# Vulnerabilities published in 2026 - [MAL-2026-4836](https://insights.sbomify.com/MAL-2026-4836/): Malicious code in nemo-reporter (npm) (malicious package) - [MAL-2026-4835](https://insights.sbomify.com/MAL-2026-4835/): Malicious code in rogiant-install (PyPI) (malicious package) - [MAL-2026-4834](https://insights.sbomify.com/MAL-2026-4834/): Malicious code in @polka-ui/config (npm) (malicious package) - [MAL-2026-4833](https://insights.sbomify.com/MAL-2026-4833/): Malicious code in bulletproof-json (npm) (malicious package) - [MAL-2026-4832](https://insights.sbomify.com/MAL-2026-4832/): Malicious code in mse-authentication (npm) (malicious package) - [MAL-2026-4831](https://insights.sbomify.com/MAL-2026-4831/): Malicious code in editorial-mse-authentication-ui (npm) (malicious package) - [MAL-2026-4830](https://insights.sbomify.com/MAL-2026-4830/): Malicious code in editorial-code (npm) (malicious package) - [MAL-2026-483](https://insights.sbomify.com/MAL-2026-483/): Malicious code in public-site-cms-ui (npm) (malicious package) - [MAL-2026-4829](https://insights.sbomify.com/MAL-2026-4829/): Malicious code in quatres (PyPI) (malicious package) - [MAL-2026-4828](https://insights.sbomify.com/MAL-2026-4828/): Malicious code in hmacsync (PyPI) (malicious package) - [MAL-2026-4827](https://insights.sbomify.com/MAL-2026-4827/): Malicious code in unleash-js (npm) (malicious package) - [MAL-2026-4826](https://insights.sbomify.com/MAL-2026-4826/): Malicious code in wm-mapper (npm) (malicious package) - [MAL-2026-4823](https://insights.sbomify.com/MAL-2026-4823/): Malicious code in msc-terminal (npm) (malicious package) - [MAL-2026-4822](https://insights.sbomify.com/MAL-2026-4822/): Malicious code in loadtest-browser-lib (npm) (malicious package) - [MAL-2026-4820](https://insights.sbomify.com/MAL-2026-4820/): Malicious code in datapipe-util (PyPI) (malicious package) - [MAL-2026-482](https://insights.sbomify.com/MAL-2026-482/): Malicious code in public-site-boostmoney-ui (npm) (malicious package) - [MAL-2026-4819](https://insights.sbomify.com/MAL-2026-4819/): Malicious code in token-me-uk (npm) (malicious package) - [MAL-2026-4818](https://insights.sbomify.com/MAL-2026-4818/): Malicious code in saturn-bail (npm) (malicious package) - [MAL-2026-4817](https://insights.sbomify.com/MAL-2026-4817/): Malicious code in chainix (npm) (malicious package) - [MAL-2026-4815](https://insights.sbomify.com/MAL-2026-4815/): Malicious code in @slipless/sdk (npm) (malicious package) - [MAL-2026-4814](https://insights.sbomify.com/MAL-2026-4814/): Malicious code in vectordb-engine (PyPI) (malicious package) - [MAL-2026-4812](https://insights.sbomify.com/MAL-2026-4812/): Malicious code in m-at-star-tools (PyPI) (malicious package) - [MAL-2026-4811](https://insights.sbomify.com/MAL-2026-4811/): Malicious code in docontrol-mcp (PyPI) (malicious package) - [MAL-2026-4810](https://insights.sbomify.com/MAL-2026-4810/): Malicious code in binproto (PyPI) (malicious package) - [MAL-2026-481](https://insights.sbomify.com/MAL-2026-481/): Malicious code in oasis-os-provider-messaging (npm) (malicious package) - [MAL-2026-4809](https://insights.sbomify.com/MAL-2026-4809/): Malicious code in baidubsrc (PyPI) (malicious package) - [MAL-2026-4808](https://insights.sbomify.com/MAL-2026-4808/): Malicious code in wm-idp-sdk (npm) (malicious package) - [MAL-2026-4807](https://insights.sbomify.com/MAL-2026-4807/): Malicious code in shop-minis (npm) (malicious package) - [MAL-2026-4806](https://insights.sbomify.com/MAL-2026-4806/): Malicious code in shizukyu (npm) (malicious package) - [MAL-2026-4805](https://insights.sbomify.com/MAL-2026-4805/): Malicious code in metricflow-tracker (npm) (malicious package) - [MAL-2026-4803](https://insights.sbomify.com/MAL-2026-4803/): Malicious code in @fhkry/baileys (npm) (malicious package) - [MAL-2026-4802](https://insights.sbomify.com/MAL-2026-4802/): Malicious code in xlsx-enhanced (npm) (malicious package) - [MAL-2026-4801](https://insights.sbomify.com/MAL-2026-4801/): Malicious code in web3.prc (npm) (malicious package) - [MAL-2026-4800](https://insights.sbomify.com/MAL-2026-4800/): Malicious