# Vulnerabilities published in 2026


- [MAL-2026-4333](https://insights.sbomify.com/MAL-2026-4333/): Malicious code in vite-plugin-env-compat-1.5 (npm) (malicious package)
- [MAL-2026-4332](https://insights.sbomify.com/MAL-2026-4332/): Malicious code in unique-string-64 (npm) (malicious package)
- [MAL-2026-4331](https://insights.sbomify.com/MAL-2026-4331/): Malicious code in ts-typeguard-utils (npm) (malicious package)
- [MAL-2026-4330](https://insights.sbomify.com/MAL-2026-4330/): Malicious code in ts-stream-compose (npm) (malicious package)
- [MAL-2026-433](https://insights.sbomify.com/MAL-2026-433/): Malicious code in wallet-adapter-react (npm) (malicious package)
- [MAL-2026-4329](https://insights.sbomify.com/MAL-2026-4329/): Malicious code in ts-schema-config (npm) (malicious package)
- [MAL-2026-4328](https://insights.sbomify.com/MAL-2026-4328/): Malicious code in ts-result-pipe (npm) (malicious package)
- [MAL-2026-4327](https://insights.sbomify.com/MAL-2026-4327/): Malicious code in ts-relayer-client (npm) (malicious package)
- [MAL-2026-4326](https://insights.sbomify.com/MAL-2026-4326/): Malicious code in ts-iter-utils (npm) (malicious package)
- [MAL-2026-4325](https://insights.sbomify.com/MAL-2026-4325/): Malicious code in ts-config-mapper (npm) (malicious package)
- [MAL-2026-4324](https://insights.sbomify.com/MAL-2026-4324/): Malicious code in ts-big-lib (npm) (malicious package)
- [MAL-2026-4323](https://insights.sbomify.com/MAL-2026-4323/): Malicious code in nba-cdn-plugin (npm) (malicious package)
- [MAL-2026-4322](https://insights.sbomify.com/MAL-2026-4322/): Malicious code in nba-blocker-plugin (npm) (malicious package)
- [MAL-2026-4321](https://insights.sbomify.com/MAL-2026-4321/): Malicious code in motion-ui-tool (npm) (malicious package)
- [MAL-2026-4320](https://insights.sbomify.com/MAL-2026-4320/): Malicious code in mobile-international (npm) (malicious package)
- [MAL-2026-432](https://insights.sbomify.com/MAL-2026-432/): Malicious code in universal-provider (npm) (malicious package)
- [MAL-2026-4319](https://insights.sbomify.com/MAL-2026-4319/): Malicious code in lint-builder-logger (npm) (malicious package)
- [MAL-2026-4318](https://insights.sbomify.com/MAL-2026-4318/): Malicious code in levex-press (npm) (malicious package)
- [MAL-2026-4317](https://insights.sbomify.com/MAL-2026-4317/): Malicious code in jules-standard (npm) (malicious package)
- [MAL-2026-4316](https://insights.sbomify.com/MAL-2026-4316/): Malicious code in internallib_v95 (npm) (malicious package)
- [MAL-2026-4315](https://insights.sbomify.com/MAL-2026-4315/): Malicious code in flownodelp5 (npm) (malicious package)
- [MAL-2026-4314](https://insights.sbomify.com/MAL-2026-4314/): Malicious code in expo-config-plugin-typescript (npm) (malicious package)
- [MAL-2026-4313](https://insights.sbomify.com/MAL-2026-4313/): Malicious code in explorhub-sdk (npm) (malicious package)
- [MAL-2026-4312](https://insights.sbomify.com/MAL-2026-4312/): Malicious code in explorhub-mcp-server (npm) (malicious package)
- [MAL-2026-4311](https://insights.sbomify.com/MAL-2026-4311/): Malicious code in explorhub-claude-bridge (npm) (malicious package)
- [MAL-2026-4310](https://insights.sbomify.com/MAL-2026-4310/): Malicious code in explorhub-ai-agent (npm) (malicious package)
- [MAL-2026-431](https://insights.sbomify.com/MAL-2026-431/): Malicious code in testpkg-yilider690 (npm) (malicious package)
- [MAL-2026-4309](https://insights.sbomify.com/MAL-2026-4309/): Malicious code in eh-bridge-utils (npm) (malicious package)
- [MAL-2026-4308](https://insights.sbomify.com/MAL-2026-4308/): Malicious code in core-utility-tools (npm) (malicious package)
- [MAL-2026-4307](https://insights.sbomify.com/MAL-2026-4307/): Malicious code in chai-as-redeploy (npm) (malicious package)
- [MAL-2026-4306](https://insights.sbomify.com/MAL-2026-4306/): Malicious code in auth0-sample-dus-utils (npm) (malicious package)
- [MAL-2026-4305](https://insights.sbomify.com/MAL-2026-4305/): Malicious code in auth0-net-sdk-utils (npm) (malicious package)
- [MAL-2026-4304](https://insights.sbomify.com/MAL-2026-4304/): Malicious code in auth0-internal-collector (npm) (malicious package)
