# Vulnerabilities published in 2026


- [MAL-2026-10261](https://insights.sbomify.com/MAL-2026-10261/): Malicious code in abuden219 (npm) (malicious package)
- [MAL-2026-10260](https://insights.sbomify.com/MAL-2026-10260/): Malicious code in abuden217 (npm) (malicious package)
- [MAL-2026-1026](https://insights.sbomify.com/MAL-2026-1026/): Malicious code in rncalendareventsexample (npm) (malicious package)
- [MAL-2026-10259](https://insights.sbomify.com/MAL-2026-10259/): Malicious code in abuden216 (npm) (malicious package)
- [MAL-2026-10258](https://insights.sbomify.com/MAL-2026-10258/): Malicious code in abuden215 (npm) (malicious package)
- [MAL-2026-10257](https://insights.sbomify.com/MAL-2026-10257/): Malicious code in abuden214 (npm) (malicious package)
- [MAL-2026-10256](https://insights.sbomify.com/MAL-2026-10256/): Malicious code in abuden213 (npm) (malicious package)
- [MAL-2026-10255](https://insights.sbomify.com/MAL-2026-10255/): Malicious code in abuden212 (npm) (malicious package)
- [MAL-2026-10254](https://insights.sbomify.com/MAL-2026-10254/): Malicious code in abuden211 (npm) (malicious package)
- [MAL-2026-10253](https://insights.sbomify.com/MAL-2026-10253/): Malicious code in abuden210 (npm) (malicious package)
- [MAL-2026-10252](https://insights.sbomify.com/MAL-2026-10252/): Malicious code in abuden2 (npm) (malicious package)
- [MAL-2026-10251](https://insights.sbomify.com/MAL-2026-10251/): Malicious code in abuden1 (npm) (malicious package)
- [MAL-2026-10250](https://insights.sbomify.com/MAL-2026-10250/): Malicious code in @gt-test-exp/profiler-exp-00000014 (npm) (malicious package)
- [MAL-2026-1025](https://insights.sbomify.com/MAL-2026-1025/): Malicious code in @unitedcapitalfinancialadvisors/finlife-component-library (npm) (malicious package)
- [MAL-2026-10249](https://insights.sbomify.com/MAL-2026-10249/): Malicious code in @gt-test-exp/profiler-exp-00000013 (npm) (malicious package)
- [MAL-2026-10248](https://insights.sbomify.com/MAL-2026-10248/): Malicious code in @gt-test-exp/profiler-exp-00000012 (npm) (malicious package)
- [MAL-2026-10247](https://insights.sbomify.com/MAL-2026-10247/): Malicious code in @gt-test-exp/profiler-exp-00000011 (npm) (malicious package)
- [MAL-2026-10246](https://insights.sbomify.com/MAL-2026-10246/): Malicious code in @gt-test-exp/profiler-exp-00000010 (npm) (malicious package)
- [MAL-2026-10245](https://insights.sbomify.com/MAL-2026-10245/): Malicious code in @gt-test-exp/profiler-exp-00000009 (npm) (malicious package)
- [MAL-2026-10244](https://insights.sbomify.com/MAL-2026-10244/): Malicious code in @gt-test-exp/profiler-exp-00000008 (npm) (malicious package)
- [MAL-2026-10243](https://insights.sbomify.com/MAL-2026-10243/): Malicious code in @gt-test-exp/profiler-exp-00000006 (npm) (malicious package)
- [MAL-2026-10242](https://insights.sbomify.com/MAL-2026-10242/): Malicious code in @gt-test-exp/profiler-exp-00000005 (npm) (malicious package)
- [MAL-2026-10241](https://insights.sbomify.com/MAL-2026-10241/): Malicious code in @gt-test-exp/profiler-exp-00000004 (npm) (malicious package)
- [MAL-2026-10240](https://insights.sbomify.com/MAL-2026-10240/): Malicious code in @gt-test-exp/profiler-exp-00000003 (npm) (malicious package)
