# Vulnerabilities published in 2026 - [MAL-2026-7282](https://insights.sbomify.com/MAL-2026-7282/): Malicious code in evil-helper-pkg (npm) (malicious package) - [MAL-2026-7281](https://insights.sbomify.com/MAL-2026-7281/): Malicious code in eslint-plugin-dagster-rules (npm) (malicious package) - [MAL-2026-7280](https://insights.sbomify.com/MAL-2026-7280/): Malicious code in eslint-plugin-click-ui (npm) (malicious package) - [MAL-2026-728](https://insights.sbomify.com/MAL-2026-728/): Malicious code in z-shop-ui (npm) (malicious package) - [MAL-2026-7279](https://insights.sbomify.com/MAL-2026-7279/): Malicious code in ereactjs (npm) (malicious package) - [MAL-2026-7278](https://insights.sbomify.com/MAL-2026-7278/): Malicious code in elf-stats-storybook-workshop-935 (npm) (malicious package) - [MAL-2026-7277](https://insights.sbomify.com/MAL-2026-7277/): Malicious code in elf-stats-storybook-snowman-513 (npm) (malicious package) - [MAL-2026-7276](https://insights.sbomify.com/MAL-2026-7276/): Malicious code in elf-stats-starlit-snowglobe-806 (npm) (malicious package) - [MAL-2026-7275](https://insights.sbomify.com/MAL-2026-7275/): Malicious code in elf-stats-snowdusted-bauble-546 (npm) (malicious package) - [MAL-2026-7274](https://insights.sbomify.com/MAL-2026-7274/): Malicious code in elf-stats-silvered-sled-455 (npm) (malicious package) - [MAL-2026-7273](https://insights.sbomify.com/MAL-2026-7273/): Malicious code in elf-stats-shimmering-cushion-351 (npm) (malicious package) - [MAL-2026-7272](https://insights.sbomify.com/MAL-2026-7272/): Malicious code in elf-stats-peppermint-northstar-168 (npm) (malicious package) - [MAL-2026-7271](https://insights.sbomify.com/MAL-2026-7271/): Malicious code in elf-stats-merry-snowflake-893 (npm) (malicious package) - [MAL-2026-7270](https://insights.sbomify.com/MAL-2026-7270/): Malicious code in elf-stats-merry-hollyberry-699 (npm) (malicious package) - [MAL-2026-727](https://insights.sbomify.com/MAL-2026-727/): Malicious code in z-shop-js-env (npm) (malicious package) - [MAL-2026-7269](https://insights.sbomify.com/MAL-2026-7269/): Malicious code in elf-stats-merry-fir-592 (npm) (malicious package) - [MAL-2026-7268](https://insights.sbomify.com/MAL-2026-7268/): Malicious code in elf-stats-marzipan-sled-824 (npm) (malicious package) - [MAL-2026-7267](https://insights.sbomify.com/MAL-2026-7267/): Malicious code in elf-stats-marzipan-saddlebag-291 (npm) (malicious package) - [MAL-2026-7266](https://insights.sbomify.com/MAL-2026-7266/): Malicious code in elf-stats-lanternlit-giftbox-663 (npm) (malicious package) - [MAL-2026-7265](https://insights.sbomify.com/MAL-2026-7265/): Malicious code in elf-stats-jolly-saddlebag-184 (npm) (malicious package) - [MAL-2026-7264](https://insights.sbomify.com/MAL-2026-7264/): Malicious code in elf-stats-holly-bauble-986 (npm) (malicious package) - [MAL-2026-7263](https://insights.sbomify.com/MAL-2026-7263/): Malicious code in elf-stats-glittering-cushion-945 (npm) (malicious package) - [MAL-2026-7262](https://insights.sbomify.com/MAL-2026-7262/): Malicious code in elf-stats-fuzzy-ribbon-874 (npm) (malicious package) - [MAL-2026-7261](https://insights.sbomify.com/MAL-2026-7261/): Malicious code in elf-stats-frosty-hammer-191 (npm) (malicious package) - [MAL-2026-7260](https://insights.sbomify.com/MAL-2026-7260/): Malicious code in elf-stats-festive-pantry-640 (npm) (malicious package) - [MAL-2026-726](https://insights.sbomify.com/MAL-2026-726/): Malicious code in z-shop-event-bus (npm) (malicious package) - [MAL-2026-7259](https://insights.sbomify.com/MAL-2026-7259/): Malicious code in elf-stats-cosy-drum-671 (npm) (malicious package) - [MAL-2026-7258](https://insights.sbomify.com/MAL-2026-7258/): Malicious code in elf-stats-candlelit-pantry-649 (npm) (malicious package) - [MAL-2026-7257](https://insights.sbomify.com/MAL-2026-7257/): Malicious code in elf-stats-bright-workbench-558 (npm) (malicious package) - [MAL-2026-7256](https://insights.sbomify.com/MAL-2026-7256/): Malicious code in elf-stats-bright-star-581 (npm) (malicious package) - [MAL-2026-7255](https://insights.sbomify.com/MAL-2026-7255/): Malicious code in elf-stats-bright-nutcracker-546 (npm) (malicious