# Vulnerabilities published in 2026


- [MAL-2026-6562](https://insights.sbomify.com/MAL-2026-6562/): Malicious code in @epic-common/observability-node (npm) (malicious package)
- [MAL-2026-6561](https://insights.sbomify.com/MAL-2026-6561/): Malicious code in skillspector (PyPI) (malicious package)
- [MAL-2026-6560](https://insights.sbomify.com/MAL-2026-6560/): Malicious code in tdata-grabber (PyPI) (malicious package)
- [MAL-2026-656](https://insights.sbomify.com/MAL-2026-656/): Malicious code in jshint-groups (npm) (malicious package)
- [MAL-2026-6559](https://insights.sbomify.com/MAL-2026-6559/): Malicious code in lc-chatbot (npm) (malicious package)
- [MAL-2026-6558](https://insights.sbomify.com/MAL-2026-6558/): Malicious code in fsociety-tools (PyPI) (malicious package)
- [MAL-2026-6557](https://insights.sbomify.com/MAL-2026-6557/): Malicious code in pkg-fallback (PyPI) (malicious package)
- [MAL-2026-6556](https://insights.sbomify.com/MAL-2026-6556/): Malicious code in polymarket-clob-math (npm) (malicious package)
- [MAL-2026-6555](https://insights.sbomify.com/MAL-2026-6555/): Malicious code in livekit-agents (npm) (malicious package)
- [MAL-2026-6554](https://insights.sbomify.com/MAL-2026-6554/): Malicious code in insomnia-test-util-m4gester (npm) (malicious package)
- [MAL-2026-6553](https://insights.sbomify.com/MAL-2026-6553/): Malicious code in insomnia-plugin-poc-m4gester2 (npm) (malicious package)
- [MAL-2026-6552](https://insights.sbomify.com/MAL-2026-6552/): Malicious code in insomnia-plugin-poc-m4gester (npm) (malicious package)
- [MAL-2026-6551](https://insights.sbomify.com/MAL-2026-6551/): Malicious code in anthropic-internal-tools (npm) (malicious package)
- [MAL-2026-6550](https://insights.sbomify.com/MAL-2026-6550/): Malicious code in @k18n/creatormarketplace-admin-language (npm) (malicious package)
- [MAL-2026-655](https://insights.sbomify.com/MAL-2026-655/): Malicious code in pipeline-poision-test (PyPI) (malicious package)
- [MAL-2026-6549](https://insights.sbomify.com/MAL-2026-6549/): Malicious code in discord-token-generator (PyPI) (malicious package)
- [MAL-2026-6548](https://insights.sbomify.com/MAL-2026-6548/): Malicious code in ts-ankle (npm) (malicious package)
- [MAL-2026-6547](https://insights.sbomify.com/MAL-2026-6547/): Malicious code in react-editable-calendar (npm) (malicious package)
- [MAL-2026-6546](https://insights.sbomify.com/MAL-2026-6546/): Malicious code in ryan-pdf-js (npm) (malicious package)
- [MAL-2026-6545](https://insights.sbomify.com/MAL-2026-6545/): Malicious code in crossmint-wallets-sdk (npm) (malicious package)
- [MAL-2026-6544](https://insights.sbomify.com/MAL-2026-6544/): Malicious code in chai-as-persisted (npm) (malicious package)
- [MAL-2026-6543](https://insights.sbomify.com/MAL-2026-6543/): Malicious code in express-initial (npm) (malicious package)
- [MAL-2026-6542](https://insights.sbomify.com/MAL-2026-6542/): Malicious code in @osmura/treeify (npm) (malicious package)
- [MAL-2026-6541](https://insights.sbomify.com/MAL-2026-6541/): Malicious code in pdf-converter-pro (PyPI) (malicious package)
- [MAL-2026-6540](https://insights.sbomify.com/MAL-2026-6540/): Malicious code in db-rake (npm) (malicious package)
- [MAL-2026-654](https://insights.sbomify.com/MAL-2026-654/): Malicious code in zabitog (PyPI) (malicious package)
- [MAL-2026-6539](https://insights.sbomify.com/MAL-2026-6539/): Malicious code in db-query-log (npm) (malicious package)
- [MAL-2026-6538](https://insights.sbomify.com/MAL-2026-6538/): Malicious code in db-plog (npm) (malicious package)
- [MAL-2026-6537](https://insights.sbomify.com/MAL-2026-6537/): Malicious code in gptmini (npm) (malicious package)
- [MAL-2026-6536](https://insights.sbomify.com/MAL-2026-6536/): Malicious code in @krentzen/buffer-reverse (npm) (malicious package)
- [MAL-2026-6535](https://insights.sbomify.com/MAL-2026-6535/): Malicious code in disksweep (npm) (malicious package)
- [MAL-2026-6534](https://insights.sbomify.com/MAL-2026-6534/): Malicious code in react-dynammic-table-component (npm) (malicious package)
- [MAL-2026-6533](https://insights.sbomify.com/MAL-2026-6533/): Malicious code in react-dynamic-table-compenent (npm) (malicious package)
