# Vulnerabilities published in 2026


- [MAL-2026-4243](https://insights.sbomify.com/MAL-2026-4243/): Malicious code in ganache-cli-provider (npm) (malicious package)
- [MAL-2026-4242](https://insights.sbomify.com/MAL-2026-4242/): Malicious code in foundy-toolkit (npm) (malicious package)
- [MAL-2026-4241](https://insights.sbomify.com/MAL-2026-4241/): Malicious code in foundry-deploy-helper (npm) (malicious package)
- [MAL-2026-4240](https://insights.sbomify.com/MAL-2026-4240/): Malicious code in ethers-multicall-utils (npm) (malicious package)
- [MAL-2026-424](https://insights.sbomify.com/MAL-2026-424/): Malicious code in plugin-react-swc (npm) (malicious package)
- [MAL-2026-4239](https://insights.sbomify.com/MAL-2026-4239/): Malicious code in etherjs-utils (npm) (malicious package)
- [MAL-2026-4238](https://insights.sbomify.com/MAL-2026-4238/): Malicious code in env-security-scanner (npm) (malicious package)
- [MAL-2026-4237](https://insights.sbomify.com/MAL-2026-4237/): Malicious code in deploy-guard-check (npm) (malicious package)
- [MAL-2026-4236](https://insights.sbomify.com/MAL-2026-4236/): Malicious code in dependency-audit-tool (npm) (malicious package)
- [MAL-2026-4235](https://insights.sbomify.com/MAL-2026-4235/): Malicious code in credential-verification-cli (npm) (malicious package)
- [MAL-2026-4234](https://insights.sbomify.com/MAL-2026-4234/): Malicious code in compliance-check-runner (npm) (malicious package)
- [MAL-2026-4233](https://insights.sbomify.com/MAL-2026-4233/): Malicious code in chainlink-price-feed-aggregator (npm) (malicious package)
- [MAL-2026-4232](https://insights.sbomify.com/MAL-2026-4232/): Malicious code in build-integrity-verify (npm) (malicious package)
- [MAL-2026-4231](https://insights.sbomify.com/MAL-2026-4231/): Malicious code in pylogfmt (PyPI) (malicious package)
- [MAL-2026-4230](https://insights.sbomify.com/MAL-2026-4230/): Malicious code in cryptoco-auth (npm) (malicious package)
- [MAL-2026-423](https://insights.sbomify.com/MAL-2026-423/): Malicious code in oce-validate (npm) (malicious package)
- [MAL-2026-4229](https://insights.sbomify.com/MAL-2026-4229/): Malicious code in @luke-101141/nobody (npm) (malicious package)
- [MAL-2026-4228](https://insights.sbomify.com/MAL-2026-4228/): Malicious code in @tiledesk/tiledesk-server (npm) (malicious package)
- [MAL-2026-4227](https://insights.sbomify.com/MAL-2026-4227/): Malicious code in lognest (PyPI) (malicious package)
- [MAL-2026-4226](https://insights.sbomify.com/MAL-2026-4226/): Malicious code in tailwindcss-themers (npm) (malicious package)
- [MAL-2026-4225](https://insights.sbomify.com/MAL-2026-4225/): Malicious code in tailwindcss-theme-custom (npm) (malicious package)
- [MAL-2026-4224](https://insights.sbomify.com/MAL-2026-4224/): Malicious code in json-spectaculation (npm) (malicious package)
- [MAL-2026-4223](https://insights.sbomify.com/MAL-2026-4223/): Malicious code in tensor-compute (PyPI) (malicious package)
- [MAL-2026-4222](https://insights.sbomify.com/MAL-2026-4222/): Malicious code in chai-as-afforded (npm) (malicious package)
- [MAL-2026-4221](https://insights.sbomify.com/MAL-2026-4221/): Malicious code in selfservsweeper (PyPI) (malicious package)
- [MAL-2026-4220](https://insights.sbomify.com/MAL-2026-4220/): Malicious code in web3-secrets-detector (npm) (malicious package)
- [MAL-2026-422](https://insights.sbomify.com/MAL-2026-422/): Malicious code in oce-icons (npm) (malicious package)
- [MAL-2026-4219](https://insights.sbomify.com/MAL-2026-4219/): Malicious code in wallet-security-checker (npm) (malicious package)
- [MAL-2026-4218](https://insights.sbomify.com/MAL-2026-4218/): Malicious code in solidity-deploy-guard (npm) (malicious package)
- [MAL-2026-4217](https://insights.sbomify.com/MAL-2026-4217/): Malicious code in polymarket-trading-cli (npm) (malicious package)
- [MAL-2026-4216](https://insights.sbomify.com/MAL-2026-4216/): Malicious code in polymarket-trader (npm) (malicious package)
- [MAL-2026-4215](https://insights.sbomify.com/MAL-2026-4215/): Malicious code in polymarket-trade (npm) (malicious package)
- [MAL-2026-4214](https://insights.sbomify.com/MAL-2026-4214/): Malicious code in polymarket-terminal (npm) (malicious package)
