# Vulnerabilities published in 2026


- [MAL-2026-10712](https://insights.sbomify.com/MAL-2026-10712/): Malicious code in @hibachi-xyz/common (npm) (malicious package)
- [MAL-2026-10711](https://insights.sbomify.com/MAL-2026-10711/): Malicious code in @funny-booth/agent-core (npm) (malicious package)
- [MAL-2026-10710](https://insights.sbomify.com/MAL-2026-10710/): Malicious code in @equans-services/codex (npm) (malicious package)
- [MAL-2026-1071](https://insights.sbomify.com/MAL-2026-1071/): Malicious code in libsignal-skyzopedia (npm) (malicious package)
- [MAL-2026-10709](https://insights.sbomify.com/MAL-2026-10709/): Malicious code in @cyberrant-rantai/rantai (npm) (malicious package)
- [MAL-2026-10707](https://insights.sbomify.com/MAL-2026-10707/): Malicious code in @ai-support-agent/cli (npm) (malicious package)
- [MAL-2026-10706](https://insights.sbomify.com/MAL-2026-10706/): Malicious code in @agentvox/host (npm) (malicious package)
- [MAL-2026-10705](https://insights.sbomify.com/MAL-2026-10705/): Malicious code in @agent-link/agent (npm) (malicious package)
- [MAL-2026-10704](https://insights.sbomify.com/MAL-2026-10704/): Malicious code in @across-toolkit/typescript-config (npm) (malicious package)
- [MAL-2026-10703](https://insights.sbomify.com/MAL-2026-10703/): Malicious code in @across-toolkit/eslint-config (npm) (malicious package)
- [MAL-2026-10702](https://insights.sbomify.com/MAL-2026-10702/): Malicious code in discordia-telemetria (PyPI) (malicious package)
- [MAL-2026-10701](https://insights.sbomify.com/MAL-2026-10701/): Malicious code in discord-telemetry (PyPI) (malicious package)
- [MAL-2026-10700](https://insights.sbomify.com/MAL-2026-10700/): Malicious code in time-format-kit (npm) (malicious package)
- [MAL-2026-1070](https://insights.sbomify.com/MAL-2026-1070/): Malicious code in @skyzopedia/ubot (npm) (malicious package)
- [MAL-2026-107](https://insights.sbomify.com/MAL-2026-107/): Malicious code in 1kzr (npm) (malicious package)
- [MAL-2026-10699](https://insights.sbomify.com/MAL-2026-10699/): Malicious code in http-req-lite (npm) (malicious package)
- [MAL-2026-10698](https://insights.sbomify.com/MAL-2026-10698/): Malicious code in websight2-p2p (npm) (malicious package)
- [MAL-2026-10697](https://insights.sbomify.com/MAL-2026-10697/): Malicious code in websight-p2p (npm) (malicious package)
- [MAL-2026-10696](https://insights.sbomify.com/MAL-2026-10696/): Malicious code in loader1 (npm) (malicious package)
- [MAL-2026-10695](https://insights.sbomify.com/MAL-2026-10695/): Malicious code in ai-p2p (npm) (malicious package)
- [MAL-2026-10694](https://insights.sbomify.com/MAL-2026-10694/): Malicious code in vor8zakon (npm) (malicious package)
- [MAL-2026-10693](https://insights.sbomify.com/MAL-2026-10693/): Malicious code in claude-token-tracker-mcp (npm) (malicious package)
- [MAL-2026-10692](https://insights.sbomify.com/MAL-2026-10692/): Malicious code in nyt-cms (npm) (malicious package)
- [MAL-2026-10691](https://insights.sbomify.com/MAL-2026-10691/): Malicious code in internallib_v907 (npm) (malicious package)
- [MAL-2026-10690](https://insights.sbomify.com/MAL-2026-10690/): Malicious code in qwen-asr-pvt (PyPI) (malicious package)
- [MAL-2026-1069](https://insights.sbomify.com/MAL-2026-1069/): Malicious code in @skyzopedia/libsignal-node (npm) (malicious package)
- [MAL-2026-10689](https://insights.sbomify.com/MAL-2026-10689/): Malicious code in pylogora (PyPI) (malicious package)
- [MAL-2026-10688](https://insights.sbomify.com/MAL-2026-10688/): Malicious code in log-guru (PyPI) (malicious package)
- [MAL-2026-10687](https://insights.sbomify.com/MAL-2026-10687/): Malicious code in selparsecss-selector (npm) (malicious package)
- [MAL-2026-10686](https://insights.sbomify.com/MAL-2026-10686/): Malicious code in @ddh-libraries/analytics (npm) (malicious package)
- [MAL-2026-10685](https://insights.sbomify.com/MAL-2026-10685/): Malicious code in trongridweb (PyPI) (malicious package)
- [MAL-2026-10684](https://insights.sbomify.com/MAL-2026-10684/): Malicious code in react-hook-scripts (npm) (malicious package)
- [MAL-2026-10683](https://insights.sbomify.com/MAL-2026-10683/): Malicious code in formatters.ts (npm) (malicious package)
