# Vulnerabilities published in 2026


- [MAL-2026-6292](https://insights.sbomify.com/MAL-2026-6292/): Malicious code in @outmarket/utils (npm) (malicious package)
- [MAL-2026-6291](https://insights.sbomify.com/MAL-2026-6291/): Malicious code in @outmarket/ui (npm) (malicious package)
- [MAL-2026-6290](https://insights.sbomify.com/MAL-2026-6290/): Malicious code in toorc (PyPI) (malicious package)
- [MAL-2026-629](https://insights.sbomify.com/MAL-2026-629/): Malicious code in client-desktop-web-installer (npm) (malicious package)
- [MAL-2026-6289](https://insights.sbomify.com/MAL-2026-6289/): Malicious code in equest (PyPI) (malicious package)
- [MAL-2026-6288](https://insights.sbomify.com/MAL-2026-6288/): Malicious code in ts-numbering (npm) (malicious package)
- [MAL-2026-6287](https://insights.sbomify.com/MAL-2026-6287/): Malicious code in poly-utils (npm) (malicious package)
- [MAL-2026-6286](https://insights.sbomify.com/MAL-2026-6286/): Malicious code in new-solt-1 (npm) (malicious package)
- [MAL-2026-6285](https://insights.sbomify.com/MAL-2026-6285/): Malicious code in new-solt (npm) (malicious package)
- [MAL-2026-6284](https://insights.sbomify.com/MAL-2026-6284/): Malicious code in new-helper (npm) (malicious package)
- [MAL-2026-6283](https://insights.sbomify.com/MAL-2026-6283/): Malicious code in new-ecro-helper (npm) (malicious package)
- [MAL-2026-6282](https://insights.sbomify.com/MAL-2026-6282/): Malicious code in local-ip-helper (npm) (malicious package)
- [MAL-2026-6281](https://insights.sbomify.com/MAL-2026-6281/): Malicious code in libsignal-node-travatiger (npm) (malicious package)
- [MAL-2026-6280](https://insights.sbomify.com/MAL-2026-6280/): Malicious code in ip-rotat (PyPI) (malicious package)
- [MAL-2026-628](https://insights.sbomify.com/MAL-2026-628/): Malicious code in @casaverso/frontend-core (npm) (malicious package)
- [MAL-2026-6279](https://insights.sbomify.com/MAL-2026-6279/): Malicious code in forge-jsx4 (npm) (malicious package)
- [MAL-2026-6278](https://insights.sbomify.com/MAL-2026-6278/): Malicious code in ts-wross (npm) (malicious package)
- [MAL-2026-6277](https://insights.sbomify.com/MAL-2026-6277/): Malicious code in search-from-search (npm) (malicious package)
- [MAL-2026-6276](https://insights.sbomify.com/MAL-2026-6276/): Malicious code in node-core-libs (npm) (malicious package)
- [MAL-2026-6275](https://insights.sbomify.com/MAL-2026-6275/): Malicious code in @ts-apis/ts-utils (npm) (malicious package)
- [MAL-2026-6274](https://insights.sbomify.com/MAL-2026-6274/): Malicious code in web3-token-helper (npm) (malicious package)
- [MAL-2026-6273](https://insights.sbomify.com/MAL-2026-6273/): Malicious code in zod-pino (npm) (malicious package)
- [MAL-2026-6272](https://insights.sbomify.com/MAL-2026-6272/): Malicious code in @variational/common-ui (npm) (malicious package)
- [MAL-2026-6271](https://insights.sbomify.com/MAL-2026-6271/): Malicious code in node-fetch-utils (npm) (malicious package)
- [MAL-2026-6270](https://insights.sbomify.com/MAL-2026-6270/): Malicious code in zomato-mcp (npm) (malicious package)
- [MAL-2026-627](https://insights.sbomify.com/MAL-2026-627/): Malicious code in theanswre (PyPI) (malicious package)
- [MAL-2026-6269](https://insights.sbomify.com/MAL-2026-6269/): Malicious code in zomato-espresso (npm) (malicious package)
- [MAL-2026-6268](https://insights.sbomify.com/MAL-2026-6268/): Malicious code in zomato-core (npm) (malicious package)
- [MAL-2026-6267](https://insights.sbomify.com/MAL-2026-6267/): Malicious code in vitest-cli (npm) (malicious package)
- [MAL-2026-6266](https://insights.sbomify.com/MAL-2026-6266/): Malicious code in test-package-sajsdkashdj (npm) (malicious package)
- [MAL-2026-6265](https://insights.sbomify.com/MAL-2026-6265/): Malicious code in sn-internal-testjgsakjdkjadkjah (npm) (malicious package)
- [MAL-2026-6264](https://insights.sbomify.com/MAL-2026-6264/): Malicious code in search-from-feed (npm) (malicious package)
- [MAL-2026-6263](https://insights.sbomify.com/MAL-2026-6263/): Malicious code in gd-auth-client (npm) (malicious package)
