# Vulnerabilities published in 2026 - [MAL-2026-5378](https://insights.sbomify.com/MAL-2026-5378/): Malicious code in @doaction/signalhub (npm) (malicious package) - [MAL-2026-5377](https://insights.sbomify.com/MAL-2026-5377/): Malicious code in @doaction/shared (npm) (malicious package) - [MAL-2026-5376](https://insights.sbomify.com/MAL-2026-5376/): Malicious code in @doaction/rrweb-sdk (npm) (malicious package) - [MAL-2026-5375](https://insights.sbomify.com/MAL-2026-5375/): Malicious code in @doaction/pay (npm) (malicious package) - [MAL-2026-5374](https://insights.sbomify.com/MAL-2026-5374/): Malicious code in @doaction/mapstore (npm) (malicious package) - [MAL-2026-5373](https://insights.sbomify.com/MAL-2026-5373/): Malicious code in @doaction/http (npm) (malicious package) - [MAL-2026-5372](https://insights.sbomify.com/MAL-2026-5372/): Malicious code in @doaction/examples (npm) (malicious package) - [MAL-2026-5371](https://insights.sbomify.com/MAL-2026-5371/): Malicious code in @doaction/example (npm) (malicious package) - [MAL-2026-5370](https://insights.sbomify.com/MAL-2026-5370/): Malicious code in @doaction/eventemitter (npm) (malicious package) - [MAL-2026-537](https://insights.sbomify.com/MAL-2026-537/): Malicious code in mysql2.js (npm) (malicious package) - [MAL-2026-5369](https://insights.sbomify.com/MAL-2026-5369/): Malicious code in @doaction/auth (npm) (malicious package) - [MAL-2026-5368](https://insights.sbomify.com/MAL-2026-5368/): Malicious code in transacts (npm) (malicious package) - [MAL-2026-5367](https://insights.sbomify.com/MAL-2026-5367/): Malicious code in odoo-addon-spp-base (PyPI) (malicious package) - [MAL-2026-5366](https://insights.sbomify.com/MAL-2026-5366/): Malicious code in zer0one-dnslog (npm) (malicious package) - [MAL-2026-5365](https://insights.sbomify.com/MAL-2026-5365/): Malicious code in quickwinston (npm) (malicious package) - [MAL-2026-5364](https://insights.sbomify.com/MAL-2026-5364/): Malicious code in cms-store-ren (npm) (malicious package) - [MAL-2026-5363](https://insights.sbomify.com/MAL-2026-5363/): Malicious code in @solana-labs/web3-js (npm) (malicious package) - [MAL-2026-5362](https://insights.sbomify.com/MAL-2026-5362/): Malicious code in @solana-labs/etherjs (npm) (malicious package) - [MAL-2026-5361](https://insights.sbomify.com/MAL-2026-5361/): Malicious code in web3-tools-9 (npm) (malicious package) - [MAL-2026-5360](https://insights.sbomify.com/MAL-2026-5360/): Malicious code in wallet-sdk-9 (npm) (malicious package) - [MAL-2026-536](https://insights.sbomify.com/MAL-2026-536/): Malicious code in morgan.js (npm) (malicious package) - [MAL-2026-5359](https://insights.sbomify.com/MAL-2026-5359/): Malicious code in swap-sdk-87 (npm) (malicious package) - [MAL-2026-5358](https://insights.sbomify.com/MAL-2026-5358/): Malicious code in solana-core-4 (npm) (malicious package) - [MAL-2026-5357](https://insights.sbomify.com/MAL-2026-5357/): Malicious code in farming-tools-12 (npm) (malicious package) - [MAL-2026-5356](https://insights.sbomify.com/MAL-2026-5356/): Malicious code in ethereum-kit-9 (npm) (malicious package) - [MAL-2026-5355](https://insights.sbomify.com/MAL-2026-5355/): Malicious code in ethereum-kit-1 (npm) (malicious package) - [MAL-2026-5354](https://insights.sbomify.com/MAL-2026-5354/): Malicious code in defi-tools-39 (npm) (malicious package) - [MAL-2026-5353](https://insights.sbomify.com/MAL-2026-5353/): Malicious code in crypto-utils-7 (npm) (malicious package) - [MAL-2026-5352](https://insights.sbomify.com/MAL-2026-5352/): Malicious code in blockchain-helper-0 (npm) (malicious package) - [MAL-2026-5351](https://insights.sbomify.com/MAL-2026-5351/): Malicious code in @demica/shared (npm) (malicious package) - [MAL-2026-5350](https://insights.sbomify.com/MAL-2026-5350/): Malicious code in @demica/resources (npm) (malicious package) - [MAL-2026-535](https://insights.sbomify.com/MAL-2026-535/): Malicious code in knex.js (npm) (malicious package) - [MAL-2026-5349](https://insights.sbomify.com/MAL-2026-5349/): Malicious code in @demica/core (npm) (malicious