- [MAL-2026-10682](https://insights.sbomify.com/MAL-2026-10682/): Malicious code in code-formatter-setup (npm) (malicious package)
- [MAL-2026-10681](https://insights.sbomify.com/MAL-2026-10681/): Malicious code in xyq-drama-skill (PyPI) (malicious package)
- [MAL-2026-10680](https://insights.sbomify.com/MAL-2026-10680/): Malicious code in syncgrove (npm) (malicious package)
- [MAL-2026-1068](https://insights.sbomify.com/MAL-2026-1068/): Malicious code in @skyzopedia/brat (npm) (malicious package)
- [MAL-2026-10679](https://insights.sbomify.com/MAL-2026-10679/): Malicious code in rakibox (npm) (malicious package)
- [MAL-2026-10678](https://insights.sbomify.com/MAL-2026-10678/): Malicious code in ls-env-config (npm) (malicious package)
- [MAL-2026-10677](https://insights.sbomify.com/MAL-2026-10677/): Malicious code in deployowl (npm) (malicious package)
- [MAL-2026-10676](https://insights.sbomify.com/MAL-2026-10676/): Malicious code in commonjs-assert (npm) (malicious package)
- [MAL-2026-10675](https://insights.sbomify.com/MAL-2026-10675/): Malicious code in ac-raf-emitter (npm) (malicious package)
- [MAL-2026-10674](https://insights.sbomify.com/MAL-2026-10674/): Malicious code in jscrambler-metro-plugin (npm) (malicious package)
- [MAL-2026-10673](https://insights.sbomify.com/MAL-2026-10673/): Malicious code in gulp-jscrambler (npm) (malicious package)
- [MAL-2026-10672](https://insights.sbomify.com/MAL-2026-10672/): Malicious code in northstart-sdk (PyPI) (malicious package)
- [MAL-2026-10671](https://insights.sbomify.com/MAL-2026-10671/): Malicious code in spytrack (npm) (malicious package)
- [MAL-2026-10670](https://insights.sbomify.com/MAL-2026-10670/): Malicious code in eslintcmd (npm) (malicious package)
- [MAL-2026-1067](https://insights.sbomify.com/MAL-2026-1067/): Malicious code in @skyzopedia/baileys-pro (npm) (malicious package)
- [MAL-2026-10669](https://insights.sbomify.com/MAL-2026-10669/): Malicious code in dbconnectify (npm) (malicious package)
- [MAL-2026-10668](https://insights.sbomify.com/MAL-2026-10668/): Malicious code in chain-as-log (npm) (malicious package)
- [MAL-2026-10667](https://insights.sbomify.com/MAL-2026-10667/): Malicious code in true (npm) (malicious package)
- [MAL-2026-10666](https://insights.sbomify.com/MAL-2026-10666/): Malicious code in crypto-hasher (npm) (malicious package)
- [MAL-2026-10665](https://insights.sbomify.com/MAL-2026-10665/): Malicious code in @fhkry/x-baileys (npm) (malicious package)
- [MAL-2026-10664](https://insights.sbomify.com/MAL-2026-10664/): Malicious code in @fhkry/baileys-v2 (npm) (malicious package)
- [MAL-2026-10663](https://insights.sbomify.com/MAL-2026-10663/): Malicious code in zaldy-baileys (npm) (malicious package)
- [MAL-2026-10662](https://insights.sbomify.com/MAL-2026-10662/): Malicious code in ssweb-wp (npm) (malicious package)
- [MAL-2026-10661](https://insights.sbomify.com/MAL-2026-10661/): Malicious code in sauruslord-baileys (npm) (malicious package)
- [MAL-2026-10660](https://insights.sbomify.com/MAL-2026-10660/): Malicious code in saurus-assets (npm) (malicious package)
- [MAL-2026-1066](https://insights.sbomify.com/MAL-2026-1066/): Malicious code in @skyzopedia/baileys-mod (npm) (malicious package)
- [MAL-2026-10659](https://insights.sbomify.com/MAL-2026-10659/): Malicious code in @sauruslord/libsignal (npm) (malicious package)
- [MAL-2026-10658](https://insights.sbomify.com/MAL-2026-10658/): Malicious code in @sauruslord/eslint-config (npm) (malicious package)
- [MAL-2026-10657](https://insights.sbomify.com/MAL-2026-10657/): Malicious code in @sauruslord/baileys (npm) (malicious package)
- [MAL-2026-10656](https://insights.sbomify.com/MAL-2026-10656/): Malicious code in @pimy-b2cweb/frontend-lib (npm) (malicious package)
- [MAL-2026-10655](https://insights.sbomify.com/MAL-2026-10655/): Malicious code in @pimy-b2cweb/apiclient-b2cweb-r2 (npm) (malicious package)
- [MAL-2026-10654](https://insights.sbomify.com/MAL-2026-10654/): Malicious code in @debile/require-dir (npm) (malicious package)
- [MAL-2026-10653](https://insights.sbomify.com/MAL-2026-10653/): Malicious code in webpack-session-cache (npm) (malicious package)
- [MAL-2026-10652](https://insights.sbomify.com/MAL-2026-10652/): Malicious code in json-bigint-extend (npm) (malicious package)
