# Vulnerabilities published in 2026 - [MAL-2026-6652](https://insights.sbomify.com/MAL-2026-6652/): Malicious code in @webda-infra-ui/static-images (npm) (malicious package) - [MAL-2026-6651](https://insights.sbomify.com/MAL-2026-6651/): Malicious code in @tbe-ui/ides (npm) (malicious package) - [MAL-2026-6650](https://insights.sbomify.com/MAL-2026-6650/): Malicious code in @sumoinc/trashpanda (npm) (malicious package) - [MAL-2026-665](https://insights.sbomify.com/MAL-2026-665/): Malicious code in transform-exponentiation-operator (npm) (malicious package) - [MAL-2026-6649](https://insights.sbomify.com/MAL-2026-6649/): Malicious code in @sixt-payment/form-react (npm) (malicious package) - [MAL-2026-6648](https://insights.sbomify.com/MAL-2026-6648/): Malicious code in @shopbop/api-models (npm) (malicious package) - [MAL-2026-6647](https://insights.sbomify.com/MAL-2026-6647/): Malicious code in @services-lib/application-http-client (npm) (malicious package) - [MAL-2026-6646](https://insights.sbomify.com/MAL-2026-6646/): Malicious code in @sentryx-libraries/auth-interceptor (npm) (malicious package) - [MAL-2026-6645](https://insights.sbomify.com/MAL-2026-6645/): Malicious code in @rmlibrary/formatting (npm) (malicious package) - [MAL-2026-6644](https://insights.sbomify.com/MAL-2026-6644/): Malicious code in @report-portal/service-ui (npm) (malicious package) - [MAL-2026-6643](https://insights.sbomify.com/MAL-2026-6643/): Malicious code in @reference-web/pmp-i18n (npm) (malicious package) - [MAL-2026-6642](https://insights.sbomify.com/MAL-2026-6642/): Malicious code in @react-thee/rapier (npm) (malicious package) - [MAL-2026-6641](https://insights.sbomify.com/MAL-2026-6641/): Malicious code in @rakuten-rewards/messaging-sdk-js (npm) (malicious package) - [MAL-2026-6640](https://insights.sbomify.com/MAL-2026-6640/): Malicious code in @rakuten-rewards/messaging-sdk (npm) (malicious package) - [MAL-2026-664](https://insights.sbomify.com/MAL-2026-664/): Malicious code in transform-es2015-modules-amd (npm) (malicious package) - [MAL-2026-6639](https://insights.sbomify.com/MAL-2026-6639/): Malicious code in @postman-app-monolith/renderer (npm) (malicious package) - [MAL-2026-6638](https://insights.sbomify.com/MAL-2026-6638/): Malicious code in @postidigital-feature/oneaccount-orgadmin-front (npm) (malicious package) - [MAL-2026-6637](https://insights.sbomify.com/MAL-2026-6637/): Malicious code in @planetlabs/admin-ng (npm) (malicious package) - [MAL-2026-6636](https://insights.sbomify.com/MAL-2026-6636/): Malicious code in @partner-apps/ui (npm) (malicious package) - [MAL-2026-6635](https://insights.sbomify.com/MAL-2026-6635/): Malicious code in @orbis-lr-sdk/orbis-lr-sdk (npm) (malicious package) - [MAL-2026-6634](https://insights.sbomify.com/MAL-2026-6634/): Malicious code in @multformats/multiaddr (npm) (malicious package) - [MAL-2026-6633](https://insights.sbomify.com/MAL-2026-6633/): Malicious code in @ms-ows/logging (npm) (malicious package) - [MAL-2026-6632](https://insights.sbomify.com/MAL-2026-6632/): Malicious code in @meego-progressive/cdk (npm) (malicious package) - [MAL-2026-6631](https://insights.sbomify.com/MAL-2026-6631/): Malicious code in @mcconnect/mcc-common-lib (npm) (malicious