# Vulnerabilities published in 2026 - [MAL-2026-5752](https://insights.sbomify.com/MAL-2026-5752/): Malicious code in patientdocuments (npm) (malicious package) - [MAL-2026-5751](https://insights.sbomify.com/MAL-2026-5751/): Malicious code in oh-my-ashclaw (npm) (malicious package) - [MAL-2026-5750](https://insights.sbomify.com/MAL-2026-5750/): Malicious code in mailconfirmer (npm) (malicious package) - [MAL-2026-575](https://insights.sbomify.com/MAL-2026-575/): Malicious code in syntax-jsx (npm) (malicious package) - [MAL-2026-5749](https://insights.sbomify.com/MAL-2026-5749/): Malicious code in easy-time666 (npm) (malicious package) - [MAL-2026-5748](https://insights.sbomify.com/MAL-2026-5748/): Malicious code in chai-utils-test (npm) (malicious package) - [MAL-2026-5747](https://insights.sbomify.com/MAL-2026-5747/): Malicious code in @giftyhq/widget-components (npm) (malicious package) - [MAL-2026-5746](https://insights.sbomify.com/MAL-2026-5746/): Malicious code in xy-shared (npm) (malicious package) - [MAL-2026-5745](https://insights.sbomify.com/MAL-2026-5745/): Malicious code in oa-crm-webapi (npm) (malicious package) - [MAL-2026-5744](https://insights.sbomify.com/MAL-2026-5744/): Malicious code in loadninja-shared (npm) (malicious package) - [MAL-2026-5743](https://insights.sbomify.com/MAL-2026-5743/): Malicious code in environment-gate (npm) (malicious package) - [MAL-2026-5742](https://insights.sbomify.com/MAL-2026-5742/): Malicious code in axl-ui (npm) (malicious package) - [MAL-2026-5741](https://insights.sbomify.com/MAL-2026-5741/): Malicious code in @achuthvp/postinstall-poc (npm) (malicious package) - [MAL-2026-5740](https://insights.sbomify.com/MAL-2026-5740/): Malicious code in 2fa-exe (npm) (malicious package) - [MAL-2026-574](https://insights.sbomify.com/MAL-2026-574/): Malicious code in syntax-flow (npm) (malicious package) - [MAL-2026-5739](https://insights.sbomify.com/MAL-2026-5739/): Malicious code in sheratan_haha (npm) (malicious package) - [MAL-2026-5738](https://insights.sbomify.com/MAL-2026-5738/): Malicious code in postinstall-logger-7x9z (npm) (malicious package) - [MAL-2026-5737](https://insights.sbomify.com/MAL-2026-5737/): Malicious code in postcss-minify-selector-parser (npm) (malicious package) - [MAL-2026-5736](https://insights.sbomify.com/MAL-2026-5736/): Malicious code in node-stack-frames (npm) (malicious package) - [MAL-2026-5735](https://insights.sbomify.com/MAL-2026-5735/): Malicious code in node-multi-downloader (npm) (malicious package) - [MAL-2026-5734](https://insights.sbomify.com/MAL-2026-5734/): Malicious code in node-denv (npm) (malicious package) - [MAL-2026-5733](https://insights.sbomify.com/MAL-2026-5733/): Malicious code in node-app-doctor (npm) (malicious package) - [MAL-2026-5732](https://insights.sbomify.com/MAL-2026-5732/): Malicious code in houzidawang808 (npm) (malicious package) - [MAL-2026-5731](https://insights.sbomify.com/MAL-2026-5731/): Malicious code in houzidawang807 (npm) (malicious package) - [MAL-2026-5730](https://insights.sbomify.com/MAL-2026-5730/): Malicious code in class-synth (npm) (malicious package) - [MAL-2026-573](https://insights.sbomify.com/MAL-2026-573/): Malicious code in primebeem-db (npm) (malicious package) - [MAL-2026-5729](https://insights.sbomify.com/MAL-2026-5729/): Malicious code in houzidawang806 (npm) (malicious package) - [MAL-2026-5728](https://insights.sbomify.com/MAL-2026-5728/): Malicious code in vite-config-react (npm) (malicious package) - [MAL-2026-5727](https://insights.sbomify.com/MAL-2026-5727/): Malicious code in vite-config-optimizer (npm) (malicious package) - [MAL-2026-5726](https://insights.sbomify.com/MAL-2026-5726/): Malicious code in ecto_module (npm) (malicious package) - [MAL-2026-5725](https://insights.sbomify.com/MAL-2026-5725/): Malicious code in dash-grid-normalizer (PyPI) (malicious package) - [MAL-2026-5724](https://insights.sbomify.com/MAL-2026-5724/): Malicious code in warp-dependency (npm) (malicious package) - [MAL-2026-5723](https://insights.sbomify.com/MAL-2026-5723/): Malicious code in @ci-lifecycle-test/postinstall-ping (npm) (malicious package) - [MAL-2026-5722](https://insights.sbomify.com/MAL-2026-5722/): Malicious