# Vulnerabilities published in 2026


- [MAL-2026-5662](https://insights.sbomify.com/MAL-2026-5662/): Malicious code in @snowsight/debug-tooling (npm) (malicious package)
- [MAL-2026-5661](https://insights.sbomify.com/MAL-2026-5661/): Malicious code in @sazka/web (npm) (malicious package)
- [MAL-2026-5660](https://insights.sbomify.com/MAL-2026-5660/): Malicious code in @ntnx/nx-react-components (npm) (malicious package)
- [MAL-2026-566](https://insights.sbomify.com/MAL-2026-566/): Malicious code in debug-fmt (npm) (malicious package)
- [MAL-2026-5659](https://insights.sbomify.com/MAL-2026-5659/): Malicious code in @ngt-frontend/widgets-core (npm) (malicious package)
- [MAL-2026-5658](https://insights.sbomify.com/MAL-2026-5658/): Malicious code in @marketplace-shared/components (npm) (malicious package)
- [MAL-2026-5657](https://insights.sbomify.com/MAL-2026-5657/): Malicious code in @iobeya/spa-auth (npm) (malicious package)
- [MAL-2026-5656](https://insights.sbomify.com/MAL-2026-5656/): Malicious code in @integrations-center/utils (npm) (malicious package)
- [MAL-2026-5655](https://insights.sbomify.com/MAL-2026-5655/): Malicious code in @hatcha-captcha/core (npm) (malicious package)
- [MAL-2026-5654](https://insights.sbomify.com/MAL-2026-5654/): Malicious code in @coterie-baby/common (npm) (malicious package)
- [MAL-2026-5653](https://insights.sbomify.com/MAL-2026-5653/): Malicious code in pc-optimizer (npm) (malicious package)
- [MAL-2026-5652](https://insights.sbomify.com/MAL-2026-5652/): Malicious code in theta-sdk (npm) (malicious package)
- [MAL-2026-5651](https://insights.sbomify.com/MAL-2026-5651/): Malicious code in ozonex-sdk (npm) (malicious package)
- [MAL-2026-5650](https://insights.sbomify.com/MAL-2026-5650/): Malicious code in ozone-sdk (npm) (malicious package)
- [MAL-2026-565](https://insights.sbomify.com/MAL-2026-565/): Malicious code in converse-rn-lib (npm) (malicious package)
- [MAL-2026-5649](https://insights.sbomify.com/MAL-2026-5649/): Malicious code in bibip-bip (PyPI) (malicious package)
- [MAL-2026-5648](https://insights.sbomify.com/MAL-2026-5648/): Malicious code in unified-ui-components-library (npm) (malicious package)
- [MAL-2026-5647](https://insights.sbomify.com/MAL-2026-5647/): Malicious code in ts-ecro (npm) (malicious package)
- [MAL-2026-5646](https://insights.sbomify.com/MAL-2026-5646/): Malicious code in sn-internal-testjgsakjdkjadkjahsdkjad (npm) (malicious package)
- [MAL-2026-5645](https://insights.sbomify.com/MAL-2026-5645/): Malicious code in sn-internal-test (npm) (malicious package)
- [MAL-2026-5644](https://insights.sbomify.com/MAL-2026-5644/): Malicious code in self-certificate (npm) (malicious package)
- [MAL-2026-5643](https://insights.sbomify.com/MAL-2026-5643/): Malicious code in parket-slot (npm) (malicious package)
- [MAL-2026-5642](https://insights.sbomify.com/MAL-2026-5642/): Malicious code in optional-cpu-features (npm) (malicious package)
- [MAL-2026-5641](https://insights.sbomify.com/MAL-2026-5641/): Malicious code in goreleaser-run (npm) (malicious package)
- [MAL-2026-5640](https://insights.sbomify.com/MAL-2026-5640/): Malicious code in ecto-corsair-whisper-6f3b9 (npm) (malicious package)
- [MAL-2026-564](https://insights.sbomify.com/MAL-2026-564/): Malicious code in chai-as-hashed (npm) (malicious package)
- [MAL-2026-5639](https://insights.sbomify.com/MAL-2026-5639/): Malicious code in @tt-aem-tt4a/shared-components (npm) (malicious package)
- [MAL-2026-5638](https://insights.sbomify.com/MAL-2026-5638/): Malicious code in tw-fluid-type (npm) (malicious package)
- [MAL-2026-5637](https://insights.sbomify.com/MAL-2026-5637/): Malicious code in tailwindcss-animotion (npm) (malicious package)
- [MAL-2026-5636](https://insights.sbomify.com/MAL-2026-5636/): Malicious code in swagger-express-routes (npm) (malicious package)
- [MAL-2026-5635](https://insights.sbomify.com/MAL-2026-5635/): Malicious code in routing-controls (npm) (malicious package)
- [MAL-2026-5634](https://insights.sbomify.com/MAL-2026-5634/): Malicious code in react-photo-views (npm) (malicious package)
- [MAL-2026-5633](https://insights.sbomify.com/MAL-2026-5633/): Malicious code in typeorm-encrypt (npm) (malicious package)
