# Vulnerabilities published in 2026


- [MAL-2026-450](https://insights.sbomify.com/MAL-2026-450/): Malicious code in sympy-dev (PyPI) (malicious package)
- [MAL-2026-45](https://insights.sbomify.com/MAL-2026-45/): Malicious code in @signify/vue-components (npm) (malicious package)
- [MAL-2026-4499](https://insights.sbomify.com/MAL-2026-4499/): Malicious code in bolt-delivery-menu-app (npm) (malicious package)
- [MAL-2026-4498](https://insights.sbomify.com/MAL-2026-4498/): Malicious code in bitrix24-tasks-mcp-server (npm) (malicious package)
- [MAL-2026-4497](https://insights.sbomify.com/MAL-2026-4497/): Malicious code in bingocode (npm) (malicious package)
- [MAL-2026-4496](https://insights.sbomify.com/MAL-2026-4496/): Malicious code in bandkit (npm) (malicious package)
- [MAL-2026-4495](https://insights.sbomify.com/MAL-2026-4495/): Malicious code in banana-stand (npm) (malicious package)
- [MAL-2026-4494](https://insights.sbomify.com/MAL-2026-4494/): Malicious code in axois-utils (npm) (malicious package)
- [MAL-2026-4493](https://insights.sbomify.com/MAL-2026-4493/): Malicious code in axiosqqq (npm) (malicious package)
- [MAL-2026-4492](https://insights.sbomify.com/MAL-2026-4492/): Malicious code in autoheal-dev-cli (npm) (malicious package)
- [MAL-2026-4491](https://insights.sbomify.com/MAL-2026-4491/): Malicious code in authcascade (npm) (malicious package)
- [MAL-2026-4490](https://insights.sbomify.com/MAL-2026-4490/): Malicious code in auth0-templates-scripts-utils (npm) (malicious package)
- [MAL-2026-449](https://insights.sbomify.com/MAL-2026-449/): Malicious code in icloudprocessor (PyPI) (malicious package)
- [MAL-2026-4489](https://insights.sbomify.com/MAL-2026-4489/): Malicious code in auth0-templates-scripts (npm) (malicious package)
- [MAL-2026-4488](https://insights.sbomify.com/MAL-2026-4488/): Malicious code in auth-basic-vault (npm) (malicious package)
- [MAL-2026-4487](https://insights.sbomify.com/MAL-2026-4487/): Malicious code in audit-logsss (npm) (malicious package)
- [MAL-2026-4486](https://insights.sbomify.com/MAL-2026-4486/): Malicious code in atomic-notes (npm) (malicious package)
- [MAL-2026-4483](https://insights.sbomify.com/MAL-2026-4483/): Malicious code in arnext-arkb (npm) (malicious package)
- [MAL-2026-4482](https://insights.sbomify.com/MAL-2026-4482/): Malicious code in arnext (npm) (malicious package)
- [MAL-2026-4481](https://insights.sbomify.com/MAL-2026-4481/): Malicious code in arc-diag-util (npm) (malicious package)
- [MAL-2026-4480](https://insights.sbomify.com/MAL-2026-4480/): Malicious code in aonote (npm) (malicious package)
- [MAL-2026-448](https://insights.sbomify.com/MAL-2026-448/): Malicious code in rank253222 (npm) (malicious package)
- [MAL-2026-4479](https://insights.sbomify.com/MAL-2026-4479/): Malicious code in anthropic-shared-logger (npm) (malicious package)
- [MAL-2026-4477](https://insights.sbomify.com/MAL-2026-4477/): Malicious code in allbridge-example-react (npm) (malicious package)
- [MAL-2026-4476](https://insights.sbomify.com/MAL-2026-4476/): Malicious code in ai3 (npm) (malicious package)
- [MAL-2026-4475](https://insights.sbomify.com/MAL-2026-4475/): Malicious code in aes-decode-runner-pro (npm) (malicious package)