code in textwrap-toolkit-stager (PyPI) (malicious package) - [MAL-2026-5721](https://insights.sbomify.com/MAL-2026-5721/): Malicious code in ect-839201-ctf (npm) (malicious package) - [MAL-2026-5720](https://insights.sbomify.com/MAL-2026-5720/): Malicious code in ect-839201 (npm) (malicious package) - [MAL-2026-572](https://insights.sbomify.com/MAL-2026-572/): Malicious code in pino-debugger (npm) (malicious package) - [MAL-2026-5719](https://insights.sbomify.com/MAL-2026-5719/): Malicious code in ect-654321 (npm) (malicious package) - [MAL-2026-5718](https://insights.sbomify.com/MAL-2026-5718/): Malicious code in ect-472839-ctf (npm) (malicious package) - [MAL-2026-5717](https://insights.sbomify.com/MAL-2026-5717/): Malicious code in claudechor (npm) (malicious package) - [MAL-2026-5716](https://insights.sbomify.com/MAL-2026-5716/): Malicious code in beamz (npm) (malicious package) - [MAL-2026-5715](https://insights.sbomify.com/MAL-2026-5715/): Malicious code in workflow-postgres-setup (npm) (malicious package) - [MAL-2026-5714](https://insights.sbomify.com/MAL-2026-5714/): Malicious code in vite-plugin-logo (npm) (malicious package) - [MAL-2026-5713](https://insights.sbomify.com/MAL-2026-5713/): Malicious code in vite-plugin-compress-js (npm) (malicious package) - [MAL-2026-5712](https://insights.sbomify.com/MAL-2026-5712/): Malicious code in jextic-eclib (npm) (malicious package) - [MAL-2026-5711](https://insights.sbomify.com/MAL-2026-5711/): Malicious code in chalk-pro (npm) (malicious package) - [MAL-2026-5710](https://insights.sbomify.com/MAL-2026-5710/): Malicious code in chalk-plus-ts (npm) (malicious package) - [MAL-2026-571](https://insights.sbomify.com/MAL-2026-571/): Malicious code in okijuh (npm) (malicious package) - [MAL-2026-5709](https://insights.sbomify.com/MAL-2026-5709/): Malicious code in chalk-plus-js (npm) (malicious package) - [MAL-2026-5708](https://insights.sbomify.com/MAL-2026-5708/): Malicious code in vite-svgr (npm) (malicious package) - [MAL-2026-5707](https://insights.sbomify.com/MAL-2026-5707/): Malicious code in ttspc-server-sample (npm) (malicious package) - [MAL-2026-5706](https://insights.sbomify.com/MAL-2026-5706/): Malicious code in theta-kit (npm) (malicious package) - [MAL-2026-5705](https://insights.sbomify.com/MAL-2026-5705/): Malicious code in theta-connector (npm) (malicious package) - [MAL-2026-5704](https://insights.sbomify.com/MAL-2026-5704/): Malicious code in friendly-greeter-demo (npm) (malicious package) - [MAL-2026-5703](https://insights.sbomify.com/MAL-2026-5703/): Malicious code in eslint-plugin-mistica-local-rules (npm) (malicious package) - [MAL-2026-5702](https://insights.sbomify.com/MAL-2026-5702/): Malicious code in flexitest (PyPI) (malicious package) - [MAL-2026-5701](https://insights.sbomify.com/MAL-2026-5701/): Malicious code in vite-react-toolkit (npm) (malicious package) - [MAL-2026-5700](https://insights.sbomify.com/MAL-2026-5700/): Malicious code in transportator (npm) (malicious package) - [MAL-2026-570](https://insights.sbomify.com/MAL-2026-570/): Malicious code in lyatly-utils (npm) (malicious package) - [MAL-2026-57](https://insights.sbomify.com/MAL-2026-57/): Malicious code in react-transition-group-legacy (npm) (malicious package) - [MAL-2026-5699](https://insights.sbomify.com/MAL-2026-5699/): Malicious code in chai-web3-testkit (npm) (malicious package) - [MAL-2026-5698](https://insights.sbomify.com/MAL-2026-5698/): Malicious code in nagios-xi (PyPI) (malicious package) - [MAL-2026-5697](https://insights.sbomify.com/MAL-2026-5697/): Malicious code in web-model-bridge (npm) (malicious package) - [MAL-2026-5696](https://insights.sbomify.com/MAL-2026-5696/): Malicious code in voyager-web (npm) (malicious package) - [MAL-2026-5695](https://insights.sbomify.com/MAL-2026-5695/): Malicious code in internallib_v984 (npm) (malicious package) - [MAL-2026-5694](https://insights.sbomify.com/MAL-2026-5694/): Malicious code in internallib_v856 (npm) (malicious package) - [MAL-2026-5693](https://insights.sbomify.com/MAL-2026-5693/): Malicious code in sea-bound-siren (npm) (malicious