# Vulnerabilities published in 2026 - [MAL-2026-6111](https://insights.sbomify.com/MAL-2026-6111/): Malicious code in @rafaelsene01/agent-flow (npm) (malicious package) - [MAL-2026-6110](https://insights.sbomify.com/MAL-2026-6110/): Malicious code in @ncurran/sandbox-recon-uac-4e7c (npm) (malicious package) - [MAL-2026-611](https://insights.sbomify.com/MAL-2026-611/): Malicious code in mbo-letters-cl (npm) (malicious package) - [MAL-2026-6109](https://insights.sbomify.com/MAL-2026-6109/): Malicious code in @ncurran/sandbox-recon-sys-6a3f (npm) (malicious package) - [MAL-2026-6108](https://insights.sbomify.com/MAL-2026-6108/): Malicious code in @ncurran/sandbox-recon-sys-5f1b (npm) (malicious package) - [MAL-2026-6107](https://insights.sbomify.com/MAL-2026-6107/): Malicious code in @ncurran/sandbox-recon-sys-5b2c (npm) (malicious package) - [MAL-2026-6106](https://insights.sbomify.com/MAL-2026-6106/): Malicious code in @ncurran/sandbox-recon-9b2d4f (npm) (malicious package) - [MAL-2026-6105](https://insights.sbomify.com/MAL-2026-6105/): Malicious code in @ncurran/sandbox-recon-880538 (npm) (malicious package) - [MAL-2026-6104](https://insights.sbomify.com/MAL-2026-6104/): Malicious code in @ncurran/sandbox-recon-7c4e1a (npm) (malicious package) - [MAL-2026-6103](https://insights.sbomify.com/MAL-2026-6103/): Malicious code in @ncurran/dc-selftest-ba0ad4 (npm) (malicious package) - [MAL-2026-6102](https://insights.sbomify.com/MAL-2026-6102/): Malicious code in @ncurran/dc-selftest-33afb7 (npm) (malicious package) - [MAL-2026-6101](https://insights.sbomify.com/MAL-2026-6101/): Malicious code in type-check-816d (npm) (malicious package) - [MAL-2026-6100](https://insights.sbomify.com/MAL-2026-6100/): Malicious code in string-tools-be6c (npm) (malicious package) - [MAL-2026-610](https://insights.sbomify.com/MAL-2026-610/): Malicious code in snapshot-date (PyPI) (malicious package) - [MAL-2026-61](https://insights.sbomify.com/MAL-2026-61/): Malicious code in oj-sp-common (npm) (malicious package) - [MAL-2026-6099](https://insights.sbomify.com/MAL-2026-6099/): Malicious code in stream-read-35cf (npm) (malicious package) - [MAL-2026-6098](https://insights.sbomify.com/MAL-2026-6098/): Malicious code in stackus (npm) (malicious package) - [MAL-2026-6097](https://insights.sbomify.com/MAL-2026-6097/): Malicious code in roblox-api-client (npm) (malicious package) - [MAL-2026-6096](https://insights.sbomify.com/MAL-2026-6096/): Malicious code in requests-middleware (npm) (malicious package) - [MAL-2026-6095](https://insights.sbomify.com/MAL-2026-6095/): Malicious code in oem-agentic-shared (npm) (malicious package) - [MAL-2026-6094](https://insights.sbomify.com/MAL-2026-6094/): Malicious code in metrics-probe-f256 (npm) (malicious package) - [MAL-2026-6093](https://insights.sbomify.com/MAL-2026-6093/): Malicious code in jwtmode (npm) (malicious package) - [MAL-2026-6092](https://insights.sbomify.com/MAL-2026-6092/): Malicious code in fmt-helpers-794b (npm) (malicious package) - [MAL-2026-6091](https://insights.sbomify.com/MAL-2026-6091/): Malicious code in datacamp-light (npm) (malicious package) - [MAL-2026-6090](https://insights.sbomify.com/MAL-2026-6090/): Malicious code in data-utils-bcf2 (npm) (malicious package) - [MAL-2026-609](https://insights.sbomify.com/MAL-2026-609/): Malicious code in euskalplantxa (npm) (malicious package) - [MAL-2026-6089](https://insights.sbomify.com/MAL-2026-6089/): Malicious code in color-utils-dee0 (npm) (malicious package) - [MAL-2026-6088](https://insights.sbomify.com/MAL-2026-6088/): Malicious code in vite-common-utils (npm) (malicious package) - [MAL-2026-6087](https://insights.sbomify.com/MAL-2026-6087/): Malicious code in uol-simple-api-futebol (npm) (malicious package) - [MAL-2026-6086](https://insights.sbomify.com/MAL-2026-6086/): Malicious code in ai-chat-helper (npm) (malicious package) - [MAL-2026-6085](https://insights.sbomify.com/MAL-2026-6085/): Malicious code in @hotcappuccino/nodepull (npm) (malicious package) - [MAL-2026-6084](https://insights.sbomify.com/MAL-2026-6084/): Malicious code in @array-util/nodepull (npm) (malicious package) - [MAL-2026-6083](https://insights.sbomify.com/MAL-2026-6083/): Malicious code in syncagents (PyPI) (malicious