# Vulnerabilities published in 2026 - [MAL-2026-5932](https://insights.sbomify.com/MAL-2026-5932/): Malicious code in package-uploader (npm) (malicious package) - [MAL-2026-5931](https://insights.sbomify.com/MAL-2026-5931/): Malicious code in mci-sdk (npm) (malicious package) - [MAL-2026-5930](https://insights.sbomify.com/MAL-2026-5930/): Malicious code in bubblestr (npm) (malicious package) - [MAL-2026-593](https://insights.sbomify.com/MAL-2026-593/): Malicious code in pypi-package-explore (PyPI) (malicious package) - [MAL-2026-5929](https://insights.sbomify.com/MAL-2026-5929/): Malicious code in backoffice-charges-module (npm) (malicious package) - [MAL-2026-5928](https://insights.sbomify.com/MAL-2026-5928/): Malicious code in chai-test-mocks (npm) (malicious package) - [MAL-2026-5927](https://insights.sbomify.com/MAL-2026-5927/): Malicious code in aillmgen (npm) (malicious package) - [MAL-2026-5926](https://insights.sbomify.com/MAL-2026-5926/): Malicious code in test-copppss (npm) (malicious package) - [MAL-2026-5925](https://insights.sbomify.com/MAL-2026-5925/): Malicious code in motion-lib (npm) (malicious package) - [MAL-2026-5924](https://insights.sbomify.com/MAL-2026-5924/): Malicious code in binproto (npm) (malicious package) - [MAL-2026-5923](https://insights.sbomify.com/MAL-2026-5923/): Malicious code in @welcome-onboarding-web/mobile-focus-account-beta-merging (npm) (malicious package) - [MAL-2026-5922](https://insights.sbomify.com/MAL-2026-5922/): Malicious code in @kalipto/local (npm) (malicious package) - [MAL-2026-5921](https://insights.sbomify.com/MAL-2026-5921/): Malicious code in proto-bin (npm) (malicious package) - [MAL-2026-5920](https://insights.sbomify.com/MAL-2026-5920/): Malicious code in pretie_x2 (npm) (malicious package) - [MAL-2026-592](https://insights.sbomify.com/MAL-2026-592/): Malicious code in lvldragdrop (npm) (malicious package) - [MAL-2026-5919](https://insights.sbomify.com/MAL-2026-5919/): Malicious code in pretie_x1 (npm) (malicious package) - [MAL-2026-5918](https://insights.sbomify.com/MAL-2026-5918/): Malicious code in nottuff7 (npm) (malicious package) - [MAL-2026-5917](https://insights.sbomify.com/MAL-2026-5917/): Malicious code in nottuff4 (npm) (malicious package) - [MAL-2026-5916](https://insights.sbomify.com/MAL-2026-5916/): Malicious code in nottuff25 (npm) (malicious package) - [MAL-2026-5915](https://insights.sbomify.com/MAL-2026-5915/): Malicious code in nottuff23 (npm) (malicious package) - [MAL-2026-5914](https://insights.sbomify.com/MAL-2026-5914/): Malicious code in nottuff15 (npm) (malicious package) - [MAL-2026-5913](https://insights.sbomify.com/MAL-2026-5913/): Malicious code in mastraqqq (npm) (malicious package) - [MAL-2026-5912](https://insights.sbomify.com/MAL-2026-5912/): Malicious code in js-digest (npm) (malicious package) - [MAL-2026-5911](https://insights.sbomify.com/MAL-2026-5911/): Malicious code in utils-common-helpers (npm) (malicious package) - [MAL-2026-5910](https://insights.sbomify.com/MAL-2026-5910/): Malicious code in uidai_reusable_components (npm) (malicious package) - [MAL-2026-591](https://insights.sbomify.com/MAL-2026-591/): Malicious code in kol7a (npm) (malicious package) - [MAL-2026-5909](https://insights.sbomify.com/MAL-2026-5909/): Malicious code in react-hook-use-debounce-throttle-12 (npm) (malicious package) - [MAL-2026-5908](https://insights.sbomify.com/MAL-2026-5908/): Malicious code in chain-chai-test (npm) (malicious package) - [MAL-2026-5907](https://insights.sbomify.com/MAL-2026-5907/): Malicious code in chai-solidity-testkit (npm) (malicious package) - [MAL-2026-5906](https://insights.sbomify.com/MAL-2026-5906/): Malicious code in chai-plugin-kit (npm) (malicious package) - [MAL-2026-5905](https://insights.sbomify.com/MAL-2026-5905/): Malicious code in chai-plugin-helper (npm) (malicious package) - [MAL-2026-5904](https://insights.sbomify.com/MAL-2026-5904/): Malicious code in chai-plugin (npm) (malicious package) - [MAL-2026-5903](https://insights.sbomify.com/MAL-2026-5903/): Malicious code in chai-guid (npm) (malicious package) - [MAL-2026-5902](https://insights.sbomify.com/MAL-2026-5902/): Malicious