# Vulnerabilities published in 2026


- [MAL-2026-3973](https://insights.sbomify.com/MAL-2026-3973/): Malicious code in @antv/g2 (npm) (malicious package)
- [MAL-2026-3972](https://insights.sbomify.com/MAL-2026-3972/): Malicious code in @antv/g-webgpu-unitchart (npm) (malicious package)
- [MAL-2026-3971](https://insights.sbomify.com/MAL-2026-3971/): Malicious code in @antv/g-webgpu-raytracer (npm) (malicious package)
- [MAL-2026-3970](https://insights.sbomify.com/MAL-2026-3970/): Malicious code in @antv/g-webgpu-engine (npm) (malicious package)
- [MAL-2026-397](https://insights.sbomify.com/MAL-2026-397/): Malicious code in recaptcha-cors (npm) (malicious package)
- [MAL-2026-3969](https://insights.sbomify.com/MAL-2026-3969/): Malicious code in @antv/g-webgpu-core (npm) (malicious package)
- [MAL-2026-3968](https://insights.sbomify.com/MAL-2026-3968/): Malicious code in @antv/g-webgpu-compiler (npm) (malicious package)
- [MAL-2026-3967](https://insights.sbomify.com/MAL-2026-3967/): Malicious code in @antv/g-webgpu (npm) (malicious package)
- [MAL-2026-3966](https://insights.sbomify.com/MAL-2026-3966/): Malicious code in @antv/g-webgl-compute (npm) (malicious package)
- [MAL-2026-3965](https://insights.sbomify.com/MAL-2026-3965/): Malicious code in @antv/g-webgl (npm) (malicious package)
- [MAL-2026-3964](https://insights.sbomify.com/MAL-2026-3964/): Malicious code in @antv/g-web-components (npm) (malicious package)
- [MAL-2026-3963](https://insights.sbomify.com/MAL-2026-3963/): Malicious code in @antv/g-web-animations-api (npm) (malicious package)
- [MAL-2026-3962](https://insights.sbomify.com/MAL-2026-3962/): Malicious code in @antv/g-svg (npm) (malicious package)
- [MAL-2026-3961](https://insights.sbomify.com/MAL-2026-3961/): Malicious code in @antv/g-shader-components (npm) (malicious package)
- [MAL-2026-3960](https://insights.sbomify.com/MAL-2026-3960/): Malicious code in @antv/g-plugin-zdog-svg-renderer (npm) (malicious package)
- [MAL-2026-396](https://insights.sbomify.com/MAL-2026-396/): Malicious code in private-internal-sdk (npm) (malicious package)
- [MAL-2026-3959](https://insights.sbomify.com/MAL-2026-3959/): Malicious code in @antv/g-plugin-zdog-canvas-renderer (npm) (malicious package)
- [MAL-2026-3958](https://insights.sbomify.com/MAL-2026-3958/): Malicious code in @antv/g-plugin-yoga (npm) (malicious package)
- [MAL-2026-3957](https://insights.sbomify.com/MAL-2026-3957/): Malicious code in @antv/g-plugin-webgpu-device (npm) (malicious package)
- [MAL-2026-3956](https://insights.sbomify.com/MAL-2026-3956/): Malicious code in @antv/g-plugin-webgl-renderer (npm) (malicious package)
- [MAL-2026-3955](https://insights.sbomify.com/MAL-2026-3955/): Malicious code in @antv/g-plugin-webgl-device (npm) (malicious package)
- [MAL-2026-3954](https://insights.sbomify.com/MAL-2026-3954/): Malicious code in @antv/g-plugin-svg-renderer (npm) (malicious package)
- [MAL-2026-3953](https://insights.sbomify.com/MAL-2026-3953/): Malicious code in @antv/g-plugin-svg-picker (npm) (malicious package)
- [MAL-2026-3952](https://insights.sbomify.com/MAL-2026-3952/): Malicious code in @antv/g-plugin-rough-svg-renderer (npm) (malicious package)