- [MAL-2026-4473](https://insights.sbomify.com/MAL-2026-4473/): Malicious code in @zizie071/libsignal-node (npm) (malicious package)
- [MAL-2026-4472](https://insights.sbomify.com/MAL-2026-4472/): Malicious code in @zhengshuo888/huoke (npm) (malicious package)
- [MAL-2026-447](https://insights.sbomify.com/MAL-2026-447/): Malicious code in ttam-ploy (PyPI) (malicious package)
- [MAL-2026-4467](https://insights.sbomify.com/MAL-2026-4467/): Malicious code in @weirdorg/dotenv (npm) (malicious package)
- [MAL-2026-4466](https://insights.sbomify.com/MAL-2026-4466/): Malicious code in @weirdorg/config (npm) (malicious package)
- [MAL-2026-4465](https://insights.sbomify.com/MAL-2026-4465/): Malicious code in @web-3d-tool/sdk (npm) (malicious package)
- [MAL-2026-4464](https://insights.sbomify.com/MAL-2026-4464/): Malicious code in @vtmn-play/react (npm) (malicious package)
- [MAL-2026-4463](https://insights.sbomify.com/MAL-2026-4463/): Malicious code in @vivaux/telemetry (npm) (malicious package)
- [MAL-2026-4460](https://insights.sbomify.com/MAL-2026-4460/): Malicious code in @trackking/core (npm) (malicious package)
- [MAL-2026-446](https://insights.sbomify.com/MAL-2026-446/): Malicious code in code-transfering-4 (PyPI) (malicious package)
- [MAL-2026-445](https://insights.sbomify.com/MAL-2026-445/): Malicious code in code-transfering-3 (PyPI) (malicious package)
- [MAL-2026-4446](https://insights.sbomify.com/MAL-2026-4446/): Malicious code in @solarcraft/observix (npm) (malicious package)
- [MAL-2026-4444](https://insights.sbomify.com/MAL-2026-4444/): Malicious code in @shwfed/nuxt (npm) (malicious package)
- [MAL-2026-4440](https://insights.sbomify.com/MAL-2026-4440/): Malicious code in @serviceshub/x-web-core (npm) (malicious package)
- [MAL-2026-444](https://insights.sbomify.com/MAL-2026-444/): Malicious code in terminalbrush (PyPI) (malicious package)
- [MAL-2026-4439](https://insights.sbomify.com/MAL-2026-4439/): Malicious code in @service-user-notifications/set_notifications_not_removable (npm) (malicious package)
- [MAL-2026-4438](https://insights.sbomify.com/MAL-2026-4438/): Malicious code in @service-suppliers/suppliers (npm) (malicious package)
- [MAL-2026-4437](https://insights.sbomify.com/MAL-2026-4437/): Malicious code in @service-suppliers/set_selected_supplier (npm) (malicious package)
- [MAL-2026-4436](https://insights.sbomify.com/MAL-2026-4436/): Malicious code in @service-suppliers/select-supplier-watcher-saga (npm) (malicious package)
- [MAL-2026-4435](https://insights.sbomify.com/MAL-2026-4435/): Malicious code in @service-suppliers/fetch_suppliers_action_saga (npm) (malicious package)
- [MAL-2026-4432](https://insights.sbomify.com/MAL-2026-4432/): Malicious code in @sec-loans-ui/utils (npm) (malicious package)
- [MAL-2026-443](https://insights.sbomify.com/MAL-2026-443/): Malicious code in 1q847 (PyPI) (malicious package)
- [MAL-2026-4427](https://insights.sbomify.com/MAL-2026-4427/): Malicious code in @rocketreach/rr-components (npm) (malicious package)
- [MAL-2026-4425](https://insights.sbomify.com/MAL-2026-4425/): Malicious code in @riskine-frontend/design-elements (npm) (malicious package)