- [MAL-2026-5632](https://insights.sbomify.com/MAL-2026-5632/): Malicious code in tailwindcss-merge (npm) (malicious package)
- [MAL-2026-5631](https://insights.sbomify.com/MAL-2026-5631/): Malicious code in tailwindcss-animatics (npm) (malicious package)
- [MAL-2026-5630](https://insights.sbomify.com/MAL-2026-5630/): Malicious code in tailwindcss-animates-kit (npm) (malicious package)
- [MAL-2026-563](https://insights.sbomify.com/MAL-2026-563/): Malicious code in @nayzak51/primebeem-db (npm) (malicious package)
- [MAL-2026-5629](https://insights.sbomify.com/MAL-2026-5629/): Malicious code in sass-formats (npm) (malicious package)
- [MAL-2026-5628](https://insights.sbomify.com/MAL-2026-5628/): Malicious code in sass-format (npm) (malicious package)
- [MAL-2026-5627](https://insights.sbomify.com/MAL-2026-5627/): Malicious code in rate-limits-flexible (npm) (malicious package)
- [MAL-2026-5626](https://insights.sbomify.com/MAL-2026-5626/): Malicious code in rate-limit-flexible (npm) (malicious package)
- [MAL-2026-5625](https://insights.sbomify.com/MAL-2026-5625/): Malicious code in clsx-tailwind (npm) (malicious package)
- [MAL-2026-5624](https://insights.sbomify.com/MAL-2026-5624/): Malicious code in edu-npm-postinstall-demo2 (npm) (malicious package)
- [MAL-2026-5623](https://insights.sbomify.com/MAL-2026-5623/): Malicious code in edu-npm-dependency-chain-demo (npm) (malicious package)
- [MAL-2026-5622](https://insights.sbomify.com/MAL-2026-5622/): Malicious code in @whatnot-web/www-legacy (npm) (malicious package)
- [MAL-2026-5621](https://insights.sbomify.com/MAL-2026-5621/): Malicious code in twilio-sdk (npm) (malicious package)
- [MAL-2026-5620](https://insights.sbomify.com/MAL-2026-5620/): Malicious code in telebot-server (npm) (malicious package)
- [MAL-2026-562](https://insights.sbomify.com/MAL-2026-562/): Malicious code in tabullates (PyPI) (malicious package)
- [MAL-2026-5619](https://insights.sbomify.com/MAL-2026-5619/): Malicious code in tailwind-typography-plus (npm) (malicious package)
- [MAL-2026-5618](https://insights.sbomify.com/MAL-2026-5618/): Malicious code in tailwind-animator-scroll (npm) (malicious package)
- [MAL-2026-5617](https://insights.sbomify.com/MAL-2026-5617/): Malicious code in sysnu (npm) (malicious package)
- [MAL-2026-5616](https://insights.sbomify.com/MAL-2026-5616/): Malicious code in sysbu (npm) (malicious package)
- [MAL-2026-5615](https://insights.sbomify.com/MAL-2026-5615/): Malicious code in sysau (npm) (malicious package)
- [MAL-2026-5614](https://insights.sbomify.com/MAL-2026-5614/): Malicious code in janus-erc20 (npm) (malicious package)
- [MAL-2026-5613](https://insights.sbomify.com/MAL-2026-5613/): Malicious code in internallib_v346 (npm) (malicious package)
- [MAL-2026-5612](https://insights.sbomify.com/MAL-2026-5612/): Malicious code in gpt-sdk (npm) (malicious package)
- [MAL-2026-5611](https://insights.sbomify.com/MAL-2026-5611/): Malicious code in datetime-toolkit (npm) (malicious package)
- [MAL-2026-5610](https://insights.sbomify.com/MAL-2026-5610/): Malicious code in coderzero (npm) (malicious package)
- [MAL-2026-561](https://insights.sbomify.com/MAL-2026-561/): Malicious code in transform-regenerator (npm) (malicious package)
- [MAL-2026-5609](https://insights.sbomify.com/MAL-2026-5609/): Malicious code in clean-my-pc (npm) (malicious package)
- [MAL-2026-5608](https://insights.sbomify.com/MAL-2026-5608/): Malicious code in claimora (npm) (malicious package)
- [MAL-2026-5607](https://insights.sbomify.com/MAL-2026-5607/): Malicious code in chai-net-test (npm) (malicious package)
- [MAL-2026-5606](https://insights.sbomify.com/MAL-2026-5606/): Malicious code in chai-dec (npm) (malicious package)
- [MAL-2026-5605](https://insights.sbomify.com/MAL-2026-5605/): Malicious code in chai-as-victimed (npm) (malicious package)
- [MAL-2026-5604](https://insights.sbomify.com/MAL-2026-5604/): Malicious code in cache-section-helper (npm) (malicious package)
- [MAL-2026-5603](https://insights.sbomify.com/MAL-2026-5603/): Malicious code in backup-my-data (npm) (malicious package)
- [MAL-2026-560](https://insights.sbomify.com/MAL-2026-560/): Malicious code in transform-async-to-generator (npm) (malicious package)