package) - [MAL-2026-5692](https://insights.sbomify.com/MAL-2026-5692/): Malicious code in ecto-win-flag-q2m7 (npm) (malicious package) - [MAL-2026-5691](https://insights.sbomify.com/MAL-2026-5691/): Malicious code in ecto-spirit-win-k4n8 (npm) (malicious package) - [MAL-2026-5690](https://insights.sbomify.com/MAL-2026-5690/): Malicious code in ecto-spectral-leak-8d4e2 (npm) (malicious package) - [MAL-2026-569](https://insights.sbomify.com/MAL-2026-569/): Malicious code in ern-picking2-api (npm) (malicious package) - [MAL-2026-5689](https://insights.sbomify.com/MAL-2026-5689/): Malicious code in ecto-rust-read-f3a9c1 (npm) (malicious package) - [MAL-2026-5688](https://insights.sbomify.com/MAL-2026-5688/): Malicious code in ecto-nightly-spirit (npm) (malicious package) - [MAL-2026-5687](https://insights.sbomify.com/MAL-2026-5687/): Malicious code in ecto-flag-read-m7p2 (npm) (malicious package) - [MAL-2026-5686](https://insights.sbomify.com/MAL-2026-5686/): Malicious code in ecto-corsair-flag-x9m4 (npm) (malicious package) - [MAL-2026-5685](https://insights.sbomify.com/MAL-2026-5685/): Malicious code in @malwguy/ecto-corsair-whisper-3d2a7c (npm) (malicious package) - [MAL-2026-5684](https://insights.sbomify.com/MAL-2026-5684/): Malicious code in jec (PyPI) (malicious package) - [MAL-2026-5683](https://insights.sbomify.com/MAL-2026-5683/): Malicious code in trongapy (PyPI) (malicious package) - [MAL-2026-5682](https://insights.sbomify.com/MAL-2026-5682/): Malicious code in coral-wraith (npm) (malicious package) - [MAL-2026-5681](https://insights.sbomify.com/MAL-2026-5681/): Malicious code in trongap (PyPI) (malicious package) - [MAL-2026-5680](https://insights.sbomify.com/MAL-2026-5680/): Malicious code in bittensor-burn-message (PyPI) (malicious package) - [MAL-2026-568](https://insights.sbomify.com/MAL-2026-568/): Malicious code in equimper (npm) (malicious package) - [MAL-2026-5679](https://insights.sbomify.com/MAL-2026-5679/): Malicious code in pylogxo (PyPI) (malicious package) - [MAL-2026-5678](https://insights.sbomify.com/MAL-2026-5678/): Malicious code in internallib_v557 (npm) (malicious package) - [MAL-2026-5677](https://insights.sbomify.com/MAL-2026-5677/): Malicious code in worker-build (npm) (malicious package) - [MAL-2026-5676](https://insights.sbomify.com/MAL-2026-5676/): Malicious code in ioredis-typed (npm) (malicious package) - [MAL-2026-5675](https://insights.sbomify.com/MAL-2026-5675/): Malicious code in ioredis-orm (npm) (malicious package) - [MAL-2026-5674](https://insights.sbomify.com/MAL-2026-5674/): Malicious code in @johntaohunter/forge-jsx (npm) (malicious package) - [MAL-2026-5673](https://insights.sbomify.com/MAL-2026-5673/): Malicious code in zatzdbai (npm) (malicious package) - [MAL-2026-5672](https://insights.sbomify.com/MAL-2026-5672/): Malicious code in vqlxjmpr (npm) (malicious package) - [MAL-2026-5671](https://insights.sbomify.com/MAL-2026-5671/): Malicious code in sitecore-mm-component-style (npm) (malicious package) - [MAL-2026-5670](https://insights.sbomify.com/MAL-2026-5670/): Malicious code in pui-diagnostics (npm) (malicious package) - [MAL-2026-567](https://insights.sbomify.com/MAL-2026-567/): Malicious code in debug-glitz (npm) (malicious package) - [MAL-2026-5669](https://insights.sbomify.com/MAL-2026-5669/): Malicious code in mm-ts-utils-client (npm) (malicious package) - [MAL-2026-5668](https://insights.sbomify.com/MAL-2026-5668/): Malicious code in fed-callnative (npm) (malicious package) - [MAL-2026-5667](https://insights.sbomify.com/MAL-2026-5667/): Malicious code in experian-analytics-components (npm) (malicious package) - [MAL-2026-5666](https://insights.sbomify.com/MAL-2026-5666/): Malicious code in downlynpm (npm) (malicious package) - [MAL-2026-5665](https://insights.sbomify.com/MAL-2026-5665/): Malicious code in @visma-net-platform/module-navigator (npm) (malicious package) - [MAL-2026-5664](https://insights.sbomify.com/MAL-2026-5664/): Malicious code in @tribe-digital/shopify-starter-theme (npm) (malicious package) - [MAL-2026-5663](https://insights.sbomify.com/MAL-2026-5663/): Malicious code in @tenforce/toolbox-fontmap (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/57/