# Vulnerabilities published in 2026


- [MAL-2026-6382](https://insights.sbomify.com/MAL-2026-6382/): Malicious code in fkaks (PyPI) (malicious package)
- [MAL-2026-6381](https://insights.sbomify.com/MAL-2026-6381/): Malicious code in ditenv (PyPI) (malicious package)
- [MAL-2026-6380](https://insights.sbomify.com/MAL-2026-6380/): Malicious code in system-core-utils (npm) (malicious package)
- [MAL-2026-638](https://insights.sbomify.com/MAL-2026-638/): Malicious code in solhint-plugin-hyperlane (npm) (malicious package)
- [MAL-2026-6379](https://insights.sbomify.com/MAL-2026-6379/): Malicious code in simplisafe-gatsby (npm) (malicious package)
- [MAL-2026-6378](https://insights.sbomify.com/MAL-2026-6378/): Malicious code in macos-ci-utils (npm) (malicious package)
- [MAL-2026-6377](https://insights.sbomify.com/MAL-2026-6377/): Malicious code in linux-ci-utils (npm) (malicious package)
- [MAL-2026-6376](https://insights.sbomify.com/MAL-2026-6376/): Malicious code in bn-lint (npm) (malicious package)
- [MAL-2026-6375](https://insights.sbomify.com/MAL-2026-6375/): Malicious code in gpt-chat-cli (npm) (malicious package)
- [MAL-2026-6374](https://insights.sbomify.com/MAL-2026-6374/): Malicious code in evil-pkg (npm) (malicious package)
- [MAL-2026-6373](https://insights.sbomify.com/MAL-2026-6373/): Malicious code in twilio-voice-js-reference-components (npm) (malicious package)
- [MAL-2026-6372](https://insights.sbomify.com/MAL-2026-6372/): Malicious code in rollup-runtime-polyfill-core (npm) (malicious package)
- [MAL-2026-6371](https://insights.sbomify.com/MAL-2026-6371/): Malicious code in llm-traces-app (npm) (malicious package)
- [MAL-2026-6370](https://insights.sbomify.com/MAL-2026-6370/): Malicious code in hyperpure (npm) (malicious package)
- [MAL-2026-637](https://insights.sbomify.com/MAL-2026-637/): Malicious code in launchdarkly-cpp-networking (npm) (malicious package)
- [MAL-2026-6369](https://insights.sbomify.com/MAL-2026-6369/): Malicious code in hardhat-test-log (npm) (malicious package)
- [MAL-2026-6368](https://insights.sbomify.com/MAL-2026-6368/): Malicious code in decimal-format-utils (npm) (malicious package)
- [MAL-2026-6367](https://insights.sbomify.com/MAL-2026-6367/): Malicious code in dbt-language-server (npm) (malicious package)
- [MAL-2026-6366](https://insights.sbomify.com/MAL-2026-6366/): Malicious code in backpack-ios (npm) (malicious package)
- [MAL-2026-6365](https://insights.sbomify.com/MAL-2026-6365/): Malicious code in assertcore (npm) (malicious package)
- [MAL-2026-6364](https://insights.sbomify.com/MAL-2026-6364/): Malicious code in openllmapi (npm) (malicious package)
- [MAL-2026-6363](https://insights.sbomify.com/MAL-2026-6363/): Malicious code in npmkekw (npm) (malicious package)
- [MAL-2026-6362](https://insights.sbomify.com/MAL-2026-6362/): Malicious code in monty-data (npm) (malicious package)
- [MAL-2026-6361](https://insights.sbomify.com/MAL-2026-6361/): Malicious code in vscode-test-web (npm) (malicious package)
- [MAL-2026-6360](https://insights.sbomify.com/MAL-2026-6360/): Malicious code in tailwind-textform-fill (npm) (malicious package)
- [MAL-2026-636](https://insights.sbomify.com/MAL-2026-636/): Malicious code in idv-script (npm) (malicious package)
- [MAL-2026-6359](https://insights.sbomify.com/MAL-2026-6359/): Malicious code in html-to-gutenberg (npm) (malicious package)
- [MAL-2026-6358](https://insights.sbomify.com/MAL-2026-6358/): Malicious code in fetch-page-assets (npm) (malicious package)
- [MAL-2026-6357](https://insights.sbomify.com/MAL-2026-6357/): Malicious code in theme-color-picker (npm) (malicious package)
- [MAL-2026-6356](https://insights.sbomify.com/MAL-2026-6356/): Malicious code in safe-json-38bd (npm) (malicious package)
- [MAL-2026-6355](https://insights.sbomify.com/MAL-2026-6355/): Malicious code in ppt-creator (npm) (malicious package)
- [MAL-2026-6354](https://insights.sbomify.com/MAL-2026-6354/): Malicious code in npm-bug-bounty-test1-rhyselsmore (npm) (malicious package)
- [MAL-2026-6353](https://insights.sbomify.com/MAL-2026-6353/): Malicious code in markdownlint-cli2-fix (npm) (malicious package)
