# Vulnerabilities published in 2026


- [MAL-2026-5198](https://insights.sbomify.com/MAL-2026-5198/): Malicious code in @ethlete/components (npm) (malicious package)
- [MAL-2026-5197](https://insights.sbomify.com/MAL-2026-5197/): Malicious code in @ethlete/cli (npm) (malicious package)
- [MAL-2026-5196](https://insights.sbomify.com/MAL-2026-5196/): Malicious code in @ethlete/cdk (npm) (malicious package)
- [MAL-2026-5195](https://insights.sbomify.com/MAL-2026-5195/): Malicious code in @contaazul/n8n-nodes-contaazul (npm) (malicious package)
- [MAL-2026-5194](https://insights.sbomify.com/MAL-2026-5194/): Malicious code in yaml-javascript (npm) (malicious package)
- [MAL-2026-5193](https://insights.sbomify.com/MAL-2026-5193/): Malicious code in javascript-yaml (npm) (malicious package)
- [MAL-2026-5192](https://insights.sbomify.com/MAL-2026-5192/): Malicious code in weavedb-contracts (npm) (malicious package)
- [MAL-2026-5191](https://insights.sbomify.com/MAL-2026-5191/): Malicious code in wdb-core (npm) (malicious package)
- [MAL-2026-5190](https://insights.sbomify.com/MAL-2026-5190/): Malicious code in hbsig (npm) (malicious package)
- [MAL-2026-519](https://insights.sbomify.com/MAL-2026-519/): Malicious code in @afg-ikea/ikea-modals (npm) (malicious package)
- [MAL-2026-5189](https://insights.sbomify.com/MAL-2026-5189/): Malicious code in arjson (npm) (malicious package)
- [MAL-2026-5188](https://insights.sbomify.com/MAL-2026-5188/): Malicious code in hello244a (npm) (malicious package)
- [MAL-2026-5186](https://insights.sbomify.com/MAL-2026-5186/): Malicious code in autotel-terminal (npm) (malicious package)
- [MAL-2026-5185](https://insights.sbomify.com/MAL-2026-5185/): Malicious code in @jagreehal/workflow (npm) (malicious package)
- [MAL-2026-5184](https://insights.sbomify.com/MAL-2026-5184/): Malicious code in sf-silly-goose-requests (PyPI) (malicious package)
- [MAL-2026-5183](https://insights.sbomify.com/MAL-2026-5183/): Malicious code in hpe-glcp-automation-lib (PyPI) (malicious package)
- [MAL-2026-5182](https://insights.sbomify.com/MAL-2026-5182/): Malicious code in brave-search-mcp-server (npm) (malicious package)
- [MAL-2026-5181](https://insights.sbomify.com/MAL-2026-5181/): Malicious code in tronlabpy3 (PyPI) (malicious package)
- [MAL-2026-5180](https://insights.sbomify.com/MAL-2026-5180/): Malicious code in nodemon-webpatch (npm) (malicious package)
- [MAL-2026-518](https://insights.sbomify.com/MAL-2026-518/): Malicious code in @afg-ikea/ikea-kiosk-related-components (npm) (malicious package)
- [MAL-2026-5179](https://insights.sbomify.com/MAL-2026-5179/): Malicious code in chai-midpatch (npm) (malicious package)
- [MAL-2026-5178](https://insights.sbomify.com/MAL-2026-5178/): Malicious code in tronlab (PyPI) (malicious package)
- [MAL-2026-5177](https://insights.sbomify.com/MAL-2026-5177/): Malicious code in fia-signals (PyPI) (malicious package)
- [MAL-2026-5176](https://insights.sbomify.com/MAL-2026-5176/): Malicious code in internal-tracker (PyPI) (malicious package)
- [MAL-2026-5175](https://insights.sbomify.com/MAL-2026-5175/): Malicious code in webpack-json (npm) (malicious package)
- [MAL-2026-5174](https://insights.sbomify.com/MAL-2026-5174/): Malicious code in nodemon-pack (npm) (malicious package)
- [MAL-2026-5173](https://insights.sbomify.com/MAL-2026-5173/): Malicious code in spadata (PyPI) (malicious package)
