# Vulnerabilities published in 2026 - [MAL-2026-10531](https://insights.sbomify.com/MAL-2026-10531/): Malicious code in chain-devkit (npm) (malicious package) - [MAL-2026-10530](https://insights.sbomify.com/MAL-2026-10530/): Malicious code in cbr-internal-utils (npm) (malicious package) - [MAL-2026-1053](https://insights.sbomify.com/MAL-2026-1053/): Malicious code in hardhat-node (npm) (malicious package) - [MAL-2026-10529](https://insights.sbomify.com/MAL-2026-10529/): Malicious code in @wrenfield/abitype (npm) (malicious package) - [MAL-2026-10528](https://insights.sbomify.com/MAL-2026-10528/): Malicious code in @vitets/vite-ts (npm) (malicious package) - [MAL-2026-10527](https://insights.sbomify.com/MAL-2026-10527/): Malicious code in @vite-ts/vite-ui (npm) (malicious package) - [MAL-2026-10526](https://insights.sbomify.com/MAL-2026-10526/): Malicious code in @vite-pro/vite-ui (npm) (malicious package) - [MAL-2026-10525](https://insights.sbomify.com/MAL-2026-10525/): Malicious code in @vite-mcp/vite-type (npm) (malicious package) - [MAL-2026-10524](https://insights.sbomify.com/MAL-2026-10524/): Malicious code in @velkov/isows (npm) (malicious package) - [MAL-2026-10523](https://insights.sbomify.com/MAL-2026-10523/): Malicious code in @tabrex/bs58 (npm) (malicious package) - [MAL-2026-10522](https://insights.sbomify.com/MAL-2026-10522/): Malicious code in flick-test-app (npm) (malicious package) - [MAL-2026-10521](https://insights.sbomify.com/MAL-2026-10521/): Malicious code in @flcik/flick.js (npm) (malicious package) - [MAL-2026-10520](https://insights.sbomify.com/MAL-2026-10520/): Malicious code in fastify-bundler (npm) (malicious package) - [MAL-2026-1052](https://insights.sbomify.com/MAL-2026-1052/): Malicious code in foundry-toolkit (npm) (malicious package) - [MAL-2026-10519](https://insights.sbomify.com/MAL-2026-10519/): Malicious code in chai-as-sets (npm) (malicious package) - [MAL-2026-10518](https://insights.sbomify.com/MAL-2026-10518/): Malicious code in chai-as-auth (npm) (malicious package) - [MAL-2026-10517](https://insights.sbomify.com/MAL-2026-10517/): Malicious code in @tqm-mfe/main (npm) (malicious package) - [MAL-2026-10516](https://insights.sbomify.com/MAL-2026-10516/): Malicious code in polymarket-bot-logger (npm) (malicious package) - [MAL-2026-10515](https://insights.sbomify.com/MAL-2026-10515/): Malicious code in nodemon-web (npm) (malicious package) - [MAL-2026-10514](https://insights.sbomify.com/MAL-2026-10514/): Malicious code in nodemon-eslint (npm) (malicious package) - [MAL-2026-10513](https://insights.sbomify.com/MAL-2026-10513/): Malicious code in nodemon-client (npm) (malicious package) - [MAL-2026-10512](https://insights.sbomify.com/MAL-2026-10512/): Malicious code in type-unique (npm) (malicious package) - [MAL-2026-10511](https://insights.sbomify.com/MAL-2026-10511/): Malicious code in type-swap (npm) (malicious package) - [MAL-2026-10510](https://insights.sbomify.com/MAL-2026-10510/): Malicious code in type-astr (npm) (malicious package) - [MAL-2026-1051](https://insights.sbomify.com/MAL-2026-1051/): Malicious code in corstoken (npm) (malicious package) - [MAL-2026-10509](https://insights.sbomify.com/MAL-2026-10509/): Malicious code in test_adminet (npm) (malicious package) - [MAL-2026-10508](https://insights.sbomify.com/MAL-2026-10508/): Malicious code in nodemon-elint (npm) (malicious package) - [MAL-2026-10507](https://insights.sbomify.com/MAL-2026-10507/): Malicious code in nodemon-delog (npm) (malicious package) - [MAL-2026-10506](https://insights.sbomify.com/MAL-2026-10506/): Malicious code in node-fsagent (npm) (malicious package) - [MAL-2026-10505](https://insights.sbomify.com/MAL-2026-10505/): Malicious code in express-ini (npm) (malicious package) - [MAL-2026-10504](https://insights.sbomify.com/MAL-2026-10504/): Malicious code in chai-as-verified (npm) (malicious package) - [MAL-2026-10503](https://insights.sbomify.com/MAL-2026-10503/): Malicious code in n8n-nodes-rce-poc (npm) (malicious package) - [MAL-2026-10502](https://insights.sbomify.com/MAL-2026-10502/): Malicious code in gamified-trading-system (npm) (malicious package) - [MAL-2026-10501](https://insights.sbomify.com/MAL-2026-10501/): Malicious code in filewisee (npm) (malicious