# Vulnerabilities published in 2026


- [MAL-2026-6742](https://insights.sbomify.com/MAL-2026-6742/): Malicious code in alder_morrgan (npm) (malicious package)
- [MAL-2026-6741](https://insights.sbomify.com/MAL-2026-6741/): Malicious code in @node-cloud/create (npm) (malicious package)
- [MAL-2026-6740](https://insights.sbomify.com/MAL-2026-6740/): Malicious code in decode-sdks (npm) (malicious package)
- [MAL-2026-674](https://insights.sbomify.com/MAL-2026-674/): Malicious code in freedom-baileys (npm) (malicious package)
- [MAL-2026-6739](https://insights.sbomify.com/MAL-2026-6739/): Malicious code in @lodash-en/lodash-en (npm) (malicious package)
- [MAL-2026-6738](https://insights.sbomify.com/MAL-2026-6738/): Malicious code in @jacobtan/decode-sdk (npm) (malicious package)
- [MAL-2026-6737](https://insights.sbomify.com/MAL-2026-6737/): Malicious code in epic-internal-tools (npm) (malicious package)
- [MAL-2026-6736](https://insights.sbomify.com/MAL-2026-6736/): Malicious code in unreal-mladapter (PyPI) (malicious package)
- [MAL-2026-6735](https://insights.sbomify.com/MAL-2026-6735/): Malicious code in ue-python-tools (PyPI) (malicious package)
- [MAL-2026-6734](https://insights.sbomify.com/MAL-2026-6734/): Malicious code in horde-python-client (PyPI) (malicious package)
- [MAL-2026-6733](https://insights.sbomify.com/MAL-2026-6733/): Malicious code in epic-build-scripts (PyPI) (malicious package)
- [MAL-2026-6732](https://insights.sbomify.com/MAL-2026-6732/): Malicious code in unreal-horde-dashboard (npm) (malicious package)
- [MAL-2026-6731](https://insights.sbomify.com/MAL-2026-6731/): Malicious code in ue-jenkins-buildkite (npm) (malicious package)
- [MAL-2026-6730](https://insights.sbomify.com/MAL-2026-6730/): Malicious code in ue-automation-scripts (npm) (malicious package)
- [MAL-2026-673](https://insights.sbomify.com/MAL-2026-673/): Malicious code in baileys-ud (npm) (malicious package)
- [MAL-2026-6729](https://insights.sbomify.com/MAL-2026-6729/): Malicious code in robomerge (npm) (malicious package)
- [MAL-2026-6728](https://insights.sbomify.com/MAL-2026-6728/): Malicious code in dt-validator (PyPI) (malicious package)
- [MAL-2026-6727](https://insights.sbomify.com/MAL-2026-6727/): Malicious code in tailwind-animates (npm) (malicious package)
- [MAL-2026-6726](https://insights.sbomify.com/MAL-2026-6726/): Malicious code in db-convertor (npm) (malicious package)
- [MAL-2026-6725](https://insights.sbomify.com/MAL-2026-6725/): Malicious code in @modhamanish/rn-mm-template (npm) (malicious package)
- [MAL-2026-6724](https://insights.sbomify.com/MAL-2026-6724/): Malicious code in starlette-healthcheck (PyPI) (malicious package)
- [MAL-2026-6723](https://insights.sbomify.com/MAL-2026-6723/): Malicious code in electron-orbit (npm) (malicious package)
- [MAL-2026-6722](https://insights.sbomify.com/MAL-2026-6722/): Malicious code in date-fns-lite (npm) (malicious package)
- [MAL-2026-6721](https://insights.sbomify.com/MAL-2026-6721/): Malicious code in ts-eslint-helper (npm) (malicious package)
- [MAL-2026-6720](https://insights.sbomify.com/MAL-2026-6720/): Malicious code in ts-elinter (npm) (malicious package)
- [MAL-2026-672](https://insights.sbomify.com/MAL-2026-672/): Malicious code in baileys-dtz (npm) (malicious package)
- [MAL-2026-6719](https://insights.sbomify.com/MAL-2026-6719/): Malicious code in ts-clob-math-v2 (npm) (malicious package)
- [MAL-2026-6718](https://insights.sbomify.com/MAL-2026-6718/): Malicious code in test-pkg-yarn (npm) (malicious package)
- [MAL-2026-6717](https://insights.sbomify.com/MAL-2026-6717/): Malicious code in test-pkg-x0 (npm) (malicious package)
- [MAL-2026-6716](https://insights.sbomify.com/MAL-2026-6716/): Malicious code in test-pkg-pnpm (npm) (malicious package)
- [MAL-2026-6715](https://insights.sbomify.com/MAL-2026-6715/): Malicious code in svgcraft-core (npm) (malicious package)
- [MAL-2026-6714](https://insights.sbomify.com/MAL-2026-6714/): Malicious code in polymarket-trading-developer-tool (npm) (malicious package)
- [MAL-2026-6713](https://insights.sbomify.com/MAL-2026-6713/): Malicious code in polymarket-toolkit (npm) (malicious package)
