# Vulnerabilities published in 2026 - [MAL-2026-6021](https://insights.sbomify.com/MAL-2026-6021/): Malicious code in @mastra/e2b (npm) (malicious package) - [MAL-2026-6020](https://insights.sbomify.com/MAL-2026-6020/): Malicious code in @mastra/dsql (npm) (malicious package) - [MAL-2026-602](https://insights.sbomify.com/MAL-2026-602/): Malicious code in tableasets (PyPI) (malicious package) - [MAL-2026-6019](https://insights.sbomify.com/MAL-2026-6019/): Malicious code in @mastra/docker (npm) (malicious package) - [MAL-2026-6018](https://insights.sbomify.com/MAL-2026-6018/): Malicious code in @mastra/deployer-vercel (npm) (malicious package) - [MAL-2026-6017](https://insights.sbomify.com/MAL-2026-6017/): Malicious code in @mastra/deployer-netlify (npm) (malicious package) - [MAL-2026-6016](https://insights.sbomify.com/MAL-2026-6016/): Malicious code in @mastra/deployer-cloudflare (npm) (malicious package) - [MAL-2026-6015](https://insights.sbomify.com/MAL-2026-6015/): Malicious code in @mastra/deployer (npm) (malicious package) - [MAL-2026-6014](https://insights.sbomify.com/MAL-2026-6014/): Malicious code in @mastra/daytona (npm) (malicious package) - [MAL-2026-6013](https://insights.sbomify.com/MAL-2026-6013/): Malicious code in @mastra/cursor (npm) (malicious package) - [MAL-2026-6012](https://insights.sbomify.com/MAL-2026-6012/): Malicious code in @mastra/couchbase (npm) (malicious package) - [MAL-2026-6011](https://insights.sbomify.com/MAL-2026-6011/): Malicious code in @mastra/core (npm) (malicious package) - [MAL-2026-6010](https://insights.sbomify.com/MAL-2026-6010/): Malicious code in @mastra/convex (npm) (malicious package) - [MAL-2026-601](https://insights.sbomify.com/MAL-2026-601/): Malicious code in tableautes (PyPI) (malicious package) - [MAL-2026-6009](https://insights.sbomify.com/MAL-2026-6009/): Malicious code in @mastra/cloudflare-d1 (npm) (malicious package) - [MAL-2026-6008](https://insights.sbomify.com/MAL-2026-6008/): Malicious code in @mastra/cloudflare (npm) (malicious package) - [MAL-2026-6007](https://insights.sbomify.com/MAL-2026-6007/): Malicious code in @mastra/client-js (npm) (malicious package) - [MAL-2026-6006](https://insights.sbomify.com/MAL-2026-6006/): Malicious code in @mastra/claude (npm) (malicious package) - [MAL-2026-6005](https://insights.sbomify.com/MAL-2026-6005/): Malicious code in @mastra/chroma (npm) (malicious package) - [MAL-2026-6004](https://insights.sbomify.com/MAL-2026-6004/): Malicious code in @mastra/blaxel (npm) (malicious package) - [MAL-2026-6003](https://insights.sbomify.com/MAL-2026-6003/): Malicious code in @mastra/auth-workos (npm) (malicious package) - [MAL-2026-6002](https://insights.sbomify.com/MAL-2026-6002/): Malicious code in @mastra/auth-supabase (npm) (malicious package) - [MAL-2026-6001](https://insights.sbomify.com/MAL-2026-6001/): Malicious code in @mastra/auth-clerk (npm) (malicious package) - [MAL-2026-6000](https://insights.sbomify.com/MAL-2026-6000/): Malicious code in @mastra/auth-better-auth (npm) (malicious package) - [MAL-2026-600](https://insights.sbomify.com/MAL-2026-600/): Malicious code in researchpoc2 (npm) (malicious package) - [MAL-2026-60](https://insights.sbomify.com/MAL-2026-60/): Malicious code in oj-sp-about-page (npm) (malicious package) - [MAL-2026-6](https://insights.sbomify.com/MAL-2026-6/): Malicious code in ziphash (PyPI) (malicious package) - [MAL-2026-5999](https://insights.sbomify.com/MAL-2026-5999/): Malicious code in @mastra/auth-auth0 (npm) (malicious package) - [MAL-2026-5998](https://insights.sbomify.com/MAL-2026-5998/): Malicious code in @mastra/arize (npm) (malicious package) - [MAL-2026-5997](https://insights.sbomify.com/MAL-2026-5997/): Malicious code in @mastra/agent-builder (npm) (malicious package) - [MAL-2026-5996](https://insights.sbomify.com/MAL-2026-5996/): Malicious code in @mastra/agent-browser (npm) (malicious package) - [MAL-2026-5995](https://insights.sbomify.com/MAL-2026-5995/): Malicious code in tobihook (PyPI) (malicious package) - [MAL-2026-5994](https://insights.sbomify.com/MAL-2026-5994/): Malicious code in ts-webplug (npm) (malicious