code in chai-as-tokenized (npm) (malicious package) - [MAL-2026-5901](https://insights.sbomify.com/MAL-2026-5901/): Malicious code in chai-as-polished (npm) (malicious package) - [MAL-2026-5900](https://insights.sbomify.com/MAL-2026-5900/): Malicious code in chai-as-decrypted (npm) (malicious package) - [MAL-2026-590](https://insights.sbomify.com/MAL-2026-590/): Malicious code in pytorch-mutex (PyPI) (malicious package) - [MAL-2026-59](https://insights.sbomify.com/MAL-2026-59/): Malicious code in hello-world-npm-demo-example (npm) (malicious package) - [MAL-2026-5899](https://insights.sbomify.com/MAL-2026-5899/): Malicious code in stripe-cli-init-plugin (npm) (malicious package) - [MAL-2026-5898](https://insights.sbomify.com/MAL-2026-5898/): Malicious code in strict-engine-peer (npm) (malicious package) - [MAL-2026-5897](https://insights.sbomify.com/MAL-2026-5897/): Malicious code in noderzero (npm) (malicious package) - [MAL-2026-5896](https://insights.sbomify.com/MAL-2026-5896/): Malicious code in jest-test-plugin-utils (npm) (malicious package) - [MAL-2026-5895](https://insights.sbomify.com/MAL-2026-5895/): Malicious code in easyllmai (npm) (malicious package) - [MAL-2026-5894](https://insights.sbomify.com/MAL-2026-5894/): Malicious code in create-vercel-integration (npm) (malicious package) - [MAL-2026-5893](https://insights.sbomify.com/MAL-2026-5893/): Malicious code in claude-jar (npm) (malicious package) - [MAL-2026-5892](https://insights.sbomify.com/MAL-2026-5892/): Malicious code in caspian-day-js (npm) (malicious package) - [MAL-2026-5891](https://insights.sbomify.com/MAL-2026-5891/): Malicious code in atlassian-forge-skills (npm) (malicious package) - [MAL-2026-5890](https://insights.sbomify.com/MAL-2026-5890/): Malicious code in @dsft/ft-utils (npm) (malicious package) - [MAL-2026-589](https://insights.sbomify.com/MAL-2026-589/): Malicious code in dotenv-embed (npm) (malicious package) - [MAL-2026-5889](https://insights.sbomify.com/MAL-2026-5889/): Malicious code in @dsft/ft-element (npm) (malicious package) - [MAL-2026-5888](https://insights.sbomify.com/MAL-2026-5888/): Malicious code in middleware-jwt (npm) (malicious package) - [MAL-2026-5887](https://insights.sbomify.com/MAL-2026-5887/): Malicious code in conducts (npm) (malicious package) - [MAL-2026-5886](https://insights.sbomify.com/MAL-2026-5886/): Malicious code in @vantuz/sdk-core (npm) (malicious package) - [MAL-2026-5885](https://insights.sbomify.com/MAL-2026-5885/): Malicious code in wordpad-text-ui (npm) (malicious package) - [MAL-2026-5884](https://insights.sbomify.com/MAL-2026-5884/): Malicious code in vortnode (npm) (malicious package) - [MAL-2026-5883](https://insights.sbomify.com/MAL-2026-5883/): Malicious code in redis-xyz (npm) (malicious package) - [MAL-2026-5882](https://insights.sbomify.com/MAL-2026-5882/): Malicious code in redis-type-os (npm) (malicious package) - [MAL-2026-5881](https://insights.sbomify.com/MAL-2026-5881/): Malicious code in obfus-jsxy (npm) (malicious package) - [MAL-2026-5880](https://insights.sbomify.com/MAL-2026-5880/): Malicious code in nat-ulid (npm) (malicious package) - [MAL-2026-588](https://insights.sbomify.com/MAL-2026-588/): Malicious code in chai-sub (npm) (malicious package) - [MAL-2026-5879](https://insights.sbomify.com/MAL-2026-5879/): Malicious code in ioredis-os (npm) (malicious package) - [MAL-2026-5878](https://insights.sbomify.com/MAL-2026-5878/): Malicious code in cache-compat-utils (PyPI) (malicious package) - [MAL-2026-5877](https://insights.sbomify.com/MAL-2026-5877/): Malicious code in check-ulid (npm) (malicious package) - [MAL-2026-5876](https://insights.sbomify.com/MAL-2026-5876/): Malicious code in temp-development-package-test (PyPI) (malicious package) - [MAL-2026-5875](https://insights.sbomify.com/MAL-2026-5875/): Malicious code in myfirstpackagetestaaa (PyPI) (malicious package) - [MAL-2026-5874](https://insights.sbomify.com/MAL-2026-5874/): Malicious code in aaaazzzzaz (PyPI) (malicious package) - [MAL-2026-5873](https://insights.sbomify.com/MAL-2026-5873/): Malicious code in rbac-auth (npm) (malicious