# Vulnerabilities published in 2026


- [MAL-2026-10805](https://insights.sbomify.com/MAL-2026-10805/): Malicious code in @gocortexio/npmgremlinbox-cc-by-sa-2-0-uk (npm) (malicious package)
- [MAL-2026-10804](https://insights.sbomify.com/MAL-2026-10804/): Malicious code in @gocortexio/npmgremlinbox-cc-by-nd-3-0-de (npm) (malicious package)
- [MAL-2026-10803](https://insights.sbomify.com/MAL-2026-10803/): Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-sa-3-0-igo (npm) (malicious package)
- [MAL-2026-10802](https://insights.sbomify.com/MAL-2026-10802/): Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-sa-3-0-de (npm) (malicious package)
- [MAL-2026-10801](https://insights.sbomify.com/MAL-2026-10801/): Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-sa-2-0-uk (npm) (malicious package)
- [MAL-2026-10800](https://insights.sbomify.com/MAL-2026-10800/): Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-sa-2-0-fr (npm) (malicious package)
- [MAL-2026-1080](https://insights.sbomify.com/MAL-2026-1080/): Malicious code in hashtools32 (PyPI) (malicious package)
- [MAL-2026-108](https://insights.sbomify.com/MAL-2026-108/): Malicious code in @nestor_hexom/garfield (npm) (malicious package)
- [MAL-2026-10799](https://insights.sbomify.com/MAL-2026-10799/): Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-sa-2-0-de (npm) (malicious package)
- [MAL-2026-10798](https://insights.sbomify.com/MAL-2026-10798/): Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-nd-3-0-igo (npm) (malicious package)
- [MAL-2026-10797](https://insights.sbomify.com/MAL-2026-10797/): Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-nd-3-0-de (npm) (malicious package)
- [MAL-2026-10796](https://insights.sbomify.com/MAL-2026-10796/): Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-3-0-de (npm) (malicious package)
- [MAL-2026-10795](https://insights.sbomify.com/MAL-2026-10795/): Malicious code in @gocortexio/npmgremlinbox-cal-1-0-combined-work-exception (npm) (malicious package)
- [MAL-2026-10794](https://insights.sbomify.com/MAL-2026-10794/): Malicious code in @gocortexio/npmgremlinbox-c-uda-1-0 (npm) (malicious package)
- [MAL-2026-10793](https://insights.sbomify.com/MAL-2026-10793/): Malicious code in @gocortexio/npmgremlinbox-busl-1-1 (npm) (malicious package)
- [MAL-2026-10792](https://insights.sbomify.com/MAL-2026-10792/): Malicious code in @gocortexio/npmgremlinbox-base (npm) (malicious package)
- [MAL-2026-10791](https://insights.sbomify.com/MAL-2026-10791/): Malicious code in @gocortexio/npmgremlinbox-artistic-1-0 (npm) (malicious package)
- [MAL-2026-10790](https://insights.sbomify.com/MAL-2026-10790/): Malicious code in @gocortexio/npmgremlinbox-arphic-1999 (npm) (malicious package)
- [MAL-2026-1079](https://insights.sbomify.com/MAL-2026-1079/): Malicious code in sokettry (npm) (malicious package)
- [MAL-2026-10789](https://insights.sbomify.com/MAL-2026-10789/): Malicious code in @gocortexio/npmgremlinbox-apsl (npm) (malicious package)
- [MAL-2026-10788](https://insights.sbomify.com/MAL-2026-10788/): Malicious code in @gocortexio/npmgremlinbox-agpl-3-0-or-later (npm) (malicious package)
- [MAL-2026-10787](https://insights.sbomify.com/MAL-2026-10787/): Malicious code in @gocortexio/npmgremlinbox-agpl-3-0-only (npm) (malicious package)