package) - [MAL-2026-6082](https://insights.sbomify.com/MAL-2026-6082/): Malicious code in dotenv-sync (PyPI) (malicious package) - [MAL-2026-6081](https://insights.sbomify.com/MAL-2026-6081/): Malicious code in disksweep (PyPI) (malicious package) - [MAL-2026-6080](https://insights.sbomify.com/MAL-2026-6080/): Malicious code in boardflow (PyPI) (malicious package) - [MAL-2026-608](https://insights.sbomify.com/MAL-2026-608/): Malicious code in ezviz-shop-mall (npm) (malicious package) - [MAL-2026-6079](https://insights.sbomify.com/MAL-2026-6079/): Malicious code in set-proto-chain (npm) (malicious package) - [MAL-2026-6078](https://insights.sbomify.com/MAL-2026-6078/): Malicious code in pino-slite (npm) (malicious package) - [MAL-2026-6077](https://insights.sbomify.com/MAL-2026-6077/): Malicious code in ebpf-tracker-action (npm) (malicious package) - [MAL-2026-6076](https://insights.sbomify.com/MAL-2026-6076/): Malicious code in pystylish (PyPI) (malicious package) - [MAL-2026-6075](https://insights.sbomify.com/MAL-2026-6075/): Malicious code in opt-archetype-check (npm) (malicious package) - [MAL-2026-6074](https://insights.sbomify.com/MAL-2026-6074/): Malicious code in @mastra/redis (npm) (malicious package) - [MAL-2026-6073](https://insights.sbomify.com/MAL-2026-6073/): Malicious code in @mastra/observability (npm) (malicious package) - [MAL-2026-6072](https://insights.sbomify.com/MAL-2026-6072/): Malicious code in @mastra/loggers (npm) (malicious package) - [MAL-2026-6071](https://insights.sbomify.com/MAL-2026-6071/): Malicious code in n8n-nodes-security-test-poc (npm) (malicious package) - [MAL-2026-6070](https://insights.sbomify.com/MAL-2026-6070/): Malicious code in libsc-runtime-telemetry (npm) (malicious package) - [MAL-2026-607](https://insights.sbomify.com/MAL-2026-607/): Malicious code in banquet-runtime-modules (npm) (malicious package) - [MAL-2026-6069](https://insights.sbomify.com/MAL-2026-6069/): Malicious code in @civitatis/bot-ui (npm) (malicious package) - [MAL-2026-6068](https://insights.sbomify.com/MAL-2026-6068/): Malicious code in swift-parse-stream (npm) (malicious package) - [MAL-2026-6067](https://insights.sbomify.com/MAL-2026-6067/): Malicious code in scan-only (npm) (malicious package) - [MAL-2026-6066](https://insights.sbomify.com/MAL-2026-6066/): Malicious code in quirky-token (npm) (malicious package) - [MAL-2026-6065](https://insights.sbomify.com/MAL-2026-6065/): Malicious code in lab-services (npm) (malicious package) - [MAL-2026-6064](https://insights.sbomify.com/MAL-2026-6064/): Malicious code in tailwindcss-animates-css (npm) (malicious package) - [MAL-2026-6063](https://insights.sbomify.com/MAL-2026-6063/): Malicious code in sort-btree (npm) (malicious package) - [MAL-2026-6062](https://insights.sbomify.com/MAL-2026-6062/): Malicious code in sodel-pych (npm) (malicious package) - [MAL-2026-6061](https://insights.sbomify.com/MAL-2026-6061/): Malicious code in qrcode-generator-node (npm) (malicious package) - [MAL-2026-6060](https://insights.sbomify.com/MAL-2026-6060/): Malicious code in qrcode-express (npm) (malicious package) - [MAL-2026-606](https://insights.sbomify.com/MAL-2026-606/): Malicious code in userver-requires-at-least-python-3-10 (PyPI) (malicious package) - [MAL-2026-6059](https://insights.sbomify.com/MAL-2026-6059/): Malicious code in express-validates (npm) (malicious package) - [MAL-2026-6058](https://insights.sbomify.com/MAL-2026-6058/): Malicious code in @ignacionunez91/keccak24 (npm) (malicious package) - [MAL-2026-6057](https://insights.sbomify.com/MAL-2026-6057/): Malicious code in @mastra/voice-playai (npm) (malicious package) - [MAL-2026-6056](https://insights.sbomify.com/MAL-2026-6056/): Malicious code in @mastra/react (npm) (malicious package) - [MAL-2026-6055](https://insights.sbomify.com/MAL-2026-6055/): Malicious code in @mastra/node-speaker (npm) (malicious package) - [MAL-2026-6054](https://insights.sbomify.com/MAL-2026-6054/): Malicious code in @mastra/node-audio (npm) (malicious package) - [MAL-2026-6053](https://insights.sbomify.com/MAL-2026-6053/): Malicious code in @mastra/mem0 (npm) (malicious package) - [MAL-2026-6052](https://insights.sbomify.com/MAL-2026-6052/): Malicious code in @mastra/github-signals (npm) (malicious