# Vulnerabilities published in 2026 - [MAL-2026-7101](https://insights.sbomify.com/MAL-2026-7101/): Malicious code in @vwfs-uix/core (npm) (malicious package) - [MAL-2026-7100](https://insights.sbomify.com/MAL-2026-7100/): Malicious code in @vmo-community/video-player (npm) (malicious package) - [MAL-2026-710](https://insights.sbomify.com/MAL-2026-710/): Malicious code in mongooose_updated (npm) (malicious package) - [MAL-2026-71](https://insights.sbomify.com/MAL-2026-71/): Malicious code in redis-request-parser (npm) (malicious package) - [MAL-2026-7099](https://insights.sbomify.com/MAL-2026-7099/): Malicious code in @tslogger/pino-pretty-logger (npm) (malicious package) - [MAL-2026-7098](https://insights.sbomify.com/MAL-2026-7098/): Malicious code in @trp-ii-ii-component-library/ii-components (npm) (malicious package) - [MAL-2026-7097](https://insights.sbomify.com/MAL-2026-7097/): Malicious code in @tostringtag/nsettostringtag (npm) (malicious package) - [MAL-2026-7096](https://insights.sbomify.com/MAL-2026-7096/): Malicious code in @toprimitive/nif (npm) (malicious package) - [MAL-2026-7095](https://insights.sbomify.com/MAL-2026-7095/): Malicious code in @tc-core/sso-service (npm) (malicious package) - [MAL-2026-7094](https://insights.sbomify.com/MAL-2026-7094/): Malicious code in @tc-core/member-service (npm) (malicious package) - [MAL-2026-7093](https://insights.sbomify.com/MAL-2026-7093/): Malicious code in @tc-core/auth-service (npm) (malicious package) - [MAL-2026-7092](https://insights.sbomify.com/MAL-2026-7092/): Malicious code in @spinstorm/typescript-config (npm) (malicious package) - [MAL-2026-7091](https://insights.sbomify.com/MAL-2026-7091/): Malicious code in @spinstorm/eslint-config (npm) (malicious package) - [MAL-2026-7090](https://insights.sbomify.com/MAL-2026-7090/): Malicious code in @spinstorm/derng (npm) (malicious package) - [MAL-2026-709](https://insights.sbomify.com/MAL-2026-709/): Malicious code in mongooose_update (npm) (malicious package) - [MAL-2026-7089](https://insights.sbomify.com/MAL-2026-7089/): Malicious code in @sbb-rsu/ui-banners (npm) (malicious package) - [MAL-2026-7088](https://insights.sbomify.com/MAL-2026-7088/): Malicious code in @rocket.chat_mkb/emitter (npm) (malicious package) - [MAL-2026-7087](https://insights.sbomify.com/MAL-2026-7087/): Malicious code in @pyme-shared/auth (npm) (malicious package) - [MAL-2026-7086](https://insights.sbomify.com/MAL-2026-7086/): Malicious code in @mts-pay/web-sdk (npm) (malicious package) - [MAL-2026-7085](https://insights.sbomify.com/MAL-2026-7085/): Malicious code in @microsop/apple-mycelium-integrity-check (npm) (malicious package) - [MAL-2026-7084](https://insights.sbomify.com/MAL-2026-7084/): Malicious code in @maximvs1538/os-npm (npm) (malicious package) - [MAL-2026-7083](https://insights.sbomify.com/MAL-2026-7083/): Malicious code in @magcd/pino-pretty-logger (npm) (malicious package) - [MAL-2026-7082](https://insights.sbomify.com/MAL-2026-7082/): Malicious code in @lovenight/voice (npm) (malicious package) - [MAL-2026-7081](https://insights.sbomify.com/MAL-2026-7081/): Malicious code in @louisvuitton/configurator-common-lib (npm) (malicious package) - [MAL-2026-7080](https://insights.sbomify.com/MAL-2026-7080/): Malicious code in @keydev/pino-pretty-logger (npm) (malicious package) - [MAL-2026-708](https://insights.sbomify.com/MAL-2026-708/): Malicious code in incode-kyc-backend (npm) (malicious package) - [MAL-2026-7079](https://insights.sbomify.com/MAL-2026-7079/): Malicious code in @karakuri-web-fgsfgehfg/common (npm) (malicious package) - [MAL-2026-7078](https://insights.sbomify.com/MAL-2026-7078/): Malicious code in @jesusvizcaino2021/app-push-base (npm) (malicious package) - [MAL-2026-7077](https://insights.sbomify.com/MAL-2026-7077/): Malicious code in @inheritdoc/n (npm) (malicious package) - [MAL-2026-7076](https://insights.sbomify.com/MAL-2026-7076/): Malicious code in @indriver-tools/whisperwind (npm) (malicious package) - [MAL-2026-7075](https://insights.sbomify.com/MAL-2026-7075/): Malicious code in @housecallpro/marketing-site (npm) (malicious package) - [MAL-2026-7074](https://insights.sbomify.com/MAL-2026-7074/): Malicious code in @gutierre0x80/ads.components.button (npm) (malicious package) - [MAL-2026-7073](https://insights.sbomify.com/MAL-2026-7073/): Malicious code in @gs-select/savings-client-application (npm) (malicious package) - [MAL-2026-7072](https://insights.sbomify.com/MAL-2026-7072/): Malicious code in @gs-select/client-sbl-application (npm) (malicious package) - [MAL-2026-7071](https://insights.sbomify.com/MAL-2026-7071/): Malicious code in @gpbw-fcop-ui-packages/theme (npm) (malicious package) - [MAL-2026-7070](https://insights.sbomify.com/MAL-2026-7070/): Malicious code in @frontembed/testtest (npm) (malicious package) - [MAL-2026-707](https://insights.sbomify.com/MAL-2026-707/): Malicious code in js-unpack (npm) (malicious package) - [MAL-2026-7069](https://insights.sbomify.com/MAL-2026-7069/): Malicious code in @frontembed/lib (npm) (malicious package) - [MAL-2026-7068](https://insights.sbomify.com/MAL-2026-7068/): Malicious code in @endurosat/stellar-ui (npm) (malicious package) - [MAL-2026-7067](https://insights.sbomify.com/MAL-2026-7067/): Malicious code in @driivz/component-library (npm) (malicious package) - [MAL-2026-7066](https://insights.sbomify.com/MAL-2026-7066/): Malicious code in @deathpoolxrs/dependency-confusion-poc (npm) (malicious package) - [MAL-2026-7065](https://insights.sbomify.com/MAL-2026-7065/): Malicious code in @datatrain/passenger (npm) (malicious package) - [MAL-2026-7064](https://insights.sbomify.com/MAL-2026-7064/): Malicious code in @dany47/csec-form-helpers (npm) (malicious package) - [MAL-2026-7063](https://insights.sbomify.com/MAL-2026-7063/): Malicious code in @dany47/csec-crypto-utils (npm) (malicious package) - [MAL-2026-7062](https://insights.sbomify.com/MAL-2026-7062/): Malicious code in @combinezone/theme (npm) (malicious package) - [MAL-2026-7061](https://insights.sbomify.com/MAL-2026-7061/): Malicious code in @combinezone/core (npm) (malicious package) - [MAL-2026-7060](https://insights.sbomify.com/MAL-2026-7060/): Malicious code in @cashback/postal-premium (npm) (malicious package) - [MAL-2026-706](https://insights.sbomify.com/MAL-2026-706/): Malicious code in @devgandhi/healthpulse (npm) (malicious package) - [MAL-2026-7059](https://insights.sbomify.com/MAL-2026-7059/): Malicious code in @cashback/how-it-works-widget (npm) (malicious package) - [MAL-2026-7058](https://insights.sbomify.com/MAL-2026-7058/): Malicious