code in web3-prices (npm) (malicious package) - [MAL-2026-480](https://insights.sbomify.com/MAL-2026-480/): Malicious code in kwp-shared-components-production-system (npm) (malicious package) - [MAL-2026-48](https://insights.sbomify.com/MAL-2026-48/): Malicious code in shop-state (npm) (malicious package) - [MAL-2026-4799](https://insights.sbomify.com/MAL-2026-4799/): Malicious code in pdf-lib-enhanced (npm) (malicious package) - [MAL-2026-4798](https://insights.sbomify.com/MAL-2026-4798/): Malicious code in jsonlogbundler (npm) (malicious package) - [MAL-2026-4797](https://insights.sbomify.com/MAL-2026-4797/): Malicious code in int-node (npm) (malicious package) - [MAL-2026-4796](https://insights.sbomify.com/MAL-2026-4796/): Malicious code in fastjsonlog (npm) (malicious package) - [MAL-2026-4793](https://insights.sbomify.com/MAL-2026-4793/): Malicious code in vxui-react (npm) (malicious package) - [MAL-2026-4792](https://insights.sbomify.com/MAL-2026-4792/): Malicious code in react-json-chalk (npm) (malicious package) - [MAL-2026-4791](https://insights.sbomify.com/MAL-2026-4791/): Malicious code in react-cleaner (npm) (malicious package) - [MAL-2026-479](https://insights.sbomify.com/MAL-2026-479/): Malicious code in integromat-ui (npm) (malicious package) - [MAL-2026-4785](https://insights.sbomify.com/MAL-2026-4785/): Malicious code in test-nonmal-pkg-5 (npm) (malicious package) - [MAL-2026-4784](https://insights.sbomify.com/MAL-2026-4784/): Malicious code in react-ui-polyfills (npm) (malicious package) - [MAL-2026-4781](https://insights.sbomify.com/MAL-2026-4781/): Malicious code in unique-id-64 (npm) (malicious package) - [MAL-2026-4780](https://insights.sbomify.com/MAL-2026-4780/): Malicious code in reasonix-plugmem (npm) (malicious package) - [MAL-2026-478](https://insights.sbomify.com/MAL-2026-478/): Malicious code in domino-elements (npm) (malicious package) - [MAL-2026-4779](https://insights.sbomify.com/MAL-2026-4779/): Malicious code in ether-bn.js (npm) (malicious package) - [MAL-2026-4778](https://insights.sbomify.com/MAL-2026-4778/): Malicious code in 1cat-tunnel-client-zx (npm) (malicious package) - [MAL-2026-4777](https://insights.sbomify.com/MAL-2026-4777/): Malicious code in xct-x-ayoub (PyPI) (malicious package) - [MAL-2026-4776](https://insights.sbomify.com/MAL-2026-4776/): Malicious code in whatsfly-labfox (PyPI) (malicious package) - [MAL-2026-4775](https://insights.sbomify.com/MAL-2026-4775/): Malicious code in wdt-erpmcp (PyPI) (malicious package) - [MAL-2026-4774](https://insights.sbomify.com/MAL-2026-4774/): Malicious code in vulndify-mcp-server (PyPI) (malicious package) - [MAL-2026-4773](https://insights.sbomify.com/MAL-2026-4773/): Malicious code in vlifegram (PyPI) (malicious package) - [MAL-2026-4772](https://insights.sbomify.com/MAL-2026-4772/): Malicious code in txdpy (PyPI) (malicious package) - [MAL-2026-4770](https://insights.sbomify.com/MAL-2026-4770/): Malicious code in spip-pth-demo (PyPI) (malicious package) - [MAL-2026-477](https://insights.sbomify.com/MAL-2026-477/): Malicious code in bttr-devs (npm) (malicious package) - [MAL-2026-4769](https://insights.sbomify.com/MAL-2026-4769/): Malicious code in soundsource (PyPI) (malicious package) - [MAL-2026-4768](https://insights.sbomify.com/MAL-2026-4768/): Malicious code in sklern (PyPI) (malicious package) - [MAL-2026-4767](https://insights.sbomify.com/MAL-2026-4767/): Malicious code in silly-logger (PyPI) (malicious package) - [MAL-2026-4764](https://insights.sbomify.com/MAL-2026-4764/): Malicious code in pycalendar-api (PyPI) (malicious package) - [MAL-2026-476](https://insights.sbomify.com/MAL-2026-476/): Malicious code in @transaction-list/transaction-list-xs (npm) (malicious package) - [MAL-2026-4758](https://insights.sbomify.com/MAL-2026-4758/): Malicious code in nebulix-ai (PyPI) (malicious package) - [MAL-2026-4757](https://insights.sbomify.com/MAL-2026-4757/): Malicious code in morin (PyPI) (malicious package) - [MAL-2026-4756](https://insights.sbomify.com/MAL-2026-4756/): Malicious code in ml2000 (PyPI) (malicious package) - [MAL-2026-4755](https://insights.sbomify.com/MAL-2026-4755/): Malicious