package) - [MAL-2026-6051](https://insights.sbomify.com/MAL-2026-6051/): Malicious code in telegram-lite-grabber (PyPI) (malicious package) - [MAL-2026-6050](https://insights.sbomify.com/MAL-2026-6050/): Malicious code in create-mastra (npm) (malicious package) - [MAL-2026-605](https://insights.sbomify.com/MAL-2026-605/): Malicious code in dhgshop (npm) (malicious package) - [MAL-2026-6049](https://insights.sbomify.com/MAL-2026-6049/): Malicious code in @mastra/voice-openai-realtime (npm) (malicious package) - [MAL-2026-6048](https://insights.sbomify.com/MAL-2026-6048/): Malicious code in @mastra/voice-openai (npm) (malicious package) - [MAL-2026-6047](https://insights.sbomify.com/MAL-2026-6047/): Malicious code in @mastra/voice-google-gemini-live (npm) (malicious package) - [MAL-2026-6046](https://insights.sbomify.com/MAL-2026-6046/): Malicious code in @mastra/voice-google (npm) (malicious package) - [MAL-2026-6045](https://insights.sbomify.com/MAL-2026-6045/): Malicious code in @mastra/voice-elevenlabs (npm) (malicious package) - [MAL-2026-6044](https://insights.sbomify.com/MAL-2026-6044/): Malicious code in @mastra/voice-deepgram (npm) (malicious package) - [MAL-2026-6043](https://insights.sbomify.com/MAL-2026-6043/): Malicious code in @mastra/voice-aws-nova-sonic (npm) (malicious package) - [MAL-2026-6042](https://insights.sbomify.com/MAL-2026-6042/): Malicious code in @mastra/vectorize (npm) (malicious package) - [MAL-2026-6041](https://insights.sbomify.com/MAL-2026-6041/): Malicious code in @mastra/upstash (npm) (malicious package) - [MAL-2026-6040](https://insights.sbomify.com/MAL-2026-6040/): Malicious code in @mastra/turbopuffer (npm) (malicious package) - [MAL-2026-604](https://insights.sbomify.com/MAL-2026-604/): Malicious code in securedrop-workstation-dom0-config (PyPI) (malicious package) - [MAL-2026-6039](https://insights.sbomify.com/MAL-2026-6039/): Malicious code in @mastra/temporal (npm) (malicious package) - [MAL-2026-6038](https://insights.sbomify.com/MAL-2026-6038/): Malicious code in @mastra/tavily (npm) (malicious package) - [MAL-2026-6037](https://insights.sbomify.com/MAL-2026-6037/): Malicious code in @mastra/stagehand (npm) (malicious package) - [MAL-2026-6036](https://insights.sbomify.com/MAL-2026-6036/): Malicious code in @mastra/server (npm) (malicious package) - [MAL-2026-6035](https://insights.sbomify.com/MAL-2026-6035/): Malicious code in @mastra/s3vectors (npm) (malicious package) - [MAL-2026-6034](https://insights.sbomify.com/MAL-2026-6034/): Malicious code in @mastra/qdrant (npm) (malicious package) - [MAL-2026-6033](https://insights.sbomify.com/MAL-2026-6033/): Malicious code in @mastra/playground-ui (npm) (malicious package) - [MAL-2026-6032](https://insights.sbomify.com/MAL-2026-6032/): Malicious code in @mastra/pinecone (npm) (malicious package) - [MAL-2026-6031](https://insights.sbomify.com/MAL-2026-6031/): Malicious code in @mastra/otel-exporter (npm) (malicious package) - [MAL-2026-6030](https://insights.sbomify.com/MAL-2026-6030/): Malicious code in @mastra/nestjs (npm) (malicious package) - [MAL-2026-603](https://insights.sbomify.com/MAL-2026-603/): Malicious code in mcp-pdftool-plus (PyPI) (malicious package) - [MAL-2026-6029](https://insights.sbomify.com/MAL-2026-6029/): Malicious code in @mastra/mssql (npm) (malicious package) - [MAL-2026-6028](https://insights.sbomify.com/MAL-2026-6028/): Malicious code in @mastra/memory (npm) (malicious package) - [MAL-2026-6027](https://insights.sbomify.com/MAL-2026-6027/): Malicious code in @mastra/mcp-registry-registry (npm) (malicious package) - [MAL-2026-6026](https://insights.sbomify.com/MAL-2026-6026/): Malicious code in @mastra/longmemeval (npm) (malicious package) - [MAL-2026-6025](https://insights.sbomify.com/MAL-2026-6025/): Malicious code in @mastra/koa (npm) (malicious package) - [MAL-2026-6024](https://insights.sbomify.com/MAL-2026-6024/): Malicious code in @mastra/google-cloud-pubsub (npm) (malicious package) - [MAL-2026-6023](https://insights.sbomify.com/MAL-2026-6023/): Malicious code in @mastra/gcs (npm) (malicious package) - [MAL-2026-6022](https://insights.sbomify.com/MAL-2026-6022/): Malicious code in @mastra/express (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/53/