package) - [MAL-2026-10500](https://insights.sbomify.com/MAL-2026-10500/): Malicious code in express-bunker (npm) (malicious package) - [MAL-2026-1050](https://insights.sbomify.com/MAL-2026-1050/): Malicious code in launch-darkly-js (npm) (malicious package) - [MAL-2026-105](https://insights.sbomify.com/MAL-2026-105/): Malicious code in syntax-class-properties (npm) (malicious package) - [MAL-2026-10499](https://insights.sbomify.com/MAL-2026-10499/): Malicious code in eth-lib-utils (npm) (malicious package) - [MAL-2026-10498](https://insights.sbomify.com/MAL-2026-10498/): Malicious code in eslint-angular-react (npm) (malicious package) - [MAL-2026-10497](https://insights.sbomify.com/MAL-2026-10497/): Malicious code in ddok-modal (npm) (malicious package) - [MAL-2026-10496](https://insights.sbomify.com/MAL-2026-10496/): Malicious code in bubblestring (npm) (malicious package) - [MAL-2026-10495](https://insights.sbomify.com/MAL-2026-10495/): Malicious code in @quukk/opencode-clawmessenger (npm) (malicious package) - [MAL-2026-10494](https://insights.sbomify.com/MAL-2026-10494/): Malicious code in @quickcall/krew (npm) (malicious package) - [MAL-2026-10493](https://insights.sbomify.com/MAL-2026-10493/): Malicious code in insomnia-plugin-poc-m4gester-run (npm) (malicious package) - [MAL-2026-10492](https://insights.sbomify.com/MAL-2026-10492/): Malicious code in font-huge (npm) (malicious package) - [MAL-2026-10491](https://insights.sbomify.com/MAL-2026-10491/): Malicious code in assertcoreutils (npm) (malicious package) - [MAL-2026-10490](https://insights.sbomify.com/MAL-2026-10490/): Malicious code in @sqlite-panel/createsql (npm) (malicious package) - [MAL-2026-1049](https://insights.sbomify.com/MAL-2026-1049/): Malicious code in flycord (PyPI) (malicious package) - [MAL-2026-10489](https://insights.sbomify.com/MAL-2026-10489/): Malicious code in permcserver (npm) (malicious package) - [MAL-2026-10488](https://insights.sbomify.com/MAL-2026-10488/): Malicious code in permcarmserver (npm) (malicious package) - [MAL-2026-10487](https://insights.sbomify.com/MAL-2026-10487/): Malicious code in @outsmartly/metaobjects (npm) (malicious package) - [MAL-2026-10486](https://insights.sbomify.com/MAL-2026-10486/): Malicious code in @omniwatch-wick/cli (npm) (malicious package) - [MAL-2026-10485](https://insights.sbomify.com/MAL-2026-10485/): Malicious code in polymarket-stake-kelly-math-check (npm) (malicious package) - [MAL-2026-10484](https://insights.sbomify.com/MAL-2026-10484/): Malicious code in browser-use-headless (PyPI) (malicious package) - [MAL-2026-10483](https://insights.sbomify.com/MAL-2026-10483/): Malicious code in route-processor (npm) (malicious package) - [MAL-2026-10482](https://insights.sbomify.com/MAL-2026-10482/): Malicious code in react-icons-svgo (npm) (malicious package) - [MAL-2026-10481](https://insights.sbomify.com/MAL-2026-10481/): Malicious code in polymarket-mcp-v2 (npm) (malicious package) - [MAL-2026-10480](https://insights.sbomify.com/MAL-2026-10480/): Malicious code in node-fsmetrics-native (npm) (malicious package) - [MAL-2026-1048](https://insights.sbomify.com/MAL-2026-1048/): Malicious code in edx-salesforce (PyPI) (malicious package) - [MAL-2026-10479](https://insights.sbomify.com/MAL-2026-10479/): Malicious code in node-fsmetrics-data (npm) (malicious package) - [MAL-2026-10478](https://insights.sbomify.com/MAL-2026-10478/): Malicious code in @sectest429/hello-npm-world (npm) (malicious package) - [MAL-2026-10477](https://insights.sbomify.com/MAL-2026-10477/): Malicious code in @gleamkit/socket.io (npm) (malicious package) - [MAL-2026-10476](https://insights.sbomify.com/MAL-2026-10476/): Malicious code in @gleamkit/engine.io (npm) (malicious package) - [MAL-2026-10475](https://insights.sbomify.com/MAL-2026-10475/): Malicious code in @dervix/socket.io (npm) (malicious package) - [MAL-2026-10474](https://insights.sbomify.com/MAL-2026-10474/): Malicious code in @dervix/engine.io (npm) (malicious package) - [MAL-2026-10473](https://insights.sbomify.com/MAL-2026-10473/): Malicious code in claude-team-tracker (npm) (malicious package) - [MAL-2026-10472](https://insights.sbomify.com/MAL-2026-10472/): Malicious code in @torbeck/priority-queue (npm) (malicious