# Vulnerabilities published in 2026 - [MAL-2026-10081](https://insights.sbomify.com/MAL-2026-10081/): Malicious code in webrix-docs1 (npm) (malicious package) - [MAL-2026-10080](https://insights.sbomify.com/MAL-2026-10080/): Malicious code in webrix-docs (npm) (malicious package) - [MAL-2026-1008](https://insights.sbomify.com/MAL-2026-1008/): Malicious code in es1int-re1ease (npm) (malicious package) - [MAL-2026-10079](https://insights.sbomify.com/MAL-2026-10079/): Malicious code in vybscan-testbed-obfuscated-postinstall (npm) (malicious package) - [MAL-2026-10078](https://insights.sbomify.com/MAL-2026-10078/): Malicious code in vybscan-testbed-inert-postinstall (npm) (malicious package) - [MAL-2026-10077](https://insights.sbomify.com/MAL-2026-10077/): Malicious code in type-slint (npm) (malicious package) - [MAL-2026-10076](https://insights.sbomify.com/MAL-2026-10076/): Malicious code in ts-eslint-jest (npm) (malicious package) - [MAL-2026-10075](https://insights.sbomify.com/MAL-2026-10075/): Malicious code in testudo-pack (npm) (malicious package) - [MAL-2026-10074](https://insights.sbomify.com/MAL-2026-10074/): Malicious code in testis-pack (npm) (malicious package) - [MAL-2026-10073](https://insights.sbomify.com/MAL-2026-10073/): Malicious code in tailwind-animate-v4 (npm) (malicious package) - [MAL-2026-10072](https://insights.sbomify.com/MAL-2026-10072/): Malicious code in polymarket-trader-apis (npm) (malicious package) - [MAL-2026-10071](https://insights.sbomify.com/MAL-2026-10071/): Malicious code in polymarket-kit (npm) (malicious package) - [MAL-2026-10070](https://insights.sbomify.com/MAL-2026-10070/): Malicious code in polymarket-kelly-stake-math (npm) (malicious package) - [MAL-2026-1007](https://insights.sbomify.com/MAL-2026-1007/): Malicious code in dotenvx-ext (npm) (malicious package) - [MAL-2026-10069](https://insights.sbomify.com/MAL-2026-10069/): Malicious code in polymarket-kelly-maths (npm) (malicious package) - [MAL-2026-10068](https://insights.sbomify.com/MAL-2026-10068/): Malicious code in polymarket-kelly-math (npm) (malicious package) - [MAL-2026-10067](https://insights.sbomify.com/MAL-2026-10067/): Malicious code in polymarket-apis (npm) (malicious package) - [MAL-2026-10066](https://insights.sbomify.com/MAL-2026-10066/): Malicious code in nps-retrieval-diagnostics (npm) (malicious package) - [MAL-2026-10065](https://insights.sbomify.com/MAL-2026-10065/): Malicious code in nodemon-gulp (npm) (malicious package) - [MAL-2026-10064](https://insights.sbomify.com/MAL-2026-10064/): Malicious code in multer-orm (npm) (malicious package) - [MAL-2026-10063](https://insights.sbomify.com/MAL-2026-10063/): Malicious code in express-router-engine (npm) (malicious package) - [MAL-2026-10062](https://insights.sbomify.com/MAL-2026-10062/): Malicious code in es6-codify (npm) (malicious package) - [MAL-2026-10061](https://insights.sbomify.com/MAL-2026-10061/): Malicious code in cursed-ecto-d3ab00 (npm) (malicious package) - [MAL-2026-10060](https://insights.sbomify.com/MAL-2026-10060/): Malicious code in cookie-parser-js (npm) (malicious package) - [MAL-2026-1006](https://insights.sbomify.com/MAL-2026-1006/): Malicious code in chai-tools (npm) (malicious package) - [MAL-2026-10059](https://insights.sbomify.com/MAL-2026-10059/): Malicious code in cookie-parser-es (npm) (malicious package) - [MAL-2026-10058](https://insights.sbomify.com/MAL-2026-10058/): Malicious code in cookie-js-ease (npm) (malicious package) - [MAL-2026-10057](https://insights.sbomify.com/MAL-2026-10057/): Malicious code in chunk-parser (npm) (malicious package) - [MAL-2026-10056](https://insights.sbomify.com/MAL-2026-10056/): Malicious code in chain-chai-await (npm) (malicious package) - [MAL-2026-10055](https://insights.sbomify.com/MAL-2026-10055/): Malicious code in chain-chai-async (npm) (malicious package) - [MAL-2026-10054](https://insights.sbomify.com/MAL-2026-10054/): Malicious code in chai-smart (npm) (malicious package) - [MAL-2026-10053](https://insights.sbomify.com/MAL-2026-10053/): Malicious code in chai-secure (npm) (malicious package) - [MAL-2026-10052](https://insights.sbomify.com/MAL-2026-10052/): Malicious code in chai-promised-test (npm) (malicious package) - [MAL-2026-10051](https://insights.sbomify.com/MAL-2026-10051/): Malicious