# Vulnerabilities published in 2026 - [MAL-2026-7372](https://insights.sbomify.com/MAL-2026-7372/): Malicious code in realtime-voice-component (npm) (malicious package) - [MAL-2026-7371](https://insights.sbomify.com/MAL-2026-7371/): Malicious code in reafctjs (npm) (malicious package) - [MAL-2026-7370](https://insights.sbomify.com/MAL-2026-7370/): Malicious code in reacytjs (npm) (malicious package) - [MAL-2026-737](https://insights.sbomify.com/MAL-2026-737/): Malicious code in remark-gfm-v4 (npm) (malicious package) - [MAL-2026-7369](https://insights.sbomify.com/MAL-2026-7369/): Malicious code in reacxtjs (npm) (malicious package) - [MAL-2026-7368](https://insights.sbomify.com/MAL-2026-7368/): Malicious code in reacvtjs (npm) (malicious package) - [MAL-2026-7367](https://insights.sbomify.com/MAL-2026-7367/): Malicious code in react-tiny-popover-next (npm) (malicious package) - [MAL-2026-7366](https://insights.sbomify.com/MAL-2026-7366/): Malicious code in react-native-paysafe-apple-pay (npm) (malicious package) - [MAL-2026-7365](https://insights.sbomify.com/MAL-2026-7365/): Malicious code in react-datepicker-next (npm) (malicious package) - [MAL-2026-7364](https://insights.sbomify.com/MAL-2026-7364/): Malicious code in reacrtjs (npm) (malicious package) - [MAL-2026-7363](https://insights.sbomify.com/MAL-2026-7363/): Malicious code in reacptjs (npm) (malicious package) - [MAL-2026-7362](https://insights.sbomify.com/MAL-2026-7362/): Malicious code in reacktjs (npm) (malicious package) - [MAL-2026-7361](https://insights.sbomify.com/MAL-2026-7361/): Malicious code in reachtjs (npm) (malicious package) - [MAL-2026-7360](https://insights.sbomify.com/MAL-2026-7360/): Malicious code in reacetjs (npm) (malicious package) - [MAL-2026-736](https://insights.sbomify.com/MAL-2026-736/): Malicious code in ggajsvjsg (npm) (malicious package) - [MAL-2026-7359](https://insights.sbomify.com/MAL-2026-7359/): Malicious code in reabctjs (npm) (malicious package) - [MAL-2026-7358](https://insights.sbomify.com/MAL-2026-7358/): Malicious code in reaactjs (npm) (malicious package) - [MAL-2026-7357](https://insights.sbomify.com/MAL-2026-7357/): Malicious code in rdeactjs (npm) (malicious package) - [MAL-2026-7356](https://insights.sbomify.com/MAL-2026-7356/): Malicious code in rceactjs (npm) (malicious package) - [MAL-2026-7355](https://insights.sbomify.com/MAL-2026-7355/): Malicious code in rbeactjs (npm) (malicious package) - [MAL-2026-7354](https://insights.sbomify.com/MAL-2026-7354/): Malicious code in raeactjs (npm) (malicious package) - [MAL-2026-7353](https://insights.sbomify.com/MAL-2026-7353/): Malicious code in qreactjs (npm) (malicious package) - [MAL-2026-7352](https://insights.sbomify.com/MAL-2026-7352/): Malicious code in pull-request-comment-branch (npm) (malicious package) - [MAL-2026-7351](https://insights.sbomify.com/MAL-2026-7351/): Malicious code in private-packages-sharingsession (npm) (malicious package) - [MAL-2026-7350](https://insights.sbomify.com/MAL-2026-7350/): Malicious code in private-packages-sharing-sessionz (npm) (malicious package) - [MAL-2026-735](https://insights.sbomify.com/MAL-2026-735/): Malicious code in docusaurus-plugin-launchdarkly (npm) (malicious package) - [MAL-2026-7349](https://insights.sbomify.com/MAL-2026-7349/): Malicious code in postgres-docker-utils (npm) (malicious package) - [MAL-2026-7348](https://insights.sbomify.com/MAL-2026-7348/): Malicious code in plugin-proposal (npm) (malicious package) - [MAL-2026-7347](https://insights.sbomify.com/MAL-2026-7347/): Malicious code in picnic-work-app-terms-of-use-nl (npm) (malicious package) - [MAL-2026-7346](https://insights.sbomify.com/MAL-2026-7346/): Malicious code in picnic-work-app-terms-of-use-fr (npm) (malicious package) - [MAL-2026-7345](https://insights.sbomify.com/MAL-2026-7345/): Malicious code in picnic-work-app-terms-of-use-de (npm) (malicious package) - [MAL-2026-7344](https://insights.sbomify.com/MAL-2026-7344/): Malicious code in picnic-store-page-platform (npm) (malicious package) - [MAL-2026-7343](https://insights.sbomify.com/MAL-2026-7343/): Malicious code in picnic-store-design-system (npm) (malicious