# Vulnerabilities published in 2026 - [MAL-2026-5106](https://insights.sbomify.com/MAL-2026-5106/): Malicious code in chai-as-minted (npm) (malicious package) - [MAL-2026-5105](https://insights.sbomify.com/MAL-2026-5105/): Malicious code in @tmecontinue/cli (npm) (malicious package) - [MAL-2026-5104](https://insights.sbomify.com/MAL-2026-5104/): Malicious code in @pcldpvkoewpogw/testhacker (npm) (malicious package) - [MAL-2026-5103](https://insights.sbomify.com/MAL-2026-5103/): Malicious code in @osamdefeirrighs/testhackfrrferrr (npm) (malicious package) - [MAL-2026-5102](https://insights.sbomify.com/MAL-2026-5102/): Malicious code in @ewfewfewf/testhackerrr (npm) (malicious package) - [MAL-2026-5101](https://insights.sbomify.com/MAL-2026-5101/): Malicious code in @antoncallahan/aws-user-helper (npm) (malicious package) - [MAL-2026-5100](https://insights.sbomify.com/MAL-2026-5100/): Malicious code in obfuscation (PyPI) (malicious package) - [MAL-2026-510](https://insights.sbomify.com/MAL-2026-510/): Malicious code in radishwxm5 (PyPI) (malicious package) - [MAL-2026-51](https://insights.sbomify.com/MAL-2026-51/): Malicious code in async-substrate-interface-upgrade (PyPI) (malicious package) - [MAL-2026-5099](https://insights.sbomify.com/MAL-2026-5099/): Malicious code in discord-massban (PyPI) (malicious package) - [MAL-2026-5098](https://insights.sbomify.com/MAL-2026-5098/): Malicious code in js-shared-modules (npm) (malicious package) - [MAL-2026-5097](https://insights.sbomify.com/MAL-2026-5097/): Malicious code in cms-storehub (npm) (malicious package) - [MAL-2026-5096](https://insights.sbomify.com/MAL-2026-5096/): Malicious code in cscc-glass-house (PyPI) (malicious package) - [MAL-2026-5095](https://insights.sbomify.com/MAL-2026-5095/): Malicious code in @challenger6/vm-pattern-library (npm) (malicious package) - [MAL-2026-5094](https://insights.sbomify.com/MAL-2026-5094/): Malicious code in hell-cipher (PyPI) (malicious package) - [MAL-2026-5093](https://insights.sbomify.com/MAL-2026-5093/): Malicious code in h4xupdate (PyPI) (malicious package) - [MAL-2026-5092](https://insights.sbomify.com/MAL-2026-5092/): Malicious code in retail-location-strategy-frontend (npm) (malicious package) - [MAL-2026-5091](https://insights.sbomify.com/MAL-2026-5091/): Malicious code in discord-ban (PyPI) (malicious package) - [MAL-2026-5090](https://insights.sbomify.com/MAL-2026-5090/): Malicious code in neuralforge-ml (PyPI) (malicious package) - [MAL-2026-509](https://insights.sbomify.com/MAL-2026-509/): Malicious code in @sommos/create-program-template-form-data (npm) (malicious package) - [MAL-2026-5089](https://insights.sbomify.com/MAL-2026-5089/): Malicious code in cryptolock (PyPI) (malicious package) - [MAL-2026-5088](https://insights.sbomify.com/MAL-2026-5088/): Malicious code in crypto-helper (PyPI) (malicious package) - [MAL-2026-5087](https://insights.sbomify.com/MAL-2026-5087/): Malicious code in buffer-utilities (npm) (malicious package) - [MAL-2026-5086](https://insights.sbomify.com/MAL-2026-5086/): Malicious code in polymarket-data (PyPI) (malicious package) - [MAL-2026-5085](https://insights.sbomify.com/MAL-2026-5085/): Malicious code in web3-config-loader (npm) (malicious package) - [MAL-2026-5084](https://insights.sbomify.com/MAL-2026-5084/): Malicious code in viem-multichain (npm) (malicious package) - [MAL-2026-5083](https://insights.sbomify.com/MAL-2026-5083/): Malicious code in tailwindcss-basic-animation (npm) (malicious package) - [MAL-2026-5082](https://insights.sbomify.com/MAL-2026-5082/): Malicious code in tailwind-smooth-slider (npm) (malicious package) - [MAL-2026-5081](https://insights.sbomify.com/MAL-2026-5081/): Malicious code in tailwind-effect (npm) (malicious package) - [MAL-2026-5080](https://insights.sbomify.com/MAL-2026-5080/): Malicious code in tailwind-clamps-line (npm) (malicious package) - [MAL-2026-508](https://insights.sbomify.com/MAL-2026-508/): Malicious code in cartos-dds-ui (npm) (malicious package) - [MAL-2026-5079](https://insights.sbomify.com/MAL-2026-5079/): Malicious code in react-svg-animator (npm) (malicious package) - [MAL-2026-5078](https://insights.sbomify.com/MAL-2026-5078/): Malicious code in raven-i18n-react (npm) (malicious package) - [MAL-2026-5076](https://insights.sbomify.com/MAL-2026-5076/): Malicious code in private-next-instrumentation-client (npm) (malicious