- [MAL-2026-4424](https://insights.sbomify.com/MAL-2026-4424/): Malicious code in @remitee-money-transfer/rmt-base (npm) (malicious package)
- [MAL-2026-4422](https://insights.sbomify.com/MAL-2026-4422/): Malicious code in @qwedqwed/axios (npm) (malicious package)
- [MAL-2026-4421](https://insights.sbomify.com/MAL-2026-4421/): Malicious code in @pulse-web-platform-core/scripts-loader (npm) (malicious package)
- [MAL-2026-4420](https://insights.sbomify.com/MAL-2026-4420/): Malicious code in @polka-ui/loader (npm) (malicious package)
- [MAL-2026-442](https://insights.sbomify.com/MAL-2026-442/): Malicious code in xadauiom (PyPI) (malicious package)
- [MAL-2026-4418](https://insights.sbomify.com/MAL-2026-4418/): Malicious code in @pluxee-connect/api-client (npm) (malicious package)
- [MAL-2026-441](https://insights.sbomify.com/MAL-2026-441/): Malicious code in spellcheckpy (PyPI) (malicious package)
- [MAL-2026-4404](https://insights.sbomify.com/MAL-2026-4404/): Malicious code in @loans/vehicles-api (npm) (malicious package)
- [MAL-2026-440](https://insights.sbomify.com/MAL-2026-440/): Malicious code in anduril-lattice-sdk-grpc-python (PyPI) (malicious package)
- [MAL-2026-44](https://insights.sbomify.com/MAL-2026-44/): Malicious code in @airtel-web/legos (npm) (malicious package)
- [MAL-2026-4396](https://insights.sbomify.com/MAL-2026-4396/): Malicious code in @izumiswap/sdk (npm) (malicious package)
- [MAL-2026-4394](https://insights.sbomify.com/MAL-2026-4394/): Malicious code in @ikyyofc/gemini-cli (npm) (malicious package)
- [MAL-2026-4393](https://insights.sbomify.com/MAL-2026-4393/): Malicious code in @hanssoft/libsignal-node (npm) (malicious package)
- [MAL-2026-4391](https://insights.sbomify.com/MAL-2026-4391/): Malicious code in @gad360/apothem (npm) (malicious package)
- [MAL-2026-439](https://insights.sbomify.com/MAL-2026-439/): Malicious code in tv-admin-commons (npm) (malicious package)
- [MAL-2026-4389](https://insights.sbomify.com/MAL-2026-4389/): Malicious code in @flipbit2-bb/test-auth-state (npm) (malicious package)
- [MAL-2026-4385](https://insights.sbomify.com/MAL-2026-4385/): Malicious code in @druids/ui (npm) (malicious package)
- [MAL-2026-4382](https://insights.sbomify.com/MAL-2026-4382/): Malicious code in @djessicatony/folk-mcp-canary (npm) (malicious package)
- [MAL-2026-438](https://insights.sbomify.com/MAL-2026-438/): Malicious code in ts-tweetnacl-utils (npm) (malicious package)
- [MAL-2026-4379](https://insights.sbomify.com/MAL-2026-4379/): Malicious code in @deadcode09284814/axios-util (npm) (malicious package)
- [MAL-2026-4378](https://insights.sbomify.com/MAL-2026-4378/): Malicious code in @databus-service-ui/scroll-up-content (npm) (malicious package)
- [MAL-2026-437](https://insights.sbomify.com/MAL-2026-437/): Malicious code in lumo-api-client (npm) (malicious package)
- [MAL-2026-436](https://insights.sbomify.com/MAL-2026-436/): Malicious code in jquery-ajaxchimp (npm) (malicious package)
- [MAL-2026-4358](https://insights.sbomify.com/MAL-2026-4358/): Malicious code in mistral-search-toolkit (PyPI) (malicious package)
- [MAL-2026-4357](https://insights.sbomify.com/MAL-2026-4357/): Malicious code in helu (PyPI) (malicious package)
