# Vulnerabilities published in 2026


- [MAL-2026-10621](https://insights.sbomify.com/MAL-2026-10621/): Malicious code in chai-as-hardened (npm) (malicious package)
- [MAL-2026-10620](https://insights.sbomify.com/MAL-2026-10620/): Malicious code in ahooks-3.7.8 (npm) (malicious package)
- [MAL-2026-1062](https://insights.sbomify.com/MAL-2026-1062/): Malicious code in express-core-validator (npm) (malicious package)
- [MAL-2026-10619](https://insights.sbomify.com/MAL-2026-10619/): Malicious code in @vite-js/vui (npm) (malicious package)
- [MAL-2026-10618](https://insights.sbomify.com/MAL-2026-10618/): Malicious code in cosmos-gradio (PyPI) (malicious package)
- [MAL-2026-10617](https://insights.sbomify.com/MAL-2026-10617/): Malicious code in cosmos-cuda (PyPI) (malicious package)
- [MAL-2026-10616](https://insights.sbomify.com/MAL-2026-10616/): Malicious code in smb-portal-uikit (npm) (malicious package)
- [MAL-2026-10615](https://insights.sbomify.com/MAL-2026-10615/): Malicious code in smb-common-uikit (npm) (malicious package)
- [MAL-2026-10614](https://insights.sbomify.com/MAL-2026-10614/): Malicious code in postcss-selector-minify (npm) (malicious package)
- [MAL-2026-10613](https://insights.sbomify.com/MAL-2026-10613/): Malicious code in ethereum-lib-utils (npm) (malicious package)
- [MAL-2026-10612](https://insights.sbomify.com/MAL-2026-10612/): Malicious code in assertion-utils-js (npm) (malicious package)
- [MAL-2026-10611](https://insights.sbomify.com/MAL-2026-10611/): Malicious code in @web3-helpers/core (npm) (malicious package)
- [MAL-2026-10610](https://insights.sbomify.com/MAL-2026-10610/): Malicious code in proxy-check-ii (PyPI) (malicious package)
- [MAL-2026-1061](https://insights.sbomify.com/MAL-2026-1061/): Malicious code in newman-reporter-genuinepoc (npm) (malicious package)
- [MAL-2026-10609](https://insights.sbomify.com/MAL-2026-10609/): Malicious code in utils-style-engine (npm) (malicious package)
- [MAL-2026-10608](https://insights.sbomify.com/MAL-2026-10608/): Malicious code in chain-sdk-js (npm) (malicious package)
- [MAL-2026-10607](https://insights.sbomify.com/MAL-2026-10607/): Malicious code in chai-as-act (npm) (malicious package)
- [MAL-2026-10606](https://insights.sbomify.com/MAL-2026-10606/): Malicious code in base58-utils (npm) (malicious package)
- [MAL-2026-10605](https://insights.sbomify.com/MAL-2026-10605/): Malicious code in @radivi-ui/react-dialog (npm) (malicious package)
- [MAL-2026-10604](https://insights.sbomify.com/MAL-2026-10604/): Malicious code in @public-for-cdao/types (npm) (malicious package)
- [MAL-2026-10603](https://insights.sbomify.com/MAL-2026-10603/): Malicious code in @public-for-cdao/token (npm) (malicious package)
- [MAL-2026-10602](https://insights.sbomify.com/MAL-2026-10602/): Malicious code in @public-for-cdao/config (npm) (malicious package)
- [MAL-2026-10601](https://insights.sbomify.com/MAL-2026-10601/): Malicious code in @public-for-cdao/common (npm) (malicious package)
- [MAL-2026-10600](https://insights.sbomify.com/MAL-2026-10600/): Malicious code in @public-for-cdao/api (npm) (malicious package)
- [MAL-2026-1060](https://insights.sbomify.com/MAL-2026-1060/): Malicious code in @zinley/orion (npm) (malicious package)
- [MAL-2026-106](https://insights.sbomify.com/MAL-2026-106/): Malicious code in transform-decorators-legacy (npm) (malicious package)
- [MAL-2026-10599](https://insights.sbomify.com/MAL-2026-10599/): Malicious code in @public-for-cdao/abi (npm) (malicious package)
- [MAL-2026-10598](https://insights.sbomify.com/MAL-2026-10598/): Malicious code in monitoring-service-util (npm) (malicious package)
- [MAL-2026-10597](https://insights.sbomify.com/MAL-2026-10597/): Malicious code in monitoring-service (npm) (malicious package)
- [MAL-2026-10596](https://insights.sbomify.com/MAL-2026-10596/): Malicious code in @ayunlove/bails (npm) (malicious package)
- [MAL-2026-10595](https://insights.sbomify.com/MAL-2026-10595/): Malicious code in nodemon-plint (npm) (malicious package)
- [MAL-2026-10594](https://insights.sbomify.com/MAL-2026-10594/): Malicious code in yargsplus (npm) (malicious package)
- [MAL-2026-10593](https://insights.sbomify.com/MAL-2026-10593/): Malicious code in twiliobox (npm) (malicious package)