- [MAL-2026-3951](https://insights.sbomify.com/MAL-2026-3951/): Malicious code in @antv/g-plugin-rough-canvas-renderer (npm) (malicious package)
- [MAL-2026-3950](https://insights.sbomify.com/MAL-2026-3950/): Malicious code in @antv/g-plugin-physx (npm) (malicious package)
- [MAL-2026-395](https://insights.sbomify.com/MAL-2026-395/): Malicious code in natateste (npm) (malicious package)
- [MAL-2026-3949](https://insights.sbomify.com/MAL-2026-3949/): Malicious code in @antv/g-plugin-mobile-interaction (npm) (malicious package)
- [MAL-2026-3948](https://insights.sbomify.com/MAL-2026-3948/): Malicious code in @antv/g-plugin-matterjs (npm) (malicious package)
- [MAL-2026-3947](https://insights.sbomify.com/MAL-2026-3947/): Malicious code in @antv/g-plugin-image-loader (npm) (malicious package)
- [MAL-2026-3946](https://insights.sbomify.com/MAL-2026-3946/): Malicious code in @antv/g-plugin-html-renderer (npm) (malicious package)
- [MAL-2026-3945](https://insights.sbomify.com/MAL-2026-3945/): Malicious code in @antv/g-plugin-gpgpu (npm) (malicious package)
- [MAL-2026-3944](https://insights.sbomify.com/MAL-2026-3944/): Malicious code in @antv/g-plugin-gesture (npm) (malicious package)
- [MAL-2026-3943](https://insights.sbomify.com/MAL-2026-3943/): Malicious code in @antv/g-plugin-dragndrop (npm) (malicious package)
- [MAL-2026-3942](https://insights.sbomify.com/MAL-2026-3942/): Malicious code in @antv/g-plugin-dom-interaction (npm) (malicious package)
- [MAL-2026-3941](https://insights.sbomify.com/MAL-2026-3941/): Malicious code in @antv/g-plugin-device-renderer (npm) (malicious package)
- [MAL-2026-3940](https://insights.sbomify.com/MAL-2026-3940/): Malicious code in @antv/g-plugin-css-select (npm) (malicious package)
- [MAL-2026-394](https://insights.sbomify.com/MAL-2026-394/): Malicious code in n8n-nodes-zl-vietts (npm) (malicious package)
- [MAL-2026-3939](https://insights.sbomify.com/MAL-2026-3939/): Malicious code in @antv/g-plugin-control (npm) (malicious package)
- [MAL-2026-3938](https://insights.sbomify.com/MAL-2026-3938/): Malicious code in @antv/g-plugin-canvaskit-renderer (npm) (malicious package)
- [MAL-2026-3937](https://insights.sbomify.com/MAL-2026-3937/): Malicious code in @antv/g-plugin-canvas-renderer (npm) (malicious package)
- [MAL-2026-3936](https://insights.sbomify.com/MAL-2026-3936/): Malicious code in @antv/g-plugin-canvas-picker (npm) (malicious package)
- [MAL-2026-3935](https://insights.sbomify.com/MAL-2026-3935/): Malicious code in @antv/g-plugin-canvas-path-generator (npm) (malicious package)
- [MAL-2026-3934](https://insights.sbomify.com/MAL-2026-3934/): Malicious code in @antv/g-plugin-box2d (npm) (malicious package)
- [MAL-2026-3933](https://insights.sbomify.com/MAL-2026-3933/): Malicious code in @antv/g-plugin-annotation (npm) (malicious package)
- [MAL-2026-3932](https://insights.sbomify.com/MAL-2026-3932/): Malicious code in @antv/g-plugin-a11y (npm) (malicious package)
- [MAL-2026-3931](https://insights.sbomify.com/MAL-2026-3931/): Malicious code in @antv/g-plugin-3d (npm) (malicious package)
- [MAL-2026-3930](https://insights.sbomify.com/MAL-2026-3930/): Malicious code in @antv/g-perf (npm) (malicious package)