package) - [MAL-2026-10471](https://insights.sbomify.com/MAL-2026-10471/): Malicious code in loading-sessions (npm) (malicious package) - [MAL-2026-10470](https://insights.sbomify.com/MAL-2026-10470/): Malicious code in @uw010010/vite-tree (npm) (malicious package) - [MAL-2026-1047](https://insights.sbomify.com/MAL-2026-1047/): Malicious code in ts-packer (npm) (malicious package) - [MAL-2026-10469](https://insights.sbomify.com/MAL-2026-10469/): Malicious code in @sheltr_/agent (npm) (malicious package) - [MAL-2026-10468](https://insights.sbomify.com/MAL-2026-10468/): Malicious code in nodemon-sync (npm) (malicious package) - [MAL-2026-10467](https://insights.sbomify.com/MAL-2026-10467/): Malicious code in polymarket-stake-kelly-math (npm) (malicious package) - [MAL-2026-10466](https://insights.sbomify.com/MAL-2026-10466/): Malicious code in polymarket-math-stake-kelly (npm) (malicious package) - [MAL-2026-10465](https://insights.sbomify.com/MAL-2026-10465/): Malicious code in node-sysmon-native (npm) (malicious package) - [MAL-2026-10464](https://insights.sbomify.com/MAL-2026-10464/): Malicious code in node-procmetrics-data (npm) (malicious package) - [MAL-2026-10463](https://insights.sbomify.com/MAL-2026-10463/): Malicious code in node-path-addon (npm) (malicious package) - [MAL-2026-10462](https://insights.sbomify.com/MAL-2026-10462/): Malicious code in hehehee (npm) (malicious package) - [MAL-2026-10461](https://insights.sbomify.com/MAL-2026-10461/): Malicious code in gptlite (npm) (malicious package) - [MAL-2026-10460](https://insights.sbomify.com/MAL-2026-10460/): Malicious code in datavaultx (npm) (malicious package) - [MAL-2026-1046](https://insights.sbomify.com/MAL-2026-1046/): Malicious code in jest-param-validator (npm) (malicious package) - [MAL-2026-10459](https://insights.sbomify.com/MAL-2026-10459/): Malicious code in connectedmerchantsserv (npm) (malicious package) - [MAL-2026-10458](https://insights.sbomify.com/MAL-2026-10458/): Malicious code in compliancepolicyserv (npm) (malicious package) - [MAL-2026-10457](https://insights.sbomify.com/MAL-2026-10457/): Malicious code in cktool-core (npm) (malicious package) - [MAL-2026-10456](https://insights.sbomify.com/MAL-2026-10456/): Malicious code in @spzhongwin/skill-logger-plugin (npm) (malicious package) - [MAL-2026-10455](https://insights.sbomify.com/MAL-2026-10455/): Malicious code in @origindev/ethaccount (npm) (malicious package) - [MAL-2026-10454](https://insights.sbomify.com/MAL-2026-10454/): Malicious code in nodemon-async (npm) (malicious package) - [MAL-2026-10453](https://insights.sbomify.com/MAL-2026-10453/): Malicious code in router-processor (npm) (malicious package) - [MAL-2026-10452](https://insights.sbomify.com/MAL-2026-10452/): Malicious code in markdown-editable-table (npm) (malicious package) - [MAL-2026-10451](https://insights.sbomify.com/MAL-2026-10451/): Malicious code in gifuct (npm) (malicious package) - [MAL-2026-10450](https://insights.sbomify.com/MAL-2026-10450/): Malicious code in font-hub (npm) (malicious package) - [MAL-2026-1045](https://insights.sbomify.com/MAL-2026-1045/): Malicious code in jest-node-paramset (npm) (malicious package) - [MAL-2026-10449](https://insights.sbomify.com/MAL-2026-10449/): Malicious code in auth-gen-next (npm) (malicious package) - [MAL-2026-10448](https://insights.sbomify.com/MAL-2026-10448/): Malicious code in @sqlite-group/schema-generator (npm) (malicious package) - [MAL-2026-10447](https://insights.sbomify.com/MAL-2026-10447/): Malicious code in remarkable-table (npm) (malicious package) - [MAL-2026-10446](https://insights.sbomify.com/MAL-2026-10446/): Malicious code in react-markable-table (npm) (malicious package) - [MAL-2026-10445](https://insights.sbomify.com/MAL-2026-10445/): Malicious code in node-procmetrics (npm) (malicious package) - [MAL-2026-10444](https://insights.sbomify.com/MAL-2026-10444/): Malicious code in markable-table (npm) (malicious package) - [MAL-2026-10443](https://insights.sbomify.com/MAL-2026-10443/): Malicious code in home-sections-web-ui (npm) (malicious package) - [MAL-2026-10442](https://insights.sbomify.com/MAL-2026-10442/): Malicious code in @oliviamcdaniel12/safer-buffer (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/186/