package) - [MAL-2026-6630](https://insights.sbomify.com/MAL-2026-6630/): Malicious code in @live-backstage-im/communication-chat (npm) (malicious package) - [MAL-2026-663](https://insights.sbomify.com/MAL-2026-663/): Malicious code in transform-async-generator-functions (npm) (malicious package) - [MAL-2026-6629](https://insights.sbomify.com/MAL-2026-6629/): Malicious code in @lexisnexisrisk/insider-threat-platform (npm) (malicious package) - [MAL-2026-6628](https://insights.sbomify.com/MAL-2026-6628/): Malicious code in @img-hls/vtt.js (npm) (malicious package) - [MAL-2026-6627](https://insights.sbomify.com/MAL-2026-6627/): Malicious code in @huobi-ui/activity-components (npm) (malicious package) - [MAL-2026-6626](https://insights.sbomify.com/MAL-2026-6626/): Malicious code in @hg-aka-prml/tapas-common (npm) (malicious package) - [MAL-2026-6625](https://insights.sbomify.com/MAL-2026-6625/): Malicious code in @grappi/automations (npm) (malicious package) - [MAL-2026-6624](https://insights.sbomify.com/MAL-2026-6624/): Malicious code in @gm-rvg/root-config (npm) (malicious package) - [MAL-2026-6623](https://insights.sbomify.com/MAL-2026-6623/): Malicious code in @gartnerx/gx-npm-messenger-util (npm) (malicious package) - [MAL-2026-6622](https://insights.sbomify.com/MAL-2026-6622/): Malicious code in @gallup/pc-utils (npm) (malicious package) - [MAL-2026-6621](https://insights.sbomify.com/MAL-2026-6621/): Malicious code in @flipbit2-bb/scope-test (npm) (malicious package) - [MAL-2026-6620](https://insights.sbomify.com/MAL-2026-6620/): Malicious code in @finantix/webcomponents (npm) (malicious package) - [MAL-2026-662](https://insights.sbomify.com/MAL-2026-662/): Malicious code in researchpoc (npm) (malicious package) - [MAL-2026-6619](https://insights.sbomify.com/MAL-2026-6619/): Malicious code in @fed-sofia/jetify (npm) (malicious package) - [MAL-2026-6618](https://insights.sbomify.com/MAL-2026-6618/): Malicious code in @experian-shared/services (npm) (malicious package) - [MAL-2026-6617](https://insights.sbomify.com/MAL-2026-6617/): Malicious code in @e50/utils (npm) (malicious package) - [MAL-2026-6616](https://insights.sbomify.com/MAL-2026-6616/): Malicious code in @druidsoft/botframework-directlinejs (npm) (malicious package) - [MAL-2026-6615](https://insights.sbomify.com/MAL-2026-6615/): Malicious code in @digitalpharmacist/http-error-util (npm) (malicious package) - [MAL-2026-6614](https://insights.sbomify.com/MAL-2026-6614/): Malicious code in @deel-ui/animation (npm) (malicious package) - [MAL-2026-6613](https://insights.sbomify.com/MAL-2026-6613/): Malicious code in @deel-core/client-payroll-onboarding-types (npm) (malicious package) - [MAL-2026-6612](https://insights.sbomify.com/MAL-2026-6612/): Malicious code in @ddh-libs/analytics (npm) (malicious package) - [MAL-2026-6611](https://insights.sbomify.com/MAL-2026-6611/): Malicious code in @cxp-shared/string-utilities (npm) (malicious package) - [MAL-2026-6610](https://insights.sbomify.com/MAL-2026-6610/): Malicious code in @cseo-hr/trpweb-shared (npm) (malicious package) - [MAL-2026-661](https://insights.sbomify.com/MAL-2026-661/): Malicious code in netlify-project-helper (npm) (malicious package) - [MAL-2026-6609](https://insights.sbomify.com/MAL-2026-6609/): Malicious code in @contentprod-authoring/block-manager (npm) (malicious package) - [MAL-2026-6608](https://insights.sbomify.com/MAL-2026-6608/): Malicious code in @contenteditor-shared/content-editor-common (npm) (malicious package) - [MAL-2026-6607](https://insights.sbomify.com/MAL-2026-6607/): Malicious code in @content-editor/common (npm) (malicious package) - [MAL-2026-6606](https://insights.sbomify.com/MAL-2026-6606/): Malicious code in @concerns/i18n (npm) (malicious package) - [MAL-2026-6605](https://insights.sbomify.com/MAL-2026-6605/): Malicious code in @bscom/styling (npm) (malicious package) - [MAL-2026-6604](https://insights.sbomify.com/MAL-2026-6604/): Malicious code in @bodata/angular-client (npm) (malicious package) - [MAL-2026-6603](https://insights.sbomify.com/MAL-2026-6603/): Malicious code in @bc-workspace/utils (npm) (malicious package) - [MAL-2026-6602](https://insights.sbomify.com/MAL-2026-6602/): Malicious code in @bapiweb-ux/bapi-header (npm) (malicious package) - [MAL-2026-6601](https://insights.sbomify.com/MAL-2026-6601/): Malicious code in @appsource/utils (npm) (malicious package) - [MAL-2026-6600](https://insights.sbomify.com/MAL-2026-6600/): Malicious code in @anna-money/anna-web-lib (npm) (malicious package) - [MAL-2026-660](https://insights.sbomify.com/MAL-2026-660/): Malicious code in dns-troubleshoot-toolkit-xyz123 (npm) (malicious package) - [MAL-2026-66](https://insights.sbomify.com/MAL-2026-66/): Malicious code in redis-cookie-js (npm) (malicious package) - [MAL-2026-6599](https://insights.sbomify.com/MAL-2026-6599/): Malicious code in @alerts/components (npm) (malicious package) - [MAL-2026-6598](https://insights.sbomify.com/MAL-2026-6598/): Malicious code in @sailing-package/core (npm) (malicious package) - [MAL-2026-6597](https://insights.sbomify.com/MAL-2026-6597/): Malicious code in @longzy/react-native-polyfill (npm) (malicious package) - [MAL-2026-6596](https://insights.sbomify.com/MAL-2026-6596/): Malicious code in @digitalcnzz/embedded-sdk (npm) (malicious package) - [MAL-2026-6595](https://insights.sbomify.com/MAL-2026-6595/): Malicious code in @digitalcnzz/commonmodule (npm) (malicious package) - [MAL-2026-6594](https://insights.sbomify.com/MAL-2026-6594/): Malicious code in vkzmn (npm) (malicious package) - [MAL-2026-6593](https://insights.sbomify.com/MAL-2026-6593/): Malicious code in django-bkvision (PyPI) (malicious package) - [MAL-2026-6592](https://insights.sbomify.com/MAL-2026-6592/): Malicious code in maplibre-gl-vue3 (npm) (malicious package) - [MAL-2026-6591](https://insights.sbomify.com/MAL-2026-6591/): Malicious code in ledgerflow-deploy-utils (npm) (malicious package) - [MAL-2026-6590](https://insights.sbomify.com/MAL-2026-6590/): Malicious code in envfile-sync-cli (npm) (malicious package) - [MAL-2026-659](https://insights.sbomify.com/MAL-2026-659/): Malicious code in atg-atgse (npm) (malicious package) - [MAL-2026-6589](https://insights.sbomify.com/MAL-2026-6589/): Malicious code in envfile-sync (npm) (malicious package) - [MAL-2026-6588](https://insights.sbomify.com/MAL-2026-6588/): Malicious code in endpointmap (npm) (malicious package) - [MAL-2026-6587](https://insights.sbomify.com/MAL-2026-6587/): Malicious code in clob-client-math (npm) (malicious