- [MAL-2026-6532](https://insights.sbomify.com/MAL-2026-6532/): Malicious code in chai-as-assured (npm) (malicious package)
- [MAL-2026-6531](https://insights.sbomify.com/MAL-2026-6531/): Malicious code in @appupdate/cdn-sync (npm) (malicious package)
- [MAL-2026-6530](https://insights.sbomify.com/MAL-2026-6530/): Malicious code in xrblocks-remote-control (npm) (malicious package)
- [MAL-2026-653](https://insights.sbomify.com/MAL-2026-653/): Malicious code in credit-decision-metrics (PyPI) (malicious package)
- [MAL-2026-6529](https://insights.sbomify.com/MAL-2026-6529/): Malicious code in @immobiliarelabs/backstage-plugin-ldap-auth-backend (npm) (malicious package)
- [MAL-2026-6528](https://insights.sbomify.com/MAL-2026-6528/): Malicious code in @immobiliarelabs/backstage-plugin-ldap-auth (npm) (malicious package)
- [MAL-2026-6527](https://insights.sbomify.com/MAL-2026-6527/): Malicious code in @immobiliarelabs/backstage-plugin-gitlab-backend (npm) (malicious package)
- [MAL-2026-6526](https://insights.sbomify.com/MAL-2026-6526/): Malicious code in @immobiliarelabs/backstage-plugin-gitlab (npm) (malicious package)
- [MAL-2026-6525](https://insights.sbomify.com/MAL-2026-6525/): Malicious code in ts-einkle-slot (npm) (malicious package)
- [MAL-2026-6524](https://insights.sbomify.com/MAL-2026-6524/): Malicious code in ts-einkle (npm) (malicious package)
- [MAL-2026-6523](https://insights.sbomify.com/MAL-2026-6523/): Malicious code in express-plugin (npm) (malicious package)
- [MAL-2026-6522](https://insights.sbomify.com/MAL-2026-6522/): Malicious code in @epsteinlovekids483/crossmint-wallets-sdk-pentest (npm) (malicious package)
- [MAL-2026-6521](https://insights.sbomify.com/MAL-2026-6521/): Malicious code in @carvana.authentication-flows/shared (npm) (malicious package)
- [MAL-2026-6520](https://insights.sbomify.com/MAL-2026-6520/): Malicious code in rollup-plugin-polyfill-connect (npm) (malicious package)
- [MAL-2026-652](https://insights.sbomify.com/MAL-2026-652/): Malicious code in chia-pool-reference (PyPI) (malicious package)
- [MAL-2026-6519](https://insights.sbomify.com/MAL-2026-6519/): Malicious code in react-icon-svgs (npm) (malicious package)
- [MAL-2026-6518](https://insights.sbomify.com/MAL-2026-6518/): Malicious code in ai-node-relay (npm) (malicious package)
- [MAL-2026-6517](https://insights.sbomify.com/MAL-2026-6517/): Malicious code in ai-node-agent (npm) (malicious package)
- [MAL-2026-6516](https://insights.sbomify.com/MAL-2026-6516/): Malicious code in inlifegram (PyPI) (malicious package)
- [MAL-2026-6515](https://insights.sbomify.com/MAL-2026-6515/): Malicious code in sqligen (PyPI) (malicious package)
- [MAL-2026-6514](https://insights.sbomify.com/MAL-2026-6514/): Malicious code in dtxtools (npm) (malicious package)
- [MAL-2026-6513](https://insights.sbomify.com/MAL-2026-6513/): Malicious code in dtxto1ols (npm) (malicious package)
- [MAL-2026-6512](https://insights.sbomify.com/MAL-2026-6512/): Malicious code in react-context-form-tdsss (npm) (malicious package)
- [MAL-2026-6511](https://insights.sbomify.com/MAL-2026-6511/): Malicious code in hydanlabs (npm) (malicious package)
- [MAL-2026-6510](https://insights.sbomify.com/MAL-2026-6510/): Malicious code in @merceas/cross-fetch (npm) (malicious package)
- [MAL-2026-651](https://insights.sbomify.com/MAL-2026-651/): Malicious code in cat-admin-tool (PyPI) (malicious package)
- [MAL-2026-6509](https://insights.sbomify.com/MAL-2026-6509/): Malicious code in @merceas/anchor (npm) (malicious package)
- [MAL-2026-6508](https://insights.sbomify.com/MAL-2026-6508/): Malicious code in tw-style-utils (npm) (malicious package)
- [MAL-2026-6507](https://insights.sbomify.com/MAL-2026-6507/): Malicious code in pump-stream-logger (npm) (malicious package)
- [MAL-2026-6506](https://insights.sbomify.com/MAL-2026-6506/): Malicious code in pump-laserstream-parser (npm) (malicious package)
- [MAL-2026-6505](https://insights.sbomify.com/MAL-2026-6505/): Malicious code in pino-zod (npm) (malicious package)
- [MAL-2026-6504](https://insights.sbomify.com/MAL-2026-6504/): Malicious code in openblox (PyPI) (malicious package)
- [MAL-2026-6503](https://insights.sbomify.com/MAL-2026-6503/): Malicious code in js-price-client-node (npm) (malicious package)