package) - [MAL-2026-5872](https://insights.sbomify.com/MAL-2026-5872/): Malicious code in pampipes (npm) (malicious package) - [MAL-2026-5871](https://insights.sbomify.com/MAL-2026-5871/): Malicious code in lucide-next (npm) (malicious package) - [MAL-2026-5870](https://insights.sbomify.com/MAL-2026-5870/): Malicious code in hot-validation-sdk (npm) (malicious package) - [MAL-2026-587](https://insights.sbomify.com/MAL-2026-587/): Malicious code in chai-px (npm) (malicious package) - [MAL-2026-5869](https://insights.sbomify.com/MAL-2026-5869/): Malicious code in fabric-graphics (npm) (malicious package) - [MAL-2026-5868](https://insights.sbomify.com/MAL-2026-5868/): Malicious code in datacamp-light (PyPI) (malicious package) - [MAL-2026-5867](https://insights.sbomify.com/MAL-2026-5867/): Malicious code in terminal-structured-logger (npm) (malicious package) - [MAL-2026-5866](https://insights.sbomify.com/MAL-2026-5866/): Malicious code in terminal-pretty-logger (npm) (malicious package) - [MAL-2026-5865](https://insights.sbomify.com/MAL-2026-5865/): Malicious code in npmjs-doc-builder (npm) (malicious package) - [MAL-2026-5864](https://insights.sbomify.com/MAL-2026-5864/): Malicious code in bign.tsm (npm) (malicious package) - [MAL-2026-5863](https://insights.sbomify.com/MAL-2026-5863/): Malicious code in @ts-internal/shared-lib (npm) (malicious package) - [MAL-2026-5862](https://insights.sbomify.com/MAL-2026-5862/): Malicious code in vitest-pro (npm) (malicious package) - [MAL-2026-5861](https://insights.sbomify.com/MAL-2026-5861/): Malicious code in solana-mev-bot (npm) (malicious package) - [MAL-2026-5860](https://insights.sbomify.com/MAL-2026-5860/): Malicious code in solana-js-client (npm) (malicious package) - [MAL-2026-586](https://insights.sbomify.com/MAL-2026-586/): Malicious code in chai-chains-async (npm) (malicious package) - [MAL-2026-5859](https://insights.sbomify.com/MAL-2026-5859/): Malicious code in setka-editor (npm) (malicious package) - [MAL-2026-5858](https://insights.sbomify.com/MAL-2026-5858/): Malicious code in metrics-pipeline-d8k2 (npm) (malicious package) - [MAL-2026-5857](https://insights.sbomify.com/MAL-2026-5857/): Malicious code in event-metrics-q3x7 (npm) (malicious package) - [MAL-2026-5856](https://insights.sbomify.com/MAL-2026-5856/): Malicious code in carousel-controller-mixin (npm) (malicious package) - [MAL-2026-5855](https://insights.sbomify.com/MAL-2026-5855/): Malicious code in vemos-sdk (npm) (malicious package) - [MAL-2026-5854](https://insights.sbomify.com/MAL-2026-5854/): Malicious code in tailwind-typography-style (npm) (malicious package) - [MAL-2026-5853](https://insights.sbomify.com/MAL-2026-5853/): Malicious code in sp-api-dev-assistant-mcp-server (npm) (malicious package) - [MAL-2026-5852](https://insights.sbomify.com/MAL-2026-5852/): Malicious code in richtext-editor-ui (npm) (malicious package) - [MAL-2026-5851](https://insights.sbomify.com/MAL-2026-5851/): Malicious code in epm-service-module-v2 (npm) (malicious package) - [MAL-2026-5850](https://insights.sbomify.com/MAL-2026-5850/): Malicious code in vite-enhancer-config (npm) (malicious package) - [MAL-2026-585](https://insights.sbomify.com/MAL-2026-585/): Malicious code in chai-async-tests (npm) (malicious package) - [MAL-2026-5849](https://insights.sbomify.com/MAL-2026-5849/): Malicious code in vite-configu-react (npm) (malicious package) - [MAL-2026-5848](https://insights.sbomify.com/MAL-2026-5848/): Malicious code in slow-surf (npm) (malicious package) - [MAL-2026-5847](https://insights.sbomify.com/MAL-2026-5847/): Malicious code in reading-cookies (npm) (malicious package) - [MAL-2026-5846](https://insights.sbomify.com/MAL-2026-5846/): Malicious code in prettier_v2 (npm) (malicious package) - [MAL-2026-5845](https://insights.sbomify.com/MAL-2026-5845/): Malicious code in prettier_v1 (npm) (malicious package) - [MAL-2026-5844](https://insights.sbomify.com/MAL-2026-5844/): Malicious code in numdifftools (npm) (malicious package) - [MAL-2026-5843](https://insights.sbomify.com/MAL-2026-5843/): Malicious code in chai-smart-assert (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/55/