# Vulnerabilities published in 2026


- [MAL-2026-4152](https://insights.sbomify.com/MAL-2026-4152/): Malicious code in ribbon.js (npm) (malicious package)
- [MAL-2026-4151](https://insights.sbomify.com/MAL-2026-4151/): Malicious code in relationship.js (npm) (malicious package)
- [MAL-2026-4150](https://insights.sbomify.com/MAL-2026-4150/): Malicious code in react-adsense (npm) (malicious package)
- [MAL-2026-415](https://insights.sbomify.com/MAL-2026-415/): Malicious code in dotenv-expanded (npm) (malicious package)
- [MAL-2026-4149](https://insights.sbomify.com/MAL-2026-4149/): Malicious code in onfire.js (npm) (malicious package)
- [MAL-2026-4148](https://insights.sbomify.com/MAL-2026-4148/): Malicious code in miz (npm) (malicious package)
- [MAL-2026-4147](https://insights.sbomify.com/MAL-2026-4147/): Malicious code in mcp-mermaid (npm) (malicious package)
- [MAL-2026-4146](https://insights.sbomify.com/MAL-2026-4146/): Malicious code in mcp-echarts (npm) (malicious package)
- [MAL-2026-4145](https://insights.sbomify.com/MAL-2026-4145/): Malicious code in lint-md-cli (npm) (malicious package)
- [MAL-2026-4144](https://insights.sbomify.com/MAL-2026-4144/): Malicious code in lint-md (npm) (malicious package)
- [MAL-2026-4143](https://insights.sbomify.com/MAL-2026-4143/): Malicious code in limit-size (npm) (malicious package)
- [MAL-2026-4142](https://insights.sbomify.com/MAL-2026-4142/): Malicious code in jest-url-loader (npm) (malicious package)
- [MAL-2026-4141](https://insights.sbomify.com/MAL-2026-4141/): Malicious code in jest-random-mock (npm) (malicious package)
- [MAL-2026-4140](https://insights.sbomify.com/MAL-2026-4140/): Malicious code in jest-less-loader (npm) (malicious package)
- [MAL-2026-414](https://insights.sbomify.com/MAL-2026-414/): Malicious code in debox-rn (npm) (malicious package)
- [MAL-2026-4139](https://insights.sbomify.com/MAL-2026-4139/): Malicious code in jest-expect (npm) (malicious package)
- [MAL-2026-4138](https://insights.sbomify.com/MAL-2026-4138/): Malicious code in jest-electron (npm) (malicious package)
- [MAL-2026-4137](https://insights.sbomify.com/MAL-2026-4137/): Malicious code in jest-date-mock (npm) (malicious package)
- [MAL-2026-4136](https://insights.sbomify.com/MAL-2026-4136/): Malicious code in jest-canvas-mock (npm) (malicious package)
- [MAL-2026-4135](https://insights.sbomify.com/MAL-2026-4135/): Malicious code in gantt-for-react (npm) (malicious package)
- [MAL-2026-4134](https://insights.sbomify.com/MAL-2026-4134/): Malicious code in fixed-round (npm) (malicious package)
- [MAL-2026-4133](https://insights.sbomify.com/MAL-2026-4133/): Malicious code in filesize.js (npm) (malicious package)
- [MAL-2026-4132](https://insights.sbomify.com/MAL-2026-4132/): Malicious code in echarts-for-react (npm) (malicious package)
- [MAL-2026-4131](https://insights.sbomify.com/MAL-2026-4131/): Malicious code in canvas-nest.js (npm) (malicious package)
- [MAL-2026-4130](https://insights.sbomify.com/MAL-2026-4130/): Malicious code in boring-avatars-vanilla (npm) (malicious package)
- [MAL-2026-413](https://insights.sbomify.com/MAL-2026-413/): Malicious code in coopshares-webcomponent (npm) (malicious package)
- [MAL-2026-4129](https://insights.sbomify.com/MAL-2026-4129/): Malicious code in babel-plugin-version (npm) (malicious package)
- [MAL-2026-4128](https://insights.sbomify.com/MAL-2026-4128/): Malicious code in ast-plugin (npm) (malicious package)
- [MAL-2026-4127](https://insights.sbomify.com/MAL-2026-4127/): Malicious code in amapcn (npm) (malicious package)
- [MAL-2026-4126](https://insights.sbomify.com/MAL-2026-4126/): Malicious code in ai-figure (npm) (malicious package)
- [MAL-2026-4125](https://insights.sbomify.com/MAL-2026-4125/): Malicious code in @lint-md/parser (npm) (malicious package)
- [MAL-2026-4124](https://insights.sbomify.com/MAL-2026-4124/): Malicious code in @lint-md/core (npm) (malicious package)
- [MAL-2026-4123](https://insights.sbomify.com/MAL-2026-4123/): Malicious code in @lint-md/cli (npm) (malicious package)
- [MAL-2026-4122](https://insights.sbomify.com/MAL-2026-4122/): Malicious code in @antv/xflow-hook (npm) (malicious package)