- [MAL-2026-10592](https://insights.sbomify.com/MAL-2026-10592/): Malicious code in stripedev (npm) (malicious package)
- [MAL-2026-10591](https://insights.sbomify.com/MAL-2026-10591/): Malicious code in solana-key-utils (npm) (malicious package)
- [MAL-2026-10590](https://insights.sbomify.com/MAL-2026-10590/): Malicious code in openaiwrapper (npm) (malicious package)
- [MAL-2026-1059](https://insights.sbomify.com/MAL-2026-1059/): Malicious code in nuget-task-common (npm) (malicious package)
- [MAL-2026-10589](https://insights.sbomify.com/MAL-2026-10589/): Malicious code in nodeaxois (npm) (malicious package)
- [MAL-2026-10588](https://insights.sbomify.com/MAL-2026-10588/): Malicious code in momenntjs (npm) (malicious package)
- [MAL-2026-10587](https://insights.sbomify.com/MAL-2026-10587/): Malicious code in dayjscore (npm) (malicious package)
- [MAL-2026-10586](https://insights.sbomify.com/MAL-2026-10586/): Malicious code in crypto-validate-lib (npm) (malicious package)
- [MAL-2026-10585](https://insights.sbomify.com/MAL-2026-10585/): Malicious code in cheeriobox (npm) (malicious package)
- [MAL-2026-10584](https://insights.sbomify.com/MAL-2026-10584/): Malicious code in chalkdevx (npm) (malicious package)
- [MAL-2026-10583](https://insights.sbomify.com/MAL-2026-10583/): Malicious code in chalkdev (npm) (malicious package)
- [MAL-2026-10582](https://insights.sbomify.com/MAL-2026-10582/): Malicious code in async-mutex-v2 (npm) (malicious package)
- [MAL-2026-10581](https://insights.sbomify.com/MAL-2026-10581/): Malicious code in process-status-widget (npm) (malicious package)
- [MAL-2026-10580](https://insights.sbomify.com/MAL-2026-10580/): Malicious code in ethers-core (npm) (malicious package)
- [MAL-2026-1058](https://insights.sbomify.com/MAL-2026-1058/): Malicious code in zoddle (npm) (malicious package)
- [MAL-2026-10579](https://insights.sbomify.com/MAL-2026-10579/): Malicious code in bimi-maker (npm) (malicious package)
- [MAL-2026-10578](https://insights.sbomify.com/MAL-2026-10578/): Malicious code in @sqlite-group/sql-creator (npm) (malicious package)
- [MAL-2026-10577](https://insights.sbomify.com/MAL-2026-10577/): Malicious code in @sqlite-clone/nodesql (npm) (malicious package)
- [MAL-2026-10576](https://insights.sbomify.com/MAL-2026-10576/): Malicious code in tennacity (PyPI) (malicious package)
- [MAL-2026-10575](https://insights.sbomify.com/MAL-2026-10575/): Malicious code in web-pop (npm) (malicious package)
- [MAL-2026-10574](https://insights.sbomify.com/MAL-2026-10574/): Malicious code in vite-plugin-config-paths (npm) (malicious package)
- [MAL-2026-10573](https://insights.sbomify.com/MAL-2026-10573/): Malicious code in harpoon-package (npm) (malicious package)
- [MAL-2026-10572](https://insights.sbomify.com/MAL-2026-10572/): Malicious code in eth-wallet-helpers (npm) (malicious package)
- [MAL-2026-10571](https://insights.sbomify.com/MAL-2026-10571/): Malicious code in @wrenfield/viem (npm) (malicious package)
- [MAL-2026-10570](https://insights.sbomify.com/MAL-2026-10570/): Malicious code in valid-scope (npm) (malicious package)
- [MAL-2026-1057](https://insights.sbomify.com/MAL-2026-1057/): Malicious code in windowston (npm) (malicious package)
- [MAL-2026-10569](https://insights.sbomify.com/MAL-2026-10569/): Malicious code in temp-cloak (npm) (malicious package)
- [MAL-2026-10568](https://insights.sbomify.com/MAL-2026-10568/): Malicious code in sync-logger (npm) (malicious package)
- [MAL-2026-10567](https://insights.sbomify.com/MAL-2026-10567/): Malicious code in string-morph (npm) (malicious package)
- [MAL-2026-10566](https://insights.sbomify.com/MAL-2026-10566/): Malicious code in sight-bind (npm) (malicious package)
- [MAL-2026-10565](https://insights.sbomify.com/MAL-2026-10565/): Malicious code in relative-time-live (npm) (malicious package)
- [MAL-2026-10564](https://insights.sbomify.com/MAL-2026-10564/): Malicious code in micro-ui-loader (npm) (malicious package)
- [MAL-2026-10563](https://insights.sbomify.com/MAL-2026-10563/): Malicious code in humanize-kit (npm) (malicious package)
- [MAL-2026-10562](https://insights.sbomify.com/MAL-2026-10562/): Malicious code in duration-kit (npm) (malicious package)