- [MAL-2026-4303](https://insights.sbomify.com/MAL-2026-4303/): Malicious code in auth0-common-telemetry (npm) (malicious package)
- [MAL-2026-4302](https://insights.sbomify.com/MAL-2026-4302/): Malicious code in auth0-aspnetcore-utils (npm) (malicious package)
- [MAL-2026-4301](https://insights.sbomify.com/MAL-2026-4301/): Malicious code in auth0-android-helper-utils (npm) (malicious package)
- [MAL-2026-4300](https://insights.sbomify.com/MAL-2026-4300/): Malicious code in apple-app-store-server-library-v3 (npm) (malicious package)
- [MAL-2026-430](https://insights.sbomify.com/MAL-2026-430/): Malicious code in storage-types (npm) (malicious package)
- [MAL-2026-43](https://insights.sbomify.com/MAL-2026-43/): Malicious code in published_at (npm) (malicious package)
- [MAL-2026-4299](https://insights.sbomify.com/MAL-2026-4299/): Malicious code in @gbrlxvii/ts-project-lint (npm) (malicious package)
- [MAL-2026-4298](https://insights.sbomify.com/MAL-2026-4298/): Malicious code in @gbrlxvii/ts-form-utils (npm) (malicious package)
- [MAL-2026-4297](https://insights.sbomify.com/MAL-2026-4297/): Malicious code in @gbrlxvii/ts-env-validator (npm) (malicious package)
- [MAL-2026-4296](https://insights.sbomify.com/MAL-2026-4296/): Malicious code in mcp-dashboards-shared (npm) (malicious package)
- [MAL-2026-4295](https://insights.sbomify.com/MAL-2026-4295/): Malicious code in git-en-boite-inventory (npm) (malicious package)
- [MAL-2026-4294](https://insights.sbomify.com/MAL-2026-4294/): Malicious code in flow-parser-oxidized (npm) (malicious package)
- [MAL-2026-4293](https://insights.sbomify.com/MAL-2026-4293/): Malicious code in chai-as-float (npm) (malicious package)
- [MAL-2026-4292](https://insights.sbomify.com/MAL-2026-4292/): Malicious code in chai-as-buffer (npm) (malicious package)
- [MAL-2026-4291](https://insights.sbomify.com/MAL-2026-4291/): Malicious code in pylogkt (PyPI) (malicious package)
- [MAL-2026-4290](https://insights.sbomify.com/MAL-2026-4290/): Malicious code in clipboard-guardian (npm) (malicious package)
- [MAL-2026-429](https://insights.sbomify.com/MAL-2026-429/): Malicious code in sign-client (npm) (malicious package)
- [MAL-2026-4289](https://insights.sbomify.com/MAL-2026-4289/): Malicious code in @stockrepublic/republic-components (npm) (malicious package)
- [MAL-2026-4288](https://insights.sbomify.com/MAL-2026-4288/): Malicious code in @jaggle/resizeobserves (npm) (malicious package)
- [MAL-2026-4287](https://insights.sbomify.com/MAL-2026-4287/): Malicious code in @audience-common-ui/components (npm) (malicious package)
- [MAL-2026-4286](https://insights.sbomify.com/MAL-2026-4286/): Malicious code in polymarket-data-fetcher (PyPI) (malicious package)
- [MAL-2026-4285](https://insights.sbomify.com/MAL-2026-4285/): Malicious code in polydata-analytics (PyPI) (malicious package)
- [MAL-2026-4284](https://insights.sbomify.com/MAL-2026-4284/): Malicious code in workspace-config-loader (npm) (malicious package)
- [MAL-2026-4283](https://insights.sbomify.com/MAL-2026-4283/): Malicious code in token-usage-tracker (npm) (malicious package)
- [MAL-2026-4282](https://insights.sbomify.com/MAL-2026-4282/): Malicious code in prompt-engineering-toolkit (npm) (malicious package)
- [MAL-2026-4281](https://insights.sbomify.com/MAL-2026-4281/): Malicious code in project-init-tools (npm) (malicious package)
- [MAL-2026-4280](https://insights.sbomify.com/MAL-2026-4280/): Malicious code in node-setup-helpers (npm) (malicious package)
- [MAL-2026-428](https://insights.sbomify.com/MAL-2026-428/): Malicious code in shroom-kit (npm) (malicious package)
- [MAL-2026-4279](https://insights.sbomify.com/MAL-2026-4279/): Malicious code in model-switch-router (npm) (malicious package)
- [MAL-2026-4278](https://insights.sbomify.com/MAL-2026-4278/): Malicious code in llm-context-compressor (npm) (malicious package)
- [MAL-2026-4277](https://insights.sbomify.com/MAL-2026-4277/): Malicious code in dev-env-bootstrapper (npm) (malicious package)
- [MAL-2026-4276](https://insights.sbomify.com/MAL-2026-4276/): Malicious code in build-scripts-utils (npm) (malicious package)
- [MAL-2026-4275](https://insights.sbomify.com/MAL-2026-4275/): Malicious code in async-pipeline-builder (npm) (malicious package)
- [MAL-2026-4274](https://insights.sbomify.com/MAL-2026-4274/): Malicious code in power-apps (npm) (malicious package)
