# Vulnerabilities published in 2026 - [MAL-2026-6922](https://insights.sbomify.com/MAL-2026-6922/): Malicious code in mcp-server-pg (npm) (malicious package) - [MAL-2026-6921](https://insights.sbomify.com/MAL-2026-6921/): Malicious code in jsf-utils (npm) (malicious package) - [MAL-2026-6920](https://insights.sbomify.com/MAL-2026-6920/): Malicious code in crypto-base58 (npm) (malicious package) - [MAL-2026-692](https://insights.sbomify.com/MAL-2026-692/): Malicious code in graphrix (npm) (malicious package) - [MAL-2026-6919](https://insights.sbomify.com/MAL-2026-6919/): Malicious code in chai-chain-dom (npm) (malicious package) - [MAL-2026-6918](https://insights.sbomify.com/MAL-2026-6918/): Malicious code in base58-cli (npm) (malicious package) - [MAL-2026-6917](https://insights.sbomify.com/MAL-2026-6917/): Malicious code in @sqlite-list/sql-creator (npm) (malicious package) - [MAL-2026-6916](https://insights.sbomify.com/MAL-2026-6916/): Malicious code in @sqlite-list/schema-generator (npm) (malicious package) - [MAL-2026-6915](https://insights.sbomify.com/MAL-2026-6915/): Malicious code in @sqlite-list/createsql (npm) (malicious package) - [MAL-2026-6914](https://insights.sbomify.com/MAL-2026-6914/): Malicious code in @sqlite-access/nodesql (npm) (malicious package) - [MAL-2026-6913](https://insights.sbomify.com/MAL-2026-6913/): Malicious code in brunomenozzi-test-pkg (npm) (malicious package) - [MAL-2026-6912](https://insights.sbomify.com/MAL-2026-6912/): Malicious code in @engagehub/test-claim (npm) (malicious package) - [MAL-2026-6911](https://insights.sbomify.com/MAL-2026-6911/): Malicious code in @higherlogic/ocfe (npm) (malicious package) - [MAL-2026-6910](https://insights.sbomify.com/MAL-2026-6910/): Malicious code in zluri-ad-connector (npm) (malicious package) - [MAL-2026-691](https://insights.sbomify.com/MAL-2026-691/): Malicious code in fingerprint-stitch (npm) (malicious package) - [MAL-2026-6909](https://insights.sbomify.com/MAL-2026-6909/): Malicious code in express-firegate (npm) (malicious package) - [MAL-2026-6908](https://insights.sbomify.com/MAL-2026-6908/): Malicious code in express-deflect (npm) (malicious package) - [MAL-2026-6907](https://insights.sbomify.com/MAL-2026-6907/): Malicious code in chai-spycore (npm) (malicious package) - [MAL-2026-6906](https://insights.sbomify.com/MAL-2026-6906/): Malicious code in xnder-sdk-js (npm) (malicious package) - [MAL-2026-6905](https://insights.sbomify.com/MAL-2026-6905/): Malicious code in winston-prism (npm) (malicious package) - [MAL-2026-6904](https://insights.sbomify.com/MAL-2026-6904/): Malicious code in winston-js-express (npm) (malicious package) - [MAL-2026-6903](https://insights.sbomify.com/MAL-2026-6903/): Malicious code in windrule-utils (npm) (malicious package) - [MAL-2026-6902](https://insights.sbomify.com/MAL-2026-6902/): Malicious code in wime-zle (npm) (malicious package) - [MAL-2026-6901](https://insights.sbomify.com/MAL-2026-6901/): Malicious code in vite-plugin-svg-paths (npm) (malicious package) - [MAL-2026-6900](https://insights.sbomify.com/MAL-2026-6900/): Malicious code in txs-data (npm) (malicious package) - [MAL-2026-690](https://insights.sbomify.com/MAL-2026-690/): Malicious code in fileupload-util (npm) (malicious package) - [MAL-2026-69](https://insights.sbomify.com/MAL-2026-69/): Malicious code in n8n-performance-metrics (npm) (malicious package) - [MAL-2026-6899](https://insights.sbomify.com/MAL-2026-6899/): Malicious code in twcompose-utils (npm) (malicious package) - [MAL-2026-6898](https://insights.sbomify.com/MAL-2026-6898/): Malicious code in ts-relayer-pub (npm) (malicious package) - [MAL-2026-6897](https://insights.sbomify.com/MAL-2026-6897/): Malicious code in ts-lint-builders (npm) (malicious package) - [MAL-2026-6896](https://insights.sbomify.com/MAL-2026-6896/): Malicious code in ts-eslinter (npm) (malicious package) - [MAL-2026-6895](https://insights.sbomify.com/MAL-2026-6895/): Malicious code in ts-bigtn (npm) (malicious package) - [MAL-2026-6894](https://insights.sbomify.com/MAL-2026-6894/): Malicious code in tracing-str (npm) (malicious