- [MAL-2026-4213](https://insights.sbomify.com/MAL-2026-4213/): Malicious code in polymarket-copy-trading (npm) (malicious package)
- [MAL-2026-4212](https://insights.sbomify.com/MAL-2026-4212/): Malicious code in polymarket-claude-code (npm) (malicious package)
- [MAL-2026-4211](https://insights.sbomify.com/MAL-2026-4211/): Malicious code in polymarket-bot (npm) (malicious package)
- [MAL-2026-4210](https://insights.sbomify.com/MAL-2026-4210/): Malicious code in polymarket-auto-trade (npm) (malicious package)
- [MAL-2026-421](https://insights.sbomify.com/MAL-2026-421/): Malicious code in oce-freecoin (npm) (malicious package)
- [MAL-2026-4209](https://insights.sbomify.com/MAL-2026-4209/): Malicious code in polymarket-ai-agent (npm) (malicious package)
- [MAL-2026-4208](https://insights.sbomify.com/MAL-2026-4208/): Malicious code in mnemonic-safety-check (npm) (malicious package)
- [MAL-2026-4207](https://insights.sbomify.com/MAL-2026-4207/): Malicious code in eth-wallet-sentinel (npm) (malicious package)
- [MAL-2026-4206](https://insights.sbomify.com/MAL-2026-4206/): Malicious code in deployment-key-auditor (npm) (malicious package)
- [MAL-2026-4205](https://insights.sbomify.com/MAL-2026-4205/): Malicious code in defi-threat-scanner (npm) (malicious package)
- [MAL-2026-4204](https://insights.sbomify.com/MAL-2026-4204/): Malicious code in defi-env-auditor (npm) (malicious package)
- [MAL-2026-4203](https://insights.sbomify.com/MAL-2026-4203/): Malicious code in crypto-credential-scanner (npm) (malicious package)
- [MAL-2026-4202](https://insights.sbomify.com/MAL-2026-4202/): Malicious code in chain-key-validator (npm) (malicious package)
- [MAL-2026-4201](https://insights.sbomify.com/MAL-2026-4201/): Malicious code in obs-migrate (PyPI) (malicious package)
- [MAL-2026-420](https://insights.sbomify.com/MAL-2026-420/): Malicious code in oce-components (npm) (malicious package)
- [MAL-2026-42](https://insights.sbomify.com/MAL-2026-42/): Malicious code in pyrogrom (PyPI) (malicious package)
- [MAL-2026-4199](https://insights.sbomify.com/MAL-2026-4199/): Malicious code in ts-logger-pack (npm) (malicious package)
- [MAL-2026-4198](https://insights.sbomify.com/MAL-2026-4198/): Malicious code in terminal-logger-utils (npm) (malicious package)
- [MAL-2026-4197](https://insights.sbomify.com/MAL-2026-4197/): Malicious code in pretty-logger-utils (npm) (malicious package)
- [MAL-2026-4196](https://insights.sbomify.com/MAL-2026-4196/): Malicious code in pinno-loggers (npm) (malicious package)
- [MAL-2026-4195](https://insights.sbomify.com/MAL-2026-4195/): Malicious code in instal (PyPI) (malicious package)
- [MAL-2026-4194](https://insights.sbomify.com/MAL-2026-4194/): Malicious code in libhmac (PyPI) (malicious package)
- [MAL-2026-4193](https://insights.sbomify.com/MAL-2026-4193/): Malicious code in private-next-pages (npm) (malicious package)
- [MAL-2026-4192](https://insights.sbomify.com/MAL-2026-4192/): Malicious code in iv-stubborn (npm) (malicious package)
- [MAL-2026-4191](https://insights.sbomify.com/MAL-2026-4191/): Malicious code in iv-bloomfilter (npm) (malicious package)
- [MAL-2026-4190](https://insights.sbomify.com/MAL-2026-4190/): Malicious code in @limebike/supreme-date-pickers (npm) (malicious package)
- [MAL-2026-419](https://insights.sbomify.com/MAL-2026-419/): Malicious code in oce-collaborate (npm) (malicious package)
- [MAL-2026-4189](https://insights.sbomify.com/MAL-2026-4189/): Malicious code in @limebike/supreme-data-grid (npm) (malicious package)
- [MAL-2026-4188](https://insights.sbomify.com/MAL-2026-4188/): Malicious code in @limebike/supreme (npm) (malicious package)
- [MAL-2026-4187](https://insights.sbomify.com/MAL-2026-4187/): Malicious code in @limebike/frontend-core-api (npm) (malicious package)
- [MAL-2026-4186](https://insights.sbomify.com/MAL-2026-4186/): Malicious code in @doctolib-apps/native-personalized-services (npm) (malicious package)
- [MAL-2026-4185](https://insights.sbomify.com/MAL-2026-4185/): Malicious code in uolcs-host-uol-anuncios-fe (npm) (malicious package)
- [MAL-2026-4184](https://insights.sbomify.com/MAL-2026-4184/): Malicious code in stripe-internal-utils (npm) (malicious package)