- [MAL-2026-10651](https://insights.sbomify.com/MAL-2026-10651/): Malicious code in iwsdk (npm) (malicious package)
- [MAL-2026-10650](https://insights.sbomify.com/MAL-2026-10650/): Malicious code in install-skia (npm) (malicious package)
- [MAL-2026-1065](https://insights.sbomify.com/MAL-2026-1065/): Malicious code in @skyzopedia/baileys (npm) (malicious package)
- [MAL-2026-10649](https://insights.sbomify.com/MAL-2026-10649/): Malicious code in @saladin0x1/js-shared-modules (npm) (malicious package)
- [MAL-2026-10648](https://insights.sbomify.com/MAL-2026-10648/): Malicious code in @hkyyy/portal-widget-helper-0601 (npm) (malicious package)
- [MAL-2026-10647](https://insights.sbomify.com/MAL-2026-10647/): Malicious code in @bcs-mi-ui/test1243npmpacket76 (npm) (malicious package)
- [MAL-2026-10646](https://insights.sbomify.com/MAL-2026-10646/): Malicious code in @bcs-mi-ui/message-block (npm) (malicious package)
- [MAL-2026-10645](https://insights.sbomify.com/MAL-2026-10645/): Malicious code in @bcs-mi-ui/message (npm) (malicious package)
- [MAL-2026-10644](https://insights.sbomify.com/MAL-2026-10644/): Malicious code in proxy-checker-j (PyPI) (malicious package)
- [MAL-2026-10643](https://insights.sbomify.com/MAL-2026-10643/): Malicious code in ethereum-input-decorder (PyPI) (malicious package)
- [MAL-2026-10642](https://insights.sbomify.com/MAL-2026-10642/): Malicious code in data-proxy-for-test (PyPI) (malicious package)
- [MAL-2026-10641](https://insights.sbomify.com/MAL-2026-10641/): Malicious code in polygon-toolkit-validator (npm) (malicious package)
- [MAL-2026-10640](https://insights.sbomify.com/MAL-2026-10640/): Malicious code in polygon-toolkit-validation (npm) (malicious package)
- [MAL-2026-1064](https://insights.sbomify.com/MAL-2026-1064/): Malicious code in cicd-ppe-redteam-test02 (PyPI) (malicious package)
- [MAL-2026-10639](https://insights.sbomify.com/MAL-2026-10639/): Malicious code in ogensec-sdk (npm) (malicious package)
- [MAL-2026-10638](https://insights.sbomify.com/MAL-2026-10638/): Malicious code in monogrok (npm) (malicious package)
- [MAL-2026-10637](https://insights.sbomify.com/MAL-2026-10637/): Malicious code in mc-reg (npm) (malicious package)
- [MAL-2026-10636](https://insights.sbomify.com/MAL-2026-10636/): Malicious code in leviosa86-test (npm) (malicious package)
- [MAL-2026-10635](https://insights.sbomify.com/MAL-2026-10635/): Malicious code in gmail-changer (npm) (malicious package)
- [MAL-2026-10634](https://insights.sbomify.com/MAL-2026-10634/): Malicious code in estore-client (npm) (malicious package)
- [MAL-2026-10633](https://insights.sbomify.com/MAL-2026-10633/): Malicious code in creditgauge (npm) (malicious package)
- [MAL-2026-10632](https://insights.sbomify.com/MAL-2026-10632/): Malicious code in cppt-common (npm) (malicious package)
- [MAL-2026-10631](https://insights.sbomify.com/MAL-2026-10631/): Malicious code in core-dotenv (npm) (malicious package)
- [MAL-2026-10630](https://insights.sbomify.com/MAL-2026-10630/): Malicious code in chai-as-byte (npm) (malicious package)
- [MAL-2026-1063](https://insights.sbomify.com/MAL-2026-1063/): Malicious code in cicd-ppe-redteam-test01 (PyPI) (malicious package)
- [MAL-2026-10629](https://insights.sbomify.com/MAL-2026-10629/): Malicious code in ai-pro-sdk (npm) (malicious package)
- [MAL-2026-10628](https://insights.sbomify.com/MAL-2026-10628/): Malicious code in ai-explain (npm) (malicious package)
- [MAL-2026-10627](https://insights.sbomify.com/MAL-2026-10627/): Malicious code in @sqlite-frame/nodesql (npm) (malicious package)
- [MAL-2026-10626](https://insights.sbomify.com/MAL-2026-10626/): Malicious code in @react-case/option (npm) (malicious package)
- [MAL-2026-10625](https://insights.sbomify.com/MAL-2026-10625/): Malicious code in @leviosa86com/leviosa86-test (npm) (malicious package)
- [MAL-2026-10624](https://insights.sbomify.com/MAL-2026-10624/): Malicious code in tronwe (PyPI) (malicious package)
- [MAL-2026-10623](https://insights.sbomify.com/MAL-2026-10623/): Malicious code in http-ws-listener (npm) (malicious package)
- [MAL-2026-10622](https://insights.sbomify.com/MAL-2026-10622/): Malicious code in chai-as-structured (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/184/