- [MAL-2026-393](https://insights.sbomify.com/MAL-2026-393/): Malicious code in manage-root (npm) (malicious package)
- [MAL-2026-3929](https://insights.sbomify.com/MAL-2026-3929/): Malicious code in @antv/g-pattern (npm) (malicious package)
- [MAL-2026-3928](https://insights.sbomify.com/MAL-2026-3928/): Malicious code in @antv/g-mobile-webgl (npm) (malicious package)
- [MAL-2026-3927](https://insights.sbomify.com/MAL-2026-3927/): Malicious code in @antv/g-mobile-svg (npm) (malicious package)
- [MAL-2026-3926](https://insights.sbomify.com/MAL-2026-3926/): Malicious code in @antv/g-mobile-canvas-element (npm) (malicious package)
- [MAL-2026-3925](https://insights.sbomify.com/MAL-2026-3925/): Malicious code in @antv/g-mobile-canvas (npm) (malicious package)
- [MAL-2026-3924](https://insights.sbomify.com/MAL-2026-3924/): Malicious code in @antv/g-mobile (npm) (malicious package)
- [MAL-2026-3923](https://insights.sbomify.com/MAL-2026-3923/): Malicious code in @antv/g-math (npm) (malicious package)
- [MAL-2026-3922](https://insights.sbomify.com/MAL-2026-3922/): Malicious code in @antv/g-lottie-player (npm) (malicious package)
- [MAL-2026-3921](https://insights.sbomify.com/MAL-2026-3921/): Malicious code in @antv/g-lite (npm) (malicious package)
- [MAL-2026-3920](https://insights.sbomify.com/MAL-2026-3920/): Malicious code in @antv/g-layout-blocklike (npm) (malicious package)
- [MAL-2026-392](https://insights.sbomify.com/MAL-2026-392/): Malicious code in jsonwebauth (npm) (malicious package)
- [MAL-2026-3919](https://insights.sbomify.com/MAL-2026-3919/): Malicious code in @antv/g-gesture (npm) (malicious package)
- [MAL-2026-3918](https://insights.sbomify.com/MAL-2026-3918/): Malicious code in @antv/g-dom-mutation-observer-api (npm) (malicious package)
- [MAL-2026-3917](https://insights.sbomify.com/MAL-2026-3917/): Malicious code in @antv/g-device-api (npm) (malicious package)
- [MAL-2026-3916](https://insights.sbomify.com/MAL-2026-3916/): Malicious code in @antv/g-css-typed-om-api (npm) (malicious package)
- [MAL-2026-3915](https://insights.sbomify.com/MAL-2026-3915/): Malicious code in @antv/g-css-layout-api (npm) (malicious package)
- [MAL-2026-3914](https://insights.sbomify.com/MAL-2026-3914/): Malicious code in @antv/g-components (npm) (malicious package)
- [MAL-2026-3913](https://insights.sbomify.com/MAL-2026-3913/): Malicious code in @antv/g-compat (npm) (malicious package)
- [MAL-2026-3912](https://insights.sbomify.com/MAL-2026-3912/): Malicious code in @antv/g-canvaskit (npm) (malicious package)
- [MAL-2026-3911](https://insights.sbomify.com/MAL-2026-3911/): Malicious code in @antv/g-canvas (npm) (malicious package)
- [MAL-2026-3910](https://insights.sbomify.com/MAL-2026-3910/): Malicious code in @antv/g-camera-api (npm) (malicious package)
- [MAL-2026-391](https://insights.sbomify.com/MAL-2026-391/): Malicious code in internallib_v962 (npm) (malicious package)
- [MAL-2026-3909](https://insights.sbomify.com/MAL-2026-3909/): Malicious code in @antv/g-base (npm) (malicious package)
- [MAL-2026-3908](https://insights.sbomify.com/MAL-2026-3908/): Malicious code in @antv/g (npm) (malicious package)
- [MAL-2026-3907](https://insights.sbomify.com/MAL-2026-3907/): Malicious code in @antv/f6-wx (npm) (malicious package)