- [MAL-2026-5172](https://insights.sbomify.com/MAL-2026-5172/): Malicious code in fundraiserserv (npm) (malicious package)
- [MAL-2026-5171](https://insights.sbomify.com/MAL-2026-5171/): Malicious code in spaysdata (PyPI) (malicious package)
- [MAL-2026-5170](https://insights.sbomify.com/MAL-2026-5170/): Malicious code in spaysrbdata (PyPI) (malicious package)
- [MAL-2026-517](https://insights.sbomify.com/MAL-2026-517/): Malicious code in @afg-ikea/ikea-family-registration-module (npm) (malicious package)
- [MAL-2026-5169](https://insights.sbomify.com/MAL-2026-5169/): Malicious code in chai-parse (npm) (malicious package)
- [MAL-2026-5168](https://insights.sbomify.com/MAL-2026-5168/): Malicious code in vg-interaction-model (npm) (malicious package)
- [MAL-2026-5167](https://insights.sbomify.com/MAL-2026-5167/): Malicious code in jules-test-utils (PyPI) (malicious package)
- [MAL-2026-5166](https://insights.sbomify.com/MAL-2026-5166/): Malicious code in sourceflow-tracker (npm) (malicious package)
- [MAL-2026-5165](https://insights.sbomify.com/MAL-2026-5165/): Malicious code in @emcd-vue/loans (npm) (malicious package)
- [MAL-2026-5164](https://insights.sbomify.com/MAL-2026-5164/): Malicious code in @emcd-vue/b2b-pay-form (npm) (malicious package)
- [MAL-2026-5163](https://insights.sbomify.com/MAL-2026-5163/): Malicious code in @emcd-vue/auth (npm) (malicious package)
- [MAL-2026-5162](https://insights.sbomify.com/MAL-2026-5162/): Malicious code in nrwl.angular-console (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2026-5161](https://insights.sbomify.com/MAL-2026-5161/): Malicious code in nrwl.angular-console (VSCode) (malicious package)
- [MAL-2026-5160](https://insights.sbomify.com/MAL-2026-5160/): Malicious code in bt-signal-utils (PyPI) (malicious package)
- [MAL-2026-516](https://insights.sbomify.com/MAL-2026-516/): Malicious code in overstock-login-layer (npm) (malicious package)
- [MAL-2026-5159](https://insights.sbomify.com/MAL-2026-5159/): Malicious code in po-ops-local-dev (npm) (malicious package)
- [MAL-2026-5158](https://insights.sbomify.com/MAL-2026-5158/): Malicious code in page-info-service (npm) (malicious package)
- [MAL-2026-5157](https://insights.sbomify.com/MAL-2026-5157/): Malicious code in @tse-digital/core (npm) (malicious package)
- [MAL-2026-5156](https://insights.sbomify.com/MAL-2026-5156/): Malicious code in @telenor-se/core (npm) (malicious package)
- [MAL-2026-5155](https://insights.sbomify.com/MAL-2026-5155/): Malicious code in @ownit/core (npm) (malicious package)
- [MAL-2026-5154](https://insights.sbomify.com/MAL-2026-5154/): Malicious code in @customer-threesixty/assets (npm) (malicious package)
- [MAL-2026-5153](https://insights.sbomify.com/MAL-2026-5153/): Malicious code in @att-ebiz/abs-components-bc (npm) (malicious package)
- [MAL-2026-5152](https://insights.sbomify.com/MAL-2026-5152/): Malicious code in quant-backtest-helpers (PyPI) (malicious package)
- [MAL-2026-5151](https://insights.sbomify.com/MAL-2026-5151/): Malicious code in parsimonius (PyPI) (malicious package)
- [MAL-2026-5150](https://insights.sbomify.com/MAL-2026-5150/): Malicious code in @aonunited/angular (npm) (malicious package)
- [MAL-2026-515](https://insights.sbomify.com/MAL-2026-515/): Malicious code in overstock-jenkins (npm) (malicious package)
