# Vulnerabilities published in 2026


- [MAL-2026-6472](https://insights.sbomify.com/MAL-2026-6472/): Malicious code in tailwindcss-effector (npm) (malicious package)
- [MAL-2026-6471](https://insights.sbomify.com/MAL-2026-6471/): Malicious code in tailwind-color-shades (npm) (malicious package)
- [MAL-2026-6470](https://insights.sbomify.com/MAL-2026-6470/): Malicious code in chlklib (npm) (malicious package)
- [MAL-2026-647](https://insights.sbomify.com/MAL-2026-647/): Malicious code in react-native-expofp (npm) (malicious package)
- [MAL-2026-6469](https://insights.sbomify.com/MAL-2026-6469/): Malicious code in ts-precision (npm) (malicious package)
- [MAL-2026-6468](https://insights.sbomify.com/MAL-2026-6468/): Malicious code in ts-opus (npm) (malicious package)
- [MAL-2026-6467](https://insights.sbomify.com/MAL-2026-6467/): Malicious code in @vpms/design-system (npm) (malicious package)
- [MAL-2026-6466](https://insights.sbomify.com/MAL-2026-6466/): Malicious code in gx-npm-feature-flags (npm) (malicious package)
- [MAL-2026-6465](https://insights.sbomify.com/MAL-2026-6465/): Malicious code in chai-as-built (npm) (malicious package)
- [MAL-2026-6464](https://insights.sbomify.com/MAL-2026-6464/): Malicious code in @colibri-event-types/megamarket-ru-web (npm) (malicious package)
- [MAL-2026-6463](https://insights.sbomify.com/MAL-2026-6463/): Malicious code in abu-common-components (npm) (malicious package)
- [MAL-2026-6462](https://insights.sbomify.com/MAL-2026-6462/): Malicious code in dttsdee (npm) (malicious package)
- [MAL-2026-6461](https://insights.sbomify.com/MAL-2026-6461/): Malicious code in easy-string-kit232 (npm) (malicious package)
- [MAL-2026-6460](https://insights.sbomify.com/MAL-2026-6460/): Malicious code in dddooo (npm) (malicious package)
- [MAL-2026-646](https://insights.sbomify.com/MAL-2026-646/): Malicious code in picking-miniapp (npm) (malicious package)
- [MAL-2026-6459](https://insights.sbomify.com/MAL-2026-6459/): Malicious code in easy-string-kit (npm) (malicious package)
- [MAL-2026-6458](https://insights.sbomify.com/MAL-2026-6458/): Malicious code in wp-codebox-workspace (npm) (malicious package)
- [MAL-2026-6457](https://insights.sbomify.com/MAL-2026-6457/): Malicious code in subsearch (npm) (malicious package)
- [MAL-2026-6456](https://insights.sbomify.com/MAL-2026-6456/): Malicious code in stitch-design (npm) (malicious package)
- [MAL-2026-6455](https://insights.sbomify.com/MAL-2026-6455/): Malicious code in simple-node-calc-ccc (npm) (malicious package)
- [MAL-2026-6454](https://insights.sbomify.com/MAL-2026-6454/): Malicious code in simple-node-calc-c (npm) (malicious package)
- [MAL-2026-6453](https://insights.sbomify.com/MAL-2026-6453/): Malicious code in simple-node-calc-b (npm) (malicious package)
- [MAL-2026-6452](https://insights.sbomify.com/MAL-2026-6452/): Malicious code in simple-node-calc-aa (npm) (malicious package)
- [MAL-2026-6451](https://insights.sbomify.com/MAL-2026-6451/): Malicious code in simple-node-calc-a (npm) (malicious package)
- [MAL-2026-6450](https://insights.sbomify.com/MAL-2026-6450/): Malicious code in nizzybase32 (npm) (malicious package)
- [MAL-2026-645](https://insights.sbomify.com/MAL-2026-645/): Malicious code in libsignal-yazxzpedia (npm) (malicious package)
- [MAL-2026-6449](https://insights.sbomify.com/MAL-2026-6449/): Malicious code in howdybase32 (npm) (malicious package)
- [MAL-2026-6448](https://insights.sbomify.com/MAL-2026-6448/): Malicious code in bs58-86 (npm) (malicious package)
- [MAL-2026-6447](https://insights.sbomify.com/MAL-2026-6447/): Malicious code in based-32 (npm) (malicious package)
- [MAL-2026-6446](https://insights.sbomify.com/MAL-2026-6446/): Malicious code in base62-86x (npm) (malicious package)
- [MAL-2026-6445](https://insights.sbomify.com/MAL-2026-6445/): Malicious code in base58-core (npm) (malicious package)
- [MAL-2026-6444](https://insights.sbomify.com/MAL-2026-6444/): Malicious code in agentsync-tool (npm) (malicious package)
- [MAL-2026-6443](https://insights.sbomify.com/MAL-2026-6443/): Malicious code in agentsync-pkg (npm) (malicious package)
