# Vulnerabilities published in 2026 - [MAL-2026-10171](https://insights.sbomify.com/MAL-2026-10171/): Malicious code in paysafe-node (npm) (malicious package) - [MAL-2026-10170](https://insights.sbomify.com/MAL-2026-10170/): Malicious code in paysafe-kyc (npm) (malicious package) - [MAL-2026-1017](https://insights.sbomify.com/MAL-2026-1017/): Malicious code in json-mapping-srcs (npm) (malicious package) - [MAL-2026-10169](https://insights.sbomify.com/MAL-2026-10169/): Malicious code in paysafe-js (npm) (malicious package) - [MAL-2026-10168](https://insights.sbomify.com/MAL-2026-10168/): Malicious code in paysafe-fraud (npm) (malicious package) - [MAL-2026-10167](https://insights.sbomify.com/MAL-2026-10167/): Malicious code in paysafe-checkout (npm) (malicious package) - [MAL-2026-10166](https://insights.sbomify.com/MAL-2026-10166/): Malicious code in paysafe-api (npm) (malicious package) - [MAL-2026-10165](https://insights.sbomify.com/MAL-2026-10165/): Malicious code in @injectivelabs/sdk-ts (npm) (malicious package) - [MAL-2026-10164](https://insights.sbomify.com/MAL-2026-10164/): Malicious code in type-async (npm) (malicious package) - [MAL-2026-10163](https://insights.sbomify.com/MAL-2026-10163/): Malicious code in llama-tokenizer (npm) (malicious package) - [MAL-2026-10162](https://insights.sbomify.com/MAL-2026-10162/): Malicious code in @bcryptln/becryptjs (npm) (malicious package) - [MAL-2026-10161](https://insights.sbomify.com/MAL-2026-10161/): Malicious code in sidecar-mcp (npm) (malicious package) - [MAL-2026-10160](https://insights.sbomify.com/MAL-2026-10160/): Malicious code in rollup-packages-polyfill-core (npm) (malicious package) - [MAL-2026-1016](https://insights.sbomify.com/MAL-2026-1016/): Malicious code in js-multer (npm) (malicious package) - [MAL-2026-10159](https://insights.sbomify.com/MAL-2026-10159/): Malicious code in npm-rce-safe-proof-yourname (npm) (malicious package) - [MAL-2026-10158](https://insights.sbomify.com/MAL-2026-10158/): Malicious code in notify-utilities (npm) (malicious package) - [MAL-2026-10157](https://insights.sbomify.com/MAL-2026-10157/): Malicious code in notify-theme (npm) (malicious package) - [MAL-2026-10156](https://insights.sbomify.com/MAL-2026-10156/): Malicious code in notify-logs (npm) (malicious package) - [MAL-2026-10155](https://insights.sbomify.com/MAL-2026-10155/): Malicious code in notify-funcs (npm) (malicious package) - [MAL-2026-10154](https://insights.sbomify.com/MAL-2026-10154/): Malicious code in notify-dist (npm) (malicious package) - [MAL-2026-10153](https://insights.sbomify.com/MAL-2026-10153/): Malicious code in notifier-log (npm) (malicious package) - [MAL-2026-10152](https://insights.sbomify.com/MAL-2026-10152/): Malicious code in notifier-funcs (npm) (malicious package) - [MAL-2026-10151](https://insights.sbomify.com/MAL-2026-10151/): Malicious code in buffer-util-internal (npm) (malicious package) - [MAL-2026-10150](https://insights.sbomify.com/MAL-2026-10150/): Malicious code in ap3-components-ui (npm) (malicious package) - [MAL-2026-1015](https://insights.sbomify.com/MAL-2026-1015/): Malicious code in es1int-config (npm) (malicious package) - [MAL-2026-10149](https://insights.sbomify.com/MAL-2026-10149/): Malicious code in polymarket-gamma-apis (npm) (malicious package) - [MAL-2026-10148](https://insights.sbomify.com/MAL-2026-10148/): Malicious code in polygon-gamma-apis (npm) (malicious package) - [MAL-2026-10147](https://insights.sbomify.com/MAL-2026-10147/): Malicious code in polygon-gama-apis (npm) (malicious package) - [MAL-2026-10146](https://insights.sbomify.com/MAL-2026-10146/): Malicious code in ng-search-api (npm) (malicious package) - [MAL-2026-10145](https://insights.sbomify.com/MAL-2026-10145/): Malicious code in motiondnb (npm) (malicious package) - [MAL-2026-10144](https://insights.sbomify.com/MAL-2026-10144/): Malicious code in mdb-vite (npm) (malicious package) - [MAL-2026-10143](https://insights.sbomify.com/MAL-2026-10143/): Malicious code in marked-prettier (npm) (malicious package) - [MAL-2026-10142](https://insights.sbomify.com/MAL-2026-10142/): Malicious code in eslint-jest (npm) (malicious package) - [MAL-2026-10141](https://insights.sbomify.com/MAL-2026-10141/): Malicious code in @genie-auth/config (npm) (malicious