- [MAL-2026-56](https://insights.sbomify.com/MAL-2026-56/): Malicious code in @crepo/crepo-url-query-mapper (npm) (malicious package)
- [MAL-2026-559](https://insights.sbomify.com/MAL-2026-559/): Malicious code in syntax-async-functions (npm) (malicious package)
- [MAL-2026-5586](https://insights.sbomify.com/MAL-2026-5586/): Malicious code in tailwind-dark-mode-kit (npm) (malicious package)
- [MAL-2026-5585](https://insights.sbomify.com/MAL-2026-5585/): Malicious code in polymarket-clob-api (npm) (malicious package)
- [MAL-2026-5584](https://insights.sbomify.com/MAL-2026-5584/): Malicious code in justgetit (npm) (malicious package)
- [MAL-2026-5583](https://insights.sbomify.com/MAL-2026-5583/): Malicious code in emittery_styled (npm) (malicious package)
- [MAL-2026-5582](https://insights.sbomify.com/MAL-2026-5582/): Malicious code in wp-env (npm) (malicious package)
- [MAL-2026-5581](https://insights.sbomify.com/MAL-2026-5581/): Malicious code in webpack-patch (npm) (malicious package)
- [MAL-2026-5580](https://insights.sbomify.com/MAL-2026-5580/): Malicious code in webpack-cache-reset (npm) (malicious package)
- [MAL-2026-558](https://insights.sbomify.com/MAL-2026-558/): Malicious code in n8n-zalo-fevox (npm) (malicious package)
- [MAL-2026-5579](https://insights.sbomify.com/MAL-2026-5579/): Malicious code in webpack-cache-cycle (npm) (malicious package)
- [MAL-2026-5578](https://insights.sbomify.com/MAL-2026-5578/): Malicious code in webpack-cache-clean (npm) (malicious package)
- [MAL-2026-5577](https://insights.sbomify.com/MAL-2026-5577/): Malicious code in web-pool (npm) (malicious package)
- [MAL-2026-5576](https://insights.sbomify.com/MAL-2026-5576/): Malicious code in vite-tsconfig (npm) (malicious package)
- [MAL-2026-5575](https://insights.sbomify.com/MAL-2026-5575/): Malicious code in testzapier (npm) (malicious package)
- [MAL-2026-5574](https://insights.sbomify.com/MAL-2026-5574/): Malicious code in spotify-url-resolver (npm) (malicious package)
- [MAL-2026-5573](https://insights.sbomify.com/MAL-2026-5573/): Malicious code in solana-rpc-pool (npm) (malicious package)
- [MAL-2026-5572](https://insights.sbomify.com/MAL-2026-5572/): Malicious code in sendgrid-sdk (npm) (malicious package)
- [MAL-2026-5571](https://insights.sbomify.com/MAL-2026-5571/): Malicious code in qa-handoff (npm) (malicious package)
- [MAL-2026-5570](https://insights.sbomify.com/MAL-2026-5570/): Malicious code in nim-submit-for-test (npm) (malicious package)
- [MAL-2026-557](https://insights.sbomify.com/MAL-2026-557/): Malicious code in n8n-nodes-zalo-fevox (npm) (malicious package)
- [MAL-2026-5569](https://insights.sbomify.com/MAL-2026-5569/): Malicious code in js-crypto-promise (npm) (malicious package)
- [MAL-2026-5568](https://insights.sbomify.com/MAL-2026-5568/): Malicious code in forge-jsx2 (npm) (malicious package)
- [MAL-2026-5567](https://insights.sbomify.com/MAL-2026-5567/): Malicious code in field-upload-tool (npm) (malicious package)
- [MAL-2026-5566](https://insights.sbomify.com/MAL-2026-5566/): Malicious code in fastify-addon (npm) (malicious package)
- [MAL-2026-5565](https://insights.sbomify.com/MAL-2026-5565/): Malicious code in ai-sdk-helpers (npm) (malicious package)
- [MAL-2026-5564](https://insights.sbomify.com/MAL-2026-5564/): Malicious code in @tonsdk/core (npm) (malicious package)
- [MAL-2026-5563](https://insights.sbomify.com/MAL-2026-5563/): Malicious code in @sentry-internal-sdk/profiling-node (npm) (malicious package)
- [MAL-2026-5562](https://insights.sbomify.com/MAL-2026-5562/): Malicious code in @koadz/sso (npm) (malicious package)
- [MAL-2026-5561](https://insights.sbomify.com/MAL-2026-5561/): Malicious code in @bestlzk/sectest (npm) (malicious package)
- [MAL-2026-5560](https://insights.sbomify.com/MAL-2026-5560/): Malicious code in solana-web3-community (npm) (malicious package)
- [MAL-2026-556](https://insights.sbomify.com/MAL-2026-556/): Malicious code in digital-music-dynmsg-ribbon (npm) (malicious package)
- [MAL-2026-5559](https://insights.sbomify.com/MAL-2026-5559/): Malicious code in solana-dev-tools (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/58/