- [MAL-2026-1024](https://insights.sbomify.com/MAL-2026-1024/): Malicious code in @protonme/routing (npm) (malicious package)
- [MAL-2026-10239](https://insights.sbomify.com/MAL-2026-10239/): Malicious code in @gt-test-exp/profiler-exp-00000002 (npm) (malicious package)
- [MAL-2026-10238](https://insights.sbomify.com/MAL-2026-10238/): Malicious code in @gt-test-exp/profiler-exp-00000001 (npm) (malicious package)
- [MAL-2026-10237](https://insights.sbomify.com/MAL-2026-10237/): Malicious code in tme-xca-react (npm) (malicious package)
- [MAL-2026-10236](https://insights.sbomify.com/MAL-2026-10236/): Malicious code in tme-xca (npm) (malicious package)
- [MAL-2026-10235](https://insights.sbomify.com/MAL-2026-10235/): Malicious code in tme-error (npm) (malicious package)
- [MAL-2026-10234](https://insights.sbomify.com/MAL-2026-10234/): Malicious code in slds-lsp-client (npm) (malicious package)
- [MAL-2026-10233](https://insights.sbomify.com/MAL-2026-10233/): Malicious code in sams-sr-sdk-h5 (npm) (malicious package)
- [MAL-2026-10232](https://insights.sbomify.com/MAL-2026-10232/): Malicious code in salesforce-vscode-slds (npm) (malicious package)
- [MAL-2026-10231](https://insights.sbomify.com/MAL-2026-10231/): Malicious code in enbd-react-logger (npm) (malicious package)
- [MAL-2026-10230](https://insights.sbomify.com/MAL-2026-10230/): Malicious code in enbd-react-lib (npm) (malicious package)
- [MAL-2026-1023](https://insights.sbomify.com/MAL-2026-1023/): Malicious code in @kiukicom/sidebar (npm) (malicious package)
- [MAL-2026-10229](https://insights.sbomify.com/MAL-2026-10229/): Malicious code in enbd-react-error-boundry (npm) (malicious package)
- [MAL-2026-10228](https://insights.sbomify.com/MAL-2026-10228/): Malicious code in chat-adapter-zoom (npm) (malicious package)
- [MAL-2026-10227](https://insights.sbomify.com/MAL-2026-10227/): Malicious code in box-react-uix (npm) (malicious package)
- [MAL-2026-10226](https://insights.sbomify.com/MAL-2026-10226/): Malicious code in @logdna-web/styles (npm) (malicious package)
- [MAL-2026-10225](https://insights.sbomify.com/MAL-2026-10225/): Malicious code in @logdna-web/shared (npm) (malicious package)
- [MAL-2026-10224](https://insights.sbomify.com/MAL-2026-10224/): Malicious code in @idms-corp/auth-ui (npm) (malicious package)
- [MAL-2026-10223](https://insights.sbomify.com/MAL-2026-10223/): Malicious code in @flex-ng/header-component (npm) (malicious package)
- [MAL-2026-10222](https://insights.sbomify.com/MAL-2026-10222/): Malicious code in @flex-ng/filter-pipe (npm) (malicious package)
- [MAL-2026-10221](https://insights.sbomify.com/MAL-2026-10221/): Malicious code in @flex-ng/error-component (npm) (malicious package)
- [MAL-2026-10220](https://insights.sbomify.com/MAL-2026-10220/): Malicious code in @jplopezy/connectivity-test-do-not-install (npm) (malicious package)
- [MAL-2026-1022](https://insights.sbomify.com/MAL-2026-1022/): Malicious code in @coinmetro/app (npm) (malicious package)
- [MAL-2026-10219](https://insights.sbomify.com/MAL-2026-10219/): Malicious code in chai-as-precision (npm) (malicious package)
- [MAL-2026-10218](https://insights.sbomify.com/MAL-2026-10218/): Malicious code in pure-folder-three (npm) (malicious package)