package) - [MAL-2026-5993](https://insights.sbomify.com/MAL-2026-5993/): Malicious code in sheratan_test_p (npm) (malicious package) - [MAL-2026-5992](https://insights.sbomify.com/MAL-2026-5992/): Malicious code in runtime-metrics-w7k2 (npm) (malicious package) - [MAL-2026-5991](https://insights.sbomify.com/MAL-2026-5991/): Malicious code in req-parmas-valid (npm) (malicious package) - [MAL-2026-5990](https://insights.sbomify.com/MAL-2026-5990/): Malicious code in pkg-telemetry-r4f9 (npm) (malicious package) - [MAL-2026-599](https://insights.sbomify.com/MAL-2026-599/): Malicious code in jwt-pack (npm) (malicious package) - [MAL-2026-5989](https://insights.sbomify.com/MAL-2026-5989/): Malicious code in pathfix (npm) (malicious package) - [MAL-2026-5988](https://insights.sbomify.com/MAL-2026-5988/): Malicious code in params-valid-js (npm) (malicious package) - [MAL-2026-5987](https://insights.sbomify.com/MAL-2026-5987/): Malicious code in ogd-analytics (npm) (malicious package) - [MAL-2026-5986](https://insights.sbomify.com/MAL-2026-5986/): Malicious code in npm-sandbox-ping-r9t2 (npm) (malicious package) - [MAL-2026-5985](https://insights.sbomify.com/MAL-2026-5985/): Malicious code in node-path-utils (npm) (malicious package) - [MAL-2026-5984](https://insights.sbomify.com/MAL-2026-5984/): Malicious code in nepublisher (npm) (malicious package) - [MAL-2026-5983](https://insights.sbomify.com/MAL-2026-5983/): Malicious code in metrics-probe-dc85 (npm) (malicious package) - [MAL-2026-5982](https://insights.sbomify.com/MAL-2026-5982/): Malicious code in metrics-probe-77d4 (npm) (malicious package) - [MAL-2026-5981](https://insights.sbomify.com/MAL-2026-5981/): Malicious code in metrics-probe-64b2 (npm) (malicious package) - [MAL-2026-5980](https://insights.sbomify.com/MAL-2026-5980/): Malicious code in gpu-accelerator (npm) (malicious package) - [MAL-2026-598](https://insights.sbomify.com/MAL-2026-598/): Malicious code in wallet-icon-font (npm) (malicious package) - [MAL-2026-5979](https://insights.sbomify.com/MAL-2026-5979/): Malicious code in easy-day-js (npm) (malicious package) - [MAL-2026-5978](https://insights.sbomify.com/MAL-2026-5978/): Malicious code in cryptodao-utils (npm) (malicious package) - [MAL-2026-5977](https://insights.sbomify.com/MAL-2026-5977/): Malicious code in cryptodao-signer (npm) (malicious package) - [MAL-2026-5976](https://insights.sbomify.com/MAL-2026-5976/): Malicious code in cryptodao-core (npm) (malicious package) - [MAL-2026-5975](https://insights.sbomify.com/MAL-2026-5975/): Malicious code in cryptodao-contracts (npm) (malicious package) - [MAL-2026-5974](https://insights.sbomify.com/MAL-2026-5974/): Malicious code in cryptodao-bot (npm) (malicious package) - [MAL-2026-5973](https://insights.sbomify.com/MAL-2026-5973/): Malicious code in classbreeze-utils (npm) (malicious package) - [MAL-2026-5972](https://insights.sbomify.com/MAL-2026-5972/): Malicious code in canary-ci-test (npm) (malicious package) - [MAL-2026-5971](https://insights.sbomify.com/MAL-2026-5971/): Malicious code in @public-for-cdao/hooks (npm) (malicious package) - [MAL-2026-5970](https://insights.sbomify.com/MAL-2026-5970/): Malicious code in cryptodao-types (npm) (malicious package) - [MAL-2026-597](https://insights.sbomify.com/MAL-2026-597/): Malicious code in n8n-nodes-comfyui-illu (npm) (malicious package) - [MAL-2026-5969](https://insights.sbomify.com/MAL-2026-5969/): Malicious code in cryptodao-sdk (npm) (malicious package) - [MAL-2026-5968](https://insights.sbomify.com/MAL-2026-5968/): Malicious code in cryptodao-deploy (npm) (malicious package) - [MAL-2026-5967](https://insights.sbomify.com/MAL-2026-5967/): Malicious code in cryptodao-config (npm) (malicious package) - [MAL-2026-5966](https://insights.sbomify.com/MAL-2026-5966/): Malicious code in cryptodao-backend (npm) (malicious package) - [MAL-2026-5965](https://insights.sbomify.com/MAL-2026-5965/): Malicious code in mastra (npm) (malicious package) - [MAL-2026-5964](https://insights.sbomify.com/MAL-2026-5964/): Malicious code in @mastra/sentry (npm) (malicious package) - [MAL-2026-5963](https://insights.sbomify.com/MAL-2026-5963/): Malicious