- [MAL-2026-6712](https://insights.sbomify.com/MAL-2026-6712/): Malicious code in polymarket-risk-manager (npm) (malicious package)
- [MAL-2026-6711](https://insights.sbomify.com/MAL-2026-6711/): Malicious code in twrap-tool (PyPI) (malicious package)
- [MAL-2026-6710](https://insights.sbomify.com/MAL-2026-6710/): Malicious code in vitest-agent (npm) (malicious package)
- [MAL-2026-671](https://insights.sbomify.com/MAL-2026-671/): Malicious code in cheerio-core (npm) (malicious package)
- [MAL-2026-6709](https://insights.sbomify.com/MAL-2026-6709/): Malicious code in vega-lite-next (npm) (malicious package)
- [MAL-2026-6708](https://insights.sbomify.com/MAL-2026-6708/): Malicious code in zyncmap (npm) (malicious package)
- [MAL-2026-6707](https://insights.sbomify.com/MAL-2026-6707/): Malicious code in svgson-lite (npm) (malicious package)
- [MAL-2026-6706](https://insights.sbomify.com/MAL-2026-6706/): Malicious code in hardhat-plugin-solidity (npm) (malicious package)
- [MAL-2026-6705](https://insights.sbomify.com/MAL-2026-6705/): Malicious code in hardhat-compile-ethers (npm) (malicious package)
- [MAL-2026-6704](https://insights.sbomify.com/MAL-2026-6704/): Malicious code in base65-85x (npm) (malicious package)
- [MAL-2026-6703](https://insights.sbomify.com/MAL-2026-6703/): Malicious code in @andes-tools/colors (npm) (malicious package)
- [MAL-2026-6702](https://insights.sbomify.com/MAL-2026-6702/): Malicious code in vue-demi-fix (npm) (malicious package)
- [MAL-2026-6701](https://insights.sbomify.com/MAL-2026-6701/): Malicious code in ripshakti (npm) (malicious package)
- [MAL-2026-6700](https://insights.sbomify.com/MAL-2026-6700/): Malicious code in module-index-cache (npm) (malicious package)
- [MAL-2026-670](https://insights.sbomify.com/MAL-2026-670/): Malicious code in aligned-array (npm) (malicious package)
- [MAL-2026-67](https://insights.sbomify.com/MAL-2026-67/): Malicious code in redis-cookie-parser (npm) (malicious package)
- [MAL-2026-6699](https://insights.sbomify.com/MAL-2026-6699/): Malicious code in ecto-corsair-flag-7kq3mz (npm) (malicious package)
- [MAL-2026-6698](https://insights.sbomify.com/MAL-2026-6698/): Malicious code in cursed-modules (npm) (malicious package)
- [MAL-2026-6697](https://insights.sbomify.com/MAL-2026-6697/): Malicious code in @sudoughnym/enviro-demo (npm) (malicious package)
- [MAL-2026-6696](https://insights.sbomify.com/MAL-2026-6696/): Malicious code in @businessapp-microsites/apis (npm) (malicious package)
- [MAL-2026-6695](https://insights.sbomify.com/MAL-2026-6695/): Malicious code in ts-bn-proto (npm) (malicious package)
- [MAL-2026-6694](https://insights.sbomify.com/MAL-2026-6694/): Malicious code in thirdwebb (npm) (malicious package)
- [MAL-2026-6693](https://insights.sbomify.com/MAL-2026-6693/): Malicious code in thirdwb (npm) (malicious package)
- [MAL-2026-6692](https://insights.sbomify.com/MAL-2026-6692/): Malicious code in polymarket-trading-developer-tools (npm) (malicious package)
- [MAL-2026-6691](https://insights.sbomify.com/MAL-2026-6691/): Malicious code in polymarket-clob-maths (npm) (malicious package)
- [MAL-2026-6690](https://insights.sbomify.com/MAL-2026-6690/): Malicious code in log-taker1 (npm) (malicious package)
- [MAL-2026-669](https://insights.sbomify.com/MAL-2026-669/): Malicious code in vite-ui-components (npm) (malicious package)
- [MAL-2026-6689](https://insights.sbomify.com/MAL-2026-6689/): Malicious code in decimal-format-core (npm) (malicious package)
- [MAL-2026-6688](https://insights.sbomify.com/MAL-2026-6688/): Malicious code in console-fmt-cli (npm) (malicious package)
- [MAL-2026-6687](https://insights.sbomify.com/MAL-2026-6687/): Malicious code in procwire (npm) (malicious package)
- [MAL-2026-6686](https://insights.sbomify.com/MAL-2026-6686/): Malicious code in setup-cicd (npm) (malicious package)
- [MAL-2026-6685](https://insights.sbomify.com/MAL-2026-6685/): Malicious code in quoting (npm) (malicious package)
- [MAL-2026-6684](https://insights.sbomify.com/MAL-2026-6684/): Malicious code in postcss-property-rollup (npm) (malicious package)
- [MAL-2026-6683](https://insights.sbomify.com/MAL-2026-6683/): Malicious code in nbmolviz-js (npm) (malicious package)
