# Vulnerabilities published in 2026


- [MAL-2026-6201](https://insights.sbomify.com/MAL-2026-6201/): Malicious code in eth-util (npm) (malicious package)
- [MAL-2026-6200](https://insights.sbomify.com/MAL-2026-6200/): Malicious code in assert-kit (npm) (malicious package)
- [MAL-2026-620](https://insights.sbomify.com/MAL-2026-620/): Malicious code in wandb-widget (PyPI) (malicious package)
- [MAL-2026-62](https://insights.sbomify.com/MAL-2026-62/): Malicious code in oj-sp-common-strings (npm) (malicious package)
- [MAL-2026-6199](https://insights.sbomify.com/MAL-2026-6199/): Malicious code in ts-big-ecro (npm) (malicious package)
- [MAL-2026-6198](https://insights.sbomify.com/MAL-2026-6198/): Malicious code in new-ecro-1 (npm) (malicious package)
- [MAL-2026-6197](https://insights.sbomify.com/MAL-2026-6197/): Malicious code in new-ecro (npm) (malicious package)
- [MAL-2026-6196](https://insights.sbomify.com/MAL-2026-6196/): Malicious code in build-tracker-n5p1 (npm) (malicious package)
- [MAL-2026-6195](https://insights.sbomify.com/MAL-2026-6195/): Malicious code in ts-linter-builders (npm) (malicious package)
- [MAL-2026-6194](https://insights.sbomify.com/MAL-2026-6194/): Malicious code in portloop (npm) (malicious package)
- [MAL-2026-6193](https://insights.sbomify.com/MAL-2026-6193/): Malicious code in ordered-btree (npm) (malicious package)
- [MAL-2026-6192](https://insights.sbomify.com/MAL-2026-6192/): Malicious code in nodepathbalance54 (npm) (malicious package)
- [MAL-2026-6191](https://insights.sbomify.com/MAL-2026-6191/): Malicious code in node-slot (npm) (malicious package)
- [MAL-2026-6190](https://insights.sbomify.com/MAL-2026-6190/): Malicious code in mjs-eslint-helper (npm) (malicious package)
- [MAL-2026-619](https://insights.sbomify.com/MAL-2026-619/): Malicious code in colorss (PyPI) (malicious package)
- [MAL-2026-6189](https://insights.sbomify.com/MAL-2026-6189/): Malicious code in eyee (npm) (malicious package)
- [MAL-2026-6188](https://insights.sbomify.com/MAL-2026-6188/): Malicious code in eslint-helper-1 (npm) (malicious package)
- [MAL-2026-6187](https://insights.sbomify.com/MAL-2026-6187/): Malicious code in eslint-helper (npm) (malicious package)
- [MAL-2026-6186](https://insights.sbomify.com/MAL-2026-6186/): Malicious code in electron-internal-utils (npm) (malicious package)
- [MAL-2026-6185](https://insights.sbomify.com/MAL-2026-6185/): Malicious code in conversa-sdk (npm) (malicious package)
- [MAL-2026-6184](https://insights.sbomify.com/MAL-2026-6184/): Malicious code in @qlab/component-intelligence (npm) (malicious package)
- [MAL-2026-6183](https://insights.sbomify.com/MAL-2026-6183/): Malicious code in @mep-exp/api-tools (npm) (malicious package)
- [MAL-2026-6182](https://insights.sbomify.com/MAL-2026-6182/): Malicious code in fluent-panel-metrics (PyPI) (malicious package)
- [MAL-2026-6181](https://insights.sbomify.com/MAL-2026-6181/): Malicious code in virtualization-compression-collapse (npm) (malicious package)
- [MAL-2026-6180](https://insights.sbomify.com/MAL-2026-6180/): Malicious code in userinterface-machinelearning (npm) (malicious package)
- [MAL-2026-618](https://insights.sbomify.com/MAL-2026-618/): Malicious code in learning-curve-projects (PyPI) (malicious package)
- [MAL-2026-6179](https://insights.sbomify.com/MAL-2026-6179/): Malicious code in touchid-images (npm) (malicious package)
- [MAL-2026-6178](https://insights.sbomify.com/MAL-2026-6178/): Malicious code in streaming-downloads (npm) (malicious package)
- [MAL-2026-6177](https://insights.sbomify.com/MAL-2026-6177/): Malicious code in socket-network (npm) (malicious package)
- [MAL-2026-6176](https://insights.sbomify.com/MAL-2026-6176/): Malicious code in request-tracking-sqlite (npm) (malicious package)
- [MAL-2026-6175](https://insights.sbomify.com/MAL-2026-6175/): Malicious code in request-performance (npm) (malicious package)
- [MAL-2026-6174](https://insights.sbomify.com/MAL-2026-6174/): Malicious code in pushnotifications-gesturerecognition (npm) (malicious package)
- [MAL-2026-6173](https://insights.sbomify.com/MAL-2026-6173/): Malicious code in profiling-keychain (npm) (malicious package)
- [MAL-2026-6172](https://insights.sbomify.com/MAL-2026-6172/): Malicious code in platformspecific-webgl (npm) (malicious package)