- [MAL-2026-5149](https://insights.sbomify.com/MAL-2026-5149/): Malicious code in align_rest_api (RubyGems) (malicious package)
- [MAL-2026-5148](https://insights.sbomify.com/MAL-2026-5148/): Malicious code in @redhat-cloud-services/vulnerabilities-client (npm) (malicious package)
- [MAL-2026-5147](https://insights.sbomify.com/MAL-2026-5147/): Malicious code in @redhat-cloud-services/tsc-transform-imports (npm) (malicious package)
- [MAL-2026-5146](https://insights.sbomify.com/MAL-2026-5146/): Malicious code in @redhat-cloud-services/remediations-client (npm) (malicious package)
- [MAL-2026-5145](https://insights.sbomify.com/MAL-2026-5145/): Malicious code in @redhat-cloud-services/patch-client (npm) (malicious package)
- [MAL-2026-5144](https://insights.sbomify.com/MAL-2026-5144/): Malicious code in @redhat-cloud-services/notifications-client (npm) (malicious package)
- [MAL-2026-5143](https://insights.sbomify.com/MAL-2026-5143/): Malicious code in @redhat-cloud-services/javascript-clients-shared (npm) (malicious package)
- [MAL-2026-5142](https://insights.sbomify.com/MAL-2026-5142/): Malicious code in @redhat-cloud-services/insights-client (npm) (malicious package)
- [MAL-2026-5141](https://insights.sbomify.com/MAL-2026-5141/): Malicious code in @redhat-cloud-services/host-inventory-client (npm) (malicious package)
- [MAL-2026-5140](https://insights.sbomify.com/MAL-2026-5140/): Malicious code in @redhat-cloud-services/hcc-pf-mcp (npm) (malicious package)
- [MAL-2026-514](https://insights.sbomify.com/MAL-2026-514/): Malicious code in overstock-health-express (npm) (malicious package)
- [MAL-2026-5139](https://insights.sbomify.com/MAL-2026-5139/): Malicious code in @redhat-cloud-services/hcc-kessel-mcp (npm) (malicious package)
- [MAL-2026-5138](https://insights.sbomify.com/MAL-2026-5138/): Malicious code in @redhat-cloud-services/frontend-components-utilities (npm) (malicious package)
- [MAL-2026-5137](https://insights.sbomify.com/MAL-2026-5137/): Malicious code in @redhat-cloud-services/frontend-components-translations (npm) (malicious package)
- [MAL-2026-5136](https://insights.sbomify.com/MAL-2026-5136/): Malicious code in @redhat-cloud-services/frontend-components-notifications (npm) (malicious package)
- [MAL-2026-5135](https://insights.sbomify.com/MAL-2026-5135/): Malicious code in @redhat-cloud-services/frontend-components-advisor-components (npm) (malicious package)
- [MAL-2026-5134](https://insights.sbomify.com/MAL-2026-5134/): Malicious code in @redhat-cloud-services/config-manager-client (npm) (malicious package)
- [MAL-2026-5133](https://insights.sbomify.com/MAL-2026-5133/): Malicious code in @redhat-cloud-services/compliance-client (npm) (malicious package)
- [MAL-2026-5132](https://insights.sbomify.com/MAL-2026-5132/): Malicious code in rookie-security-test-pkg (npm) (malicious package)
- [MAL-2026-5131](https://insights.sbomify.com/MAL-2026-5131/): Malicious code in @redhat-cloud-services/sources-client (npm) (malicious package)
- [MAL-2026-5130](https://insights.sbomify.com/MAL-2026-5130/): Malicious code in @redhat-cloud-services/integrations-client (npm) (malicious package)
- [MAL-2026-513](https://insights.sbomify.com/MAL-2026-513/): Malicious code in overstock-component-library-v3 (npm) (malicious package)
- [MAL-2026-5129](https://insights.sbomify.com/MAL-2026-5129/): Malicious code in @redhat-cloud-services/hcc-feo-mcp (npm) (malicious package)