- [MAL-2026-6442](https://insights.sbomify.com/MAL-2026-6442/): Malicious code in easy-time-format (npm) (malicious package)
- [MAL-2026-6441](https://insights.sbomify.com/MAL-2026-6441/): Malicious code in unifydata (npm) (malicious package)
- [MAL-2026-6440](https://insights.sbomify.com/MAL-2026-6440/): Malicious code in tokenization-util (npm) (malicious package)
- [MAL-2026-644](https://insights.sbomify.com/MAL-2026-644/): Malicious code in dise-pkt (npm) (malicious package)
- [MAL-2026-6439](https://insights.sbomify.com/MAL-2026-6439/): Malicious code in polymarket-stake-maths (npm) (malicious package)
- [MAL-2026-6438](https://insights.sbomify.com/MAL-2026-6438/): Malicious code in polymarket-stake-math (npm) (malicious package)
- [MAL-2026-6437](https://insights.sbomify.com/MAL-2026-6437/): Malicious code in logfmt-core (npm) (malicious package)
- [MAL-2026-6436](https://insights.sbomify.com/MAL-2026-6436/): Malicious code in solo-nav (npm) (malicious package)
- [MAL-2026-6435](https://insights.sbomify.com/MAL-2026-6435/): Malicious code in serverless-leo (npm) (malicious package)
- [MAL-2026-6434](https://insights.sbomify.com/MAL-2026-6434/): Malicious code in serverless-convention (npm) (malicious package)
- [MAL-2026-6433](https://insights.sbomify.com/MAL-2026-6433/): Malicious code in rstreams-shard-util (npm) (malicious package)
- [MAL-2026-6432](https://insights.sbomify.com/MAL-2026-6432/): Malicious code in rstreams-metrics (npm) (malicious package)
- [MAL-2026-6431](https://insights.sbomify.com/MAL-2026-6431/): Malicious code in leo-streams (npm) (malicious package)
- [MAL-2026-6430](https://insights.sbomify.com/MAL-2026-6430/): Malicious code in leo-sdk (npm) (malicious package)
- [MAL-2026-643](https://insights.sbomify.com/MAL-2026-643/): Malicious code in @hemanshu_patil/xcode-windows-x64 (npm) (malicious package)
- [MAL-2026-6429](https://insights.sbomify.com/MAL-2026-6429/): Malicious code in leo-logger (npm) (malicious package)
- [MAL-2026-6428](https://insights.sbomify.com/MAL-2026-6428/): Malicious code in leo-cron (npm) (malicious package)
- [MAL-2026-6427](https://insights.sbomify.com/MAL-2026-6427/): Malicious code in leo-connector-redshift (npm) (malicious package)
- [MAL-2026-6426](https://insights.sbomify.com/MAL-2026-6426/): Malicious code in leo-connector-oracle (npm) (malicious package)
- [MAL-2026-6425](https://insights.sbomify.com/MAL-2026-6425/): Malicious code in leo-connector-mysql (npm) (malicious package)
- [MAL-2026-6424](https://insights.sbomify.com/MAL-2026-6424/): Malicious code in leo-connector-mongo (npm) (malicious package)
- [MAL-2026-6423](https://insights.sbomify.com/MAL-2026-6423/): Malicious code in leo-connector-elasticsearch (npm) (malicious package)
- [MAL-2026-6422](https://insights.sbomify.com/MAL-2026-6422/): Malicious code in leo-config (npm) (malicious package)
- [MAL-2026-6421](https://insights.sbomify.com/MAL-2026-6421/): Malicious code in leo-cli (npm) (malicious package)
- [MAL-2026-6420](https://insights.sbomify.com/MAL-2026-6420/): Malicious code in leo-cdk-lib (npm) (malicious package)
- [MAL-2026-642](https://insights.sbomify.com/MAL-2026-642/): Malicious code in @hemanshu_patil/xcode (npm) (malicious package)
- [MAL-2026-6419](https://insights.sbomify.com/MAL-2026-6419/): Malicious code in leo-cache (npm) (malicious package)
- [MAL-2026-6418](https://insights.sbomify.com/MAL-2026-6418/): Malicious code in leo-aws (npm) (malicious package)
- [MAL-2026-6417](https://insights.sbomify.com/MAL-2026-6417/): Malicious code in leo-auth (npm) (malicious package)
- [MAL-2026-6416](https://insights.sbomify.com/MAL-2026-6416/): Malicious code in block-slot (npm) (malicious package)
- [MAL-2026-6415](https://insights.sbomify.com/MAL-2026-6415/): Malicious code in anthropic-claude-latest (npm) (malicious package)
- [MAL-2026-6414](https://insights.sbomify.com/MAL-2026-6414/): Malicious code in two-factor-prompt-lib (npm) (malicious package)
- [MAL-2026-6413](https://insights.sbomify.com/MAL-2026-6413/): Malicious code in poc-publish-test-su-doughnym (npm) (malicious package)
- [MAL-2026-6412](https://insights.sbomify.com/MAL-2026-6412/): Malicious code in nabisco (npm) (malicious package)