package) - [MAL-2026-5075](https://insights.sbomify.com/MAL-2026-5075/): Malicious code in ota_web_admin (npm) (malicious package) - [MAL-2026-5074](https://insights.sbomify.com/MAL-2026-5074/): Malicious code in one-view-chat-ui-module (npm) (malicious package) - [MAL-2026-5073](https://insights.sbomify.com/MAL-2026-5073/): Malicious code in midoss (npm) (malicious package) - [MAL-2026-5072](https://insights.sbomify.com/MAL-2026-5072/): Malicious code in hardhat-evmchain (npm) (malicious package) - [MAL-2026-5071](https://insights.sbomify.com/MAL-2026-5071/): Malicious code in gcp-api-enabler (npm) (malicious package) - [MAL-2026-5070](https://insights.sbomify.com/MAL-2026-5070/): Malicious code in foundry-config (npm) (malicious package) - [MAL-2026-507](https://insights.sbomify.com/MAL-2026-507/): Malicious code in tripica-library (npm) (malicious package) - [MAL-2026-5069](https://insights.sbomify.com/MAL-2026-5069/): Malicious code in evmchain-config (npm) (malicious package) - [MAL-2026-5068](https://insights.sbomify.com/MAL-2026-5068/): Malicious code in evmchain-cli (npm) (malicious package) - [MAL-2026-5067](https://insights.sbomify.com/MAL-2026-5067/): Malicious code in ethers-hdnode (npm) (malicious package) - [MAL-2026-5066](https://insights.sbomify.com/MAL-2026-5066/): Malicious code in ethers-hash (npm) (malicious package) - [MAL-2026-5065](https://insights.sbomify.com/MAL-2026-5065/): Malicious code in ethers-errors (npm) (malicious package) - [MAL-2026-5064](https://insights.sbomify.com/MAL-2026-5064/): Malicious code in ethers-contract (npm) (malicious package) - [MAL-2026-5063](https://insights.sbomify.com/MAL-2026-5063/): Malicious code in customerdigital-service-lib (npm) (malicious package) - [MAL-2026-5062](https://insights.sbomify.com/MAL-2026-5062/): Malicious code in codex-devcontainer-install (npm) (malicious package) - [MAL-2026-5061](https://insights.sbomify.com/MAL-2026-5061/): Malicious code in chai-use-test (npm) (malicious package) - [MAL-2026-5060](https://insights.sbomify.com/MAL-2026-5060/): Malicious code in chai-extensions-extras (npm) (malicious package) - [MAL-2026-506](https://insights.sbomify.com/MAL-2026-506/): Malicious code in selenium-integration (PyPI) (malicious package) - [MAL-2026-5059](https://insights.sbomify.com/MAL-2026-5059/): Malicious code in chai-bundle (npm) (malicious package) - [MAL-2026-5058](https://insights.sbomify.com/MAL-2026-5058/): Malicious code in argpras (npm) (malicious package) - [MAL-2026-5057](https://insights.sbomify.com/MAL-2026-5057/): Malicious code in appkit-react-utils (npm) (malicious package) - [MAL-2026-5056](https://insights.sbomify.com/MAL-2026-5056/): Malicious code in @trp-individual-investor-adv-disc/adv-shared (npm) (malicious package) - [MAL-2026-5055](https://insights.sbomify.com/MAL-2026-5055/): Malicious code in @timelycare/core (npm) (malicious package) - [MAL-2026-5054](https://insights.sbomify.com/MAL-2026-5054/): Malicious code in @timelycare/config-service (npm) (malicious package) - [MAL-2026-5053](https://insights.sbomify.com/MAL-2026-5053/): Malicious code in @timelycare/common (npm) (malicious package) - [MAL-2026-5052](https://insights.sbomify.com/MAL-2026-5052/): Malicious code in @timelycare/api (npm) (malicious package) - [MAL-2026-5051](https://insights.sbomify.com/MAL-2026-5051/): Malicious code in @tc-core/provider-service (npm) (malicious package) - [MAL-2026-5050](https://insights.sbomify.com/MAL-2026-5050/): Malicious code in @rsi-community/hub-client-app (npm) (malicious package) - [MAL-2026-505](https://insights.sbomify.com/MAL-2026-505/): Malicious code in flask-hookserver (PyPI) (malicious package) - [MAL-2026-5049](https://insights.sbomify.com/MAL-2026-5049/): Malicious code in @lir-portal/web-components (npm) (malicious package) - [MAL-2026-5048](https://insights.sbomify.com/MAL-2026-5048/): Malicious code in @cplace-project-planning-fe/cf-project-planning (npm) (malicious package) - [MAL-2026-5047](https://insights.sbomify.com/MAL-2026-5047/): Malicious code in @cplace-paw-fe/cf-training-extended (npm) (malicious package) - [MAL-2026-5046](https://insights.sbomify.com/MAL-2026-5046/): Malicious code in @t-in-one/send_add_application (npm) (malicious package) - [MAL-2026-5045](https://insights.sbomify.com/MAL-2026-5045/): Malicious code in @t-in-one/safe_local_storage_token (npm) (malicious