-malware-code-obfuscation (npm) (malicious package)
- [MAL-2026-10832](https://insights.sbomify.com/MAL-2026-10832/): Malicious code in @gocortexio/npmgremlinbox-malware-c2-beacon (npm) (malicious package)
- [MAL-2026-10831](https://insights.sbomify.com/MAL-2026-10831/): Malicious code in @gocortexio/npmgremlinbox-linux-man-pages-copyleft (npm) (malicious package)
- [MAL-2026-10830](https://insights.sbomify.com/MAL-2026-10830/): Malicious code in @gocortexio/npmgremlinbox-lgpl-3-0 (npm) (malicious package)
- [MAL-2026-1083](https://insights.sbomify.com/MAL-2026-1083/): Malicious code in dc-mobx (npm) (malicious package)
- [MAL-2026-10829](https://insights.sbomify.com/MAL-2026-10829/): Malicious code in @gocortexio/npmgremlinbox-lgpl-2-1 (npm) (malicious package)
- [MAL-2026-10828](https://insights.sbomify.com/MAL-2026-10828/): Malicious code in @gocortexio/npmgremlinbox-lgpl-2-0 (npm) (malicious package)
- [MAL-2026-10827](https://insights.sbomify.com/MAL-2026-10827/): Malicious code in @gocortexio/npmgremlinbox-jpl-image (npm) (malicious package)
- [MAL-2026-10826](https://insights.sbomify.com/MAL-2026-10826/): Malicious code in @gocortexio/npmgremlinbox-hippocratic-2-1 (npm) (malicious package)
- [MAL-2026-10825](https://insights.sbomify.com/MAL-2026-10825/): Malicious code in @gocortexio/npmgremlinbox-gpl-3-0 (npm) (malicious package)
- [MAL-2026-10824](https://insights.sbomify.com/MAL-2026-10824/): Malicious code in @gocortexio/npmgremlinbox-gpl-2-0 (npm) (malicious package)
- [MAL-2026-10823](https://insights.sbomify.com/MAL-2026-10823/): Malicious code in @gocortexio/npmgremlinbox-fdk-aac (npm) (malicious package)
- [MAL-2026-10822](https://insights.sbomify.com/MAL-2026-10822/): Malicious code in @gocortexio/npmgremlinbox-eupl-3-0 (npm) (malicious package)
- [MAL-2026-10821](https://insights.sbomify.com/MAL-2026-10821/): Malicious code in @gocortexio/npmgremlinbox-eupl-1-2 (npm) (malicious package)
- [MAL-2026-10820](https://insights.sbomify.com/MAL-2026-10820/): Malicious code in @gocortexio/npmgremlinbox-eupl-1-1 (npm) (malicious package)
- [MAL-2026-1082](https://insights.sbomify.com/MAL-2026-1082/): Malicious code in cdf-clients (PyPI) (malicious package)
- [MAL-2026-10819](https://insights.sbomify.com/MAL-2026-10819/): Malicious code in @gocortexio/npmgremlinbox-epl-2-0 (npm) (malicious package)
- [MAL-2026-10818](https://insights.sbomify.com/MAL-2026-10818/): Malicious code in @gocortexio/npmgremlinbox-epl-1-0 (npm) (malicious package)
- [MAL-2026-10817](https://insights.sbomify.com/MAL-2026-10817/): Malicious code in @gocortexio/npmgremlinbox-ecos-2-0 (npm) (malicious package)
- [MAL-2026-10816](https://insights.sbomify.com/MAL-2026-10816/): Malicious code in @gocortexio/npmgremlinbox-cpol-1-02 (npm) (malicious package)
- [MAL-2026-10815](https://insights.sbomify.com/MAL-2026-10815/): Malicious code in @gocortexio/npmgremlinbox-copyleft-next-0-3-1 (npm) (malicious package)
- [MAL-2026-10814](https://insights.sbomify.com/MAL-2026-10814/): Malicious code in @gocortexio/npmgremlinbox-copyleft-next-0-3-0 (npm) (malicious package)
- [MAL-2026-10813](https://insights.sbomify.com/MAL-2026-10813/): Malicious code in @gocortexio/npmgremlinbox-cern-ohl-w-2-0 (npm) (malicious package)
- [MAL-2026-10812](https://insights.sbomify.com/MAL-2026-10812/): Malicious code in @gocortexio/npmgremlinbox-cern-ohl-s-2-0 (npm) (malicious package)
- [MAL-2026-10811](https://insights.sbomify.com/MAL-2026-10811/): Malicious code in @gocortexio/npmgremlinbox-cdla-sharing-1-0 (npm) (malicious package)
- [MAL-2026-10810](https://insights.sbomify.com/MAL-2026-10810/): Malicious code in @gocortexio/npmgremlinbox-cddl-1-0 (npm) (malicious package)
- [MAL-2026-1081](https://insights.sbomify.com/MAL-2026-1081/): Malicious code in marionette-react-view (npm) (malicious package)
- [MAL-2026-10809](https://insights.sbomify.com/MAL-2026-10809/): Malicious code in @gocortexio/npmgremlinbox-cc-by-sa-4-0 (npm) (malicious package)
- [MAL-2026-10808](https://insights.sbomify.com/MAL-2026-10808/): Malicious code in @gocortexio/npmgremlinbox-cc-by-sa-3-0-de (npm) (malicious package)
- [MAL-2026-10807](https://insights.sbomify.com/MAL-2026-10807/): Malicious code in @gocortexio/npmgremlinbox-cc-by-sa-3-0-at (npm) (malicious package)
- [MAL-2026-10806](https://insights.sbomify.com/MAL-2026-10806/): Malicious code in @gocortexio/npmgremlinbox-cc-by-sa-2-1-jp (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/182/