- [MAL-2026-4121](https://insights.sbomify.com/MAL-2026-4121/): Malicious code in @antv/xflow-extension (npm) (malicious package)
- [MAL-2026-4120](https://insights.sbomify.com/MAL-2026-4120/): Malicious code in @antv/xflow-diff (npm) (malicious package)
- [MAL-2026-412](https://insights.sbomify.com/MAL-2026-412/): Malicious code in connect-web (npm) (malicious package)
- [MAL-2026-4119](https://insights.sbomify.com/MAL-2026-4119/): Malicious code in @antv/xflow-core (npm) (malicious package)
- [MAL-2026-4118](https://insights.sbomify.com/MAL-2026-4118/): Malicious code in @antv/xflow (npm) (malicious package)
- [MAL-2026-4117](https://insights.sbomify.com/MAL-2026-4117/): Malicious code in @antv/x6-vue3-shape (npm) (malicious package)
- [MAL-2026-4116](https://insights.sbomify.com/MAL-2026-4116/): Malicious code in @antv/x6-vue-shape (npm) (malicious package)
- [MAL-2026-4115](https://insights.sbomify.com/MAL-2026-4115/): Malicious code in @antv/x6-vector (npm) (malicious package)
- [MAL-2026-4114](https://insights.sbomify.com/MAL-2026-4114/): Malicious code in @antv/x6-react-shape (npm) (malicious package)
- [MAL-2026-4113](https://insights.sbomify.com/MAL-2026-4113/): Malicious code in @antv/x6-react-components (npm) (malicious package)
- [MAL-2026-4112](https://insights.sbomify.com/MAL-2026-4112/): Malicious code in @antv/x6-react (npm) (malicious package)
- [MAL-2026-4111](https://insights.sbomify.com/MAL-2026-4111/): Malicious code in @antv/x6-plugin-transform (npm) (malicious package)
- [MAL-2026-4110](https://insights.sbomify.com/MAL-2026-4110/): Malicious code in @antv/x6-plugin-stencil (npm) (malicious package)
- [MAL-2026-411](https://insights.sbomify.com/MAL-2026-411/): Malicious code in collaborate (npm) (malicious package)
- [MAL-2026-4109](https://insights.sbomify.com/MAL-2026-4109/): Malicious code in @antv/x6-plugin-snapline (npm) (malicious package)
- [MAL-2026-4108](https://insights.sbomify.com/MAL-2026-4108/): Malicious code in @antv/x6-plugin-selection (npm) (malicious package)
- [MAL-2026-4107](https://insights.sbomify.com/MAL-2026-4107/): Malicious code in @antv/x6-plugin-scroller (npm) (malicious package)
- [MAL-2026-4106](https://insights.sbomify.com/MAL-2026-4106/): Malicious code in @antv/x6-plugin-minimap (npm) (malicious package)
- [MAL-2026-4105](https://insights.sbomify.com/MAL-2026-4105/): Malicious code in @antv/x6-plugin-keyboard (npm) (malicious package)
- [MAL-2026-4104](https://insights.sbomify.com/MAL-2026-4104/): Malicious code in @antv/x6-plugin-history (npm) (malicious package)
- [MAL-2026-4103](https://insights.sbomify.com/MAL-2026-4103/): Malicious code in @antv/x6-plugin-export (npm) (malicious package)
- [MAL-2026-4102](https://insights.sbomify.com/MAL-2026-4102/): Malicious code in @antv/x6-plugin-dnd (npm) (malicious package)
- [MAL-2026-4101](https://insights.sbomify.com/MAL-2026-4101/): Malicious code in @antv/x6-plugin-clipboard (npm) (malicious package)
- [MAL-2026-4100](https://insights.sbomify.com/MAL-2026-4100/): Malicious code in @antv/x6-components (npm) (malicious package)
- [MAL-2026-410](https://insights.sbomify.com/MAL-2026-410/): Malicious code in clerk-js (npm) (malicious package)
- [MAL-2026-41](https://insights.sbomify.com/MAL-2026-41/): Malicious code in spire.officejs-document (npm) (malicious package)
- [MAL-2026-4099](https://insights.sbomify.com/MAL-2026-4099/): Malicious code in @antv/x6-common (npm) (malicious package)
- [MAL-2026-4098](https://insights.sbomify.com/MAL-2026-4098/): Malicious code in @antv/x6-angular-shape (npm) (malicious package)
- [MAL-2026-4097](https://insights.sbomify.com/MAL-2026-4097/): Malicious code in @antv/wx-f2 (npm) (malicious package)
- [MAL-2026-4096](https://insights.sbomify.com/MAL-2026-4096/): Malicious code in @antv/word-scale-chart (npm) (malicious package)
- [MAL-2026-4095](https://insights.sbomify.com/MAL-2026-4095/): Malicious code in @antv/webgpu-graph (npm) (malicious package)
- [MAL-2026-4094](https://insights.sbomify.com/MAL-2026-4094/): Malicious code in @antv/vis-predict-engine (npm) (malicious package)
- [MAL-2026-4093](https://insights.sbomify.com/MAL-2026-4093/): Malicious code in @antv/vendor (npm) (malicious package)