package) - [MAL-2026-10140](https://insights.sbomify.com/MAL-2026-10140/): Malicious code in @amtrav/webservice (npm) (malicious package) - [MAL-2026-1014](https://insights.sbomify.com/MAL-2026-1014/): Malicious code in chai-iotype (npm) (malicious package) - [MAL-2026-10139](https://insights.sbomify.com/MAL-2026-10139/): Malicious code in turbocalc (PyPI) (malicious package) - [MAL-2026-10138](https://insights.sbomify.com/MAL-2026-10138/): Malicious code in uac-package (npm) (malicious package) - [MAL-2026-10137](https://insights.sbomify.com/MAL-2026-10137/): Malicious code in type-elint (npm) (malicious package) - [MAL-2026-10136](https://insights.sbomify.com/MAL-2026-10136/): Malicious code in transform-es2015-sticky-regex (npm) (malicious package) - [MAL-2026-10135](https://insights.sbomify.com/MAL-2026-10135/): Malicious code in theta-sdk-js (npm) (malicious package) - [MAL-2026-10134](https://insights.sbomify.com/MAL-2026-10134/): Malicious code in stella-coder (npm) (malicious package) - [MAL-2026-10133](https://insights.sbomify.com/MAL-2026-10133/): Malicious code in stella-ai-cli (npm) (malicious package) - [MAL-2026-10132](https://insights.sbomify.com/MAL-2026-10132/): Malicious code in react-jsonwebtoken (npm) (malicious package) - [MAL-2026-10131](https://insights.sbomify.com/MAL-2026-10131/): Malicious code in express-session-kit (npm) (malicious package) - [MAL-2026-10130](https://insights.sbomify.com/MAL-2026-10130/): Malicious code in type-plint (npm) (malicious package) - [MAL-2026-1013](https://insights.sbomify.com/MAL-2026-1013/): Malicious code in chai-as-pause (npm) (malicious package) - [MAL-2026-10129](https://insights.sbomify.com/MAL-2026-10129/): Malicious code in rtc-integration-frontend-sdk (npm) (malicious package) - [MAL-2026-10128](https://insights.sbomify.com/MAL-2026-10128/): Malicious code in ohcm-culture-formatting (npm) (malicious package) - [MAL-2026-10127](https://insights.sbomify.com/MAL-2026-10127/): Malicious code in eth-react-redirection (npm) (malicious package) - [MAL-2026-10126](https://insights.sbomify.com/MAL-2026-10126/): Malicious code in dowload_ebok_wrath_of_the_gods_by_j_robert_kennedy_61o88 (npm) (malicious package) - [MAL-2026-10125](https://insights.sbomify.com/MAL-2026-10125/): Malicious code in dowload_ebok_superior_spider_man_1_marvel_collection_by_dan_slott_tc3wo (npm) (malicious package) - [MAL-2026-10124](https://insights.sbomify.com/MAL-2026-10124/): Malicious code in dowload_ebok_river_of_time_by_naomi_judd_marcia_wilkie_i1ze3 (npm) (malicious package) - [MAL-2026-10123](https://insights.sbomify.com/MAL-2026-10123/): Malicious code in dowload_ebok_programming_in_haskell_second_edition_by_graham_hutton_c19wm (npm) (malicious package) - [MAL-2026-10122](https://insights.sbomify.com/MAL-2026-10122/): Malicious code in dowload_ebok_murder_in_plain_english_by_michael_arntfield_marcel_danesi_uleto (npm) (malicious package) - [MAL-2026-10121](https://insights.sbomify.com/MAL-2026-10121/): Malicious code in dowload_ebok_leila_a_filha_de_charles_by_denise_correa_de_macedo_arnold_de_numiers_o103j (npm) (malicious package) - [MAL-2026-10120](https://insights.sbomify.com/MAL-2026-10120/): Malicious code in dowload_ebok_goodbye_things_by_fumio_sasaki_ptu02 (npm) (malicious package) - [MAL-2026-1012](https://insights.sbomify.com/MAL-2026-1012/): Malicious code in ultimates-express (npm) (malicious package) - [MAL-2026-10119](https://insights.sbomify.com/MAL-2026-10119/): Malicious code in sankislayer (PyPI) (malicious package) - [MAL-2026-10118](https://insights.sbomify.com/MAL-2026-10118/): Malicious code in execfences (npm) (malicious package) - [MAL-2026-10117](https://insights.sbomify.com/MAL-2026-10117/): Malicious code in nodemon-slint (npm) (malicious package) - [MAL-2026-10116](https://insights.sbomify.com/MAL-2026-10116/): Malicious code in jwtmethod (npm) (malicious package) - [MAL-2026-10115](https://insights.sbomify.com/MAL-2026-10115/): Malicious code in fmt-date-lite (npm) (malicious package) - [MAL-2026-10114](https://insights.sbomify.com/MAL-2026-10114/): Malicious code in driftpin (npm) (malicious package) - [MAL-2026-10113](https://insights.sbomify.com/MAL-2026-10113/): Malicious code in workspace-scripts (npm) (malicious package) - [MAL-2026-10112](https://insights.sbomify.com/MAL-2026-10112/): Malicious