- [MAL-2026-10786](https://insights.sbomify.com/MAL-2026-10786/): Malicious code in @gocortexio/npmgremlinbox-agpl-3-0 (npm) (malicious package)
- [MAL-2026-10785](https://insights.sbomify.com/MAL-2026-10785/): Malicious code in @gocortexio/npmgremlinbox-agpl-1-0-or-later (npm) (malicious package)
- [MAL-2026-10784](https://insights.sbomify.com/MAL-2026-10784/): Malicious code in @gocortexio/npmgremlinbox-agpl-1-0-only (npm) (malicious package)
- [MAL-2026-10783](https://insights.sbomify.com/MAL-2026-10783/): Malicious code in @gocortexio/npmgremlinbox-agpl-1-0 (npm) (malicious package)
- [MAL-2026-10782](https://insights.sbomify.com/MAL-2026-10782/): Malicious code in zoom-widget-xss-poc-paresh (npm) (malicious package)
- [MAL-2026-10781](https://insights.sbomify.com/MAL-2026-10781/): Malicious code in chart-animation-helper (npm) (malicious package)
- [MAL-2026-10780](https://insights.sbomify.com/MAL-2026-10780/): Malicious code in data-parser-utils (PyPI) (malicious package)
- [MAL-2026-1078](https://insights.sbomify.com/MAL-2026-1078/): Malicious code in socket-dgxeon (npm) (malicious package)
- [MAL-2026-10779](https://insights.sbomify.com/MAL-2026-10779/): Malicious code in mlflow-ui (PyPI) (malicious package)
- [MAL-2026-10778](https://insights.sbomify.com/MAL-2026-10778/): Malicious code in relativity-pdfjs-dist (npm) (malicious package)
- [MAL-2026-10777](https://insights.sbomify.com/MAL-2026-10777/): Malicious code in n8n-nodes-probe (npm) (malicious package)
- [MAL-2026-10776](https://insights.sbomify.com/MAL-2026-10776/): Malicious code in n8n-nodes-final-mile (npm) (malicious package)
- [MAL-2026-10775](https://insights.sbomify.com/MAL-2026-10775/): Malicious code in n8n-nodes-devops-utils (npm) (malicious package)
- [MAL-2026-10774](https://insights.sbomify.com/MAL-2026-10774/): Malicious code in n8n-nodes-api-finder (npm) (malicious package)
- [MAL-2026-10773](https://insights.sbomify.com/MAL-2026-10773/): Malicious code in telemetry-axios (npm) (malicious package)
- [MAL-2026-10772](https://insights.sbomify.com/MAL-2026-10772/): Malicious code in axios-native (npm) (malicious package)
- [MAL-2026-10771](https://insights.sbomify.com/MAL-2026-10771/): Malicious code in trongridme (PyPI) (malicious package)
- [MAL-2026-10770](https://insights.sbomify.com/MAL-2026-10770/): Malicious code in govpkg (PyPI) (malicious package)
- [MAL-2026-1077](https://insights.sbomify.com/MAL-2026-1077/): Malicious code in dgxeon-soket4 (npm) (malicious package)
- [MAL-2026-10769](https://insights.sbomify.com/MAL-2026-10769/): Malicious code in easyway2 (npm) (malicious package)
- [MAL-2026-10768](https://insights.sbomify.com/MAL-2026-10768/): Malicious code in trongridev (PyPI) (malicious package)
- [MAL-2026-10767](https://insights.sbomify.com/MAL-2026-10767/): Malicious code in syft-acp-util (npm) (malicious package)
- [MAL-2026-10766](https://insights.sbomify.com/MAL-2026-10766/): Malicious code in syft-acp-uikit (npm) (malicious package)
- [MAL-2026-10765](https://insights.sbomify.com/MAL-2026-10765/): Malicious code in syft-acp-core (npm) (malicious package)
- [MAL-2026-10764](https://insights.sbomify.com/MAL-2026-10764/): Malicious code in syft-acp-atoms (npm) (malicious package)
- [MAL-2026-10763](https://insights.sbomify.com/MAL-2026-10763/): Malicious code in @edgecommons/streamlog-node (npm) (malicious package)