- [MAL-2026-10217](https://insights.sbomify.com/MAL-2026-10217/): Malicious code in dotnet-runtime-base (npm) (malicious package)
- [MAL-2026-10216](https://insights.sbomify.com/MAL-2026-10216/): Malicious code in node-sysmetrics (npm) (malicious package)
- [MAL-2026-10215](https://insights.sbomify.com/MAL-2026-10215/): Malicious code in fast-dotenv (PyPI) (malicious package)
- [MAL-2026-10214](https://insights.sbomify.com/MAL-2026-10214/): Malicious code in babel-preset-lib-client (npm) (malicious package)
- [MAL-2026-10213](https://insights.sbomify.com/MAL-2026-10213/): Malicious code in pipspeed (PyPI) (malicious package)
- [MAL-2026-10212](https://insights.sbomify.com/MAL-2026-10212/): Malicious code in vuln-package (npm) (malicious package)
- [MAL-2026-10211](https://insights.sbomify.com/MAL-2026-10211/): Malicious code in react-next-vite (npm) (malicious package)
- [MAL-2026-10210](https://insights.sbomify.com/MAL-2026-10210/): Malicious code in mcp-notes-server-poc-praetorian (npm) (malicious package)
- [MAL-2026-1021](https://insights.sbomify.com/MAL-2026-1021/): Malicious code in @atg-aml-shared/kyc-domain (npm) (malicious package)
- [MAL-2026-10209](https://insights.sbomify.com/MAL-2026-10209/): Malicious code in auto-debug-tool (npm) (malicious package)
- [MAL-2026-10208](https://insights.sbomify.com/MAL-2026-10208/): Malicious code in @meziizana/frontend-logger (npm) (malicious package)
- [MAL-2026-10207](https://insights.sbomify.com/MAL-2026-10207/): Malicious code in react-dom-v17 (npm) (malicious package)
- [MAL-2026-10206](https://insights.sbomify.com/MAL-2026-10206/): Malicious code in nullrift (npm) (malicious package)
- [MAL-2026-10205](https://insights.sbomify.com/MAL-2026-10205/): Malicious code in library-explorer (npm) (malicious package)
- [MAL-2026-10204](https://insights.sbomify.com/MAL-2026-10204/): Malicious code in gptcore (npm) (malicious package)
- [MAL-2026-10203](https://insights.sbomify.com/MAL-2026-10203/): Malicious code in giantswarm (npm) (malicious package)
- [MAL-2026-10202](https://insights.sbomify.com/MAL-2026-10202/): Malicious code in chain-await-dom (npm) (malicious package)
- [MAL-2026-10201](https://insights.sbomify.com/MAL-2026-10201/): Malicious code in bugexploit (npm) (malicious package)
- [MAL-2026-10200](https://insights.sbomify.com/MAL-2026-10200/): Malicious code in api-changelly (npm) (malicious package)
- [MAL-2026-1020](https://insights.sbomify.com/MAL-2026-1020/): Malicious code in @ai-studio-web/app (npm) (malicious package)
- [MAL-2026-102](https://insights.sbomify.com/MAL-2026-102/): Malicious code in redis-cookie-ts (npm) (malicious package)
- [MAL-2026-10199](https://insights.sbomify.com/MAL-2026-10199/): Malicious code in polymarket-kelly-math-stake (npm) (malicious package)
- [MAL-2026-10198](https://insights.sbomify.com/MAL-2026-10198/): Malicious code in polylabel-web-lib (npm) (malicious package)
- [MAL-2026-10197](https://insights.sbomify.com/MAL-2026-10197/): Malicious code in metemask-sdk (PyPI) (malicious package)
- [MAL-2026-10196](https://insights.sbomify.com/MAL-2026-10196/): Malicious code in jupiter-sdk (PyPI) (malicious package)