package) - [MAL-2026-7254](https://insights.sbomify.com/MAL-2026-7254/): Malicious code in dwagger-express-router (npm) (malicious package) - [MAL-2026-7253](https://insights.sbomify.com/MAL-2026-7253/): Malicious code in dreactjs (npm) (malicious package) - [MAL-2026-7252](https://insights.sbomify.com/MAL-2026-7252/): Malicious code in dpd-security-poc (npm) (malicious package) - [MAL-2026-7251](https://insights.sbomify.com/MAL-2026-7251/): Malicious code in dontawesome (npm) (malicious package) - [MAL-2026-7250](https://insights.sbomify.com/MAL-2026-7250/): Malicious code in divvy-web (npm) (malicious package) - [MAL-2026-725](https://insights.sbomify.com/MAL-2026-725/): Malicious code in json-mapping-source (npm) (malicious package) - [MAL-2026-7249](https://insights.sbomify.com/MAL-2026-7249/): Malicious code in csec-form-helpers (npm) (malicious package) - [MAL-2026-7248](https://insights.sbomify.com/MAL-2026-7248/): Malicious code in csec-crypto-utils (npm) (malicious package) - [MAL-2026-7247](https://insights.sbomify.com/MAL-2026-7247/): Malicious code in cookie-parseflow (npm) (malicious package) - [MAL-2026-7246](https://insights.sbomify.com/MAL-2026-7246/): Malicious code in cli-pretty-logger (npm) (malicious package) - [MAL-2026-7245](https://insights.sbomify.com/MAL-2026-7245/): Malicious code in chalk-standard (npm) (malicious package) - [MAL-2026-7244](https://insights.sbomify.com/MAL-2026-7244/): Malicious code in chai-fetchs (npm) (malicious package) - [MAL-2026-7243](https://insights.sbomify.com/MAL-2026-7243/): Malicious code in chai-extention-utils (npm) (malicious package) - [MAL-2026-7242](https://insights.sbomify.com/MAL-2026-7242/): Malicious code in chai-chain-test (npm) (malicious package) - [MAL-2026-7241](https://insights.sbomify.com/MAL-2026-7241/): Malicious code in chai-as-upgraded (npm) (malicious package) - [MAL-2026-7240](https://insights.sbomify.com/MAL-2026-7240/): Malicious code in chai-as-test (npm) (malicious package) - [MAL-2026-724](https://insights.sbomify.com/MAL-2026-724/): Malicious code in https-emailjs (npm) (malicious package) - [MAL-2026-7239](https://insights.sbomify.com/MAL-2026-7239/): Malicious code in chai-as-sai (npm) (malicious package) - [MAL-2026-7238](https://insights.sbomify.com/MAL-2026-7238/): Malicious code in chai-as-purified (npm) (malicious package) - [MAL-2026-7237](https://insights.sbomify.com/MAL-2026-7237/): Malicious code in chai-as-patched (npm) (malicious package) - [MAL-2026-7236](https://insights.sbomify.com/MAL-2026-7236/): Malicious code in chai-as-legit (npm) (malicious package) - [MAL-2026-7235](https://insights.sbomify.com/MAL-2026-7235/): Malicious code in chai-as-launched (npm) (malicious package) - [MAL-2026-7234](https://insights.sbomify.com/MAL-2026-7234/): Malicious code in chai-as-informed (npm) (malicious package) - [MAL-2026-7233](https://insights.sbomify.com/MAL-2026-7233/): Malicious code in chai-as-consisted (npm) (malicious package) - [MAL-2026-7232](https://insights.sbomify.com/MAL-2026-7232/): Malicious code in chai-as-commited (npm) (malicious package) - [MAL-2026-7231](https://insights.sbomify.com/MAL-2026-7231/): Malicious code in chai-as-belonged (npm) (malicious package) - [MAL-2026-7230](https://insights.sbomify.com/MAL-2026-7230/): Malicious code in chai-as-absorbed (npm) (malicious package) - [MAL-2026-723](https://insights.sbomify.com/MAL-2026-723/): Malicious code in http-emailjs (npm) (malicious package) - [MAL-2026-7229](https://insights.sbomify.com/MAL-2026-7229/): Malicious code in breactjs (npm) (malicious package) - [MAL-2026-7228](https://insights.sbomify.com/MAL-2026-7228/): Malicious code in box-ui-elements-usm (npm) (malicious package) - [MAL-2026-7227](https://insights.sbomify.com/MAL-2026-7227/): Malicious code in bode-which (npm) (malicious package) - [MAL-2026-7226](https://insights.sbomify.com/MAL-2026-7226/): Malicious code in bmg-user-interaction-tracker (npm) (malicious package) - [MAL-2026-7225](https://insights.sbomify.com/MAL-2026-7225/): Malicious code in bitu-wallet (npm) (malicious package) - [MAL-2026-7224](https://insights.sbomify.com/MAL-2026-7224/): Malicious code in bitu-user (npm) (malicious package) - [MAL-2026-7223](https://insights.sbomify.com/MAL-2026-7223/): Malicious