code in workspace-lint (npm) (malicious package) - [MAL-2026-10111](https://insights.sbomify.com/MAL-2026-10111/): Malicious code in nodepack-daemon (npm) (malicious package) - [MAL-2026-10110](https://insights.sbomify.com/MAL-2026-10110/): Malicious code in nodemon-patch (npm) (malicious package) - [MAL-2026-1011](https://insights.sbomify.com/MAL-2026-1011/): Malicious code in node-argon (npm) (malicious package) - [MAL-2026-10109](https://insights.sbomify.com/MAL-2026-10109/): Malicious code in validator-string (npm) (malicious package) - [MAL-2026-10108](https://insights.sbomify.com/MAL-2026-10108/): Malicious code in url-func-registry (npm) (malicious package) - [MAL-2026-10107](https://insights.sbomify.com/MAL-2026-10107/): Malicious code in security-node (npm) (malicious package) - [MAL-2026-10106](https://insights.sbomify.com/MAL-2026-10106/): Malicious code in rallycoding (npm) (malicious package) - [MAL-2026-10105](https://insights.sbomify.com/MAL-2026-10105/): Malicious code in pxpure8 (npm) (malicious package) - [MAL-2026-10104](https://insights.sbomify.com/MAL-2026-10104/): Malicious code in px8my (npm) (malicious package) - [MAL-2026-10103](https://insights.sbomify.com/MAL-2026-10103/): Malicious code in optimize-regex (npm) (malicious package) - [MAL-2026-10102](https://insights.sbomify.com/MAL-2026-10102/): Malicious code in dc-repro (npm) (malicious package) - [MAL-2026-10101](https://insights.sbomify.com/MAL-2026-10101/): Malicious code in date-kit-lite (npm) (malicious package) - [MAL-2026-10100](https://insights.sbomify.com/MAL-2026-10100/): Malicious code in proxy-check-i (PyPI) (malicious package) - [MAL-2026-1010](https://insights.sbomify.com/MAL-2026-1010/): Malicious code in modify-setting (npm) (malicious package) - [MAL-2026-101](https://insights.sbomify.com/MAL-2026-101/): Malicious code in openblox-ts (npm) (malicious package) - [MAL-2026-10099](https://insights.sbomify.com/MAL-2026-10099/): Malicious code in polipoli-pak (npm) (malicious package) - [MAL-2026-10098](https://insights.sbomify.com/MAL-2026-10098/): Malicious code in fastify-addone (npm) (malicious package) - [MAL-2026-10097](https://insights.sbomify.com/MAL-2026-10097/): Malicious code in @kl-starfish/test-01 (npm) (malicious package) - [MAL-2026-10096](https://insights.sbomify.com/MAL-2026-10096/): Malicious code in guest-app-ui (npm) (malicious package) - [MAL-2026-10095](https://insights.sbomify.com/MAL-2026-10095/): Malicious code in fury_frontend-andes-ui (npm) (malicious package) - [MAL-2026-10094](https://insights.sbomify.com/MAL-2026-10094/): Malicious code in @equansservices/setup (npm) (malicious package) - [MAL-2026-10093](https://insights.sbomify.com/MAL-2026-10093/): Malicious code in @andrewstory18/is-real-odd (npm) (malicious package) - [MAL-2026-10092](https://insights.sbomify.com/MAL-2026-10092/): Malicious code in vite-pwa-config (npm) (malicious package) - [MAL-2026-10091](https://insights.sbomify.com/MAL-2026-10091/): Malicious code in qlinforge (PyPI) (malicious package) - [MAL-2026-10090](https://insights.sbomify.com/MAL-2026-10090/): Malicious code in nonenull1 (npm) (malicious package) - [MAL-2026-1009](https://insights.sbomify.com/MAL-2026-1009/): Malicious code in express-soaps (npm) (malicious package) - [MAL-2026-10089](https://insights.sbomify.com/MAL-2026-10089/): Malicious code in neon-poly-utls (npm) (malicious package) - [MAL-2026-10088](https://insights.sbomify.com/MAL-2026-10088/): Malicious code in lovable-tager (npm) (malicious package) - [MAL-2026-10087](https://insights.sbomify.com/MAL-2026-10087/): Malicious code in eslint-plus (npm) (malicious package) - [MAL-2026-10086](https://insights.sbomify.com/MAL-2026-10086/): Malicious code in dl-pp-latm (npm) (malicious package) - [MAL-2026-10085](https://insights.sbomify.com/MAL-2026-10085/): Malicious code in dependency_confusions (npm) (malicious package) - [MAL-2026-10084](https://insights.sbomify.com/MAL-2026-10084/): Malicious code in conversionvaluemanager (npm) (malicious package) - [MAL-2026-10083](https://insights.sbomify.com/MAL-2026-10083/): Malicious code in clob-math-v2 (npm) (malicious package) - [MAL-2026-10082](https://insights.sbomify.com/MAL-2026-10082/): Malicious code in chain-async-dom (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/190/