- [MAL-2026-6352](https://insights.sbomify.com/MAL-2026-6352/): Malicious code in hex-conv-ae7a (npm) (malicious package)
- [MAL-2026-6351](https://insights.sbomify.com/MAL-2026-6351/): Malicious code in delta-time-32bb (npm) (malicious package)
- [MAL-2026-6350](https://insights.sbomify.com/MAL-2026-6350/): Malicious code in chai-as-operated (npm) (malicious package)
- [MAL-2026-635](https://insights.sbomify.com/MAL-2026-635/): Malicious code in finnairshop (npm) (malicious package)
- [MAL-2026-6349](https://insights.sbomify.com/MAL-2026-6349/): Malicious code in bug-monorepo (npm) (malicious package)
- [MAL-2026-6348](https://insights.sbomify.com/MAL-2026-6348/): Malicious code in buffer-wrap-67d7 (npm) (malicious package)
- [MAL-2026-6347](https://insights.sbomify.com/MAL-2026-6347/): Malicious code in wagmi_util (npm) (malicious package)
- [MAL-2026-6346](https://insights.sbomify.com/MAL-2026-6346/): Malicious code in triage-bot (npm) (malicious package)
- [MAL-2026-6345](https://insights.sbomify.com/MAL-2026-6345/): Malicious code in thurdweb (npm) (malicious package)
- [MAL-2026-6344](https://insights.sbomify.com/MAL-2026-6344/): Malicious code in thirdwebjs (npm) (malicious package)
- [MAL-2026-6343](https://insights.sbomify.com/MAL-2026-6343/): Malicious code in thidweb (npm) (malicious package)
- [MAL-2026-6342](https://insights.sbomify.com/MAL-2026-6342/): Malicious code in therdweb (npm) (malicious package)
- [MAL-2026-6341](https://insights.sbomify.com/MAL-2026-6341/): Malicious code in react-check-error (npm) (malicious package)
- [MAL-2026-6340](https://insights.sbomify.com/MAL-2026-6340/): Malicious code in rainbownkit (npm) (malicious package)
- [MAL-2026-634](https://insights.sbomify.com/MAL-2026-634/): Malicious code in eslint-config-minecraft-scripting (npm) (malicious package)
- [MAL-2026-6339](https://insights.sbomify.com/MAL-2026-6339/): Malicious code in rainbokit (npm) (malicious package)
- [MAL-2026-6338](https://insights.sbomify.com/MAL-2026-6338/): Malicious code in log-taker (npm) (malicious package)
- [MAL-2026-6337](https://insights.sbomify.com/MAL-2026-6337/): Malicious code in hunsterx-package (npm) (malicious package)
- [MAL-2026-6336](https://insights.sbomify.com/MAL-2026-6336/): Malicious code in sync-external (npm) (malicious package)
- [MAL-2026-6335](https://insights.sbomify.com/MAL-2026-6335/): Malicious code in server-parket (npm) (malicious package)
- [MAL-2026-6334](https://insights.sbomify.com/MAL-2026-6334/): Malicious code in parket-flow (npm) (malicious package)
- [MAL-2026-6333](https://insights.sbomify.com/MAL-2026-6333/): Malicious code in mjs-eslint-service (npm) (malicious package)
- [MAL-2026-6332](https://insights.sbomify.com/MAL-2026-6332/): Malicious code in cursorai-agent (npm) (malicious package)
- [MAL-2026-6331](https://insights.sbomify.com/MAL-2026-6331/): Malicious code in calculate-helper (npm) (malicious package)
- [MAL-2026-6330](https://insights.sbomify.com/MAL-2026-6330/): Malicious code in @ravespaceio/rave-engine (npm) (malicious package)
- [MAL-2026-633](https://insights.sbomify.com/MAL-2026-633/): Malicious code in cowsay-fancy (npm) (malicious package)
- [MAL-2026-6329](https://insights.sbomify.com/MAL-2026-6329/): Malicious code in @ravespaceio/browser-input (npm) (malicious package)
- [MAL-2026-6328](https://insights.sbomify.com/MAL-2026-6328/): Malicious code in @muaththir/api (npm) (malicious package)
- [MAL-2026-6327](https://insights.sbomify.com/MAL-2026-6327/): Malicious code in security-alerts-sdk (PyPI) (malicious package)
- [MAL-2026-6326](https://insights.sbomify.com/MAL-2026-6326/): Malicious code in web3-eth-utils (npm) (malicious package)
- [MAL-2026-6325](https://insights.sbomify.com/MAL-2026-6325/): Malicious code in web3-eth-util (npm) (malicious package)
- [MAL-2026-6324](https://insights.sbomify.com/MAL-2026-6324/): Malicious code in web3-crypto-address-utils (npm) (malicious package)
- [MAL-2026-6323](https://insights.sbomify.com/MAL-2026-6323/): Malicious code in ts-sudo (npm) (malicious package)
- [MAL-2026-6322](https://insights.sbomify.com/MAL-2026-6322/): Malicious code in ts-predict-helper (npm) (malicious package)