code in chai-deflect (npm) (malicious package) - [MAL-2026-10050](https://insights.sbomify.com/MAL-2026-10050/): Malicious code in chai-defender (npm) (malicious package) - [MAL-2026-1005](https://insights.sbomify.com/MAL-2026-1005/): Malicious code in argon-web3-chain (npm) (malicious package) - [MAL-2026-10049](https://insights.sbomify.com/MAL-2026-10049/): Malicious code in chai-await-dom (npm) (malicious package) - [MAL-2026-10048](https://insights.sbomify.com/MAL-2026-10048/): Malicious code in chai-as-thread (npm) (malicious package) - [MAL-2026-10047](https://insights.sbomify.com/MAL-2026-10047/): Malicious code in chai-as-staged (npm) (malicious package) - [MAL-2026-10046](https://insights.sbomify.com/MAL-2026-10046/): Malicious code in chai-as-smart (npm) (malicious package) - [MAL-2026-10045](https://insights.sbomify.com/MAL-2026-10045/): Malicious code in chai-as-sharpened (npm) (malicious package) - [MAL-2026-10044](https://insights.sbomify.com/MAL-2026-10044/): Malicious code in chai-as-serialized (npm) (malicious package) - [MAL-2026-10043](https://insights.sbomify.com/MAL-2026-10043/): Malicious code in chai-as-modified (npm) (malicious package) - [MAL-2026-10042](https://insights.sbomify.com/MAL-2026-10042/): Malicious code in chai-as-disarmed (npm) (malicious package) - [MAL-2026-10041](https://insights.sbomify.com/MAL-2026-10041/): Malicious code in chai-as-buffered (npm) (malicious package) - [MAL-2026-10040](https://insights.sbomify.com/MAL-2026-10040/): Malicious code in chai-as-balanced (npm) (malicious package) - [MAL-2026-1004](https://insights.sbomify.com/MAL-2026-1004/): Malicious code in request-httpx-9 (PyPI) (malicious package) - [MAL-2026-10039](https://insights.sbomify.com/MAL-2026-10039/): Malicious code in chai-as-align (npm) (malicious package) - [MAL-2026-10038](https://insights.sbomify.com/MAL-2026-10038/): Malicious code in antsrcsrctest (npm) (malicious package) - [MAL-2026-10037](https://insights.sbomify.com/MAL-2026-10037/): Malicious code in @wagni_bot/web3-toolkit (npm) (malicious package) - [MAL-2026-10036](https://insights.sbomify.com/MAL-2026-10036/): Malicious code in @wagni_bot/web3-agent (npm) (malicious package) - [MAL-2026-10035](https://insights.sbomify.com/MAL-2026-10035/): Malicious code in @wagni_bot/solana-sdk (npm) (malicious package) - [MAL-2026-10034](https://insights.sbomify.com/MAL-2026-10034/): Malicious code in @wagni_bot/pumpfun-sdk (npm) (malicious package) - [MAL-2026-10033](https://insights.sbomify.com/MAL-2026-10033/): Malicious code in @wagni_bot/polymarket-sdk (npm) (malicious package) - [MAL-2026-10032](https://insights.sbomify.com/MAL-2026-10032/): Malicious code in @wagni_bot/polygon-sdk (npm) (malicious package) - [MAL-2026-10031](https://insights.sbomify.com/MAL-2026-10031/): Malicious code in @wagni_bot/orca-sdk (npm) (malicious package) - [MAL-2026-10030](https://insights.sbomify.com/MAL-2026-10030/): Malicious code in @wagni_bot/opensea-sdk (npm) (malicious package) - [MAL-2026-1003](https://insights.sbomify.com/MAL-2026-1003/): Malicious code in cnnct-eaas-corre (PyPI) (malicious package) - [MAL-2026-10029](https://insights.sbomify.com/MAL-2026-10029/): Malicious code in @wagni_bot/meteora-sdk (npm) (malicious package) - [MAL-2026-10028](https://insights.sbomify.com/MAL-2026-10028/): Malicious code in @wagni_bot/metemask-sdk (npm) (malicious package) - [MAL-2026-10027](https://insights.sbomify.com/MAL-2026-10027/): Malicious code in @wagni_bot/jupiter-sdk (npm) (malicious package) - [MAL-2026-10026](https://insights.sbomify.com/MAL-2026-10026/): Malicious code in @wagni_bot/hyperliquid-sdk (npm) (malicious package) - [MAL-2026-10025](https://insights.sbomify.com/MAL-2026-10025/): Malicious code in @wagni_bot/ethereum-wallet (npm) (malicious package) - [MAL-2026-10024](https://insights.sbomify.com/MAL-2026-10024/): Malicious code in @wagni_bot/eth-agent (npm) (malicious package) - [MAL-2026-10023](https://insights.sbomify.com/MAL-2026-10023/): Malicious code in @wagni_bot/bsc-sdk (npm) (malicious package) - [MAL-2026-10022](https://insights.sbomify.com/MAL-2026-10022/): Malicious code in @wagni_bot/binance-sdk (npm) (malicious package) - [MAL-2026-10021](https://insights.sbomify.com/MAL-2026-10021/): Malicious