- [MAL-2026-5128](https://insights.sbomify.com/MAL-2026-5128/): Malicious code in @redhat-cloud-services/frontend-components-testing (npm) (malicious package)
- [MAL-2026-5127](https://insights.sbomify.com/MAL-2026-5127/): Malicious code in @redhat-cloud-services/frontend-components-remediations (npm) (malicious package)
- [MAL-2026-5126](https://insights.sbomify.com/MAL-2026-5126/): Malicious code in @redhat-cloud-services/frontend-components-config (npm) (malicious package)
- [MAL-2026-5125](https://insights.sbomify.com/MAL-2026-5125/): Malicious code in @redhat-cloud-services/entitlements-client (npm) (malicious package)
- [MAL-2026-5124](https://insights.sbomify.com/MAL-2026-5124/): Malicious code in @chat-template/auth (npm) (malicious package)
- [MAL-2026-5123](https://insights.sbomify.com/MAL-2026-5123/): Malicious code in imgmatrix-analysis (PyPI) (malicious package)
- [MAL-2026-5122](https://insights.sbomify.com/MAL-2026-5122/): Malicious code in picnic-react-mise-en-place (npm) (malicious package)
- [MAL-2026-5121](https://insights.sbomify.com/MAL-2026-5121/): Malicious code in nepsnowplow (npm) (malicious package)
- [MAL-2026-5120](https://insights.sbomify.com/MAL-2026-5120/): Malicious code in redteam-qxz7-utils (PyPI) (malicious package)
- [MAL-2026-512](https://insights.sbomify.com/MAL-2026-512/): Malicious code in overstock-component-library (npm) (malicious package)
- [MAL-2026-5119](https://insights.sbomify.com/MAL-2026-5119/): Malicious code in @redhat-cloud-services/types (npm) (malicious package)
- [MAL-2026-5118](https://insights.sbomify.com/MAL-2026-5118/): Malicious code in @redhat-cloud-services/topological-inventory-client (npm) (malicious package)
- [MAL-2026-5117](https://insights.sbomify.com/MAL-2026-5117/): Malicious code in @redhat-cloud-services/rule-components (npm) (malicious package)
- [MAL-2026-5116](https://insights.sbomify.com/MAL-2026-5116/): Malicious code in @redhat-cloud-services/rbac-client (npm) (malicious package)
- [MAL-2026-5115](https://insights.sbomify.com/MAL-2026-5115/): Malicious code in @redhat-cloud-services/quickstarts-client (npm) (malicious package)
- [MAL-2026-5114](https://insights.sbomify.com/MAL-2026-5114/): Malicious code in @redhat-cloud-services/frontend-components-config-utilities (npm) (malicious package)
- [MAL-2026-5113](https://insights.sbomify.com/MAL-2026-5113/): Malicious code in @redhat-cloud-services/frontend-components (npm) (malicious package)
- [MAL-2026-5112](https://insights.sbomify.com/MAL-2026-5112/): Malicious code in @redhat-cloud-services/eslint-config-redhat-cloud-services (npm) (malicious package)
- [MAL-2026-5111](https://insights.sbomify.com/MAL-2026-5111/): Malicious code in @redhat-cloud-services/chrome (npm) (malicious package)
- [MAL-2026-5110](https://insights.sbomify.com/MAL-2026-5110/): Malicious code in jingmeideshishi (npm) (malicious package)
- [MAL-2026-511](https://insights.sbomify.com/MAL-2026-511/): Malicious code in ostk-otel-autoconfig (npm) (malicious package)
- [MAL-2026-5109](https://insights.sbomify.com/MAL-2026-5109/): Malicious code in shopifyto-cms (npm) (malicious package)
- [MAL-2026-5108](https://insights.sbomify.com/MAL-2026-5108/): Malicious code in cms-helpgit (npm) (malicious package)
- [MAL-2026-5107](https://insights.sbomify.com/MAL-2026-5107/): Malicious code in cms-github (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/63/