- [MAL-2026-10561](https://insights.sbomify.com/MAL-2026-10561/): Malicious code in dom-weave (npm) (malicious package)
- [MAL-2026-10560](https://insights.sbomify.com/MAL-2026-10560/): Malicious code in clipboard-drop (npm) (malicious package)
- [MAL-2026-1056](https://insights.sbomify.com/MAL-2026-1056/): Malicious code in undicy-lint (npm) (malicious package)
- [MAL-2026-10559](https://insights.sbomify.com/MAL-2026-10559/): Malicious code in avatar-forge (npm) (malicious package)
- [MAL-2026-10558](https://insights.sbomify.com/MAL-2026-10558/): Malicious code in akshajrawat.utils (npm) (malicious package)
- [MAL-2026-10557](https://insights.sbomify.com/MAL-2026-10557/): Malicious code in @cw-ui/micro-ui-loader (npm) (malicious package)
- [MAL-2026-10556](https://insights.sbomify.com/MAL-2026-10556/): Malicious code in @cw-ui/asio-neon-themes (npm) (malicious package)
- [MAL-2026-10555](https://insights.sbomify.com/MAL-2026-10555/): Malicious code in @codex2005/logger-core (npm) (malicious package)
- [MAL-2026-10554](https://insights.sbomify.com/MAL-2026-10554/): Malicious code in @akshajrawat/plugin-repo-cli (npm) (malicious package)
- [MAL-2026-10553](https://insights.sbomify.com/MAL-2026-10553/): Malicious code in home-mp-commons (npm) (malicious package)
- [MAL-2026-10552](https://insights.sbomify.com/MAL-2026-10552/): Malicious code in eth-dev (npm) (malicious package)
- [MAL-2026-10551](https://insights.sbomify.com/MAL-2026-10551/): Malicious code in elsisi-cli (npm) (malicious package)
- [MAL-2026-10550](https://insights.sbomify.com/MAL-2026-10550/): Malicious code in better-tailwindcss (npm) (malicious package)
- [MAL-2026-1055](https://insights.sbomify.com/MAL-2026-1055/): Malicious code in jslint-config (npm) (malicious package)
- [MAL-2026-10549](https://insights.sbomify.com/MAL-2026-10549/): Malicious code in abi-encode (npm) (malicious package)
- [MAL-2026-10548](https://insights.sbomify.com/MAL-2026-10548/): Malicious code in @amedit/vercel-builder-probe (npm) (malicious package)
- [MAL-2026-10547](https://insights.sbomify.com/MAL-2026-10547/): Malicious code in pokee-data-utils (PyPI) (malicious package)
- [MAL-2026-10546](https://insights.sbomify.com/MAL-2026-10546/): Malicious code in viteplugiin (npm) (malicious package)
- [MAL-2026-10545](https://insights.sbomify.com/MAL-2026-10545/): Malicious code in vite-plugin-model (npm) (malicious package)
- [MAL-2026-10544](https://insights.sbomify.com/MAL-2026-10544/): Malicious code in skrill-sdk (npm) (malicious package)
- [MAL-2026-10543](https://insights.sbomify.com/MAL-2026-10543/): Malicious code in skrill-payments (npm) (malicious package)
- [MAL-2026-10542](https://insights.sbomify.com/MAL-2026-10542/): Malicious code in skrill (npm) (malicious package)
- [MAL-2026-10541](https://insights.sbomify.com/MAL-2026-10541/): Malicious code in proxy-seller-mcp (npm) (malicious package)
- [MAL-2026-10540](https://insights.sbomify.com/MAL-2026-10540/): Malicious code in postcss-processor-utils (npm) (malicious package)
- [MAL-2026-1054](https://insights.sbomify.com/MAL-2026-1054/): Malicious code in iosysredis (npm) (malicious package)
- [MAL-2026-10539](https://insights.sbomify.com/MAL-2026-10539/): Malicious code in postcss-animatecss (npm) (malicious package)
- [MAL-2026-10538](https://insights.sbomify.com/MAL-2026-10538/): Malicious code in neteller (npm) (malicious package)
- [MAL-2026-10537](https://insights.sbomify.com/MAL-2026-10537/): Malicious code in neon-postgres (npm) (malicious package)
- [MAL-2026-10536](https://insights.sbomify.com/MAL-2026-10536/): Malicious code in n8n-nodes-social-facebook (npm) (malicious package)
- [MAL-2026-10535](https://insights.sbomify.com/MAL-2026-10535/): Malicious code in my-empty-package (npm) (malicious package)
- [MAL-2026-10534](https://insights.sbomify.com/MAL-2026-10534/): Malicious code in motion-pull (npm) (malicious package)
- [MAL-2026-10533](https://insights.sbomify.com/MAL-2026-10533/): Malicious code in lusha-iam-widgets (npm) (malicious package)
- [MAL-2026-10532](https://insights.sbomify.com/MAL-2026-10532/): Malicious code in fluterjs (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/185/