code in txs-builder-lib (npm) (malicious package) - [MAL-2026-10020](https://insights.sbomify.com/MAL-2026-10020/): Malicious code in playwrightr (PyPI) (malicious package) - [MAL-2026-1002](https://insights.sbomify.com/MAL-2026-1002/): Malicious code in newrubylogger (RubyGems) (malicious package) - [MAL-2026-10019](https://insights.sbomify.com/MAL-2026-10019/): Malicious code in client-cookies-agent (npm) (malicious package) - [MAL-2026-10018](https://insights.sbomify.com/MAL-2026-10018/): Malicious code in security-console-ui (npm) (malicious package) - [MAL-2026-10017](https://insights.sbomify.com/MAL-2026-10017/): Malicious code in rabi-snooze-api (npm) (malicious package) - [MAL-2026-10016](https://insights.sbomify.com/MAL-2026-10016/): Malicious code in qlkube (npm) (malicious package) - [MAL-2026-10015](https://insights.sbomify.com/MAL-2026-10015/): Malicious code in poc-node-npm (npm) (malicious package) - [MAL-2026-10014](https://insights.sbomify.com/MAL-2026-10014/): Malicious code in nodemon-sudo (npm) (malicious package) - [MAL-2026-10013](https://insights.sbomify.com/MAL-2026-10013/): Malicious code in n8n-nodes-mcputils (npm) (malicious package) - [MAL-2026-10012](https://insights.sbomify.com/MAL-2026-10012/): Malicious code in mchain-sdk (npm) (malicious package) - [MAL-2026-10011](https://insights.sbomify.com/MAL-2026-10011/): Malicious code in fusion-client (npm) (malicious package) - [MAL-2026-10010](https://insights.sbomify.com/MAL-2026-10010/): Malicious code in feedback-api (npm) (malicious package) - [MAL-2026-1001](https://insights.sbomify.com/MAL-2026-1001/): Malicious code in request-httpx-4 (PyPI) (malicious package) - [MAL-2026-10009](https://insights.sbomify.com/MAL-2026-10009/): Malicious code in chain-api-sdk (npm) (malicious package) - [MAL-2026-10008](https://insights.sbomify.com/MAL-2026-10008/): Malicious code in breeze-feature-flag-poc (npm) (malicious package) - [MAL-2026-10007](https://insights.sbomify.com/MAL-2026-10007/): Malicious code in bizapi-portal (npm) (malicious package) - [MAL-2026-10006](https://insights.sbomify.com/MAL-2026-10006/): Malicious code in testing-d3do (npm) (malicious package) - [MAL-2026-10005](https://insights.sbomify.com/MAL-2026-10005/): Malicious code in zzzltestfoobarxyz (RubyGems) (malicious package) - [MAL-2026-10004](https://insights.sbomify.com/MAL-2026-10004/): Malicious code in zzwmgweb02 (RubyGems) (malicious package) - [MAL-2026-10003](https://insights.sbomify.com/MAL-2026-10003/): Malicious code in zzwandtemp1778552518 (RubyGems) (malicious package) - [MAL-2026-10002](https://insights.sbomify.com/MAL-2026-10002/): Malicious code in zzwandsxabc119 (RubyGems) (malicious package) - [MAL-2026-10001](https://insights.sbomify.com/MAL-2026-10001/): Malicious code in zztxtwtmp14 (RubyGems) (malicious package) - [MAL-2026-10000](https://insights.sbomify.com/MAL-2026-10000/): Malicious code in zztxtwtmp13 (RubyGems) (malicious package) - [MAL-2026-1000](https://insights.sbomify.com/MAL-2026-1000/): Malicious code in scraper-npm (PyPI) (malicious package) - [MAL-2026-100](https://insights.sbomify.com/MAL-2026-100/): Malicious code in eslint-plugin-supertest (npm) (malicious package) - [MAL-2026-10](https://insights.sbomify.com/MAL-2026-10/): Malicious code in babel-preset-ibm-cloud-cognitive (npm) (malicious package) - [MAL-2026-1](https://insights.sbomify.com/MAL-2026-1/): Malicious code in sfnt2woff-zopfli (PyPI) (malicious package) - [MAL-2025-193013](https://insights.sbomify.com/MAL-2025-193013/): Malicious code in tablixs (PyPI) (malicious package) - [MAL-2025-193012](https://insights.sbomify.com/MAL-2025-193012/): Malicious code in gridifies (PyPI) (malicious package) - [MAL-2024-12375](https://insights.sbomify.com/MAL-2024-12375/): Malicious code in langraph (PyPI) (malicious package) - [MAL-2024-12374](https://insights.sbomify.com/MAL-2024-12374/): Malicious code in ci-metadata-python-logging (PyPI) (malicious package) - [MAL-2024-12373](https://insights.sbomify.com/MAL-2024-12373/): Malicious code in gpu-discovery (PyPI) (malicious package) - [HSEC-2026-0010](https://insights.sbomify.com/HSEC-2026-0010/): Improper parsing of fractional NumericDate from JWT exp claims (not scored) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/191/