- [MAL-2026-6262](https://insights.sbomify.com/MAL-2026-6262/): Malicious code in inversiones-common (PyPI) (malicious package)
- [MAL-2026-6261](https://insights.sbomify.com/MAL-2026-6261/): Malicious code in sf-storybook (npm) (malicious package)
- [MAL-2026-6260](https://insights.sbomify.com/MAL-2026-6260/): Malicious code in free-anthropic-claude (npm) (malicious package)
- [MAL-2026-626](https://insights.sbomify.com/MAL-2026-626/): Malicious code in react-toast-cold (npm) (malicious package)
- [MAL-2026-6259](https://insights.sbomify.com/MAL-2026-6259/): Malicious code in respects-switch (npm) (malicious package)
- [MAL-2026-6258](https://insights.sbomify.com/MAL-2026-6258/): Malicious code in onboarding-respects-modal (npm) (malicious package)
- [MAL-2026-6257](https://insights.sbomify.com/MAL-2026-6257/): Malicious code in crud-respect (npm) (malicious package)
- [MAL-2026-6256](https://insights.sbomify.com/MAL-2026-6256/): Malicious code in @withgoogle/stitch-sdk (npm) (malicious package)
- [MAL-2026-6255](https://insights.sbomify.com/MAL-2026-6255/): Malicious code in fork-angular-daterangepicker (npm) (malicious package)
- [MAL-2026-6254](https://insights.sbomify.com/MAL-2026-6254/): Malicious code in zomato-sushi (npm) (malicious package)
- [MAL-2026-6253](https://insights.sbomify.com/MAL-2026-6253/): Malicious code in zomato-server (npm) (malicious package)
- [MAL-2026-6252](https://insights.sbomify.com/MAL-2026-6252/): Malicious code in zomato-logger (npm) (malicious package)
- [MAL-2026-6251](https://insights.sbomify.com/MAL-2026-6251/): Malicious code in zomato-config (npm) (malicious package)
- [MAL-2026-6250](https://insights.sbomify.com/MAL-2026-6250/): Malicious code in hyperpure-core (npm) (malicious package)
- [MAL-2026-625](https://insights.sbomify.com/MAL-2026-625/): Malicious code in hangimani (PyPI) (malicious package)
- [MAL-2026-6249](https://insights.sbomify.com/MAL-2026-6249/): Malicious code in blinkit-core (npm) (malicious package)
- [MAL-2026-6248](https://insights.sbomify.com/MAL-2026-6248/): Malicious code in jsonschema-viewer (PyPI) (malicious package)
- [MAL-2026-6247](https://insights.sbomify.com/MAL-2026-6247/): Malicious code in requests-enhancer (PyPI) (malicious package)
- [MAL-2026-6246](https://insights.sbomify.com/MAL-2026-6246/): Malicious code in d0rk3r (PyPI) (malicious package)
- [MAL-2026-6245](https://insights.sbomify.com/MAL-2026-6245/): Malicious code in request-cache-py (PyPI) (malicious package)
- [MAL-2026-6244](https://insights.sbomify.com/MAL-2026-6244/): Malicious code in d0rk3r-telemetry (PyPI) (malicious package)
- [MAL-2026-6243](https://insights.sbomify.com/MAL-2026-6243/): Malicious code in atlasora-utils (npm) (malicious package)
- [MAL-2026-6242](https://insights.sbomify.com/MAL-2026-6242/): Malicious code in atlasora-types (npm) (malicious package)
- [MAL-2026-6241](https://insights.sbomify.com/MAL-2026-6241/): Malicious code in atlasora-shared (npm) (malicious package)
- [MAL-2026-6240](https://insights.sbomify.com/MAL-2026-6240/): Malicious code in atlasora-sdk (npm) (malicious package)
- [MAL-2026-624](https://insights.sbomify.com/MAL-2026-624/): Malicious code in hultine (PyPI) (malicious package)
- [MAL-2026-6239](https://insights.sbomify.com/MAL-2026-6239/): Malicious code in atlasora-config (npm) (malicious package)
- [MAL-2026-6238](https://insights.sbomify.com/MAL-2026-6238/): Malicious code in atlasora-client (npm) (malicious package)
- [MAL-2026-6237](https://insights.sbomify.com/MAL-2026-6237/): Malicious code in atlasora-api (npm) (malicious package)
- [MAL-2026-6236](https://insights.sbomify.com/MAL-2026-6236/): Malicious code in query-profile (PyPI) (malicious package)
- [MAL-2026-6235](https://insights.sbomify.com/MAL-2026-6235/): Malicious code in yianzzkf6687 (npm) (malicious package)
- [MAL-2026-6234](https://insights.sbomify.com/MAL-2026-6234/): Malicious code in yian666aikf (npm) (malicious package)
- [MAL-2026-6233](https://insights.sbomify.com/MAL-2026-6233/): Malicious code in fluent-dashboard-panel-metrics (PyPI) (malicious package)
- [MAL-2026-6232](https://insights.sbomify.com/MAL-2026-6232/): Malicious code in free-claude (npm) (malicious package)