package) - [MAL-2026-7342](https://insights.sbomify.com/MAL-2026-7342/): Malicious code in picnic-store-delivery-miniapp (npm) (malicious package) - [MAL-2026-7341](https://insights.sbomify.com/MAL-2026-7341/): Malicious code in picnic-store-basket-miniapp (npm) (malicious package) - [MAL-2026-7340](https://insights.sbomify.com/MAL-2026-7340/): Malicious code in picnic-decoder-generator (npm) (malicious package) - [MAL-2026-734](https://insights.sbomify.com/MAL-2026-734/): Malicious code in xpack-subscription-test (npm) (malicious package) - [MAL-2026-7339](https://insights.sbomify.com/MAL-2026-7339/): Malicious code in penny-core (npm) (malicious package) - [MAL-2026-7338](https://insights.sbomify.com/MAL-2026-7338/): Malicious code in pe3-ihm-plateforme (npm) (malicious package) - [MAL-2026-7337](https://insights.sbomify.com/MAL-2026-7337/): Malicious code in paypal-legal-components (npm) (malicious package) - [MAL-2026-7336](https://insights.sbomify.com/MAL-2026-7336/): Malicious code in oztxrk-mfa (npm) (malicious package) - [MAL-2026-7335](https://insights.sbomify.com/MAL-2026-7335/): Malicious code in ovault-evm (npm) (malicious package) - [MAL-2026-7334](https://insights.sbomify.com/MAL-2026-7334/): Malicious code in outer-package (npm) (malicious package) - [MAL-2026-7333](https://insights.sbomify.com/MAL-2026-7333/): Malicious code in oreactjs (npm) (malicious package) - [MAL-2026-7332](https://insights.sbomify.com/MAL-2026-7332/): Malicious code in options-msg (npm) (malicious package) - [MAL-2026-7331](https://insights.sbomify.com/MAL-2026-7331/): Malicious code in oidcsessioncheck-enduser (npm) (malicious package) - [MAL-2026-7330](https://insights.sbomify.com/MAL-2026-7330/): Malicious code in nreactjs (npm) (malicious package) - [MAL-2026-733](https://insights.sbomify.com/MAL-2026-733/): Malicious code in deuro-landing-page (npm) (malicious package) - [MAL-2026-7329](https://insights.sbomify.com/MAL-2026-7329/): Malicious code in notepad-monorepo (npm) (malicious package) - [MAL-2026-7328](https://insights.sbomify.com/MAL-2026-7328/): Malicious code in notepad-frontend (npm) (malicious package) - [MAL-2026-7327](https://insights.sbomify.com/MAL-2026-7327/): Malicious code in next-runtimejs (npm) (malicious package) - [MAL-2026-7326](https://insights.sbomify.com/MAL-2026-7326/): Malicious code in newsroom-2022 (npm) (malicious package) - [MAL-2026-7325](https://insights.sbomify.com/MAL-2026-7325/): Malicious code in mx-frontend (npm) (malicious package) - [MAL-2026-7324](https://insights.sbomify.com/MAL-2026-7324/): Malicious code in mwf-accounts-lib-native-call-language-preference (npm) (malicious package) - [MAL-2026-7323](https://insights.sbomify.com/MAL-2026-7323/): Malicious code in mreactjs (npm) (malicious package) - [MAL-2026-7322](https://insights.sbomify.com/MAL-2026-7322/): Malicious code in motion-ani (npm) (malicious package) - [MAL-2026-7321](https://insights.sbomify.com/MAL-2026-7321/): Malicious code in modustack (npm) (malicious package) - [MAL-2026-7320](https://insights.sbomify.com/MAL-2026-7320/): Malicious code in mngularjs (npm) (malicious package) - [MAL-2026-732](https://insights.sbomify.com/MAL-2026-732/): Malicious code in gridifys (PyPI) (malicious package) - [MAL-2026-7319](https://insights.sbomify.com/MAL-2026-7319/): Malicious code in meta-templates (npm) (malicious package) - [MAL-2026-7318](https://insights.sbomify.com/MAL-2026-7318/): Malicious code in mcp-ci-runner-poc (npm) (malicious package) - [MAL-2026-7317](https://insights.sbomify.com/MAL-2026-7317/): Malicious code in manage-subscription-app (npm) (malicious package) - [MAL-2026-7316](https://insights.sbomify.com/MAL-2026-7316/): Malicious code in lunkr (npm) (malicious package) - [MAL-2026-7315](https://insights.sbomify.com/MAL-2026-7315/): Malicious code in lreactjs (npm) (malicious package) - [MAL-2026-7314](https://insights.sbomify.com/MAL-2026-7314/): Malicious code in logfuse (npm) (malicious package) - [MAL-2026-7313](https://insights.sbomify.com/MAL-2026-7313/): Malicious code in liportal-web-app (npm) (malicious package) - [MAL-2026-7312](https://insights.sbomify.com/MAL-2026-7312/): Malicious