- [MAL-2026-10762](https://insights.sbomify.com/MAL-2026-10762/): Malicious code in @edgecommons/edgecommons (npm) (malicious package)
- [MAL-2026-10761](https://insights.sbomify.com/MAL-2026-10761/): Malicious code in my-tailwind-gutenberg-block (npm) (malicious package)
- [MAL-2026-10760](https://insights.sbomify.com/MAL-2026-10760/): Malicious code in abseil-py (PyPI) (malicious package)
- [MAL-2026-1076](https://insights.sbomify.com/MAL-2026-1076/): Malicious code in dgxeon-soket3 (npm) (malicious package)
- [MAL-2026-10759](https://insights.sbomify.com/MAL-2026-10759/): Malicious code in ryry-cli (PyPI) (malicious package)
- [MAL-2026-10758](https://insights.sbomify.com/MAL-2026-10758/): Malicious code in mfq-private-encoder (PyPI) (malicious package)
- [MAL-2026-10757](https://insights.sbomify.com/MAL-2026-10757/): Malicious code in dde-common (PyPI) (malicious package)
- [MAL-2026-10756](https://insights.sbomify.com/MAL-2026-10756/): Malicious code in darkglitch (PyPI) (malicious package)
- [MAL-2026-10755](https://insights.sbomify.com/MAL-2026-10755/): Malicious code in captcha-solve-api (PyPI) (malicious package)
- [MAL-2026-10754](https://insights.sbomify.com/MAL-2026-10754/): Malicious code in airflow-provider-spirit (PyPI) (malicious package)
- [MAL-2026-10753](https://insights.sbomify.com/MAL-2026-10753/): Malicious code in a3s-code (PyPI) (malicious package)
- [MAL-2026-10752](https://insights.sbomify.com/MAL-2026-10752/): Malicious code in xxdxa (npm) (malicious package)
- [MAL-2026-10751](https://insights.sbomify.com/MAL-2026-10751/): Malicious code in vanexa-agent (npm) (malicious package)
- [MAL-2026-10750](https://insights.sbomify.com/MAL-2026-10750/): Malicious code in telemetry-metrics (npm) (malicious package)
- [MAL-2026-1075](https://insights.sbomify.com/MAL-2026-1075/): Malicious code in dgxeon-soket2 (npm) (malicious package)
- [MAL-2026-10749](https://insights.sbomify.com/MAL-2026-10749/): Malicious code in sync-grove (npm) (malicious package)
- [MAL-2026-10748](https://insights.sbomify.com/MAL-2026-10748/): Malicious code in string-formatter-pro (npm) (malicious package)
- [MAL-2026-10747](https://insights.sbomify.com/MAL-2026-10747/): Malicious code in sensorium-mcp (npm) (malicious package)
- [MAL-2026-10746](https://insights.sbomify.com/MAL-2026-10746/): Malicious code in sakuraai (npm) (malicious package)
- [MAL-2026-10743](https://insights.sbomify.com/MAL-2026-10743/): Malicious code in nordpass (npm) (malicious package)
- [MAL-2026-10742](https://insights.sbomify.com/MAL-2026-10742/): Malicious code in node-as-api (npm) (malicious package)
- [MAL-2026-10741](https://insights.sbomify.com/MAL-2026-10741/): Malicious code in netcontrol-agent (npm) (malicious package)
- [MAL-2026-10740](https://insights.sbomify.com/MAL-2026-10740/): Malicious code in myreviews-core (npm) (malicious package)
- [MAL-2026-1074](https://insights.sbomify.com/MAL-2026-1074/): Malicious code in dgxeon-soket (npm) (malicious package)
- [MAL-2026-10739](https://insights.sbomify.com/MAL-2026-10739/): Malicious code in mw-server-util (npm) (malicious package)
- [MAL-2026-10738](https://insights.sbomify.com/MAL-2026-10738/): Malicious code in mui-option (npm) (malicious package)