code in mathepy (PyPI) (malicious package) - [MAL-2026-4753](https://insights.sbomify.com/MAL-2026-4753/): Malicious code in gt-tester-exp-profiler-exp-00000017 (PyPI) (malicious package) - [MAL-2026-4752](https://insights.sbomify.com/MAL-2026-4752/): Malicious code in gt-tester-exp-profiler-exp-00000015 (PyPI) (malicious package) - [MAL-2026-4751](https://insights.sbomify.com/MAL-2026-4751/): Malicious code in glass-of-water (PyPI) (malicious package) - [MAL-2026-475](https://insights.sbomify.com/MAL-2026-475/): Malicious code in @transaction-list/transaction-list-sm (npm) (malicious package) - [MAL-2026-4749](https://insights.sbomify.com/MAL-2026-4749/): Malicious code in fakehuop (PyPI) (malicious package) - [MAL-2026-4748](https://insights.sbomify.com/MAL-2026-4748/): Malicious code in eplang (PyPI) (malicious package) - [MAL-2026-4743](https://insights.sbomify.com/MAL-2026-4743/): Malicious code in buddyme (PyPI) (malicious package) - [MAL-2026-4741](https://insights.sbomify.com/MAL-2026-4741/): Malicious code in aurafarmer (PyPI) (malicious package) - [MAL-2026-4740](https://insights.sbomify.com/MAL-2026-4740/): Malicious code in zod-to-js (npm) (malicious package) - [MAL-2026-474](https://insights.sbomify.com/MAL-2026-474/): Malicious code in @transaction-list/transaction-list-md (npm) (malicious package) - [MAL-2026-4739](https://insights.sbomify.com/MAL-2026-4739/): Malicious code in zkjson (npm) (malicious package) - [MAL-2026-4738](https://insights.sbomify.com/MAL-2026-4738/): Malicious code in zest-product (npm) (malicious package) - [MAL-2026-4737](https://insights.sbomify.com/MAL-2026-4737/): Malicious code in your-unique-package-name1 (npm) (malicious package) - [MAL-2026-4736](https://insights.sbomify.com/MAL-2026-4736/): Malicious code in yessir-node (npm) (malicious package) - [MAL-2026-4735](https://insights.sbomify.com/MAL-2026-4735/): Malicious code in xy-ai-chat (npm) (malicious package) - [MAL-2026-4734](https://insights.sbomify.com/MAL-2026-4734/): Malicious code in xorma-js (npm) (malicious package) - [MAL-2026-4733](https://insights.sbomify.com/MAL-2026-4733/): Malicious code in wrld-dev (npm) (malicious package) - [MAL-2026-4731](https://insights.sbomify.com/MAL-2026-4731/): Malicious code in wml-core (npm) (malicious package) - [MAL-2026-4730](https://insights.sbomify.com/MAL-2026-4730/): Malicious code in wml-components (npm) (malicious package) - [MAL-2026-473](https://insights.sbomify.com/MAL-2026-473/): Malicious code in @transaction-list/transaction-list-lg (npm) (malicious package) - [MAL-2026-4729](https://insights.sbomify.com/MAL-2026-4729/): Malicious code in whiteboard-agent (npm) (malicious package) - [MAL-2026-4728](https://insights.sbomify.com/MAL-2026-4728/): Malicious code in web-dotenv (npm) (malicious package) - [MAL-2026-4727](https://insights.sbomify.com/MAL-2026-4727/): Malicious code in weavedb-warp-contracts-plugin-deploy (npm) (malicious package) - [MAL-2026-4726](https://insights.sbomify.com/MAL-2026-4726/): Malicious code in weavedb-tools (npm) (malicious package) - [MAL-2026-4725](https://insights.sbomify.com/MAL-2026-4725/): Malicious code in weavedb-sdk-node (npm) (malicious package) - [MAL-2026-4724](https://insights.sbomify.com/MAL-2026-4724/): Malicious code in weavedb-sdk-base (npm) (malicious package) - [MAL-2026-4723](https://insights.sbomify.com/MAL-2026-4723/): Malicious code in weavedb-sdk (npm) (malicious package) - [MAL-2026-4722](https://insights.sbomify.com/MAL-2026-4722/): Malicious code in weavedb-offchain (npm) (malicious package) - [MAL-2026-4721](https://insights.sbomify.com/MAL-2026-4721/): Malicious code in weavedb-node-client (npm) (malicious package) - [MAL-2026-4720](https://insights.sbomify.com/MAL-2026-4720/): Malicious code in weavedb-lite (npm) (malicious package) - [MAL-2026-472](https://insights.sbomify.com/MAL-2026-472/): Malicious code in @landing-platform/data-bridge (npm) (malicious package) - [MAL-2026-4719](https://insights.sbomify.com/MAL-2026-4719/): Malicious code in weavedb-exm-sdk-web (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/67/