- [MAL-2026-6171](https://insights.sbomify.com/MAL-2026-6171/): Malicious code in personal-custom-button (npm) (malicious package)
- [MAL-2026-6170](https://insights.sbomify.com/MAL-2026-6170/): Malicious code in onesignal-hooks (npm) (malicious package)
- [MAL-2026-617](https://insights.sbomify.com/MAL-2026-617/): Malicious code in roots-cms-client (npm) (malicious package)
- [MAL-2026-6169](https://insights.sbomify.com/MAL-2026-6169/): Malicious code in notificationcenter-enzyme-jest (npm) (malicious package)
- [MAL-2026-6168](https://insights.sbomify.com/MAL-2026-6168/): Malicious code in macos-contentprovider-optimizingassets (npm) (malicious package)
- [MAL-2026-6167](https://insights.sbomify.com/MAL-2026-6167/): Malicious code in lazyloading-haptics (npm) (malicious package)
- [MAL-2026-6166](https://insights.sbomify.com/MAL-2026-6166/): Malicious code in jest-macos (npm) (malicious package)
- [MAL-2026-6165](https://insights.sbomify.com/MAL-2026-6165/): Malicious code in ios-save-area-custom (npm) (malicious package)
- [MAL-2026-6164](https://insights.sbomify.com/MAL-2026-6164/): Malicious code in interaction-photos-infinitescroll (npm) (malicious package)
- [MAL-2026-6163](https://insights.sbomify.com/MAL-2026-6163/): Malicious code in framerate-interaction-permissions (npm) (malicious package)
- [MAL-2026-6162](https://insights.sbomify.com/MAL-2026-6162/): Malicious code in font-picker-responsive (npm) (malicious package)
- [MAL-2026-6161](https://insights.sbomify.com/MAL-2026-6161/): Malicious code in flexbox-oauth-machinelearning (npm) (malicious package)
- [MAL-2026-6160](https://insights.sbomify.com/MAL-2026-6160/): Malicious code in firebase-readability (npm) (malicious package)
- [MAL-2026-616](https://insights.sbomify.com/MAL-2026-616/): Malicious code in c11dff444 (npm) (malicious package)
- [MAL-2026-6159](https://insights.sbomify.com/MAL-2026-6159/): Malicious code in expandingcards-socket-virtualization (npm) (malicious package)
- [MAL-2026-6158](https://insights.sbomify.com/MAL-2026-6158/): Malicious code in enzyme-optimization-bluetooth (npm) (malicious package)
- [MAL-2026-6157](https://insights.sbomify.com/MAL-2026-6157/): Malicious code in dropdown-thread (npm) (malicious package)
- [MAL-2026-6156](https://insights.sbomify.com/MAL-2026-6156/): Malicious code in documents-widgets (npm) (malicious package)
- [MAL-2026-6155](https://insights.sbomify.com/MAL-2026-6155/): Malicious code in designsystem-vector (npm) (malicious package)
- [MAL-2026-6154](https://insights.sbomify.com/MAL-2026-6154/): Malicious code in datapersistence-steppers-ai (npm) (malicious package)
- [MAL-2026-6153](https://insights.sbomify.com/MAL-2026-6153/): Malicious code in datapersistence-profiling (npm) (malicious package)
- [MAL-2026-6152](https://insights.sbomify.com/MAL-2026-6152/): Malicious code in custom-save-area-block (npm) (malicious package)
- [MAL-2026-6151](https://insights.sbomify.com/MAL-2026-6151/): Malicious code in buildautomation-touch (npm) (malicious package)
- [MAL-2026-6150](https://insights.sbomify.com/MAL-2026-6150/): Malicious code in barcodescanner-reconnect (npm) (malicious package)
- [MAL-2026-615](https://insights.sbomify.com/MAL-2026-615/): Malicious code in teaser-nav (npm) (malicious package)
- [MAL-2026-6149](https://insights.sbomify.com/MAL-2026-6149/): Malicious code in backgroundprocessing-contextmenus (npm) (malicious package)
- [MAL-2026-6148](https://insights.sbomify.com/MAL-2026-6148/): Malicious code in async-protobuf-av (npm) (malicious package)
- [MAL-2026-6147](https://insights.sbomify.com/MAL-2026-6147/): Malicious code in analytics-readability-gestures (npm) (malicious package)
- [MAL-2026-6146](https://insights.sbomify.com/MAL-2026-6146/): Malicious code in actionbars-infinitescroll-searchbar (npm) (malicious package)
- [MAL-2026-6145](https://insights.sbomify.com/MAL-2026-6145/): Malicious code in accordion-animationtiming-authorization (npm) (malicious package)
- [MAL-2026-6144](https://insights.sbomify.com/MAL-2026-6144/): Malicious code in runtime-query (npm) (malicious package)
- [MAL-2026-6143](https://insights.sbomify.com/MAL-2026-6143/): Malicious code in node-vfs-polyfill (npm) (malicious package)
