# Vulnerabilities published in 2026


- [MAL-2026-3883](https://insights.sbomify.com/MAL-2026-3883/): Malicious code in @antv/f-lottie (npm) (malicious package)
- [MAL-2026-3882](https://insights.sbomify.com/MAL-2026-3882/): Malicious code in @antv/f-engine (npm) (malicious package)
- [MAL-2026-3881](https://insights.sbomify.com/MAL-2026-3881/): Malicious code in @antv/f-charts (npm) (malicious package)
- [MAL-2026-3880](https://insights.sbomify.com/MAL-2026-3880/): Malicious code in @antv/expr (npm) (malicious package)
- [MAL-2026-388](https://insights.sbomify.com/MAL-2026-388/): Malicious code in charlie_charlie_kirky (npm) (malicious package)
- [MAL-2026-3879](https://insights.sbomify.com/MAL-2026-3879/): Malicious code in @antv/event-emitter (npm) (malicious package)
- [MAL-2026-3878](https://insights.sbomify.com/MAL-2026-3878/): Malicious code in @antv/dw-util (npm) (malicious package)
- [MAL-2026-3877](https://insights.sbomify.com/MAL-2026-3877/): Malicious code in @antv/dw-transform (npm) (malicious package)
- [MAL-2026-3876](https://insights.sbomify.com/MAL-2026-3876/): Malicious code in @antv/dw-random (npm) (malicious package)
- [MAL-2026-3875](https://insights.sbomify.com/MAL-2026-3875/): Malicious code in @antv/dw-analyzer (npm) (malicious package)
- [MAL-2026-3874](https://insights.sbomify.com/MAL-2026-3874/): Malicious code in @antv/dumi-theme-antv (npm) (malicious package)
- [MAL-2026-3873](https://insights.sbomify.com/MAL-2026-3873/): Malicious code in @antv/dom-util (npm) (malicious package)
- [MAL-2026-3872](https://insights.sbomify.com/MAL-2026-3872/): Malicious code in @antv/dipper-map (npm) (malicious package)
- [MAL-2026-3871](https://insights.sbomify.com/MAL-2026-3871/): Malicious code in @antv/dipper-hooks (npm) (malicious package)
- [MAL-2026-3870](https://insights.sbomify.com/MAL-2026-3870/): Malicious code in @antv/dipper-component (npm) (malicious package)
- [MAL-2026-387](https://insights.sbomify.com/MAL-2026-387/): Malicious code in chai-dex (npm) (malicious package)
- [MAL-2026-3869](https://insights.sbomify.com/MAL-2026-3869/): Malicious code in @antv/data-wizard (npm) (malicious package)
- [MAL-2026-3868](https://insights.sbomify.com/MAL-2026-3868/): Malicious code in @antv/data-set (npm) (malicious package)
- [MAL-2026-3867](https://insights.sbomify.com/MAL-2026-3867/): Malicious code in @antv/data-samples (npm) (malicious package)
- [MAL-2026-3866](https://insights.sbomify.com/MAL-2026-3866/): Malicious code in @antv/d3-interpolate (npm) (malicious package)
- [MAL-2026-3865](https://insights.sbomify.com/MAL-2026-3865/): Malicious code in @antv/d3-color (npm) (malicious package)
- [MAL-2026-3864](https://insights.sbomify.com/MAL-2026-3864/): Malicious code in @antv/coord (npm) (malicious package)
- [MAL-2026-3863](https://insights.sbomify.com/MAL-2026-3863/): Malicious code in @antv/component (npm) (malicious package)
- [MAL-2026-3862](https://insights.sbomify.com/MAL-2026-3862/): Malicious code in @antv/color-util (npm) (malicious package)
- [MAL-2026-3861](https://insights.sbomify.com/MAL-2026-3861/): Malicious code in @antv/color-schema (npm) (malicious package)
- [MAL-2026-3860](https://insights.sbomify.com/MAL-2026-3860/): Malicious code in @antv/ckb (npm) (malicious package)