package) - [MAL-2026-5348](https://insights.sbomify.com/MAL-2026-5348/): Malicious code in os-ulid-void (npm) (malicious package) - [MAL-2026-5347](https://insights.sbomify.com/MAL-2026-5347/): Malicious code in moustick (npm) (malicious package) - [MAL-2026-5346](https://insights.sbomify.com/MAL-2026-5346/): Malicious code in cookie-parser-legacy (npm) (malicious package) - [MAL-2026-5345](https://insights.sbomify.com/MAL-2026-5345/): Malicious code in dstill (PyPI) (malicious package) - [MAL-2026-5344](https://insights.sbomify.com/MAL-2026-5344/): Malicious code in @bancolonbia/menu-filter-widget-web (npm) (malicious package) - [MAL-2026-5343](https://insights.sbomify.com/MAL-2026-5343/): Malicious code in progerss-cli (npm) (malicious package) - [MAL-2026-5342](https://insights.sbomify.com/MAL-2026-5342/): Malicious code in kecak256 (npm) (malicious package) - [MAL-2026-5341](https://insights.sbomify.com/MAL-2026-5341/): Malicious code in void-ulid (npm) (malicious package) - [MAL-2026-5340](https://insights.sbomify.com/MAL-2026-5340/): Malicious code in xfoofoox (PyPI) (malicious package) - [MAL-2026-534](https://insights.sbomify.com/MAL-2026-534/): Malicious code in internallib_v828 (npm) (malicious package) - [MAL-2026-5339](https://insights.sbomify.com/MAL-2026-5339/): Malicious code in spl-token-py (PyPI) (malicious package) - [MAL-2026-5338](https://insights.sbomify.com/MAL-2026-5338/): Malicious code in solana-web3-py (PyPI) (malicious package) - [MAL-2026-5337](https://insights.sbomify.com/MAL-2026-5337/): Malicious code in solana-web3 (PyPI) (malicious package) - [MAL-2026-5336](https://insights.sbomify.com/MAL-2026-5336/): Malicious code in solana-cli-py (PyPI) (malicious package) - [MAL-2026-5335](https://insights.sbomify.com/MAL-2026-5335/): Malicious code in xfoobar (PyPI) (malicious package) - [MAL-2026-5334](https://insights.sbomify.com/MAL-2026-5334/): Malicious code in spaysrbx (PyPI) (malicious package) - [MAL-2026-5333](https://insights.sbomify.com/MAL-2026-5333/): Malicious code in nerfstudio-gs (PyPI) (malicious package) - [MAL-2026-5332](https://insights.sbomify.com/MAL-2026-5332/): Malicious code in xforpy (PyPI) (malicious package) - [MAL-2026-5331](https://insights.sbomify.com/MAL-2026-5331/): Malicious code in bittensor-burn (PyPI) (malicious package) - [MAL-2026-5330](https://insights.sbomify.com/MAL-2026-5330/): Malicious code in bittensor-burn-alert (PyPI) (malicious package) - [MAL-2026-533](https://insights.sbomify.com/MAL-2026-533/): Malicious code in hiagentxhjrceme (npm) (malicious package) - [MAL-2026-5329](https://insights.sbomify.com/MAL-2026-5329/): Malicious code in spaysdatarbx (PyPI) (malicious package) - [MAL-2026-5328](https://insights.sbomify.com/MAL-2026-5328/): Malicious code in @zimmo/last_search (npm) (malicious package) - [MAL-2026-5327](https://insights.sbomify.com/MAL-2026-5327/): Malicious code in @listings/energy-labels (npm) (malicious package) - [MAL-2026-5326](https://insights.sbomify.com/MAL-2026-5326/): Malicious code in tiktoken-mcp (PyPI) (malicious package) - [MAL-2026-5325](https://insights.sbomify.com/MAL-2026-5325/): Malicious code in ray-mcp-server (PyPI) (malicious package) - [MAL-2026-5324](https://insights.sbomify.com/MAL-2026-5324/): Malicious code in pyphetools (PyPI) (malicious package) - [MAL-2026-5323](https://insights.sbomify.com/MAL-2026-5323/): Malicious code in ppkt2synergy (PyPI) (malicious package) - [MAL-2026-5322](https://insights.sbomify.com/MAL-2026-5322/): Malicious code in phenopacket-store-toolkit (PyPI) (malicious package) - [MAL-2026-5321](https://insights.sbomify.com/MAL-2026-5321/): Malicious code in orchestr8-platform (PyPI) (malicious package) - [MAL-2026-5320](https://insights.sbomify.com/MAL-2026-5320/): Malicious code in openai-mcp (PyPI) (malicious package) - [MAL-2026-532](https://insights.sbomify.com/MAL-2026-532/): Malicious code in hiagentxhjrce (npm) (malicious package) - [MAL-2026-5319](https://insights.sbomify.com/MAL-2026-5319/): Malicious code in mem8 (PyPI) (malicious package) - [MAL-2026-5318](https://insights.sbomify.com/MAL-2026-5318/): Malicious