package) - [MAL-2026-6893](https://insights.sbomify.com/MAL-2026-6893/): Malicious code in test-prettier (npm) (malicious package) - [MAL-2026-6892](https://insights.sbomify.com/MAL-2026-6892/): Malicious code in tailwindcss-svg-helper (npm) (malicious package) - [MAL-2026-6891](https://insights.sbomify.com/MAL-2026-6891/): Malicious code in tailwindcss-framer-motion (npm) (malicious package) - [MAL-2026-6890](https://insights.sbomify.com/MAL-2026-6890/): Malicious code in tailwindcss-fonttypo-inter (npm) (malicious package) - [MAL-2026-689](https://insights.sbomify.com/MAL-2026-689/): Malicious code in eslint-config-stitch (npm) (malicious package) - [MAL-2026-6889](https://insights.sbomify.com/MAL-2026-6889/): Malicious code in tailwindcss-fonttype-inter (npm) (malicious package) - [MAL-2026-6888](https://insights.sbomify.com/MAL-2026-6888/): Malicious code in tailwindcss-animatecss-latest (npm) (malicious package) - [MAL-2026-6887](https://insights.sbomify.com/MAL-2026-6887/): Malicious code in tailwind-scroller (npm) (malicious package) - [MAL-2026-6886](https://insights.sbomify.com/MAL-2026-6886/): Malicious code in tailwind-fonttype-inter (npm) (malicious package) - [MAL-2026-6885](https://insights.sbomify.com/MAL-2026-6885/): Malicious code in tailstyle-core (npm) (malicious package) - [MAL-2026-6884](https://insights.sbomify.com/MAL-2026-6884/): Malicious code in syncora (npm) (malicious package) - [MAL-2026-6883](https://insights.sbomify.com/MAL-2026-6883/): Malicious code in styled-text-logger (npm) (malicious package) - [MAL-2026-6882](https://insights.sbomify.com/MAL-2026-6882/): Malicious code in stacknova (npm) (malicious package) - [MAL-2026-6881](https://insights.sbomify.com/MAL-2026-6881/): Malicious code in st-bigintr (npm) (malicious package) - [MAL-2026-6880](https://insights.sbomify.com/MAL-2026-6880/): Malicious code in st-biginteger (npm) (malicious package) - [MAL-2026-688](https://insights.sbomify.com/MAL-2026-688/): Malicious code in eslint-config-nlx (npm) (malicious package) - [MAL-2026-6879](https://insights.sbomify.com/MAL-2026-6879/): Malicious code in sol-sdk (npm) (malicious package) - [MAL-2026-6878](https://insights.sbomify.com/MAL-2026-6878/): Malicious code in sleek-pretty (npm) (malicious package) - [MAL-2026-6877](https://insights.sbomify.com/MAL-2026-6877/): Malicious code in sjs-builders (npm) (malicious package) - [MAL-2026-6876](https://insights.sbomify.com/MAL-2026-6876/): Malicious code in sjs-builder (npm) (malicious package) - [MAL-2026-6875](https://insights.sbomify.com/MAL-2026-6875/): Malicious code in secure-box (npm) (malicious package) - [MAL-2026-6874](https://insights.sbomify.com/MAL-2026-6874/): Malicious code in safe-validate (npm) (malicious package) - [MAL-2026-6873](https://insights.sbomify.com/MAL-2026-6873/): Malicious code in router-kit (npm) (malicious package) - [MAL-2026-6872](https://insights.sbomify.com/MAL-2026-6872/): Malicious code in rma-utils (npm) (malicious package) - [MAL-2026-6871](https://insights.sbomify.com/MAL-2026-6871/): Malicious code in renderctx (npm) (malicious package) - [MAL-2026-6870](https://insights.sbomify.com/MAL-2026-6870/): Malicious code in react-svg-render (npm) (malicious package) - [MAL-2026-687](https://insights.sbomify.com/MAL-2026-687/): Malicious code in @uselagoon/ui-library (npm) (malicious package) - [MAL-2026-6869](https://insights.sbomify.com/MAL-2026-6869/): Malicious code in react-native-template-my-starter (npm) (malicious package) - [MAL-2026-6868](https://insights.sbomify.com/MAL-2026-6868/): Malicious code in pretty-pino-loggers (npm) (malicious package) - [MAL-2026-6867](https://insights.sbomify.com/MAL-2026-6867/): Malicious code in pretty-pino-logger (npm) (malicious package) - [MAL-2026-6866](https://insights.sbomify.com/MAL-2026-6866/): Malicious code in prettier-logger (npm) (malicious package) - [MAL-2026-6865](https://insights.sbomify.com/MAL-2026-6865/): Malicious code in polymarket-onchain-sdk (npm) (malicious package) - [MAL-2026-6864](https://insights.sbomify.com/MAL-2026-6864/): Malicious code in polymarket-onchain-plugin (npm) (malicious