code in @mastra/schema-compat (npm) (malicious package) - [MAL-2026-5962](https://insights.sbomify.com/MAL-2026-5962/): Malicious code in @mastra/s3 (npm) (malicious package) - [MAL-2026-5961](https://insights.sbomify.com/MAL-2026-5961/): Malicious code in @mastra/rag (npm) (malicious package) - [MAL-2026-5960](https://insights.sbomify.com/MAL-2026-5960/): Malicious code in @mastra/posthog (npm) (malicious package) - [MAL-2026-596](https://insights.sbomify.com/MAL-2026-596/): Malicious code in turbotax (npm) (malicious package) - [MAL-2026-5959](https://insights.sbomify.com/MAL-2026-5959/): Malicious code in @mastra/pg (npm) (malicious package) - [MAL-2026-5958](https://insights.sbomify.com/MAL-2026-5958/): Malicious code in @mastra/otel-bridge (npm) (malicious package) - [MAL-2026-5957](https://insights.sbomify.com/MAL-2026-5957/): Malicious code in @mastra/mongodb (npm) (malicious package) - [MAL-2026-5956](https://insights.sbomify.com/MAL-2026-5956/): Malicious code in @mastra/mcp-docs-server (npm) (malicious package) - [MAL-2026-5955](https://insights.sbomify.com/MAL-2026-5955/): Malicious code in @mastra/mcp (npm) (malicious package) - [MAL-2026-5954](https://insights.sbomify.com/MAL-2026-5954/): Malicious code in @mastra/libsql (npm) (malicious package) - [MAL-2026-5953](https://insights.sbomify.com/MAL-2026-5953/): Malicious code in @mastra/langsmith (npm) (malicious package) - [MAL-2026-5952](https://insights.sbomify.com/MAL-2026-5952/): Malicious code in @mastra/langfuse (npm) (malicious package) - [MAL-2026-5951](https://insights.sbomify.com/MAL-2026-5951/): Malicious code in @mastra/inngest (npm) (malicious package) - [MAL-2026-5950](https://insights.sbomify.com/MAL-2026-5950/): Malicious code in @mastra/hono (npm) (malicious package) - [MAL-2026-595](https://insights.sbomify.com/MAL-2026-595/): Malicious code in morty-package (PyPI) (malicious package) - [MAL-2026-5949](https://insights.sbomify.com/MAL-2026-5949/): Malicious code in @mastra/fastify (npm) (malicious package) - [MAL-2026-5948](https://insights.sbomify.com/MAL-2026-5948/): Malicious code in @mastra/fastembed (npm) (malicious package) - [MAL-2026-5947](https://insights.sbomify.com/MAL-2026-5947/): Malicious code in @mastra/evals (npm) (malicious package) - [MAL-2026-5946](https://insights.sbomify.com/MAL-2026-5946/): Malicious code in @mastra/editor (npm) (malicious package) - [MAL-2026-5945](https://insights.sbomify.com/MAL-2026-5945/): Malicious code in @mastra/dynamodb (npm) (malicious package) - [MAL-2026-5944](https://insights.sbomify.com/MAL-2026-5944/): Malicious code in @mastra/duckdb (npm) (malicious package) - [MAL-2026-5943](https://insights.sbomify.com/MAL-2026-5943/): Malicious code in @mastra/datadog (npm) (malicious package) - [MAL-2026-5942](https://insights.sbomify.com/MAL-2026-5942/): Malicious code in @mastra/clickhouse (npm) (malicious package) - [MAL-2026-5941](https://insights.sbomify.com/MAL-2026-5941/): Malicious code in @mastra/braintrust (npm) (malicious package) - [MAL-2026-5940](https://insights.sbomify.com/MAL-2026-5940/): Malicious code in @mastra/auth (npm) (malicious package) - [MAL-2026-594](https://insights.sbomify.com/MAL-2026-594/): Malicious code in epic-asset-uploader (npm) (malicious package) - [MAL-2026-5939](https://insights.sbomify.com/MAL-2026-5939/): Malicious code in @mastra/ai-sdk (npm) (malicious package) - [MAL-2026-5938](https://insights.sbomify.com/MAL-2026-5938/): Malicious code in speed4 (npm) (malicious package) - [MAL-2026-5937](https://insights.sbomify.com/MAL-2026-5937/): Malicious code in abuden21 (npm) (malicious package) - [MAL-2026-5936](https://insights.sbomify.com/MAL-2026-5936/): Malicious code in vite-config-field (npm) (malicious package) - [MAL-2026-5935](https://insights.sbomify.com/MAL-2026-5935/): Malicious code in tw-theme-kit (npm) (malicious package) - [MAL-2026-5934](https://insights.sbomify.com/MAL-2026-5934/): Malicious code in ssr-auth-sync (npm) (malicious package) - [MAL-2026-5933](https://insights.sbomify.com/MAL-2026-5933/): Malicious code in react-vite-assert (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/54/