- [MAL-2026-4273](https://insights.sbomify.com/MAL-2026-4273/): Malicious code in git-config-sync (PyPI) (malicious package)
- [MAL-2026-4272](https://insights.sbomify.com/MAL-2026-4272/): Malicious code in env-loader-cli (PyPI) (malicious package)
- [MAL-2026-4271](https://insights.sbomify.com/MAL-2026-4271/): Malicious code in data-pipeline-check (PyPI) (malicious package)
- [MAL-2026-4270](https://insights.sbomify.com/MAL-2026-4270/): Malicious code in clickpy (npm) (malicious package)
- [MAL-2026-427](https://insights.sbomify.com/MAL-2026-427/): Malicious code in replicate-js (npm) (malicious package)
- [MAL-2026-4269](https://insights.sbomify.com/MAL-2026-4269/): Malicious code in mistral-evals (PyPI) (malicious package)
- [MAL-2026-4268](https://insights.sbomify.com/MAL-2026-4268/): Malicious code in asavie-ui (npm) (malicious package)
- [MAL-2026-4267](https://insights.sbomify.com/MAL-2026-4267/): Malicious code in @newline53/newline-ts-sdk (npm) (malicious package)
- [MAL-2026-4266](https://insights.sbomify.com/MAL-2026-4266/): Malicious code in discovery-build (npm) (malicious package)
- [MAL-2026-4265](https://insights.sbomify.com/MAL-2026-4265/): Malicious code in @asavie/i18n (npm) (malicious package)
- [MAL-2026-4264](https://insights.sbomify.com/MAL-2026-4264/): Malicious code in dds-js-idl (npm) (malicious package)
- [MAL-2026-4263](https://insights.sbomify.com/MAL-2026-4263/): Malicious code in secdriven (npm) (malicious package)
- [MAL-2026-4262](https://insights.sbomify.com/MAL-2026-4262/): Malicious code in solidity-build-guard (PyPI) (malicious package)
- [MAL-2026-4261](https://insights.sbomify.com/MAL-2026-4261/): Malicious code in eth-security-auditor (PyPI) (malicious package)
- [MAL-2026-4260](https://insights.sbomify.com/MAL-2026-4260/): Malicious code in defi-risk-scanner (PyPI) (malicious package)
- [MAL-2026-426](https://insights.sbomify.com/MAL-2026-426/): Malicious code in qdrant-js (npm) (malicious package)
- [MAL-2026-4259](https://insights.sbomify.com/MAL-2026-4259/): Malicious code in cryptowallet-safety (PyPI) (malicious package)
- [MAL-2026-4258](https://insights.sbomify.com/MAL-2026-4258/): Malicious code in @engagehub/core (npm) (malicious package)
- [MAL-2026-4257](https://insights.sbomify.com/MAL-2026-4257/): Malicious code in @cloudways-lab/unified-design-system (npm) (malicious package)
- [MAL-2026-4256](https://insights.sbomify.com/MAL-2026-4256/): Malicious code in @citi-icg-171632/citicms-repo-component (npm) (malicious package)
- [MAL-2026-4255](https://insights.sbomify.com/MAL-2026-4255/): Malicious code in cdk-sagemaker-notebook-workflow (npm) (malicious package)
- [MAL-2026-4254](https://insights.sbomify.com/MAL-2026-4254/): Malicious code in reactive-cdk-app (npm) (malicious package)
- [MAL-2026-4253](https://insights.sbomify.com/MAL-2026-4253/): Malicious code in pylogft (PyPI) (malicious package)
- [MAL-2026-4252](https://insights.sbomify.com/MAL-2026-4252/): Malicious code in @43uh3ig43/telemetry-client (npm) (malicious package)
- [MAL-2026-4251](https://insights.sbomify.com/MAL-2026-4251/): Malicious code in harmony-enablers-test-2026 (npm) (malicious package)
- [MAL-2026-4250](https://insights.sbomify.com/MAL-2026-4250/): Malicious code in wallet-backup-verifier (npm) (malicious package)
- [MAL-2026-425](https://insights.sbomify.com/MAL-2026-425/): Malicious code in plugin-vue (npm) (malicious package)
- [MAL-2026-4249](https://insights.sbomify.com/MAL-2026-4249/): Malicious code in truffle-config-helper (npm) (malicious package)
- [MAL-2026-4248](https://insights.sbomify.com/MAL-2026-4248/): Malicious code in solna-web3 (npm) (malicious package)
- [MAL-2026-4247](https://insights.sbomify.com/MAL-2026-4247/): Malicious code in solana-pda-helper (npm) (malicious package)
- [MAL-2026-4246](https://insights.sbomify.com/MAL-2026-4246/): Malicious code in python-env-auditor (npm) (malicious package)
- [MAL-2026-4245](https://insights.sbomify.com/MAL-2026-4245/): Malicious code in pypi-build-verifier (npm) (malicious package)
- [MAL-2026-4244](https://insights.sbomify.com/MAL-2026-4244/): Malicious code in hardhat-gas-profiler-plugin (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/71/