package) - [MAL-2026-6863](https://insights.sbomify.com/MAL-2026-6863/): Malicious code in pino-utils (npm) (malicious package) - [MAL-2026-6862](https://insights.sbomify.com/MAL-2026-6862/): Malicious code in pino-pretty-logs (npm) (malicious package) - [MAL-2026-6861](https://insights.sbomify.com/MAL-2026-6861/): Malicious code in picocolor-logger (npm) (malicious package) - [MAL-2026-6860](https://insights.sbomify.com/MAL-2026-6860/): Malicious code in peptideenv (npm) (malicious package) - [MAL-2026-686](https://insights.sbomify.com/MAL-2026-686/): Malicious code in tableapys (PyPI) (malicious package) - [MAL-2026-6859](https://insights.sbomify.com/MAL-2026-6859/): Malicious code in older_morgan (npm) (malicious package) - [MAL-2026-6858](https://insights.sbomify.com/MAL-2026-6858/): Malicious code in npm-eslint-helper (npm) (malicious package) - [MAL-2026-6857](https://insights.sbomify.com/MAL-2026-6857/): Malicious code in npm-doc-dev (npm) (malicious package) - [MAL-2026-6856](https://insights.sbomify.com/MAL-2026-6856/): Malicious code in node-env-detector (npm) (malicious package) - [MAL-2026-6855](https://insights.sbomify.com/MAL-2026-6855/): Malicious code in next-bignumber.js (npm) (malicious package) - [MAL-2026-6854](https://insights.sbomify.com/MAL-2026-6854/): Malicious code in modulyn (npm) (malicious package) - [MAL-2026-6853](https://insights.sbomify.com/MAL-2026-6853/): Malicious code in mjs-biginteger (npm) (malicious package) - [MAL-2026-6852](https://insights.sbomify.com/MAL-2026-6852/): Malicious code in metrica-node (npm) (malicious package) - [MAL-2026-6851](https://insights.sbomify.com/MAL-2026-6851/): Malicious code in metrica-chain (npm) (malicious package) - [MAL-2026-6850](https://insights.sbomify.com/MAL-2026-6850/): Malicious code in logger-beauty (npm) (malicious package) - [MAL-2026-685](https://insights.sbomify.com/MAL-2026-685/): Malicious code in strengthifys (npm) (malicious package) - [MAL-2026-6849](https://insights.sbomify.com/MAL-2026-6849/): Malicious code in log-upgrade (npm) (malicious package) - [MAL-2026-6848](https://insights.sbomify.com/MAL-2026-6848/): Malicious code in log-format-thread (npm) (malicious package) - [MAL-2026-6847](https://insights.sbomify.com/MAL-2026-6847/): Malicious code in linter-entry (npm) (malicious package) - [MAL-2026-6846](https://insights.sbomify.com/MAL-2026-6846/): Malicious code in lint-null (npm) (malicious package) - [MAL-2026-6845](https://insights.sbomify.com/MAL-2026-6845/): Malicious code in lint-nuler (npm) (malicious package) - [MAL-2026-6844](https://insights.sbomify.com/MAL-2026-6844/): Malicious code in lint-nule (npm) (malicious package) - [MAL-2026-6843](https://insights.sbomify.com/MAL-2026-6843/): Malicious code in lint-builds (npm) (malicious package) - [MAL-2026-6842](https://insights.sbomify.com/MAL-2026-6842/): Malicious code in lint-builders (npm) (malicious package) - [MAL-2026-6841](https://insights.sbomify.com/MAL-2026-6841/): Malicious code in jsonupper (npm) (malicious package) - [MAL-2026-6840](https://insights.sbomify.com/MAL-2026-6840/): Malicious code in js-unimode (npm) (malicious package) - [MAL-2026-684](https://insights.sbomify.com/MAL-2026-684/): Malicious code in react-responsive-carousel-v4 (npm) (malicious package) - [MAL-2026-6839](https://insights.sbomify.com/MAL-2026-6839/): Malicious code in hjs-lint-builders (npm) (malicious package) - [MAL-2026-6838](https://insights.sbomify.com/MAL-2026-6838/): Malicious code in hjs-biginteger (npm) (malicious package) - [MAL-2026-6837](https://insights.sbomify.com/MAL-2026-6837/): Malicious code in eth-tick (npm) (malicious package) - [MAL-2026-6836](https://insights.sbomify.com/MAL-2026-6836/): Malicious code in eslint-vite (npm) (malicious package) - [MAL-2026-6835](https://insights.sbomify.com/MAL-2026-6835/): Malicious code in es-lint-entry (npm) (malicious package) - [MAL-2026-6834](https://insights.sbomify.com/MAL-2026-6834/): Malicious code in df-vision (npm) (malicious package) - [MAL-2026-6833](https://insights.sbomify.com/MAL-2026-6833/): Malicious code in debug-glitzs (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/44/