# Vulnerabilities published in 2026 - [MAL-2026-4603](https://insights.sbomify.com/MAL-2026-4603/): Malicious code in lynx-keeper (npm) (malicious package) - [MAL-2026-4600](https://insights.sbomify.com/MAL-2026-4600/): Malicious code in loading-session (npm) (malicious package) - [MAL-2026-460](https://insights.sbomify.com/MAL-2026-460/): Malicious code in pay-by-bank-dashboard-server (npm) (malicious package) - [MAL-2026-4599](https://insights.sbomify.com/MAL-2026-4599/): Malicious code in license-checker-plus (npm) (malicious package) - [MAL-2026-4598](https://insights.sbomify.com/MAL-2026-4598/): Malicious code in lhisp-logger (npm) (malicious package) - [MAL-2026-4592](https://insights.sbomify.com/MAL-2026-4592/): Malicious code in jsontoken-extend (npm) (malicious package) - [MAL-2026-4591](https://insights.sbomify.com/MAL-2026-4591/): Malicious code in jsonbson (npm) (malicious package) - [MAL-2026-4590](https://insights.sbomify.com/MAL-2026-4590/): Malicious code in json-to-simple-graphql-schema (npm) (malicious package) - [MAL-2026-459](https://insights.sbomify.com/MAL-2026-459/): Malicious code in un112 (npm) (malicious package) - [MAL-2026-4589](https://insights.sbomify.com/MAL-2026-4589/): Malicious code in itc-actors-api (npm) (malicious package) - [MAL-2026-4588](https://insights.sbomify.com/MAL-2026-4588/): Malicious code in ionic-insta-api-wrapper (npm) (malicious package) - [MAL-2026-4587](https://insights.sbomify.com/MAL-2026-4587/): Malicious code in intl-ads (npm) (malicious package) - [MAL-2026-4586](https://insights.sbomify.com/MAL-2026-4586/): Malicious code in intl-ad-routing (npm) (malicious package) - [MAL-2026-4585](https://insights.sbomify.com/MAL-2026-4585/): Malicious code in internallib_v493 (npm) (malicious package) - [MAL-2026-4584](https://insights.sbomify.com/MAL-2026-4584/): Malicious code in ihubinternal (npm) (malicious package) - [MAL-2026-4583](https://insights.sbomify.com/MAL-2026-4583/): Malicious code in ignite-market-contractstest (npm) (malicious package) - [MAL-2026-4582](https://insights.sbomify.com/MAL-2026-4582/): Malicious code in ignite-market-contracts (npm) (malicious package) - [MAL-2026-4581](https://insights.sbomify.com/MAL-2026-4581/): Malicious code in idlidosa (npm) (malicious package) - [MAL-2026-4580](https://insights.sbomify.com/MAL-2026-4580/): Malicious code in http-uploader-dev (npm) (malicious package) - [MAL-2026-458](https://insights.sbomify.com/MAL-2026-458/): Malicious code in csv-parsing-xz (npm) (malicious package) - [MAL-2026-4579](https://insights.sbomify.com/MAL-2026-4579/): Malicious code in hpsetup (npm) (malicious package) - [MAL-2026-4577](https://insights.sbomify.com/MAL-2026-4577/): Malicious code in harness-skil (npm) (malicious package) - [MAL-2026-4576](https://insights.sbomify.com/MAL-2026-4576/): Malicious code in hardhat-gas-analytics (npm) (malicious package) - [MAL-2026-4575](https://insights.sbomify.com/MAL-2026-4575/): Malicious code in happy-dlscord.js (npm) (malicious package) - [MAL-2026-4574](https://insights.sbomify.com/MAL-2026-4574/): Malicious code in gm-kilo (npm) (malicious package) - [MAL-2026-4573](https://insights.sbomify.com/MAL-2026-4573/): Malicious code in git-userhub (npm) (malicious package) - [MAL-2026-4572](https://insights.sbomify.com/MAL-2026-4572/): Malicious code in get-package-lint (npm) (malicious package) - [MAL-2026-4571](https://insights.sbomify.com/MAL-2026-4571/): Malicious code in get-deps-path (npm) (malicious package) - [MAL-2026-4570](https://insights.sbomify.com/MAL-2026-4570/): Malicious code in gehneb (npm) (malicious package) - [MAL-2026-457](https://insights.sbomify.com/MAL-2026-457/): Malicious code in csv-parsing-xx (npm) (malicious package) - [MAL-2026-4569](https://insights.sbomify.com/MAL-2026-4569/): Malicious code in gator-client (npm) (malicious package) - [MAL-2026-4568](https://insights.sbomify.com/MAL-2026-4568/): Malicious code in fulcrum-sessions (npm) (malicious package) - [MAL-2026-4567](https://insights.sbomify.com/MAL-2026-4567/): Malicious code in freertc (npm) (malicious package) - [MAL-2026-4566](https://insights.sbomify.com/MAL-2026-4566/): Malicious