# Vulnerabilities published in 2026


- [MAL-2026-5558](https://insights.sbomify.com/MAL-2026-5558/): Malicious code in sensivity (npm) (malicious package)
- [MAL-2026-5557](https://insights.sbomify.com/MAL-2026-5557/): Malicious code in janus-ft (npm) (malicious package)
- [MAL-2026-5556](https://insights.sbomify.com/MAL-2026-5556/): Malicious code in janus-flow (npm) (malicious package)
- [MAL-2026-5555](https://insights.sbomify.com/MAL-2026-5555/): Malicious code in express-timer (npm) (malicious package)
- [MAL-2026-5554](https://insights.sbomify.com/MAL-2026-5554/): Malicious code in express-self-destruct2 (npm) (malicious package)
- [MAL-2026-5553](https://insights.sbomify.com/MAL-2026-5553/): Malicious code in express-self-destruct (npm) (malicious package)
- [MAL-2026-5552](https://insights.sbomify.com/MAL-2026-5552/): Malicious code in @my_name_is_khn/express-security-tool-v3 (npm) (malicious package)
- [MAL-2026-5551](https://insights.sbomify.com/MAL-2026-5551/): Malicious code in @my_name_is_khn/express-security-tool-v1 (npm) (malicious package)
- [MAL-2026-5550](https://insights.sbomify.com/MAL-2026-5550/): Malicious code in @my_name_is_khn/express-security-tool (npm) (malicious package)
- [MAL-2026-555](https://insights.sbomify.com/MAL-2026-555/): Malicious code in acuitymobileapp (npm) (malicious package)
- [MAL-2026-5549](https://insights.sbomify.com/MAL-2026-5549/): Malicious code in @403name/fsevent (npm) (malicious package)
- [MAL-2026-5548](https://insights.sbomify.com/MAL-2026-5548/): Malicious code in @403name/ether-js (npm) (malicious package)
- [MAL-2026-5547](https://insights.sbomify.com/MAL-2026-5547/): Malicious code in @403name/electron-buidler (npm) (malicious package)
- [MAL-2026-5546](https://insights.sbomify.com/MAL-2026-5546/): Malicious code in @common-stack/generate-plugin (npm) (malicious package)
- [MAL-2026-5545](https://insights.sbomify.com/MAL-2026-5545/): Malicious code in acme-widget-layout-utils (PyPI) (malicious package)
- [MAL-2026-5544](https://insights.sbomify.com/MAL-2026-5544/): Malicious code in pocteszep (npm) (malicious package)
- [MAL-2026-5543](https://insights.sbomify.com/MAL-2026-5543/): Malicious code in jailbreak-code (npm) (malicious package)
- [MAL-2026-5542](https://insights.sbomify.com/MAL-2026-5542/): Malicious code in india-map-react (npm) (malicious package)
- [MAL-2026-5541](https://insights.sbomify.com/MAL-2026-5541/): Malicious code in @w2d/web-components (npm) (malicious package)
- [MAL-2026-5540](https://insights.sbomify.com/MAL-2026-5540/): Malicious code in @monitoring-lib/error-tracking (npm) (malicious package)
- [MAL-2026-554](https://insights.sbomify.com/MAL-2026-554/): Malicious code in braintree-web-latest (npm) (malicious package)
- [MAL-2026-5539](https://insights.sbomify.com/MAL-2026-5539/): Malicious code in mermaid-v11 (npm) (malicious package)
- [MAL-2026-5538](https://insights.sbomify.com/MAL-2026-5538/): Malicious code in hex-type (npm) (malicious package)
- [MAL-2026-5537](https://insights.sbomify.com/MAL-2026-5537/): Malicious code in @entos-ems/xerxes-client-js (npm) (malicious package)
- [MAL-2026-5536](https://insights.sbomify.com/MAL-2026-5536/): Malicious code in zer0onedatetool (npm) (malicious package)
- [MAL-2026-5535](https://insights.sbomify.com/MAL-2026-5535/): Malicious code in zer0onedate (npm) (malicious package)
- [MAL-2026-5534](https://insights.sbomify.com/MAL-2026-5534/): Malicious code in @thomlecter1122/lab-helper-test (npm) (malicious package)
- [MAL-2026-5533](https://insights.sbomify.com/MAL-2026-5533/): Malicious code in @coze-common/chat-area (npm) (malicious package)
- [MAL-2026-5532](https://insights.sbomify.com/MAL-2026-5532/): Malicious code in icinga (PyPI) (malicious package)
- [MAL-2026-5531](https://insights.sbomify.com/MAL-2026-5531/): Malicious code in telegramlite (PyPI) (malicious package)
- [MAL-2026-5530](https://insights.sbomify.com/MAL-2026-5530/): Malicious code in websocket-slot (npm) (malicious package)
- [MAL-2026-553](https://insights.sbomify.com/MAL-2026-553/): Malicious code in @snazah/davey (npm) (malicious package)
- [MAL-2026-5529](https://insights.sbomify.com/MAL-2026-5529/): Malicious code in v018-axios-cdntest (npm) (malicious package)