- [MAL-2026-10195](https://insights.sbomify.com/MAL-2026-10195/): Malicious code in eth-agent (PyPI) (malicious package)
- [MAL-2026-10194](https://insights.sbomify.com/MAL-2026-10194/): Malicious code in solidity-dev (PyPI) (malicious package)
- [MAL-2026-10193](https://insights.sbomify.com/MAL-2026-10193/): Malicious code in py-base58 (PyPI) (malicious package)
- [MAL-2026-10192](https://insights.sbomify.com/MAL-2026-10192/): Malicious code in defi-tools (PyPI) (malicious package)
- [MAL-2026-10191](https://insights.sbomify.com/MAL-2026-10191/): Malicious code in data-harvester (PyPI) (malicious package)
- [MAL-2026-10190](https://insights.sbomify.com/MAL-2026-10190/): Malicious code in tinyparrot (npm) (malicious package)
- [MAL-2026-1019](https://insights.sbomify.com/MAL-2026-1019/): Malicious code in spark-audit-notify (PyPI) (malicious package)
- [MAL-2026-10189](https://insights.sbomify.com/MAL-2026-10189/): Malicious code in tinymask-js (npm) (malicious package)
- [MAL-2026-10188](https://insights.sbomify.com/MAL-2026-10188/): Malicious code in awesome-ts-jest (npm) (malicious package)
- [MAL-2026-10187](https://insights.sbomify.com/MAL-2026-10187/): Malicious code in jscrambler (npm) (malicious package)
- [MAL-2026-10186](https://insights.sbomify.com/MAL-2026-10186/): Malicious code in google-caja-bower (npm) (malicious package)
- [MAL-2026-10185](https://insights.sbomify.com/MAL-2026-10185/): Malicious code in authvaultx (npm) (malicious package)
- [MAL-2026-10184](https://insights.sbomify.com/MAL-2026-10184/): Malicious code in mongoose-schema-unique (npm) (malicious package)
- [MAL-2026-10183](https://insights.sbomify.com/MAL-2026-10183/): Malicious code in fkext-browser-min (npm) (malicious package)
- [MAL-2026-10182](https://insights.sbomify.com/MAL-2026-10182/): Malicious code in express-guardian (npm) (malicious package)
- [MAL-2026-10181](https://insights.sbomify.com/MAL-2026-10181/): Malicious code in consumerweb (npm) (malicious package)
- [MAL-2026-10180](https://insights.sbomify.com/MAL-2026-10180/): Malicious code in auth-next-gen (npm) (malicious package)
- [MAL-2026-1018](https://insights.sbomify.com/MAL-2026-1018/): Malicious code in do-not-install-this-package-003 (PyPI) (malicious package)
- [MAL-2026-10179](https://insights.sbomify.com/MAL-2026-10179/): Malicious code in @uwr/colors (npm) (malicious package)
- [MAL-2026-10178](https://insights.sbomify.com/MAL-2026-10178/): Malicious code in @broadpeak/smartlib-ad (npm) (malicious package)
- [MAL-2026-10177](https://insights.sbomify.com/MAL-2026-10177/): Malicious code in @jaymara/jsononifier (npm) (malicious package)
- [MAL-2026-10176](https://insights.sbomify.com/MAL-2026-10176/): Malicious code in uncaxss (npm) (malicious package)
- [MAL-2026-10175](https://insights.sbomify.com/MAL-2026-10175/): Malicious code in chai-as-doc (npm) (malicious package)
- [MAL-2026-10174](https://insights.sbomify.com/MAL-2026-10174/): Malicious code in type-atob (npm) (malicious package)
- [MAL-2026-10173](https://insights.sbomify.com/MAL-2026-10173/): Malicious code in paysafe-vault (npm) (malicious package)
- [MAL-2026-10172](https://insights.sbomify.com/MAL-2026-10172/): Malicious code in paysafe-payments (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/189/