# Vulnerabilities published in 2026


- [MAL-2026-10441](https://insights.sbomify.com/MAL-2026-10441/): Malicious code in turbocalcng (PyPI) (malicious package)
- [MAL-2026-10440](https://insights.sbomify.com/MAL-2026-10440/): Malicious code in type-context (npm) (malicious package)
- [MAL-2026-1044](https://insights.sbomify.com/MAL-2026-1044/): Malicious code in awareness-demo-pkg (PyPI) (malicious package)
- [MAL-2026-10439](https://insights.sbomify.com/MAL-2026-10439/): Malicious code in react-hot-svg (npm) (malicious package)
- [MAL-2026-10438](https://insights.sbomify.com/MAL-2026-10438/): Malicious code in netspeedutil (npm) (malicious package)
- [MAL-2026-10437](https://insights.sbomify.com/MAL-2026-10437/): Malicious code in jsonfb (npm) (malicious package)
- [MAL-2026-10436](https://insights.sbomify.com/MAL-2026-10436/): Malicious code in jest-formatter (npm) (malicious package)
- [MAL-2026-10435](https://insights.sbomify.com/MAL-2026-10435/): Malicious code in fetchcraft (npm) (malicious package)
- [MAL-2026-10434](https://insights.sbomify.com/MAL-2026-10434/): Malicious code in env-fast (npm) (malicious package)
- [MAL-2026-10433](https://insights.sbomify.com/MAL-2026-10433/): Malicious code in chain-guardian (npm) (malicious package)
- [MAL-2026-10432](https://insights.sbomify.com/MAL-2026-10432/): Malicious code in animated-css-kit (npm) (malicious package)
- [MAL-2026-10431](https://insights.sbomify.com/MAL-2026-10431/): Malicious code in @tailwind-ts/eslint-plugin (npm) (malicious package)
- [MAL-2026-10430](https://insights.sbomify.com/MAL-2026-10430/): Malicious code in prettier-plugin-base (npm) (malicious package)
- [MAL-2026-1043](https://insights.sbomify.com/MAL-2026-1043/): Malicious code in uuindex (npm) (malicious package)
- [MAL-2026-10429](https://insights.sbomify.com/MAL-2026-10429/): Malicious code in @nsub/nitxe (npm) (malicious package)
- [MAL-2026-10428](https://insights.sbomify.com/MAL-2026-10428/): Malicious code in sysb1 (npm) (malicious package)
- [MAL-2026-10427](https://insights.sbomify.com/MAL-2026-10427/): Malicious code in svg-fetcher (npm) (malicious package)
- [MAL-2026-10426](https://insights.sbomify.com/MAL-2026-10426/): Malicious code in chai-log (npm) (malicious package)
- [MAL-2026-10425](https://insights.sbomify.com/MAL-2026-10425/): Malicious code in trinity-scheme (npm) (malicious package)
- [MAL-2026-10424](https://insights.sbomify.com/MAL-2026-10424/): Malicious code in terminal-mascot (npm) (malicious package)
- [MAL-2026-10423](https://insights.sbomify.com/MAL-2026-10423/): Malicious code in supertokens-web (npm) (malicious package)
- [MAL-2026-10422](https://insights.sbomify.com/MAL-2026-10422/): Malicious code in sso-users-detection (npm) (malicious package)
- [MAL-2026-10421](https://insights.sbomify.com/MAL-2026-10421/): Malicious code in portway (npm) (malicious package)
- [MAL-2026-10420](https://insights.sbomify.com/MAL-2026-10420/): Malicious code in path-addon-extend (npm) (malicious package)
- [MAL-2026-1042](https://insights.sbomify.com/MAL-2026-1042/): Malicious code in trae-browser-inspect (npm) (malicious package)
- [MAL-2026-10419](https://insights.sbomify.com/MAL-2026-10419/): Malicious code in notifications-broadcast (npm) (malicious package)
- [MAL-2026-10418](https://insights.sbomify.com/MAL-2026-10418/): Malicious code in note-utilities (npm) (malicious package)
- [MAL-2026-10417](https://insights.sbomify.com/MAL-2026-10417/): Malicious code in minigptcore (npm) (malicious package)
- [MAL-2026-10416](https://insights.sbomify.com/MAL-2026-10416/): Malicious code in kuaishou (npm) (malicious package)
- [MAL-2026-10415](https://insights.sbomify.com/MAL-2026-10415/): Malicious code in frontend-regulations (npm) (malicious package)
- [MAL-2026-10414](https://insights.sbomify.com/MAL-2026-10414/): Malicious code in express-request-engine (npm) (malicious package)
- [MAL-2026-10413](https://insights.sbomify.com/MAL-2026-10413/): Malicious code in eth-base (npm) (malicious package)
- [MAL-2026-10412](https://insights.sbomify.com/MAL-2026-10412/): Malicious code in env-stream (npm) (malicious package)