- [MAL-2026-4356](https://insights.sbomify.com/MAL-2026-4356/): Malicious code in testing-on-npmjs (npm) (malicious package)
- [MAL-2026-4355](https://insights.sbomify.com/MAL-2026-4355/): Malicious code in mistral-workflows-plugins-webhook (PyPI) (malicious package)
- [MAL-2026-4354](https://insights.sbomify.com/MAL-2026-4354/): Malicious code in mistral-workflows-plugins-mistralai (PyPI) (malicious package)
- [MAL-2026-4353](https://insights.sbomify.com/MAL-2026-4353/): Malicious code in mistral-workflows (PyPI) (malicious package)
- [MAL-2026-4352](https://insights.sbomify.com/MAL-2026-4352/): Malicious code in xarc-webpack-cli (npm) (malicious package)
- [MAL-2026-4351](https://insights.sbomify.com/MAL-2026-4351/): Malicious code in @databus-service-ui/ui-event (npm) (malicious package)
- [MAL-2026-4350](https://insights.sbomify.com/MAL-2026-4350/): Malicious code in clobprice.api (npm) (malicious package)
- [MAL-2026-435](https://insights.sbomify.com/MAL-2026-435/): Malicious code in aligntype (npm) (malicious package)
- [MAL-2026-4349](https://insights.sbomify.com/MAL-2026-4349/): Malicious code in clob.api (npm) (malicious package)
- [MAL-2026-4348](https://insights.sbomify.com/MAL-2026-4348/): Malicious code in api-rs-node (npm) (malicious package)
- [MAL-2026-4347](https://insights.sbomify.com/MAL-2026-4347/): Malicious code in @devcarron/clob (npm) (malicious package)
- [MAL-2026-4346](https://insights.sbomify.com/MAL-2026-4346/): Malicious code in logger-draft (npm) (malicious package)
- [MAL-2026-4345](https://insights.sbomify.com/MAL-2026-4345/): Malicious code in eo-terminal (npm) (malicious package)
- [MAL-2026-4344](https://insights.sbomify.com/MAL-2026-4344/): Malicious code in verify-mycommand (npm) (malicious package)
- [MAL-2026-4343](https://insights.sbomify.com/MAL-2026-4343/): Malicious code in wnba-parent (npm) (malicious package)
- [MAL-2026-4342](https://insights.sbomify.com/MAL-2026-4342/): Malicious code in wm-w5g-preview (npm) (malicious package)
- [MAL-2026-4341](https://insights.sbomify.com/MAL-2026-4341/): Malicious code in wm-plugin-set-walkme-language (npm) (malicious package)
- [MAL-2026-4340](https://insights.sbomify.com/MAL-2026-4340/): Malicious code in wm-plugin-open-teach-me-after-deployable-played (npm) (malicious package)
- [MAL-2026-434](https://insights.sbomify.com/MAL-2026-434/): Malicious code in weaviate-js (npm) (malicious package)
- [MAL-2026-4339](https://insights.sbomify.com/MAL-2026-4339/): Malicious code in wm-plugin-native-functions-restorer (npm) (malicious package)
- [MAL-2026-4338](https://insights.sbomify.com/MAL-2026-4338/): Malicious code in wm-plugin-json-conditions (npm) (malicious package)
- [MAL-2026-4337](https://insights.sbomify.com/MAL-2026-4337/): Malicious code in wm-plugin-create-iframe-capturing (npm) (malicious package)
- [MAL-2026-4336](https://insights.sbomify.com/MAL-2026-4336/): Malicious code in webservices.rest-utils (npm) (malicious package)
- [MAL-2026-4335](https://insights.sbomify.com/MAL-2026-4335/): Malicious code in webservices.rest (npm) (malicious package)
- [MAL-2026-4334](https://insights.sbomify.com/MAL-2026-4334/): Malicious code in vite-plugin-env-compat-plus (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/70/