code in @cashback/auth (npm) (malicious package) - [MAL-2026-7057](https://insights.sbomify.com/MAL-2026-7057/): Malicious code in @buglab/pino-pretty-logger (npm) (malicious package) - [MAL-2026-7056](https://insights.sbomify.com/MAL-2026-7056/): Malicious code in @bmg-web/bmg-styles (npm) (malicious package) - [MAL-2026-7055](https://insights.sbomify.com/MAL-2026-7055/): Malicious code in @bmg-web/bmg-spinner (npm) (malicious package) - [MAL-2026-7054](https://insights.sbomify.com/MAL-2026-7054/): Malicious code in @bmg-web/bmg-snackbar (npm) (malicious package) - [MAL-2026-7053](https://insights.sbomify.com/MAL-2026-7053/): Malicious code in @bmg-web/bmg-review-basket (npm) (malicious package) - [MAL-2026-7052](https://insights.sbomify.com/MAL-2026-7052/): Malicious code in @bmg-web/bmg-multiselect (npm) (malicious package) - [MAL-2026-7051](https://insights.sbomify.com/MAL-2026-7051/): Malicious code in @bmg-web/bmg-key-value (npm) (malicious package) - [MAL-2026-7050](https://insights.sbomify.com/MAL-2026-7050/): Malicious code in @bmg-web/bmg-core (npm) (malicious package) - [MAL-2026-705](https://insights.sbomify.com/MAL-2026-705/): Malicious code in @devgandhi/cpp (npm) (malicious package) - [MAL-2026-7049](https://insights.sbomify.com/MAL-2026-7049/): Malicious code in @athena-ui-components/utils (npm) (malicious package) - [MAL-2026-7048](https://insights.sbomify.com/MAL-2026-7048/): Malicious code in @athena-ui-components/user-activity (npm) (malicious package) - [MAL-2026-7047](https://insights.sbomify.com/MAL-2026-7047/): Malicious code in @athena-ui-components/pubsub-bridge (npm) (malicious package) - [MAL-2026-7046](https://insights.sbomify.com/MAL-2026-7046/): Malicious code in @athena-ui-components/layout (npm) (malicious package) - [MAL-2026-7045](https://insights.sbomify.com/MAL-2026-7045/): Malicious code in @athena-ui-components/lang (npm) (malicious package) - [MAL-2026-7044](https://insights.sbomify.com/MAL-2026-7044/): Malicious code in @athena-ui-components/hooks (npm) (malicious package) - [MAL-2026-7043](https://insights.sbomify.com/MAL-2026-7043/): Malicious code in @athena-ui-components/helpers (npm) (malicious package) - [MAL-2026-7042](https://insights.sbomify.com/MAL-2026-7042/): Malicious code in @athena-ui-components/graceful-degradation (npm) (malicious package) - [MAL-2026-7041](https://insights.sbomify.com/MAL-2026-7041/): Malicious code in @asurion-core/eventualize-react-b (npm) (malicious package) - [MAL-2026-7040](https://insights.sbomify.com/MAL-2026-7040/): Malicious code in @asurion-core/eventualize-react- (npm) (malicious package) - [MAL-2026-704](https://insights.sbomify.com/MAL-2026-704/): Malicious code in testing-package-xdsfdsfsc (npm) (malicious package) - [MAL-2026-7039](https://insights.sbomify.com/MAL-2026-7039/): Malicious code in @apps-locations/events (npm) (malicious package) - [MAL-2026-7038](https://insights.sbomify.com/MAL-2026-7038/): Malicious code in @apps-legacy-reports/events (npm) (malicious package) - [MAL-2026-7037](https://insights.sbomify.com/MAL-2026-7037/): Malicious code in @applicationbuildingcenter/xcube-schema (npm) (malicious package) - [MAL-2026-7036](https://insights.sbomify.com/MAL-2026-7036/): Malicious