- [MAL-2026-10411](https://insights.sbomify.com/MAL-2026-10411/): Malicious code in cookie-sign (npm) (malicious package)
- [MAL-2026-10410](https://insights.sbomify.com/MAL-2026-10410/): Malicious code in cookie-phase (npm) (malicious package)
- [MAL-2026-1041](https://insights.sbomify.com/MAL-2026-1041/): Malicious code in secure-monkey (npm) (malicious package)
- [MAL-2026-10409](https://insights.sbomify.com/MAL-2026-10409/): Malicious code in cold-debug-elevator (npm) (malicious package)
- [MAL-2026-10408](https://insights.sbomify.com/MAL-2026-10408/): Malicious code in chain-js-utils (npm) (malicious package)
- [MAL-2026-10407](https://insights.sbomify.com/MAL-2026-10407/): Malicious code in awesome-terminal (npm) (malicious package)
- [MAL-2026-10406](https://insights.sbomify.com/MAL-2026-10406/): Malicious code in async-chain-dom (npm) (malicious package)
- [MAL-2026-10405](https://insights.sbomify.com/MAL-2026-10405/): Malicious code in @torbeck/heap (npm) (malicious package)
- [MAL-2026-10404](https://insights.sbomify.com/MAL-2026-10404/): Malicious code in @ica-gaming/slot-engine (npm) (malicious package)
- [MAL-2026-10403](https://insights.sbomify.com/MAL-2026-10403/): Malicious code in @iana-rzms/bff-sdk (npm) (malicious package)
- [MAL-2026-10402](https://insights.sbomify.com/MAL-2026-10402/): Malicious code in @gleamkit/ws (npm) (malicious package)
- [MAL-2026-10401](https://insights.sbomify.com/MAL-2026-10401/): Malicious code in @espn-ping/react-dmed-oauth (npm) (malicious package)
- [MAL-2026-10400](https://insights.sbomify.com/MAL-2026-10400/): Malicious code in @equansservices/tool (npm) (malicious package)
- [MAL-2026-1040](https://insights.sbomify.com/MAL-2026-1040/): Malicious code in react-markdown-canvas (npm) (malicious package)
- [MAL-2026-104](https://insights.sbomify.com/MAL-2026-104/): Malicious code in sort-imports-es6-autofix (npm) (malicious package)
- [MAL-2026-10399](https://insights.sbomify.com/MAL-2026-10399/): Malicious code in @equansservices/codex (npm) (malicious package)
- [MAL-2026-10398](https://insights.sbomify.com/MAL-2026-10398/): Malicious code in @db-tools/main-app (npm) (malicious package)
- [MAL-2026-10397](https://insights.sbomify.com/MAL-2026-10397/): Malicious code in @car_loans/dealerships-approval (npm) (malicious package)
- [MAL-2026-10396](https://insights.sbomify.com/MAL-2026-10396/): Malicious code in whatsadmaidk (npm) (malicious package)
- [MAL-2026-10395](https://insights.sbomify.com/MAL-2026-10395/): Malicious code in vibewise-cli (npm) (malicious package)
- [MAL-2026-10394](https://insights.sbomify.com/MAL-2026-10394/): Malicious code in vibewise (npm) (malicious package)
- [MAL-2026-10393](https://insights.sbomify.com/MAL-2026-10393/): Malicious code in tipsen-poc-again (npm) (malicious package)
- [MAL-2026-10392](https://insights.sbomify.com/MAL-2026-10392/): Malicious code in tipsen-last-pls (npm) (malicious package)
- [MAL-2026-10391](https://insights.sbomify.com/MAL-2026-10391/): Malicious code in tipsen-last (npm) (malicious package)
- [MAL-2026-10390](https://insights.sbomify.com/MAL-2026-10390/): Malicious code in timmytuffknuckles9 (npm) (malicious package)
- [MAL-2026-1039](https://insights.sbomify.com/MAL-2026-1039/): Malicious code in react-devtools-raycast (npm) (malicious package)
- [MAL-2026-10389](https://insights.sbomify.com/MAL-2026-10389/): Malicious code in timmytuffknuckles6 (npm) (malicious package)
- [MAL-2026-10388](https://insights.sbomify.com/MAL-2026-10388/): Malicious code in timmytuffknuckles3 (npm) (malicious package)
- [MAL-2026-10387](https://insights.sbomify.com/MAL-2026-10387/): Malicious code in thebigyahu (npm) (malicious package)
- [MAL-2026-10386](https://insights.sbomify.com/MAL-2026-10386/): Malicious code in testdonotredeemit (npm) (malicious package)
- [MAL-2026-10385](https://insights.sbomify.com/MAL-2026-10385/): Malicious code in speed5 (npm) (malicious package)
- [MAL-2026-10384](https://insights.sbomify.com/MAL-2026-10384/): Malicious code in speed3 (npm) (malicious package)
- [MAL-2026-10383](https://insights.sbomify.com/MAL-2026-10383/): Malicious code in speed2 (npm) (malicious package)