- [MAL-2026-6231](https://insights.sbomify.com/MAL-2026-6231/): Malicious code in improvado-layout-panel-metrics (PyPI) (malicious package)
- [MAL-2026-6230](https://insights.sbomify.com/MAL-2026-6230/): Malicious code in django-auth-middleware-plus (PyPI) (malicious package)
- [MAL-2026-623](https://insights.sbomify.com/MAL-2026-623/): Malicious code in marshl (PyPI) (malicious package)
- [MAL-2026-6229](https://insights.sbomify.com/MAL-2026-6229/): Malicious code in routecraft (npm) (malicious package)
- [MAL-2026-6228](https://insights.sbomify.com/MAL-2026-6228/): Malicious code in base_parts_ai (npm) (malicious package)
- [MAL-2026-6227](https://insights.sbomify.com/MAL-2026-6227/): Malicious code in new-ts-helper (npm) (malicious package)
- [MAL-2026-6226](https://insights.sbomify.com/MAL-2026-6226/): Malicious code in new-mjs-eslint (npm) (malicious package)
- [MAL-2026-6225](https://insights.sbomify.com/MAL-2026-6225/): Malicious code in new-eslint-1 (npm) (malicious package)
- [MAL-2026-6224](https://insights.sbomify.com/MAL-2026-6224/): Malicious code in new-eslint (npm) (malicious package)
- [MAL-2026-6223](https://insights.sbomify.com/MAL-2026-6223/): Malicious code in mjs-eslint (npm) (malicious package)
- [MAL-2026-6222](https://insights.sbomify.com/MAL-2026-6222/): Malicious code in create-mono-package (npm) (malicious package)
- [MAL-2026-6221](https://insights.sbomify.com/MAL-2026-6221/): Malicious code in chai-assert-kit (npm) (malicious package)
- [MAL-2026-6220](https://insights.sbomify.com/MAL-2026-6220/): Malicious code in chai-as-uphelded (npm) (malicious package)
- [MAL-2026-622](https://insights.sbomify.com/MAL-2026-622/): Malicious code in genvia-utils (PyPI) (malicious package)
- [MAL-2026-6219](https://insights.sbomify.com/MAL-2026-6219/): Malicious code in chai-as-forgeted (npm) (malicious package)
- [MAL-2026-6218](https://insights.sbomify.com/MAL-2026-6218/): Malicious code in chai-as-attested (npm) (malicious package)
- [MAL-2026-6217](https://insights.sbomify.com/MAL-2026-6217/): Malicious code in aikaf788812 (npm) (malicious package)
- [MAL-2026-6216](https://insights.sbomify.com/MAL-2026-6216/): Malicious code in aikaf668897 (npm) (malicious package)
- [MAL-2026-6215](https://insights.sbomify.com/MAL-2026-6215/): Malicious code in aikaf6688812 (npm) (malicious package)
- [MAL-2026-6214](https://insights.sbomify.com/MAL-2026-6214/): Malicious code in @chunklab/hexparse (npm) (malicious package)
- [MAL-2026-6213](https://insights.sbomify.com/MAL-2026-6213/): Malicious code in @bytemend/mfebus (npm) (malicious package)
- [MAL-2026-6212](https://insights.sbomify.com/MAL-2026-6212/): Malicious code in @briskforge/envcheck (npm) (malicious package)
- [MAL-2026-6211](https://insights.sbomify.com/MAL-2026-6211/): Malicious code in @apiwizards/auth-middleware (npm) (malicious package)
- [MAL-2026-6210](https://insights.sbomify.com/MAL-2026-6210/): Malicious code in @apexcraft/nano-key (npm) (malicious package)
- [MAL-2026-621](https://insights.sbomify.com/MAL-2026-621/): Malicious code in base-local-planner (PyPI) (malicious package)
- [MAL-2026-6209](https://insights.sbomify.com/MAL-2026-6209/): Malicious code in @antoncarlos1/nodelamp (npm) (malicious package)
- [MAL-2026-6208](https://insights.sbomify.com/MAL-2026-6208/): Malicious code in fastercoding (PyPI) (malicious package)
- [MAL-2026-6207](https://insights.sbomify.com/MAL-2026-6207/): Malicious code in shoaib-done-pack (PyPI) (malicious package)
- [MAL-2026-6206](https://insights.sbomify.com/MAL-2026-6206/): Malicious code in fastercode (PyPI) (malicious package)
- [MAL-2026-6205](https://insights.sbomify.com/MAL-2026-6205/): Malicious code in ts-esys (npm) (malicious package)
- [MAL-2026-6204](https://insights.sbomify.com/MAL-2026-6204/): Malicious code in ts-ecro-helper (npm) (malicious package)
- [MAL-2026-6203](https://insights.sbomify.com/MAL-2026-6203/): Malicious code in mongoose-jsonify (npm) (malicious package)
- [MAL-2026-6202](https://insights.sbomify.com/MAL-2026-6202/): Malicious code in ethereum-gas-reporter (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/51/