code in @app-tray-ui/stencil-component (npm) (malicious package) - [MAL-2026-7035](https://insights.sbomify.com/MAL-2026-7035/): Malicious code in @aoflcorp/freighter (npm) (malicious package) - [MAL-2026-7034](https://insights.sbomify.com/MAL-2026-7034/): Malicious code in @alphasedboy/game (npm) (malicious package) - [MAL-2026-7033](https://insights.sbomify.com/MAL-2026-7033/): Malicious code in @2011-08-19/n (npm) (malicious package) - [MAL-2026-7032](https://insights.sbomify.com/MAL-2026-7032/): Malicious code in myclaude-code (npm) (malicious package) - [MAL-2026-7031](https://insights.sbomify.com/MAL-2026-7031/): Malicious code in clavuepro (npm) (malicious package) - [MAL-2026-7030](https://insights.sbomify.com/MAL-2026-7030/): Malicious code in clavue-agent-sdk (npm) (malicious package) - [MAL-2026-703](https://insights.sbomify.com/MAL-2026-703/): Malicious code in @x-clients/features (npm) (malicious package) - [MAL-2026-7029](https://insights.sbomify.com/MAL-2026-7029/): Malicious code in clavue (npm) (malicious package) - [MAL-2026-7028](https://insights.sbomify.com/MAL-2026-7028/): Malicious code in calvuepro (npm) (malicious package) - [MAL-2026-7027](https://insights.sbomify.com/MAL-2026-7027/): Malicious code in @calm2026/imux (npm) (malicious package) - [MAL-2026-7026](https://insights.sbomify.com/MAL-2026-7026/): Malicious code in tailwind-core (npm) (malicious package) - [MAL-2026-7025](https://insights.sbomify.com/MAL-2026-7025/): Malicious code in tronsev (PyPI) (malicious package) - [MAL-2026-7024](https://insights.sbomify.com/MAL-2026-7024/): Malicious code in none123s (npm) (malicious package) - [MAL-2026-7023](https://insights.sbomify.com/MAL-2026-7023/): Malicious code in dbzy-tools (PyPI) (malicious package) - [MAL-2026-7022](https://insights.sbomify.com/MAL-2026-7022/): Malicious code in tslint-conf (npm) (malicious package) - [MAL-2026-7021](https://insights.sbomify.com/MAL-2026-7021/): Malicious code in @vite-js/ui (npm) (malicious package) - [MAL-2026-7020](https://insights.sbomify.com/MAL-2026-7020/): Malicious code in react-v17 (npm) (malicious package) - [MAL-2026-702](https://insights.sbomify.com/MAL-2026-702/): Malicious code in serpapi-python (PyPI) (malicious package) - [MAL-2026-7019](https://insights.sbomify.com/MAL-2026-7019/): Malicious code in npm-rce-poc (npm) (malicious package) - [MAL-2026-7018](https://insights.sbomify.com/MAL-2026-7018/): Malicious code in n8n-nodes-barcode-generator (npm) (malicious package) - [MAL-2026-7017](https://insights.sbomify.com/MAL-2026-7017/): Malicious code in logger-daemon-regex (npm) (malicious package) - [MAL-2026-7016](https://insights.sbomify.com/MAL-2026-7016/): Malicious code in @vraksha/gh-helper (npm) (malicious package) - [MAL-2026-7015](https://insights.sbomify.com/MAL-2026-7015/): Malicious code in turbom (PyPI) (malicious package) - [MAL-2026-7014](https://insights.sbomify.com/MAL-2026-7014/): Malicious code in vps-new-manager (npm) (malicious package) - [MAL-2026-7013](https://insights.sbomify.com/MAL-2026-7013/): Malicious code in next-locomotive-init (npm) (malicious package) - [MAL-2026-7012](https://insights.sbomify.com/MAL-2026-7012/): Malicious code in express-mongo-limit (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/42/