- [MAL-2026-3906](https://insights.sbomify.com/MAL-2026-3906/): Malicious code in @antv/f6-ui (npm) (malicious package)
- [MAL-2026-3905](https://insights.sbomify.com/MAL-2026-3905/): Malicious code in @antv/f6-plugin (npm) (malicious package)
- [MAL-2026-3904](https://insights.sbomify.com/MAL-2026-3904/): Malicious code in @antv/f6-hammerjs (npm) (malicious package)
- [MAL-2026-3903](https://insights.sbomify.com/MAL-2026-3903/): Malicious code in @antv/f6-element (npm) (malicious package)
- [MAL-2026-3902](https://insights.sbomify.com/MAL-2026-3902/): Malicious code in @antv/f6-core (npm) (malicious package)
- [MAL-2026-3901](https://insights.sbomify.com/MAL-2026-3901/): Malicious code in @antv/f6-alipay (npm) (malicious package)
- [MAL-2026-3900](https://insights.sbomify.com/MAL-2026-3900/): Malicious code in @antv/f6 (npm) (malicious package)
- [MAL-2026-390](https://insights.sbomify.com/MAL-2026-390/): Malicious code in internallib_v325 (npm) (malicious package)
- [MAL-2026-39](https://insights.sbomify.com/MAL-2026-39/): Malicious code in spire.officejs-common (npm) (malicious package)
- [MAL-2026-3899](https://insights.sbomify.com/MAL-2026-3899/): Malicious code in @antv/f2-wx (npm) (malicious package)
- [MAL-2026-3898](https://insights.sbomify.com/MAL-2026-3898/): Malicious code in @antv/f2-wordcloud (npm) (malicious package)
- [MAL-2026-3897](https://insights.sbomify.com/MAL-2026-3897/): Malicious code in @antv/f2-vue (npm) (malicious package)
- [MAL-2026-3896](https://insights.sbomify.com/MAL-2026-3896/): Malicious code in @antv/f2-site (npm) (malicious package)
- [MAL-2026-3895](https://insights.sbomify.com/MAL-2026-3895/): Malicious code in @antv/f2-react (npm) (malicious package)
- [MAL-2026-3894](https://insights.sbomify.com/MAL-2026-3894/): Malicious code in @antv/f2-my (npm) (malicious package)
- [MAL-2026-3893](https://insights.sbomify.com/MAL-2026-3893/): Malicious code in @antv/f2-graphic (npm) (malicious package)
- [MAL-2026-3892](https://insights.sbomify.com/MAL-2026-3892/): Malicious code in @antv/f2-context (npm) (malicious package)
- [MAL-2026-3891](https://insights.sbomify.com/MAL-2026-3891/): Malicious code in @antv/f2-canvas (npm) (malicious package)
- [MAL-2026-3890](https://insights.sbomify.com/MAL-2026-3890/): Malicious code in @antv/f2-algorithm (npm) (malicious package)
- [MAL-2026-389](https://insights.sbomify.com/MAL-2026-389/): Malicious code in genki-analytics (npm) (malicious package)
- [MAL-2026-3889](https://insights.sbomify.com/MAL-2026-3889/): Malicious code in @antv/f2 (npm) (malicious package)
- [MAL-2026-3888](https://insights.sbomify.com/MAL-2026-3888/): Malicious code in @antv/f-wx (npm) (malicious package)
- [MAL-2026-3887](https://insights.sbomify.com/MAL-2026-3887/): Malicious code in @antv/f-vue (npm) (malicious package)
- [MAL-2026-3886](https://insights.sbomify.com/MAL-2026-3886/): Malicious code in @antv/f-test-utils (npm) (malicious package)
- [MAL-2026-3885](https://insights.sbomify.com/MAL-2026-3885/): Malicious code in @antv/f-react (npm) (malicious package)
- [MAL-2026-3884](https://insights.sbomify.com/MAL-2026-3884/): Malicious code in @antv/f-my (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/75/