code in bitu-trade (npm) (malicious package) - [MAL-2026-7222](https://insights.sbomify.com/MAL-2026-7222/): Malicious code in bitu-sdk (npm) (malicious package) - [MAL-2026-7221](https://insights.sbomify.com/MAL-2026-7221/): Malicious code in bitu-protocol (npm) (malicious package) - [MAL-2026-7220](https://insights.sbomify.com/MAL-2026-7220/): Malicious code in bitu-core (npm) (malicious package) - [MAL-2026-722](https://insights.sbomify.com/MAL-2026-722/): Malicious code in express-groups-routes (npm) (malicious package) - [MAL-2026-7219](https://insights.sbomify.com/MAL-2026-7219/): Malicious code in bitu-app (npm) (malicious package) - [MAL-2026-7218](https://insights.sbomify.com/MAL-2026-7218/): Malicious code in bitopro-trade-guard (npm) (malicious package) - [MAL-2026-7217](https://insights.sbomify.com/MAL-2026-7217/): Malicious code in backoff-table (npm) (malicious package) - [MAL-2026-7216](https://insights.sbomify.com/MAL-2026-7216/): Malicious code in babelcode_js (npm) (malicious package) - [MAL-2026-7215](https://insights.sbomify.com/MAL-2026-7215/): Malicious code in axgularjs (npm) (malicious package) - [MAL-2026-7214](https://insights.sbomify.com/MAL-2026-7214/): Malicious code in autoprethixer (npm) (malicious package) - [MAL-2026-7213](https://insights.sbomify.com/MAL-2026-7213/): Malicious code in autoprafixar (npm) (malicious package) - [MAL-2026-7212](https://insights.sbomify.com/MAL-2026-7212/): Malicious code in atgularjs (npm) (malicious package) - [MAL-2026-7211](https://insights.sbomify.com/MAL-2026-7211/): Malicious code in ashcare-ui-ember (npm) (malicious package) - [MAL-2026-7210](https://insights.sbomify.com/MAL-2026-7210/): Malicious code in ash-session-tracker (npm) (malicious package) - [MAL-2026-721](https://insights.sbomify.com/MAL-2026-721/): Malicious code in dotenv-embedded (npm) (malicious package) - [MAL-2026-7209](https://insights.sbomify.com/MAL-2026-7209/): Malicious code in areactjs (npm) (malicious package) - [MAL-2026-7208](https://insights.sbomify.com/MAL-2026-7208/): Malicious code in apple-mycelium-internal-research (npm) (malicious package) - [MAL-2026-7207](https://insights.sbomify.com/MAL-2026-7207/): Malicious code in appauthhelper-enduser (npm) (malicious package) - [MAL-2026-7206](https://insights.sbomify.com/MAL-2026-7206/): Malicious code in apache-arrow-17 (npm) (malicious package) - [MAL-2026-7205](https://insights.sbomify.com/MAL-2026-7205/): Malicious code in anjularjs (npm) (malicious package) - [MAL-2026-7204](https://insights.sbomify.com/MAL-2026-7204/): Malicious code in angzlarjs (npm) (malicious package) - [MAL-2026-7203](https://insights.sbomify.com/MAL-2026-7203/): Malicious code in angylarjs (npm) (malicious package) - [MAL-2026-7202](https://insights.sbomify.com/MAL-2026-7202/): Malicious code in angxlarjs (npm) (malicious package) - [MAL-2026-7201](https://insights.sbomify.com/MAL-2026-7201/): Malicious code in angwlarjs (npm) (malicious package) - [MAL-2026-7200](https://insights.sbomify.com/MAL-2026-7200/): Malicious code in angvlarjs (npm) (malicious package) - [MAL-2026-720](https://insights.sbomify.com/MAL-2026-720/): Malicious code in chai-grab (npm) (malicious package) - [MAL-2026-72](https://insights.sbomify.com/MAL-2026-72/): Malicious code in bignumber.js-new (npm) (malicious package) - [MAL-2026-7199](https://insights.sbomify.com/MAL-2026-7199/): Malicious code in anguzarjs (npm) (malicious package) - [MAL-2026-7198](https://insights.sbomify.com/MAL-2026-7198/): Malicious code in anguyarjs (npm) (malicious package) - [MAL-2026-7197](https://insights.sbomify.com/MAL-2026-7197/): Malicious code in anguxarjs (npm) (malicious package) - [MAL-2026-7196](https://insights.sbomify.com/MAL-2026-7196/): Malicious code in anguwarjs (npm) (malicious package) - [MAL-2026-7195](https://insights.sbomify.com/MAL-2026-7195/): Malicious code in anguvarjs (npm) (malicious package) - [MAL-2026-7194](https://insights.sbomify.com/MAL-2026-7194/): Malicious code in anguuarjs (npm) (malicious package) - [MAL-2026-7193](https://insights.sbomify.com/MAL-2026-7193/): Malicious code in angutarjs (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/40/