- [MAL-2026-5528](https://insights.sbomify.com/MAL-2026-5528/): Malicious code in events-runtime (npm) (malicious package)
- [MAL-2026-5527](https://insights.sbomify.com/MAL-2026-5527/): Malicious code in check-error-util (npm) (malicious package)
- [MAL-2026-5526](https://insights.sbomify.com/MAL-2026-5526/): Malicious code in chai-check-error (npm) (malicious package)
- [MAL-2026-5525](https://insights.sbomify.com/MAL-2026-5525/): Malicious code in @solana-labs/web3.js (npm) (malicious package)
- [MAL-2026-5524](https://insights.sbomify.com/MAL-2026-5524/): Malicious code in @orion-design-system/store (npm) (malicious package)
- [MAL-2026-5523](https://insights.sbomify.com/MAL-2026-5523/): Malicious code in @orion-design-system/foundation (npm) (malicious package)
- [MAL-2026-5522](https://insights.sbomify.com/MAL-2026-5522/): Malicious code in @orion-design-system/components (npm) (malicious package)
- [MAL-2026-5521](https://insights.sbomify.com/MAL-2026-5521/): Malicious code in @helpcentre/tesco-help (npm) (malicious package)
- [MAL-2026-5520](https://insights.sbomify.com/MAL-2026-5520/): Malicious code in @access-risk/browser-remedy-react (npm) (malicious package)
- [MAL-2026-552](https://insights.sbomify.com/MAL-2026-552/): Malicious code in json-mapping-web (npm) (malicious package)
- [MAL-2026-5519](https://insights.sbomify.com/MAL-2026-5519/): Malicious code in requests-toolbelt-plus (PyPI) (malicious package)
- [MAL-2026-5518](https://insights.sbomify.com/MAL-2026-5518/): Malicious code in hello-dynamic (PyPI) (malicious package)
- [MAL-2026-5517](https://insights.sbomify.com/MAL-2026-5517/): Malicious code in firefly-utilities-helper (npm) (malicious package)
- [MAL-2026-5516](https://insights.sbomify.com/MAL-2026-5516/): Malicious code in tailwind-animator (npm) (malicious package)
- [MAL-2026-5515](https://insights.sbomify.com/MAL-2026-5515/): Malicious code in yelp-react-component-chaos (npm) (malicious package)
- [MAL-2026-5514](https://insights.sbomify.com/MAL-2026-5514/): Malicious code in solidity-abi (npm) (malicious package)
- [MAL-2026-5513](https://insights.sbomify.com/MAL-2026-5513/): Malicious code in solc-compiler (npm) (malicious package)
- [MAL-2026-5512](https://insights.sbomify.com/MAL-2026-5512/): Malicious code in solc-abi (npm) (malicious package)
- [MAL-2026-5511](https://insights.sbomify.com/MAL-2026-5511/): Malicious code in nw-demo-utils (npm) (malicious package)
- [MAL-2026-5510](https://insights.sbomify.com/MAL-2026-5510/): Malicious code in npmjs_web3-common (npm) (malicious package)
- [MAL-2026-551](https://insights.sbomify.com/MAL-2026-551/): Malicious code in express-lists-routes (npm) (malicious package)
- [MAL-2026-5509](https://insights.sbomify.com/MAL-2026-5509/): Malicious code in npmjs_truffle-helper (npm) (malicious package)
- [MAL-2026-5508](https://insights.sbomify.com/MAL-2026-5508/): Malicious code in martinez-polygon-clipping-simul-dalton (npm) (malicious package)
- [MAL-2026-5507](https://insights.sbomify.com/MAL-2026-5507/): Malicious code in crypto-promise-js (npm) (malicious package)
- [MAL-2026-5506](https://insights.sbomify.com/MAL-2026-5506/): Malicious code in argoncrypt (npm) (malicious package)
- [MAL-2026-5505](https://insights.sbomify.com/MAL-2026-5505/): Malicious code in anaylze-json (npm) (malicious package)
- [MAL-2026-5504](https://insights.sbomify.com/MAL-2026-5504/): Malicious code in @easytipsportal/pos-adapters (npm) (malicious package)
- [MAL-2026-5503](https://insights.sbomify.com/MAL-2026-5503/): Malicious code in plugin-fastify (npm) (malicious package)
- [MAL-2026-5502](https://insights.sbomify.com/MAL-2026-5502/): Malicious code in graphbase-js (npm) (malicious package)
- [MAL-2026-5501](https://insights.sbomify.com/MAL-2026-5501/): Malicious code in ethers-jss (npm) (malicious package)
- [MAL-2026-5500](https://insights.sbomify.com/MAL-2026-5500/): Malicious code in csc154-internall-depend (npm) (malicious package)
- [MAL-2026-550](https://insights.sbomify.com/MAL-2026-550/): Malicious code in cdnhost (npm) (malicious package)
- [MAL-2026-55](https://insights.sbomify.com/MAL-2026-55/): Malicious code in lium-io-gztensor (PyPI) (malicious package)
- [MAL-2026-5499](https://insights.sbomify.com/MAL-2026-5499/): Malicious code in coinbase-wallet-utils (npm) (malicious package)