- [MAL-2026-4092](https://insights.sbomify.com/MAL-2026-4092/): Malicious code in @antv/util (npm) (malicious package)
- [MAL-2026-4091](https://insights.sbomify.com/MAL-2026-4091/): Malicious code in @antv/translator (npm) (malicious package)
- [MAL-2026-4090](https://insights.sbomify.com/MAL-2026-4090/): Malicious code in @antv/torch (npm) (malicious package)
- [MAL-2026-409](https://insights.sbomify.com/MAL-2026-409/): Malicious code in chai-async-test (npm) (malicious package)
- [MAL-2026-4089](https://insights.sbomify.com/MAL-2026-4089/): Malicious code in @antv/thumbnails-component (npm) (malicious package)
- [MAL-2026-4088](https://insights.sbomify.com/MAL-2026-4088/): Malicious code in @antv/thumbnails (npm) (malicious package)
- [MAL-2026-4087](https://insights.sbomify.com/MAL-2026-4087/): Malicious code in @antv/t8 (npm) (malicious package)
- [MAL-2026-4086](https://insights.sbomify.com/MAL-2026-4086/): Malicious code in @antv/stat (npm) (malicious package)
- [MAL-2026-4085](https://insights.sbomify.com/MAL-2026-4085/): Malicious code in @antv/smart-color (npm) (malicious package)
- [MAL-2026-4084](https://insights.sbomify.com/MAL-2026-4084/): Malicious code in @antv/semantic-release-pnpm (npm) (malicious package)
- [MAL-2026-4083](https://insights.sbomify.com/MAL-2026-4083/): Malicious code in @antv/scale (npm) (malicious package)
- [MAL-2026-4082](https://insights.sbomify.com/MAL-2026-4082/): Malicious code in @antv/sam (npm) (malicious package)
- [MAL-2026-4081](https://insights.sbomify.com/MAL-2026-4081/): Malicious code in @antv/s2-vue (npm) (malicious package)
- [MAL-2026-4080](https://insights.sbomify.com/MAL-2026-4080/): Malicious code in @antv/s2-ssr (npm) (malicious package)
- [MAL-2026-408](https://insights.sbomify.com/MAL-2026-408/): Malicious code in bitbot (npm) (malicious package)
- [MAL-2026-4079](https://insights.sbomify.com/MAL-2026-4079/): Malicious code in @antv/s2-react-components (npm) (malicious package)
- [MAL-2026-4078](https://insights.sbomify.com/MAL-2026-4078/): Malicious code in @antv/s2-react (npm) (malicious package)
- [MAL-2026-4077](https://insights.sbomify.com/MAL-2026-4077/): Malicious code in @antv/s2 (npm) (malicious package)
- [MAL-2026-4076](https://insights.sbomify.com/MAL-2026-4076/): Malicious code in @antv/react-g (npm) (malicious package)
- [MAL-2026-4075](https://insights.sbomify.com/MAL-2026-4075/): Malicious code in @antv/path-util (npm) (malicious package)
- [MAL-2026-4074](https://insights.sbomify.com/MAL-2026-4074/): Malicious code in @antv/narrative-text-vis (npm) (malicious package)
- [MAL-2026-4073](https://insights.sbomify.com/MAL-2026-4073/): Malicious code in @antv/narrative-text-schema (npm) (malicious package)
- [MAL-2026-4072](https://insights.sbomify.com/MAL-2026-4072/): Malicious code in @antv/narrative-text-editor (npm) (malicious package)
- [MAL-2026-4071](https://insights.sbomify.com/MAL-2026-4071/): Malicious code in @antv/my-f2-pc (npm) (malicious package)
- [MAL-2026-4070](https://insights.sbomify.com/MAL-2026-4070/): Malicious code in @antv/my-f2 (npm) (malicious package)
- [MAL-2026-407](https://insights.sbomify.com/MAL-2026-407/): Malicious code in babel-js (npm) (malicious package)
- [MAL-2026-4069](https://insights.sbomify.com/MAL-2026-4069/): Malicious code in @antv/mcp-server-chart (npm) (malicious package)
- [MAL-2026-4068](https://insights.sbomify.com/MAL-2026-4068/): Malicious code in @antv/mcp-server-antv (npm) (malicious package)
- [MAL-2026-4067](https://insights.sbomify.com/MAL-2026-4067/): Malicious code in @antv/matrix-util (npm) (malicious package)
- [MAL-2026-4066](https://insights.sbomify.com/MAL-2026-4066/): Malicious code in @antv/lite-insight (npm) (malicious package)
- [MAL-2026-4065](https://insights.sbomify.com/MAL-2026-4065/): Malicious code in @antv/li-sdk (npm) (malicious package)
- [MAL-2026-4064](https://insights.sbomify.com/MAL-2026-4064/): Malicious code in @antv/li-sam-assets (npm) (malicious package)
- [MAL-2026-4063](https://insights.sbomify.com/MAL-2026-4063/): Malicious code in @antv/li-p2 (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/73/