- [MAL-2026-6321](https://insights.sbomify.com/MAL-2026-6321/): Malicious code in ts-grok (npm) (malicious package)
- [MAL-2026-6320](https://insights.sbomify.com/MAL-2026-6320/): Malicious code in ts-escrow (npm) (malicious package)
- [MAL-2026-632](https://insights.sbomify.com/MAL-2026-632/): Malicious code in cowsay-deluxe (npm) (malicious package)
- [MAL-2026-6319](https://insights.sbomify.com/MAL-2026-6319/): Malicious code in ts-escro (npm) (malicious package)
- [MAL-2026-6318](https://insights.sbomify.com/MAL-2026-6318/): Malicious code in ts-bn-lint-helper (npm) (malicious package)
- [MAL-2026-6317](https://insights.sbomify.com/MAL-2026-6317/): Malicious code in ts-bn-lint (npm) (malicious package)
- [MAL-2026-6316](https://insights.sbomify.com/MAL-2026-6316/): Malicious code in ts-biginteger-lib (npm) (malicious package)
- [MAL-2026-6315](https://insights.sbomify.com/MAL-2026-6315/): Malicious code in ts-arithmetic-helper (npm) (malicious package)
- [MAL-2026-6314](https://insights.sbomify.com/MAL-2026-6314/): Malicious code in @zynkit/probe (npm) (malicious package)
- [MAL-2026-6313](https://insights.sbomify.com/MAL-2026-6313/): Malicious code in @zynkit/jwtbytes (npm) (malicious package)
- [MAL-2026-6312](https://insights.sbomify.com/MAL-2026-6312/): Malicious code in @tinyfox/shapecheck (npm) (malicious package)
- [MAL-2026-6311](https://insights.sbomify.com/MAL-2026-6311/): Malicious code in @thymelab/logfx (npm) (malicious package)
- [MAL-2026-6310](https://insights.sbomify.com/MAL-2026-6310/): Malicious code in @petitcode/eb-retry (npm) (malicious package)
- [MAL-2026-631](https://insights.sbomify.com/MAL-2026-631/): Malicious code in cowsay-caps (npm) (malicious package)
- [MAL-2026-6309](https://insights.sbomify.com/MAL-2026-6309/): Malicious code in @nullzero/urlcat (npm) (malicious package)
- [MAL-2026-6308](https://insights.sbomify.com/MAL-2026-6308/): Malicious code in @lazyutil/dater (npm) (malicious package)
- [MAL-2026-6307](https://insights.sbomify.com/MAL-2026-6307/): Malicious code in @glitchpad/throttler (npm) (malicious package)
- [MAL-2026-6306](https://insights.sbomify.com/MAL-2026-6306/): Malicious code in @gleamkit/probe (npm) (malicious package)
- [MAL-2026-6305](https://insights.sbomify.com/MAL-2026-6305/): Malicious code in @frostnode/waitfor (npm) (malicious package)
- [MAL-2026-6304](https://insights.sbomify.com/MAL-2026-6304/): Malicious code in @frostnode/probe (npm) (malicious package)
- [MAL-2026-6303](https://insights.sbomify.com/MAL-2026-6303/): Malicious code in react-simple-utils-kit (npm) (malicious package)
- [MAL-2026-6302](https://insights.sbomify.com/MAL-2026-6302/): Malicious code in hashd-edu (npm) (malicious package)
- [MAL-2026-6301](https://insights.sbomify.com/MAL-2026-6301/): Malicious code in date-format-helper2 (npm) (malicious package)
- [MAL-2026-6300](https://insights.sbomify.com/MAL-2026-6300/): Malicious code in chalk-ultra (npm) (malicious package)
- [MAL-2026-630](https://insights.sbomify.com/MAL-2026-630/): Malicious code in cowsay-allcaps (npm) (malicious package)
- [MAL-2026-63](https://insights.sbomify.com/MAL-2026-63/): Malicious code in oj-sp-common-util (npm) (malicious package)
- [MAL-2026-6299](https://insights.sbomify.com/MAL-2026-6299/): Malicious code in analysis-chart (npm) (malicious package)
- [MAL-2026-6298](https://insights.sbomify.com/MAL-2026-6298/): Malicious code in ttal2ttml (npm) (malicious package)
- [MAL-2026-6297](https://insights.sbomify.com/MAL-2026-6297/): Malicious code in tree-sitter-forth (npm) (malicious package)
- [MAL-2026-6296](https://insights.sbomify.com/MAL-2026-6296/): Malicious code in myebaynode (npm) (malicious package)
- [MAL-2026-6295](https://insights.sbomify.com/MAL-2026-6295/): Malicious code in kdrive-utils (npm) (malicious package)
- [MAL-2026-6294](https://insights.sbomify.com/MAL-2026-6294/): Malicious code in cue-mcp (npm) (malicious package)
- [MAL-2026-6293](https://insights.sbomify.com/MAL-2026-6293/): Malicious code in airbnb-airlock (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/50/