- [MAL-2026-10382](https://insights.sbomify.com/MAL-2026-10382/): Malicious code in speed1 (npm) (malicious package)
- [MAL-2026-10381](https://insights.sbomify.com/MAL-2026-10381/): Malicious code in sixseven9 (npm) (malicious package)
- [MAL-2026-10380](https://insights.sbomify.com/MAL-2026-10380/): Malicious code in sixseven8 (npm) (malicious package)
- [MAL-2026-1038](https://insights.sbomify.com/MAL-2026-1038/): Malicious code in promanage (npm) (malicious package)
- [MAL-2026-10379](https://insights.sbomify.com/MAL-2026-10379/): Malicious code in sixseven7 (npm) (malicious package)
- [MAL-2026-10378](https://insights.sbomify.com/MAL-2026-10378/): Malicious code in sixseven6 (npm) (malicious package)
- [MAL-2026-10377](https://insights.sbomify.com/MAL-2026-10377/): Malicious code in sixseven5 (npm) (malicious package)
- [MAL-2026-10376](https://insights.sbomify.com/MAL-2026-10376/): Malicious code in sixseven4 (npm) (malicious package)
- [MAL-2026-10375](https://insights.sbomify.com/MAL-2026-10375/): Malicious code in sixseven3 (npm) (malicious package)
- [MAL-2026-10374](https://insights.sbomify.com/MAL-2026-10374/): Malicious code in sixseven2 (npm) (malicious package)
- [MAL-2026-10373](https://insights.sbomify.com/MAL-2026-10373/): Malicious code in sixseven10 (npm) (malicious package)
- [MAL-2026-10372](https://insights.sbomify.com/MAL-2026-10372/): Malicious code in sixseven1 (npm) (malicious package)
- [MAL-2026-10371](https://insights.sbomify.com/MAL-2026-10371/): Malicious code in ratelimitsucks9 (npm) (malicious package)
- [MAL-2026-10370](https://insights.sbomify.com/MAL-2026-10370/): Malicious code in ratelimitsucks5 (npm) (malicious package)
- [MAL-2026-1037](https://insights.sbomify.com/MAL-2026-1037/): Malicious code in get-fonts (npm) (malicious package)
- [MAL-2026-10369](https://insights.sbomify.com/MAL-2026-10369/): Malicious code in ratelimitsucks4 (npm) (malicious package)
- [MAL-2026-10368](https://insights.sbomify.com/MAL-2026-10368/): Malicious code in ratelimitsucks3 (npm) (malicious package)
- [MAL-2026-10367](https://insights.sbomify.com/MAL-2026-10367/): Malicious code in ratelimitsucks2 (npm) (malicious package)
- [MAL-2026-10366](https://insights.sbomify.com/MAL-2026-10366/): Malicious code in ratelimitsucks10 (npm) (malicious package)
- [MAL-2026-10365](https://insights.sbomify.com/MAL-2026-10365/): Malicious code in ratelimitsucks1 (npm) (malicious package)
- [MAL-2026-10364](https://insights.sbomify.com/MAL-2026-10364/): Malicious code in pasirianspirit (npm) (malicious package)
- [MAL-2026-10363](https://insights.sbomify.com/MAL-2026-10363/): Malicious code in openai-apps (npm) (malicious package)
- [MAL-2026-10362](https://insights.sbomify.com/MAL-2026-10362/): Malicious code in omgyesyesyes (npm) (malicious package)
- [MAL-2026-10361](https://insights.sbomify.com/MAL-2026-10361/): Malicious code in omglucidesotuff (npm) (malicious package)
- [MAL-2026-10360](https://insights.sbomify.com/MAL-2026-10360/): Malicious code in nottuff9 (npm) (malicious package)
- [MAL-2026-1036](https://insights.sbomify.com/MAL-2026-1036/): Malicious code in uitil (PyPI) (malicious package)
- [MAL-2026-10359](https://insights.sbomify.com/MAL-2026-10359/): Malicious code in nottuff8 (npm) (malicious package)
- [MAL-2026-10358](https://insights.sbomify.com/MAL-2026-10358/): Malicious code in nottuff6 (npm) (malicious package)
- [MAL-2026-10357](https://insights.sbomify.com/MAL-2026-10357/): Malicious code in nottuff5 (npm) (malicious package)
- [MAL-2026-10356](https://insights.sbomify.com/MAL-2026-10356/): Malicious code in nottuff30 (npm) (malicious package)
- [MAL-2026-10355](https://insights.sbomify.com/MAL-2026-10355/): Malicious code in nottuff3 (npm) (malicious package)
- [MAL-2026-10354](https://insights.sbomify.com/MAL-2026-10354/): Malicious code in nottuff29 (npm) (malicious package)
- [MAL-2026-10353](https://insights.sbomify.com/MAL-2026-10353/): Malicious code in nottuff28 (npm) (malicious package)
- [MAL-2026-10352](https://insights.sbomify.com/MAL-2026-10352/): Malicious code in nottuff27 (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/187/