- [MAL-2026-5498](https://insights.sbomify.com/MAL-2026-5498/): Malicious code in @validator-sdk/pubkey (npm) (malicious package)
- [MAL-2026-5497](https://insights.sbomify.com/MAL-2026-5497/): Malicious code in @validate-sdk/v2 (npm) (malicious package)
- [MAL-2026-5496](https://insights.sbomify.com/MAL-2026-5496/): Malicious code in @validate-ethereum-address/core (npm) (malicious package)
- [MAL-2026-5495](https://insights.sbomify.com/MAL-2026-5495/): Malicious code in @solana-launchpad/sdk (npm) (malicious package)
- [MAL-2026-5494](https://insights.sbomify.com/MAL-2026-5494/): Malicious code in @meme-sdk/trade (npm) (malicious package)
- [MAL-2026-5493](https://insights.sbomify.com/MAL-2026-5493/): Malicious code in @builder.io/dev-tools (npm) (malicious package)
- [MAL-2026-5492](https://insights.sbomify.com/MAL-2026-5492/): Malicious code in xnder-wrapper-module (npm) (malicious package)
- [MAL-2026-5491](https://insights.sbomify.com/MAL-2026-5491/): Malicious code in xnder-sdk (npm) (malicious package)
- [MAL-2026-5490](https://insights.sbomify.com/MAL-2026-5490/): Malicious code in sb-original (npm) (malicious package)
- [MAL-2026-549](https://insights.sbomify.com/MAL-2026-549/): Malicious code in blockchain-helper-lib (npm) (malicious package)
- [MAL-2026-5489](https://insights.sbomify.com/MAL-2026-5489/): Malicious code in bittensor-emission-tracker (PyPI) (malicious package)
- [MAL-2026-5488](https://insights.sbomify.com/MAL-2026-5488/): Malicious code in react-pinojs (npm) (malicious package)
- [MAL-2026-5487](https://insights.sbomify.com/MAL-2026-5487/): Malicious code in tailwind-form (npm) (malicious package)
- [MAL-2026-5486](https://insights.sbomify.com/MAL-2026-5486/): Malicious code in menu-filter-widget-web (npm) (malicious package)
- [MAL-2026-5485](https://insights.sbomify.com/MAL-2026-5485/): Malicious code in mcp-server-supabase (npm) (malicious package)
- [MAL-2026-5484](https://insights.sbomify.com/MAL-2026-5484/): Malicious code in mcp-server-sequential-thinking (npm) (malicious package)
- [MAL-2026-5483](https://insights.sbomify.com/MAL-2026-5483/): Malicious code in mcp-server-sentry (npm) (malicious package)
- [MAL-2026-5482](https://insights.sbomify.com/MAL-2026-5482/): Malicious code in mcp-server-redis (npm) (malicious package)
- [MAL-2026-5481](https://insights.sbomify.com/MAL-2026-5481/): Malicious code in mcp-server-postgres (npm) (malicious package)
- [MAL-2026-5480](https://insights.sbomify.com/MAL-2026-5480/): Malicious code in mcp-server-notion (npm) (malicious package)
- [MAL-2026-548](https://insights.sbomify.com/MAL-2026-548/): Malicious code in tabletas (PyPI) (malicious package)
- [MAL-2026-5479](https://insights.sbomify.com/MAL-2026-5479/): Malicious code in mcp-server-github (npm) (malicious package)
- [MAL-2026-5478](https://insights.sbomify.com/MAL-2026-5478/): Malicious code in mcp-server-git (npm) (malicious package)
- [MAL-2026-5477](https://insights.sbomify.com/MAL-2026-5477/): Malicious code in mcp-server-figma (npm) (malicious package)
- [MAL-2026-5476](https://insights.sbomify.com/MAL-2026-5476/): Malicious code in mcp-server-fetch (npm) (malicious package)
- [MAL-2026-5475](https://insights.sbomify.com/MAL-2026-5475/): Malicious code in ipy-rev-proxy (npm) (malicious package)
- [MAL-2026-5474](https://insights.sbomify.com/MAL-2026-5474/): Malicious code in getui-library (npm) (malicious package)
- [MAL-2026-5473](https://insights.sbomify.com/MAL-2026-5473/): Malicious code in gethandler-api (npm) (malicious package)
- [MAL-2026-5472](https://insights.sbomify.com/MAL-2026-5472/): Malicious code in getd-web-corporativa (npm) (malicious package)
- [MAL-2026-5471](https://insights.sbomify.com/MAL-2026-5471/): Malicious code in getd-ui-library (npm) (malicious package)
- [MAL-2026-5470](https://insights.sbomify.com/MAL-2026-5470/): Malicious code in getd-typescript-eslint-rules (npm) (malicious package)
- [MAL-2026-547](https://insights.sbomify.com/MAL-2026-547/): Malicious code in solhint-plugin-hyperlane (PyPI) (malicious package)
- [MAL-2026-5469](https://insights.sbomify.com/MAL-2026-5469/): Malicious code in getd-transactional-web (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/59/