- [MAL-2026-6411](https://insights.sbomify.com/MAL-2026-6411/): Malicious code in data-fetching-client (npm) (malicious package)
- [MAL-2026-6410](https://insights.sbomify.com/MAL-2026-6410/): Malicious code in @su-doughnym/react-dlb (npm) (malicious package)
- [MAL-2026-641](https://insights.sbomify.com/MAL-2026-641/): Malicious code in connections-api-requests (PyPI) (malicious package)
- [MAL-2026-6409](https://insights.sbomify.com/MAL-2026-6409/): Malicious code in @su-doughnym/metrics-js (npm) (malicious package)
- [MAL-2026-6408](https://insights.sbomify.com/MAL-2026-6408/): Malicious code in @su-doughnym/loginui (npm) (malicious package)
- [MAL-2026-6407](https://insights.sbomify.com/MAL-2026-6407/): Malicious code in @su-doughnym/hubspot-loginui-poc (npm) (malicious package)
- [MAL-2026-6406](https://insights.sbomify.com/MAL-2026-6406/): Malicious code in syspo (npm) (malicious package)
- [MAL-2026-6405](https://insights.sbomify.com/MAL-2026-6405/): Malicious code in sypoi1 (npm) (malicious package)
- [MAL-2026-6404](https://insights.sbomify.com/MAL-2026-6404/): Malicious code in syco1 (npm) (malicious package)
- [MAL-2026-6403](https://insights.sbomify.com/MAL-2026-6403/): Malicious code in @kl-dolphin/jump (npm) (malicious package)
- [MAL-2026-6402](https://insights.sbomify.com/MAL-2026-6402/): Malicious code in @kl-dolphin/swim (npm) (malicious package)
- [MAL-2026-6401](https://insights.sbomify.com/MAL-2026-6401/): Malicious code in zenith-utils (npm) (malicious package)
- [MAL-2026-6400](https://insights.sbomify.com/MAL-2026-6400/): Malicious code in python-dateutil2 (PyPI) (malicious package)
- [MAL-2026-640](https://insights.sbomify.com/MAL-2026-640/): Malicious code in connections-api-request (PyPI) (malicious package)
- [MAL-2026-64](https://insights.sbomify.com/MAL-2026-64/): Malicious code in oj-sp-css-additions (npm) (malicious package)
- [MAL-2026-6399](https://insights.sbomify.com/MAL-2026-6399/): Malicious code in normalize-plus (npm) (malicious package)
- [MAL-2026-6398](https://insights.sbomify.com/MAL-2026-6398/): Malicious code in ui-core-system (npm) (malicious package)
- [MAL-2026-6397](https://insights.sbomify.com/MAL-2026-6397/): Malicious code in ldapaotest (npm) (malicious package)
- [MAL-2026-6396](https://insights.sbomify.com/MAL-2026-6396/): Malicious code in signup-embedder (npm) (malicious package)
- [MAL-2026-6395](https://insights.sbomify.com/MAL-2026-6395/): Malicious code in react-campaign-optimizer (npm) (malicious package)
- [MAL-2026-6394](https://insights.sbomify.com/MAL-2026-6394/): Malicious code in hs-locale-management (npm) (malicious package)
- [MAL-2026-6393](https://insights.sbomify.com/MAL-2026-6393/): Malicious code in chai-as-predicted (npm) (malicious package)
- [MAL-2026-6392](https://insights.sbomify.com/MAL-2026-6392/): Malicious code in cccmyssr3 (npm) (malicious package)
- [MAL-2026-6391](https://insights.sbomify.com/MAL-2026-6391/): Malicious code in cccmyssr2 (npm) (malicious package)
- [MAL-2026-6390](https://insights.sbomify.com/MAL-2026-6390/): Malicious code in cccmyssr-util (npm) (malicious package)
- [MAL-2026-639](https://insights.sbomify.com/MAL-2026-639/): Malicious code in connection-api-requests (PyPI) (malicious package)
- [MAL-2026-6389](https://insights.sbomify.com/MAL-2026-6389/): Malicious code in vercel-api-client (npm) (malicious package)
- [MAL-2026-6388](https://insights.sbomify.com/MAL-2026-6388/): Malicious code in rapidsearch (npm) (malicious package)
- [MAL-2026-6387](https://insights.sbomify.com/MAL-2026-6387/): Malicious code in multer-express (npm) (malicious package)
- [MAL-2026-6386](https://insights.sbomify.com/MAL-2026-6386/): Malicious code in evmdotjs (npm) (malicious package)
- [MAL-2026-6385](https://insights.sbomify.com/MAL-2026-6385/): Malicious code in eth_accounts (npm) (malicious package)
- [MAL-2026-6384](https://insights.sbomify.com/MAL-2026-6384/): Malicious code in mcpsever (PyPI) (malicious package)
- [MAL-2026-6383](https://insights.sbomify.com/MAL-2026-6383/): Malicious code in gunicorm (PyPI) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/49/