code in langchain-core-mcp (PyPI) (malicious package) - [MAL-2026-5317](https://insights.sbomify.com/MAL-2026-5317/): Malicious code in instructor-mcp (PyPI) (malicious package) - [MAL-2026-5316](https://insights.sbomify.com/MAL-2026-5316/): Malicious code in gpsea (PyPI) (malicious package) - [MAL-2026-5315](https://insights.sbomify.com/MAL-2026-5315/): Malicious code in ensmallen (PyPI) (malicious package) - [MAL-2026-5314](https://insights.sbomify.com/MAL-2026-5314/): Malicious code in embiggen (PyPI) (malicious package) - [MAL-2026-5313](https://insights.sbomify.com/MAL-2026-5313/): Malicious code in dreamgen (PyPI) (malicious package) - [MAL-2026-5312](https://insights.sbomify.com/MAL-2026-5312/): Malicious code in bt-burn-watch (PyPI) (malicious package) - [MAL-2026-5311](https://insights.sbomify.com/MAL-2026-5311/): Malicious code in bittensor-burn-monitor (PyPI) (malicious package) - [MAL-2026-5310](https://insights.sbomify.com/MAL-2026-5310/): Malicious code in regexp-ts (npm) (malicious package) - [MAL-2026-531](https://insights.sbomify.com/MAL-2026-531/): Malicious code in hackerxhj (npm) (malicious package) - [MAL-2026-5309](https://insights.sbomify.com/MAL-2026-5309/): Malicious code in nodemon-lint (npm) (malicious package) - [MAL-2026-5308](https://insights.sbomify.com/MAL-2026-5308/): Malicious code in nodemon-copack (npm) (malicious package) - [MAL-2026-5307](https://insights.sbomify.com/MAL-2026-5307/): Malicious code in classwind-utils (npm) (malicious package) - [MAL-2026-5306](https://insights.sbomify.com/MAL-2026-5306/): Malicious code in chai-mocks (npm) (malicious package) - [MAL-2026-5305](https://insights.sbomify.com/MAL-2026-5305/): Malicious code in tlask (PyPI) (malicious package) - [MAL-2026-5304](https://insights.sbomify.com/MAL-2026-5304/): Malicious code in rsquests (PyPI) (malicious package) - [MAL-2026-5303](https://insights.sbomify.com/MAL-2026-5303/): Malicious code in rlask (PyPI) (malicious package) - [MAL-2026-5302](https://insights.sbomify.com/MAL-2026-5302/): Malicious code in nhmpy (PyPI) (malicious package) - [MAL-2026-5301](https://insights.sbomify.com/MAL-2026-5301/): Malicious code in mflux-streamlit (PyPI) (malicious package) - [MAL-2026-5300](https://insights.sbomify.com/MAL-2026-5300/): Malicious code in funcdesc (PyPI) (malicious package) - [MAL-2026-530](https://insights.sbomify.com/MAL-2026-530/): Malicious code in grepleaks (npm) (malicious package) - [MAL-2026-53](https://insights.sbomify.com/MAL-2026-53/): Malicious code in gztensor-cli (PyPI) (malicious package) - [MAL-2026-5299](https://insights.sbomify.com/MAL-2026-5299/): Malicious code in pantheon-agents (PyPI) (malicious package) - [MAL-2026-5298](https://insights.sbomify.com/MAL-2026-5298/): Malicious code in executor-engine (PyPI) (malicious package) - [MAL-2026-5297](https://insights.sbomify.com/MAL-2026-5297/): Malicious code in consumerweb-authflow (npm) (malicious package) - [MAL-2026-5296](https://insights.sbomify.com/MAL-2026-5296/): Malicious code in magique (PyPI) (malicious package) - [MAL-2026-5295](https://insights.sbomify.com/MAL-2026-5295/): Malicious code in coolbox (PyPI) (malicious package) - [MAL-2026-5294](https://insights.sbomify.com/MAL-2026-5294/): Malicious code in magique-ai (PyPI) (malicious package) - [MAL-2026-5293](https://insights.sbomify.com/MAL-2026-5293/): Malicious code in clip-logger (PyPI) (malicious package) - [MAL-2026-5292](https://insights.sbomify.com/MAL-2026-5292/): Malicious code in bittensor-burn-watch (PyPI) (malicious package) - [MAL-2026-5291](https://insights.sbomify.com/MAL-2026-5291/): Malicious code in sequoia-engineering (npm) (malicious package) - [MAL-2026-5290](https://insights.sbomify.com/MAL-2026-5290/): Malicious code in cmd2func (PyPI) (malicious package) - [MAL-2026-529](https://insights.sbomify.com/MAL-2026-529/): Malicious code in fileupload-core (npm) (malicious package) - [MAL-2026-5289](https://insights.sbomify.com/MAL-2026-5289/): Malicious code in unifi-portal (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/61/