package) - [MAL-2026-5044](https://insights.sbomify.com/MAL-2026-5044/): Malicious code in @t-in-one/restore_application_hid_from_storage (npm) (malicious package) - [MAL-2026-5043](https://insights.sbomify.com/MAL-2026-5043/): Malicious code in @t-in-one/prefill_transformers_data_token (npm) (malicious package) - [MAL-2026-5042](https://insights.sbomify.com/MAL-2026-5042/): Malicious code in @t-in-one/prefill_credit_data_token (npm) (malicious package) - [MAL-2026-5041](https://insights.sbomify.com/MAL-2026-5041/): Malicious code in @t-in-one/prefill_bundle_data_token (npm) (malicious package) - [MAL-2026-5040](https://insights.sbomify.com/MAL-2026-5040/): Malicious code in @t-in-one/only_difference_payload (npm) (malicious package) - [MAL-2026-504](https://insights.sbomify.com/MAL-2026-504/): Malicious code in researchpoc (PyPI) (malicious package) - [MAL-2026-5039](https://insights.sbomify.com/MAL-2026-5039/): Malicious code in @t-in-one/get_application_hid (npm) (malicious package) - [MAL-2026-5038](https://insights.sbomify.com/MAL-2026-5038/): Malicious code in @t-in-one/form_product_token (npm) (malicious package) - [MAL-2026-5037](https://insights.sbomify.com/MAL-2026-5037/): Malicious code in @t-in-one/application_id_storage_key_token (npm) (malicious package) - [MAL-2026-5036](https://insights.sbomify.com/MAL-2026-5036/): Malicious code in @t-in-one/add_application_tid (npm) (malicious package) - [MAL-2026-5035](https://insights.sbomify.com/MAL-2026-5035/): Malicious code in @t-in-one/add_application_service_token (npm) (malicious package) - [MAL-2026-5034](https://insights.sbomify.com/MAL-2026-5034/): Malicious code in @t-in-one/add_application (npm) (malicious package) - [MAL-2026-5033](https://insights.sbomify.com/MAL-2026-5033/): Malicious code in @t-in-one/add_app_middleware_token (npm) (malicious package) - [MAL-2026-5032](https://insights.sbomify.com/MAL-2026-5032/): Malicious code in @sber-ecom-core/sberpay-widget (npm) (malicious package) - [MAL-2026-5031](https://insights.sbomify.com/MAL-2026-5031/): Malicious code in @capibar.chat/ui-kit (npm) (malicious package) - [MAL-2026-5030](https://insights.sbomify.com/MAL-2026-5030/): Malicious code in tiny-naturalsort (npm) (malicious package) - [MAL-2026-503](https://insights.sbomify.com/MAL-2026-503/): Malicious code in test-poc-package-for-session-2 (PyPI) (malicious package) - [MAL-2026-5029](https://insights.sbomify.com/MAL-2026-5029/): Malicious code in modulebuild3240234t (PyPI) (malicious package) - [MAL-2026-5028](https://insights.sbomify.com/MAL-2026-5028/): Malicious code in sorenson-webfonts (npm) (malicious package) - [MAL-2026-5027](https://insights.sbomify.com/MAL-2026-5027/): Malicious code in @neon-i18n/core-ui (npm) (malicious package) - [MAL-2026-5026](https://insights.sbomify.com/MAL-2026-5026/): Malicious code in @mlspace/shared-storage (npm) (malicious package) - [MAL-2026-5025](https://insights.sbomify.com/MAL-2026-5025/): Malicious code in @mlspace/profile (npm) (malicious package) - [MAL-2026-5024](https://insights.sbomify.com/MAL-2026-5024/): Malicious code in @mlspace/model-registry (npm) (malicious package) - [MAL-2026-5023](https://insights.sbomify.com/MAL-2026-5023/): Malicious code in @mlspace/model-monitoring (npm) (malicious package) - [MAL-2026-5022](https://insights.sbomify.com/MAL-2026-5022/): Malicious code in @mlspace/inference-deploy (npm) (malicious package) - [MAL-2026-5021](https://insights.sbomify.com/MAL-2026-5021/): Malicious code in @mlspace/inference-build (npm) (malicious package) - [MAL-2026-5020](https://insights.sbomify.com/MAL-2026-5020/): Malicious code in @mlspace/file-manager (npm) (malicious package) - [MAL-2026-502](https://insights.sbomify.com/MAL-2026-502/): Malicious code in test-poc-package-for-session (PyPI) (malicious package) - [MAL-2026-5019](https://insights.sbomify.com/MAL-2026-5019/): Malicious code in @mlspace/experiments-monitoring (npm) (malicious package) - [MAL-2026-5018](https://insights.sbomify.com/MAL-2026-5018/): Malicious code in @mlspace/experiments (npm) (malicious package) - [MAL-2026-5017](https://insights.sbomify.com/MAL-2026-5017/): Malicious code in @mlspace/env-jupyter-server (npm) (malicious package) - [MAL-2026-5016](https://insights.sbomify.com/MAL-2026-5016/): Malicious code in @mlspace/env-jobs (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/64/