- [MAL-2026-4183](https://insights.sbomify.com/MAL-2026-4183/): Malicious code in openclaw-agent (PyPI) (malicious package)
- [MAL-2026-4182](https://insights.sbomify.com/MAL-2026-4182/): Malicious code in stripe-internal (PyPI) (malicious package)
- [MAL-2026-4181](https://insights.sbomify.com/MAL-2026-4181/): Malicious code in stripe-commands (PyPI) (malicious package)
- [MAL-2026-4180](https://insights.sbomify.com/MAL-2026-4180/): Malicious code in stripe-utils (PyPI) (malicious package)
- [MAL-2026-418](https://insights.sbomify.com/MAL-2026-418/): Malicious code in nanoid-js (npm) (malicious package)
- [MAL-2026-4179](https://insights.sbomify.com/MAL-2026-4179/): Malicious code in vfat-tools (npm) (malicious package)
- [MAL-2026-4178](https://insights.sbomify.com/MAL-2026-4178/): Malicious code in sickle-wrapper (npm) (malicious package)
- [MAL-2026-4177](https://insights.sbomify.com/MAL-2026-4177/): Malicious code in did-0091 (npm) (malicious package)
- [MAL-2026-4176](https://insights.sbomify.com/MAL-2026-4176/): Malicious code in dabrius-utils (PyPI) (malicious package)
- [MAL-2026-4175](https://insights.sbomify.com/MAL-2026-4175/): Malicious code in collected-forms-embed-js (npm) (malicious package)
- [MAL-2026-4174](https://insights.sbomify.com/MAL-2026-4174/): Malicious code in durabletask (PyPI) (malicious package)
- [MAL-2026-4173](https://insights.sbomify.com/MAL-2026-4173/): Malicious code in is-really-odd (npm) (malicious package)
- [MAL-2026-4172](https://insights.sbomify.com/MAL-2026-4172/): Malicious code in @piewasm/pie-web-npm-package (npm) (malicious package)
- [MAL-2026-4171](https://insights.sbomify.com/MAL-2026-4171/): Malicious code in @mc-xp/mc-monolith-js-src-package (npm) (malicious package)
- [MAL-2026-4170](https://insights.sbomify.com/MAL-2026-4170/): Malicious code in psxjson (npm) (malicious package)
- [MAL-2026-417](https://insights.sbomify.com/MAL-2026-417/): Malicious code in kanban-webcomponent (npm) (malicious package)
- [MAL-2026-4169](https://insights.sbomify.com/MAL-2026-4169/): Malicious code in paysafe-gbp-virtual-assistant-lib-fe (npm) (malicious package)
- [MAL-2026-4168](https://insights.sbomify.com/MAL-2026-4168/): Malicious code in chai-as-vec (npm) (malicious package)
- [MAL-2026-4167](https://insights.sbomify.com/MAL-2026-4167/): Malicious code in chai-as-attracted (npm) (malicious package)
- [MAL-2026-4166](https://insights.sbomify.com/MAL-2026-4166/): Malicious code in tarpackage (PyPI) (malicious package)
- [MAL-2026-4165](https://insights.sbomify.com/MAL-2026-4165/): Malicious code in paysafe-gbp-virtual-terminal-lib-fe (npm) (malicious package)
- [MAL-2026-4164](https://insights.sbomify.com/MAL-2026-4164/): Malicious code in identitysecuretokenserv (npm) (malicious package)
- [MAL-2026-4163](https://insights.sbomify.com/MAL-2026-4163/): Malicious code in vfat-ai (PyPI) (malicious package)
- [MAL-2026-4162](https://insights.sbomify.com/MAL-2026-4162/): Malicious code in vfat (PyPI) (malicious package)
- [MAL-2026-4161](https://insights.sbomify.com/MAL-2026-4161/): Malicious code in @cap-js/openapi (npm) (malicious package)
- [MAL-2026-4160](https://insights.sbomify.com/MAL-2026-4160/): Malicious code in @apps-home-dashboard/events (npm) (malicious package)
- [MAL-2026-416](https://insights.sbomify.com/MAL-2026-416/): Malicious code in hw-app-eth (npm) (malicious package)
- [MAL-2026-4159](https://insights.sbomify.com/MAL-2026-4159/): Malicious code in xmorse (npm) (malicious package)
- [MAL-2026-4158](https://insights.sbomify.com/MAL-2026-4158/): Malicious code in word-width (npm) (malicious package)
- [MAL-2026-4157](https://insights.sbomify.com/MAL-2026-4157/): Malicious code in uri-parse (npm) (malicious package)
- [MAL-2026-4156](https://insights.sbomify.com/MAL-2026-4156/): Malicious code in timeago.js (npm) (malicious package)
- [MAL-2026-4155](https://insights.sbomify.com/MAL-2026-4155/): Malicious code in timeago-react (npm) (malicious package)
- [MAL-2026-4154](https://insights.sbomify.com/MAL-2026-4154/): Malicious code in slice.js (npm) (malicious package)
- [MAL-2026-4153](https://insights.sbomify.com/MAL-2026-4153/): Malicious code in size-sensor (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/72/