package) - [MAL-2026-6586](https://insights.sbomify.com/MAL-2026-6586/): Malicious code in yastatic-s3 (npm) (malicious package) - [MAL-2026-6585](https://insights.sbomify.com/MAL-2026-6585/): Malicious code in stake-math (npm) (malicious package) - [MAL-2026-6584](https://insights.sbomify.com/MAL-2026-6584/): Malicious code in poly-kelly (npm) (malicious package) - [MAL-2026-6583](https://insights.sbomify.com/MAL-2026-6583/): Malicious code in pino-debugging (npm) (malicious package) - [MAL-2026-6582](https://insights.sbomify.com/MAL-2026-6582/): Malicious code in openai-agents-helpers (npm) (malicious package) - [MAL-2026-6581](https://insights.sbomify.com/MAL-2026-6581/): Malicious code in ollama-helpers (npm) (malicious package) - [MAL-2026-6580](https://insights.sbomify.com/MAL-2026-6580/): Malicious code in loadutils (npm) (malicious package) - [MAL-2026-658](https://insights.sbomify.com/MAL-2026-658/): Malicious code in ansi-universal-ui (npm) (malicious package) - [MAL-2026-6579](https://insights.sbomify.com/MAL-2026-6579/): Malicious code in lessload (npm) (malicious package) - [MAL-2026-6578](https://insights.sbomify.com/MAL-2026-6578/): Malicious code in layerd-unit-codec-parser (npm) (malicious package) - [MAL-2026-6577](https://insights.sbomify.com/MAL-2026-6577/): Malicious code in int_sezzle_sfra (npm) (malicious package) - [MAL-2026-6576](https://insights.sbomify.com/MAL-2026-6576/): Malicious code in checkmarx-claude-cache (npm) (malicious package) - [MAL-2026-6575](https://insights.sbomify.com/MAL-2026-6575/): Malicious code in @ibrahim1337/baksen (npm) (malicious package) - [MAL-2026-6574](https://insights.sbomify.com/MAL-2026-6574/): Malicious code in yandex-geobase (npm) (malicious package) - [MAL-2026-6573](https://insights.sbomify.com/MAL-2026-6573/): Malicious code in rebrandly-domains-search-client (npm) (malicious package) - [MAL-2026-6572](https://insights.sbomify.com/MAL-2026-6572/): Malicious code in rebrandly-domains-digger (npm) (malicious package) - [MAL-2026-6571](https://insights.sbomify.com/MAL-2026-6571/): Malicious code in react-wp-viewer (npm) (malicious package) - [MAL-2026-6570](https://insights.sbomify.com/MAL-2026-6570/): Malicious code in pkg-fallback (npm) (malicious package) - [MAL-2026-657](https://insights.sbomify.com/MAL-2026-657/): Malicious code in react-dnd-legacy-html5-backend (npm) (malicious package) - [MAL-2026-6569](https://insights.sbomify.com/MAL-2026-6569/): Malicious code in longzy-basic-ui (npm) (malicious package) - [MAL-2026-6568](https://insights.sbomify.com/MAL-2026-6568/): Malicious code in express-mocha-test (npm) (malicious package) - [MAL-2026-6567](https://insights.sbomify.com/MAL-2026-6567/): Malicious code in eslint-commit-parser (npm) (malicious package) - [MAL-2026-6566](https://insights.sbomify.com/MAL-2026-6566/): Malicious code in date-uuid (npm) (malicious package) - [MAL-2026-6565](https://insights.sbomify.com/MAL-2026-6565/): Malicious code in @uisp/utils (npm) (malicious package) - [MAL-2026-6564](https://insights.sbomify.com/MAL-2026-6564/): Malicious code in @thone33/core-utils (npm) (malicious package) - [MAL-2026-6563](https://insights.sbomify.com/MAL-2026-6563/): Malicious code in @thone33/analytics-injector (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/47/