code in lint-prettier (npm) (malicious package) - [MAL-2026-7311](https://insights.sbomify.com/MAL-2026-7311/): Malicious code in launchdarkly-ai-tooling (npm) (malicious package) - [MAL-2026-7310](https://insights.sbomify.com/MAL-2026-7310/): Malicious code in latency-tracking-internal (npm) (malicious package) - [MAL-2026-731](https://insights.sbomify.com/MAL-2026-731/): Malicious code in cicd-ppe-test (PyPI) (malicious package) - [MAL-2026-7309](https://insights.sbomify.com/MAL-2026-7309/): Malicious code in latency-tracking (npm) (malicious package) - [MAL-2026-7308](https://insights.sbomify.com/MAL-2026-7308/): Malicious code in lage-npm (npm) (malicious package) - [MAL-2026-7307](https://insights.sbomify.com/MAL-2026-7307/): Malicious code in kreactjs (npm) (malicious package) - [MAL-2026-7306](https://insights.sbomify.com/MAL-2026-7306/): Malicious code in jwt-path (npm) (malicious package) - [MAL-2026-7305](https://insights.sbomify.com/MAL-2026-7305/): Malicious code in jreactjs (npm) (malicious package) - [MAL-2026-7304](https://insights.sbomify.com/MAL-2026-7304/): Malicious code in ixpresso-core (npm) (malicious package) - [MAL-2026-7303](https://insights.sbomify.com/MAL-2026-7303/): Malicious code in ireactjs (npm) (malicious package) - [MAL-2026-7302](https://insights.sbomify.com/MAL-2026-7302/): Malicious code in insomnia-plugin-poctest-null0001 (npm) (malicious package) - [MAL-2026-7301](https://insights.sbomify.com/MAL-2026-7301/): Malicious code in ingularjs (npm) (malicious package) - [MAL-2026-7300](https://insights.sbomify.com/MAL-2026-7300/): Malicious code in ict-ui-carbon (npm) (malicious package) - [MAL-2026-730](https://insights.sbomify.com/MAL-2026-730/): Malicious code in zappr (npm) (malicious package) - [MAL-2026-73](https://insights.sbomify.com/MAL-2026-73/): Malicious code in chai-as-required (npm) (malicious package) - [MAL-2026-7299](https://insights.sbomify.com/MAL-2026-7299/): Malicious code in ict-api-foundations (npm) (malicious package) - [MAL-2026-7298](https://insights.sbomify.com/MAL-2026-7298/): Malicious code in icons.generated (npm) (malicious package) - [MAL-2026-7297](https://insights.sbomify.com/MAL-2026-7297/): Malicious code in ibotta-ts (npm) (malicious package) - [MAL-2026-7296](https://insights.sbomify.com/MAL-2026-7296/): Malicious code in iam-scripts (npm) (malicious package) - [MAL-2026-7295](https://insights.sbomify.com/MAL-2026-7295/): Malicious code in hreactjs (npm) (malicious package) - [MAL-2026-7294](https://insights.sbomify.com/MAL-2026-7294/): Malicious code in google-tag-manager-integration-sample (npm) (malicious package) - [MAL-2026-7293](https://insights.sbomify.com/MAL-2026-7293/): Malicious code in gontawesome (npm) (malicious package) - [MAL-2026-7292](https://insights.sbomify.com/MAL-2026-7292/): Malicious code in gitpath-package (npm) (malicious package) - [MAL-2026-7291](https://insights.sbomify.com/MAL-2026-7291/): Malicious code in generate-iam-token (npm) (malicious package) - [MAL-2026-7290](https://insights.sbomify.com/MAL-2026-7290/): Malicious code in fnnote-monorepo (npm) (malicious package) - [MAL-2026-729](https://insights.sbomify.com/MAL-2026-729/): Malicious code in zalando-consent-api (npm) (malicious package) - [MAL-2026-7289](https://insights.sbomify.com/MAL-2026-7289/): Malicious code in fnnote-frontend (npm) (malicious package) - [MAL-2026-7288](https://insights.sbomify.com/MAL-2026-7288/): Malicious code in fnnote-combined (npm) (malicious package) - [MAL-2026-7287](https://insights.sbomify.com/MAL-2026-7287/): Malicious code in fngularjs (npm) (malicious package) - [MAL-2026-7286](https://insights.sbomify.com/MAL-2026-7286/): Malicious code in fiat-token-admin (npm) (malicious package) - [MAL-2026-7285](https://insights.sbomify.com/MAL-2026-7285/): Malicious code in fabric-grachics (npm) (malicious package) - [MAL-2026-7284](https://insights.sbomify.com/MAL-2026-7284/): Malicious code in express-flowlimit (npm) (malicious package) - [MAL-2026-7283](https://insights.sbomify.com/MAL-2026-7283/): Malicious code in express-denv (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/39/