- [MAL-2026-10737](https://insights.sbomify.com/MAL-2026-10737/): Malicious code in mmagrt (npm) (malicious package)
- [MAL-2026-10736](https://insights.sbomify.com/MAL-2026-10736/): Malicious code in memtry-cli (npm) (malicious package)
- [MAL-2026-10735](https://insights.sbomify.com/MAL-2026-10735/): Malicious code in isite (npm) (malicious package)
- [MAL-2026-10734](https://insights.sbomify.com/MAL-2026-10734/): Malicious code in infrastructure-common (npm) (malicious package)
- [MAL-2026-10733](https://insights.sbomify.com/MAL-2026-10733/): Malicious code in idlive-document-capture-web (npm) (malicious package)
- [MAL-2026-10732](https://insights.sbomify.com/MAL-2026-10732/): Malicious code in hehehe (npm) (malicious package)
- [MAL-2026-10731](https://insights.sbomify.com/MAL-2026-10731/): Malicious code in date-utils-light (npm) (malicious package)
- [MAL-2026-10730](https://insights.sbomify.com/MAL-2026-10730/): Malicious code in codeam-cli (npm) (malicious package)
- [MAL-2026-1073](https://insights.sbomify.com/MAL-2026-1073/): Malicious code in baileys-xeonbot (npm) (malicious package)
- [MAL-2026-10729](https://insights.sbomify.com/MAL-2026-10729/): Malicious code in channel-worker (npm) (malicious package)
- [MAL-2026-10728](https://insights.sbomify.com/MAL-2026-10728/): Malicious code in bvm-core (npm) (malicious package)
- [MAL-2026-10727](https://insights.sbomify.com/MAL-2026-10727/): Malicious code in axios-test-one (npm) (malicious package)
- [MAL-2026-10725](https://insights.sbomify.com/MAL-2026-10725/): Malicious code in agentto (npm) (malicious package)
- [MAL-2026-10724](https://insights.sbomify.com/MAL-2026-10724/): Malicious code in @yuandc/aica (npm) (malicious package)
- [MAL-2026-10723](https://insights.sbomify.com/MAL-2026-10723/): Malicious code in @yeaft/webchat-agent (npm) (malicious package)
- [MAL-2026-10722](https://insights.sbomify.com/MAL-2026-10722/): Malicious code in @whalent/agent-core (npm) (malicious package)
- [MAL-2026-10721](https://insights.sbomify.com/MAL-2026-10721/): Malicious code in @whalent/agent (npm) (malicious package)
- [MAL-2026-10720](https://insights.sbomify.com/MAL-2026-10720/): Malicious code in @vibelet/cli (npm) (malicious package)
- [MAL-2026-1072](https://insights.sbomify.com/MAL-2026-1072/): Malicious code in @dgxeon/libsignal-node (npm) (malicious package)
- [MAL-2026-10719](https://insights.sbomify.com/MAL-2026-10719/): Malicious code in @thepayulink/server (npm) (malicious package)
- [MAL-2026-10718](https://insights.sbomify.com/MAL-2026-10718/): Malicious code in @sciagent/cli (npm) (malicious package)
- [MAL-2026-10717](https://insights.sbomify.com/MAL-2026-10717/): Malicious code in @onescience/onecode (npm) (malicious package)
- [MAL-2026-10716](https://insights.sbomify.com/MAL-2026-10716/): Malicious code in @hibachi-xyz/ui (npm) (malicious package)
- [MAL-2026-10715](https://insights.sbomify.com/MAL-2026-10715/): Malicious code in @hibachi-xyz/types (npm) (malicious package)
- [MAL-2026-10714](https://insights.sbomify.com/MAL-2026-10714/): Malicious code in @hibachi-xyz/sdk (npm) (malicious package)
- [MAL-2026-10713](https://insights.sbomify.com/MAL-2026-10713/): Malicious code in @hibachi-xyz/config (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/183/