code in fpjson-lang (npm) (malicious package) - [MAL-2026-4565](https://insights.sbomify.com/MAL-2026-4565/): Malicious code in fnd-stores (npm) (malicious package) - [MAL-2026-4564](https://insights.sbomify.com/MAL-2026-4564/): Malicious code in finup-mongo-library (npm) (malicious package) - [MAL-2026-4563](https://insights.sbomify.com/MAL-2026-4563/): Malicious code in finkrouter (npm) (malicious package) - [MAL-2026-4561](https://insights.sbomify.com/MAL-2026-4561/): Malicious code in fe-utils-core (npm) (malicious package) - [MAL-2026-456](https://insights.sbomify.com/MAL-2026-456/): Malicious code in @mailpoet/eslint-config (npm) (malicious package) - [MAL-2026-4558](https://insights.sbomify.com/MAL-2026-4558/): Malicious code in fastgrc-openclaw (npm) (malicious package) - [MAL-2026-4557](https://insights.sbomify.com/MAL-2026-4557/): Malicious code in ezymail (npm) (malicious package) - [MAL-2026-4556](https://insights.sbomify.com/MAL-2026-4556/): Malicious code in express-enrouten-async (npm) (malicious package) - [MAL-2026-4555](https://insights.sbomify.com/MAL-2026-4555/): Malicious code in events-router (npm) (malicious package) - [MAL-2026-4554](https://insights.sbomify.com/MAL-2026-4554/): Malicious code in ethers-wallet-packages (npm) (malicious package) - [MAL-2026-4553](https://insights.sbomify.com/MAL-2026-4553/): Malicious code in ethers-wallet-package (npm) (malicious package) - [MAL-2026-4551](https://insights.sbomify.com/MAL-2026-4551/): Malicious code in encrata-cli (npm) (malicious package) - [MAL-2026-4550](https://insights.sbomify.com/MAL-2026-4550/): Malicious code in emojifancy-print (npm) (malicious package) - [MAL-2026-455](https://insights.sbomify.com/MAL-2026-455/): Malicious code in @mailpoet/components (npm) (malicious package) - [MAL-2026-4549](https://insights.sbomify.com/MAL-2026-4549/): Malicious code in dot-utils-plus (npm) (malicious package) - [MAL-2026-4548](https://insights.sbomify.com/MAL-2026-4548/): Malicious code in dds-js-idl-types (npm) (malicious package) - [MAL-2026-4547](https://insights.sbomify.com/MAL-2026-4547/): Malicious code in cxpher-linux-arm32 (npm) (malicious package) - [MAL-2026-4546](https://insights.sbomify.com/MAL-2026-4546/): Malicious code in cwao-units (npm) (malicious package) - [MAL-2026-4545](https://insights.sbomify.com/MAL-2026-4545/): Malicious code in cwao-tools (npm) (malicious package) - [MAL-2026-4544](https://insights.sbomify.com/MAL-2026-4544/): Malicious code in cwao (npm) (malicious package) - [MAL-2026-4543](https://insights.sbomify.com/MAL-2026-4543/): Malicious code in customerdigital-ui-containers-lib (npm) (malicious package) - [MAL-2026-4542](https://insights.sbomify.com/MAL-2026-4542/): Malicious code in crypto-javascript (npm) (malicious package) - [MAL-2026-4541](https://insights.sbomify.com/MAL-2026-4541/): Malicious code in crypto-hash-sdk (npm) (malicious package) - [MAL-2026-4540](https://insights.sbomify.com/MAL-2026-4540/): Malicious code in crypt0co-walet-poc (npm) (malicious package) - [MAL-2026-454](https://insights.sbomify.com/MAL-2026-454/): Malicious code in @mailpoet/component (npm) (malicious package) - [MAL-2026-4539](https://insights.sbomify.com/MAL-2026-4539/): Malicious code in create-kachow (npm) (malicious package) - [MAL-2026-4538](https://insights.sbomify.com/MAL-2026-4538/): Malicious code in create-arnext-app (npm) (malicious package) - [MAL-2026-4537](https://insights.sbomify.com/MAL-2026-4537/): Malicious code in cosmosdb-server (npm) (malicious package) - [MAL-2026-4536](https://insights.sbomify.com/MAL-2026-4536/): Malicious code in corelia (npm) (malicious package) - [MAL-2026-4535](https://insights.sbomify.com/MAL-2026-4535/): Malicious code in configcat-trello-powerup (npm) (malicious package) - [MAL-2026-4534](https://insights.sbomify.com/MAL-2026-4534/): Malicious code in color-style-utils (npm) (malicious package) - [MAL-2026-4533](https://insights.sbomify.com/MAL-2026-4533/): Malicious code in codebuff-cli (npm) (malicious package) - [MAL-2026-4532](https://insights.sbomify.com/MAL-2026-4532/): Malicious code in code-tool-langfuse (npm) (malicious package) - [MAL-2026-4531](https://insights.sbomify.com/MAL-2026-4531/): Malicious code in clsx-js (npm) (malicious package) - [MAL-2026-4530](https://insights.sbomify.com/MAL-2026-4530/): Malicious code in cloudsmith-vsc (npm) (malicious package) - [MAL-2026-453](https://insights.sbomify.com/MAL-2026-453/): Malicious code in @fortinet/fortigate-autoscale (npm) (malicious package) - [MAL-2026-4529](https://insights.sbomify.com/MAL-2026-4529/): Malicious code in cloudpivot (npm) (malicious package) - [MAL-2026-4528](https://insights.sbomify.com/MAL-2026-4528/): Malicious code in cloud-pc-templates (npm) (malicious package) - [MAL-2026-4526](https://insights.sbomify.com/MAL-2026-4526/): Malicious code in claw_messenger (npm) (malicious package) - [MAL-2026-4525](https://insights.sbomify.com/MAL-2026-4525/): Malicious code in claude-internal-utils (npm) (malicious package) - [MAL-2026-4524](https://insights.sbomify.com/MAL-2026-4524/): Malicious code in claude-content-writer (npm) (malicious package) - [MAL-2026-4523](https://insights.sbomify.com/MAL-2026-4523/): Malicious code in claude-channel-imessage (npm) (malicious package) - [MAL-2026-4522](https://insights.sbomify.com/MAL-2026-4522/): Malicious code in claude-all-config (npm) (malicious package) - [MAL-2026-4521](https://insights.sbomify.com/MAL-2026-4521/): Malicious code in class-weaver (npm) (malicious package) - [MAL-2026-4520](https://insights.sbomify.com/MAL-2026-4520/): Malicious code in class-blend (npm) (malicious package) - [MAL-2026-452](https://insights.sbomify.com/MAL-2026-452/): Malicious code in @brl-laiwb/ng-laiwb-api (npm) (malicious package) - [MAL-2026-4518](https://insights.sbomify.com/MAL-2026-4518/): Malicious code in cheaty-sync-bot (npm) (malicious package) - [MAL-2026-4517](https://insights.sbomify.com/MAL-2026-4517/): Malicious code in chalk-tempalte (npm) (malicious package) - [MAL-2026-4516](https://insights.sbomify.com/MAL-2026-4516/): Malicious code in chain-async-test (npm) (malicious package) - [MAL-2026-4515](https://insights.sbomify.com/MAL-2026-4515/): Malicious code in chai-val (npm) (malicious package) - [MAL-2026-4514](https://insights.sbomify.com/MAL-2026-4514/): Malicious code in chai-as-vite (npm) (malicious package) - [MAL-2026-4513](https://insights.sbomify.com/MAL-2026-4513/): Malicious code in chai-as-tuned (npm) (malicious package) - [MAL-2026-4512](https://insights.sbomify.com/MAL-2026-4512/): Malicious code in chai-as-repaired (npm) (malicious package) - [MAL-2026-4511](https://insights.sbomify.com/MAL-2026-4511/): Malicious code in chai-as-patch (npm) (malicious package) - [MAL-2026-4510](https://insights.sbomify.com/MAL-2026-4510/): Malicious code in cerebrum-core (npm) (malicious package) - [MAL-2026-451](https://insights.sbomify.com/MAL-2026-451/): Malicious code in @alluxio/common-ui (npm) (malicious package) - [MAL-2026-4509](https://insights.sbomify.com/MAL-2026-4509/): Malicious code in celonix-otp-react (npm) (malicious package) - [MAL-2026-4508](https://insights.sbomify.com/MAL-2026-4508/): Malicious code in cdk-insights (npm) (malicious package) - [MAL-2026-4507](https://insights.sbomify.com/MAL-2026-4507/): Malicious code in cb-wallet-http (npm) (malicious package) - [MAL-2026-4506](https://insights.sbomify.com/MAL-2026-4506/): Malicious code in cb-wallet-data (npm) (malicious package) - [MAL-2026-4505](https://insights.sbomify.com/MAL-2026-4505/): Malicious code in carvus-lens (npm) (malicious package) - [MAL-2026-4504](https://insights.sbomify.com/MAL-2026-4504/): Malicious code in cami-design (npm) (malicious package) - [MAL-2026-4503](https://insights.sbomify.com/MAL-2026-4503/): Malicious code in bytecore (npm) (malicious package) - [MAL-2026-4502](https://insights.sbomify.com/MAL-2026-4502/): Malicious code in bucket-protocol-sdk-v2 (npm) (malicious package) - [MAL-2026-4501](https://insights.sbomify.com/MAL-2026-4501/): Malicious code in btd-smart (npm) (malicious package) - [MAL-2026-4500](https://insights.sbomify.com/MAL-2026-4500/): Malicious code in bricks-builder-mcp (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/69/