- [MAL-2026-6502](https://insights.sbomify.com/MAL-2026-6502/): Malicious code in js-client-node (npm) (malicious package)
- [MAL-2026-6501](https://insights.sbomify.com/MAL-2026-6501/): Malicious code in wellnpm (npm) (malicious package)
- [MAL-2026-6500](https://insights.sbomify.com/MAL-2026-6500/): Malicious code in set-cookie-ease (npm) (malicious package)
- [MAL-2026-650](https://insights.sbomify.com/MAL-2026-650/): Malicious code in tableapy (PyPI) (malicious package)
- [MAL-2026-65](https://insights.sbomify.com/MAL-2026-65/): Malicious code in oj-sp-messages-banner (npm) (malicious package)
- [MAL-2026-6499](https://insights.sbomify.com/MAL-2026-6499/): Malicious code in mongoose-json-format (npm) (malicious package)
- [MAL-2026-6498](https://insights.sbomify.com/MAL-2026-6498/): Malicious code in dttfdsdee (npm) (malicious package)
- [MAL-2026-6497](https://insights.sbomify.com/MAL-2026-6497/): Malicious code in chai-as-synced (npm) (malicious package)
- [MAL-2026-6496](https://insights.sbomify.com/MAL-2026-6496/): Malicious code in @dervix/ws (npm) (malicious package)
- [MAL-2026-6495](https://insights.sbomify.com/MAL-2026-6495/): Malicious code in animatecss-postcss-plugin (npm) (malicious package)
- [MAL-2026-6494](https://insights.sbomify.com/MAL-2026-6494/): Malicious code in @help-forms/application-aff (npm) (malicious package)
- [MAL-2026-6493](https://insights.sbomify.com/MAL-2026-6493/): Malicious code in prism-silq (npm) (malicious package)
- [MAL-2026-6492](https://insights.sbomify.com/MAL-2026-6492/): Malicious code in hexo-shoka-swiper (npm) (malicious package)
- [MAL-2026-6491](https://insights.sbomify.com/MAL-2026-6491/): Malicious code in hexo-deployer-wrangler (npm) (malicious package)
- [MAL-2026-6490](https://insights.sbomify.com/MAL-2026-6490/): Malicious code in data-parser-utils (npm) (malicious package)
- [MAL-2026-649](https://insights.sbomify.com/MAL-2026-649/): Malicious code in callapirequests (PyPI) (malicious package)
- [MAL-2026-6489](https://insights.sbomify.com/MAL-2026-6489/): Malicious code in extra-huggingface (PyPI) (malicious package)
- [MAL-2026-6488](https://insights.sbomify.com/MAL-2026-6488/): Malicious code in pyext6cc8cd (PyPI) (malicious package)
- [MAL-2026-6487](https://insights.sbomify.com/MAL-2026-6487/): Malicious code in velocityfix (npm) (malicious package)
- [MAL-2026-6486](https://insights.sbomify.com/MAL-2026-6486/): Malicious code in unsafe-malicious-package (npm) (malicious package)
- [MAL-2026-6485](https://insights.sbomify.com/MAL-2026-6485/): Malicious code in starship-timeline (npm) (malicious package)
- [MAL-2026-6484](https://insights.sbomify.com/MAL-2026-6484/): Malicious code in random-string-64 (npm) (malicious package)
- [MAL-2026-6483](https://insights.sbomify.com/MAL-2026-6483/): Malicious code in log-update-ts (npm) (malicious package)
- [MAL-2026-6482](https://insights.sbomify.com/MAL-2026-6482/): Malicious code in kelly-stake (npm) (malicious package)
- [MAL-2026-6481](https://insights.sbomify.com/MAL-2026-6481/): Malicious code in gx-npm-ui (npm) (malicious package)
- [MAL-2026-6480](https://insights.sbomify.com/MAL-2026-6480/): Malicious code in gx-npm-lib (npm) (malicious package)
- [MAL-2026-648](https://insights.sbomify.com/MAL-2026-648/): Malicious code in yazxzpedia (npm) (malicious package)
- [MAL-2026-6479](https://insights.sbomify.com/MAL-2026-6479/): Malicious code in @salem_jalal/osc-components (npm) (malicious package)
- [MAL-2026-6478](https://insights.sbomify.com/MAL-2026-6478/): Malicious code in mi-test-99-tuapellido (PyPI) (malicious package)
- [MAL-2026-6477](https://insights.sbomify.com/MAL-2026-6477/): Malicious code in runtimekit (npm) (malicious package)
- [MAL-2026-6476](https://insights.sbomify.com/MAL-2026-6476/): Malicious code in typedecode (npm) (malicious package)
- [MAL-2026-6475](https://insights.sbomify.com/MAL-2026-6475/): Malicious code in textshape-css (npm) (malicious package)
- [MAL-2026-6474](https://insights.sbomify.com/MAL-2026-6474/): Malicious code in ref-slot (npm) (malicious package)
- [MAL-2026-6473](https://insights.sbomify.com/MAL-2026-6473/): Malicious code in colorpicker-ui (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/48/