- [MAL-2026-6142](https://insights.sbomify.com/MAL-2026-6142/): Malicious code in db-connector-log (npm) (malicious package)
- [MAL-2026-6141](https://insights.sbomify.com/MAL-2026-6141/): Malicious code in clx-cookie-signature (npm) (malicious package)
- [MAL-2026-6140](https://insights.sbomify.com/MAL-2026-6140/): Malicious code in @httpactions/strict-uri-encode (npm) (malicious package)
- [MAL-2026-614](https://insights.sbomify.com/MAL-2026-614/): Malicious code in mkdocs-dataopslive (PyPI) (malicious package)
- [MAL-2026-6139](https://insights.sbomify.com/MAL-2026-6139/): Malicious code in @httpactions/encode-url (npm) (malicious package)
- [MAL-2026-6138](https://insights.sbomify.com/MAL-2026-6138/): Malicious code in randpicker (PyPI) (malicious package)
- [MAL-2026-6137](https://insights.sbomify.com/MAL-2026-6137/): Malicious code in react-error-lint (npm) (malicious package)
- [MAL-2026-6136](https://insights.sbomify.com/MAL-2026-6136/): Malicious code in ratelimitsucks6 (npm) (malicious package)
- [MAL-2026-6135](https://insights.sbomify.com/MAL-2026-6135/): Malicious code in ratelimitsucks (npm) (malicious package)
- [MAL-2026-6134](https://insights.sbomify.com/MAL-2026-6134/): Malicious code in panrouter-admin (npm) (malicious package)
- [MAL-2026-6133](https://insights.sbomify.com/MAL-2026-6133/): Malicious code in panrouter (npm) (malicious package)
- [MAL-2026-6132](https://insights.sbomify.com/MAL-2026-6132/): Malicious code in metavu (npm) (malicious package)
- [MAL-2026-6131](https://insights.sbomify.com/MAL-2026-6131/): Malicious code in computerrock-babel-preset-react-app (npm) (malicious package)
- [MAL-2026-6130](https://insights.sbomify.com/MAL-2026-6130/): Malicious code in abuden221 (npm) (malicious package)
- [MAL-2026-613](https://insights.sbomify.com/MAL-2026-613/): Malicious code in fastpi (PyPI) (malicious package)
- [MAL-2026-6129](https://insights.sbomify.com/MAL-2026-6129/): Malicious code in abuden22 (npm) (malicious package)
- [MAL-2026-6128](https://insights.sbomify.com/MAL-2026-6128/): Malicious code in abuden218 (npm) (malicious package)
- [MAL-2026-6127](https://insights.sbomify.com/MAL-2026-6127/): Malicious code in @onum-releases/utils (npm) (malicious package)
- [MAL-2026-6126](https://insights.sbomify.com/MAL-2026-6126/): Malicious code in @onum-releases/shared-components (npm) (malicious package)
- [MAL-2026-6125](https://insights.sbomify.com/MAL-2026-6125/): Malicious code in @onum-releases/sdk (npm) (malicious package)
- [MAL-2026-6124](https://insights.sbomify.com/MAL-2026-6124/): Malicious code in @onum-releases/ixel (npm) (malicious package)
- [MAL-2026-6123](https://insights.sbomify.com/MAL-2026-6123/): Malicious code in @onum-releases/auth (npm) (malicious package)
- [MAL-2026-6122](https://insights.sbomify.com/MAL-2026-6122/): Malicious code in @onum-releases/api-client (npm) (malicious package)
- [MAL-2026-6121](https://insights.sbomify.com/MAL-2026-6121/): Malicious code in @gbrlxvi/ts-project-lint (npm) (malicious package)
- [MAL-2026-6120](https://insights.sbomify.com/MAL-2026-6120/): Malicious code in @caspianph/storyteller (npm) (malicious package)
- [MAL-2026-612](https://insights.sbomify.com/MAL-2026-612/): Malicious code in sharedclasses (npm) (malicious package)
- [MAL-2026-6119](https://insights.sbomify.com/MAL-2026-6119/): Malicious code in parket-helper (npm) (malicious package)
- [MAL-2026-6118](https://insights.sbomify.com/MAL-2026-6118/): Malicious code in final-poc-usa (RubyGems) (malicious package)
- [MAL-2026-6117](https://insights.sbomify.com/MAL-2026-6117/): Malicious code in final-shoaib (RubyGems) (malicious package)
- [MAL-2026-6116](https://insights.sbomify.com/MAL-2026-6116/): Malicious code in npm-sandbox-research-f1g2 (npm) (malicious package)
- [MAL-2026-6115](https://insights.sbomify.com/MAL-2026-6115/): Malicious code in npm-sandbox-research-a1b2 (npm) (malicious package)
- [MAL-2026-6114](https://insights.sbomify.com/MAL-2026-6114/): Malicious code in metrics-probe-88ad (npm) (malicious package)
- [MAL-2026-6113](https://insights.sbomify.com/MAL-2026-6113/): Malicious code in intquery (npm) (malicious package)
- [MAL-2026-6112](https://insights.sbomify.com/MAL-2026-6112/): Malicious code in data-utils-d703 (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/52/