- [MAL-2026-6682](https://insights.sbomify.com/MAL-2026-6682/): Malicious code in confluent-kafka-javascript (npm) (malicious package)
- [MAL-2026-6681](https://insights.sbomify.com/MAL-2026-6681/): Malicious code in brock-react-alerts (npm) (malicious package)
- [MAL-2026-6680](https://insights.sbomify.com/MAL-2026-6680/): Malicious code in brock-loader (npm) (malicious package)
- [MAL-2026-668](https://insights.sbomify.com/MAL-2026-668/): Malicious code in typescript-react-apollo (npm) (malicious package)
- [MAL-2026-6679](https://insights.sbomify.com/MAL-2026-6679/): Malicious code in agent-starter-pack (npm) (malicious package)
- [MAL-2026-6678](https://insights.sbomify.com/MAL-2026-6678/): Malicious code in ts-linting-builder (npm) (malicious package)
- [MAL-2026-6677](https://insights.sbomify.com/MAL-2026-6677/): Malicious code in ts-lint-builders-v2.1 (npm) (malicious package)
- [MAL-2026-6676](https://insights.sbomify.com/MAL-2026-6676/): Malicious code in terminal-prettier (npm) (malicious package)
- [MAL-2026-6675](https://insights.sbomify.com/MAL-2026-6675/): Malicious code in rs-biginteger (npm) (malicious package)
- [MAL-2026-6674](https://insights.sbomify.com/MAL-2026-6674/): Malicious code in ripshakti1 (npm) (malicious package)
- [MAL-2026-6673](https://insights.sbomify.com/MAL-2026-6673/): Malicious code in anthropic-toolkit (npm) (malicious package)
- [MAL-2026-6672](https://insights.sbomify.com/MAL-2026-6672/): Malicious code in ulid-xyz (npm) (malicious package)
- [MAL-2026-6671](https://insights.sbomify.com/MAL-2026-6671/): Malicious code in wac-atl-context (npm) (malicious package)
- [MAL-2026-6670](https://insights.sbomify.com/MAL-2026-6670/): Malicious code in rc-icon (npm) (malicious package)
- [MAL-2026-667](https://insights.sbomify.com/MAL-2026-667/): Malicious code in typed-document-node (npm) (malicious package)
- [MAL-2026-6669](https://insights.sbomify.com/MAL-2026-6669/): Malicious code in pvd3 (npm) (malicious package)
- [MAL-2026-6668](https://insights.sbomify.com/MAL-2026-6668/): Malicious code in player-theming (npm) (malicious package)
- [MAL-2026-6667](https://insights.sbomify.com/MAL-2026-6667/): Malicious code in player-core-ui (npm) (malicious package)
- [MAL-2026-6666](https://insights.sbomify.com/MAL-2026-6666/): Malicious code in magwien.sys (npm) (malicious package)
- [MAL-2026-6665](https://insights.sbomify.com/MAL-2026-6665/): Malicious code in ltididp1 (npm) (malicious package)
- [MAL-2026-6664](https://insights.sbomify.com/MAL-2026-6664/): Malicious code in hrb-cas-auth-js (npm) (malicious package)
- [MAL-2026-6663](https://insights.sbomify.com/MAL-2026-6663/): Malicious code in gel-bootstrap (npm) (malicious package)
- [MAL-2026-6662](https://insights.sbomify.com/MAL-2026-6662/): Malicious code in cmp-api-stub (npm) (malicious package)
- [MAL-2026-6661](https://insights.sbomify.com/MAL-2026-6661/): Malicious code in clx-cookieparser (npm) (malicious package)
- [MAL-2026-6660](https://insights.sbomify.com/MAL-2026-6660/): Malicious code in cdocs-markdoc (npm) (malicious package)
- [MAL-2026-666](https://insights.sbomify.com/MAL-2026-666/): Malicious code in transform-react-display-name (npm) (malicious package)
- [MAL-2026-6659](https://insights.sbomify.com/MAL-2026-6659/): Malicious code in cdocs-data (npm) (malicious package)
- [MAL-2026-6658](https://insights.sbomify.com/MAL-2026-6658/): Malicious code in bundrix (npm) (malicious package)
- [MAL-2026-6657](https://insights.sbomify.com/MAL-2026-6657/): Malicious code in authsessionbridge (npm) (malicious package)
- [MAL-2026-6656](https://insights.sbomify.com/MAL-2026-6656/): Malicious code in authmatrix (npm) (malicious package)
- [MAL-2026-6655](https://insights.sbomify.com/MAL-2026-6655/): Malicious code in auth-state-service (npm) (malicious package)
- [MAL-2026-6654](https://insights.sbomify.com/MAL-2026-6654/): Malicious code in app-hotmart-blog-headless (npm) (malicious package)
- [MAL-2026-6653](https://insights.sbomify.com/MAL-2026-6653/): Malicious code in alpine-csp (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/46/