- [MAL-2026-386](https://insights.sbomify.com/MAL-2026-386/): Malicious code in chai-chain-async (npm) (malicious package)
- [MAL-2026-3859](https://insights.sbomify.com/MAL-2026-3859/): Malicious code in @antv/chart-visualization-skills (npm) (malicious package)
- [MAL-2026-3858](https://insights.sbomify.com/MAL-2026-3858/): Malicious code in @antv/chart-node-g6 (npm) (malicious package)
- [MAL-2026-3857](https://insights.sbomify.com/MAL-2026-3857/): Malicious code in @antv/chart-linter (npm) (malicious package)
- [MAL-2026-3856](https://insights.sbomify.com/MAL-2026-3856/): Malicious code in @antv/calendar-heatmap (npm) (malicious package)
- [MAL-2026-3855](https://insights.sbomify.com/MAL-2026-3855/): Malicious code in @antv/awards (npm) (malicious package)
- [MAL-2026-3854](https://insights.sbomify.com/MAL-2026-3854/): Malicious code in @antv/ava-react (npm) (malicious package)
- [MAL-2026-3853](https://insights.sbomify.com/MAL-2026-3853/): Malicious code in @antv/ava (npm) (malicious package)
- [MAL-2026-3852](https://insights.sbomify.com/MAL-2026-3852/): Malicious code in @antv/attr (npm) (malicious package)
- [MAL-2026-3851](https://insights.sbomify.com/MAL-2026-3851/): Malicious code in @antv/async-hook (npm) (malicious package)
- [MAL-2026-3850](https://insights.sbomify.com/MAL-2026-3850/): Malicious code in @antv/algorithm (npm) (malicious package)
- [MAL-2026-385](https://insights.sbomify.com/MAL-2026-385/): Malicious code in blocks-builder-manifest-generator (npm) (malicious package)
- [MAL-2026-3849](https://insights.sbomify.com/MAL-2026-3849/): Malicious code in @antv/adjust (npm) (malicious package)
- [MAL-2026-3848](https://insights.sbomify.com/MAL-2026-3848/): Malicious code in @antv/a8 (npm) (malicious package)
- [MAL-2026-3847](https://insights.sbomify.com/MAL-2026-3847/): Malicious code in openclaw-cn (npm) (malicious package)
- [MAL-2026-3846](https://insights.sbomify.com/MAL-2026-3846/): Malicious code in byte-parser (npm) (malicious package)
- [MAL-2026-3845](https://insights.sbomify.com/MAL-2026-3845/): Malicious code in @starmind/collector-cli (npm) (malicious package)
- [MAL-2026-3844](https://insights.sbomify.com/MAL-2026-3844/): Malicious code in @openclaw-cn/toutiao-ops (npm) (malicious package)
- [MAL-2026-3843](https://insights.sbomify.com/MAL-2026-3843/): Malicious code in @openclaw-cn/libsignal (npm) (malicious package)
- [MAL-2026-3842](https://insights.sbomify.com/MAL-2026-3842/): Malicious code in @openclaw-cn/feishu (npm) (malicious package)
- [MAL-2026-3841](https://insights.sbomify.com/MAL-2026-3841/): Malicious code in @openclaw-cn/cli (npm) (malicious package)
- [MAL-2026-3840](https://insights.sbomify.com/MAL-2026-3840/): Malicious code in @antv/x6-geometry (npm) (malicious package)
- [MAL-2026-384](https://insights.sbomify.com/MAL-2026-384/): Malicious code in @mikudev/signal (npm) (malicious package)
- [MAL-2026-3839](https://insights.sbomify.com/MAL-2026-3839/): Malicious code in @antv/x6 (npm) (malicious package)
- [MAL-2026-3838](https://insights.sbomify.com/MAL-2026-3838/): Malicious code in @antv/gi-assets-advance (npm) (malicious package)
- [MAL-2026-3837](https://insights.sbomify.com/MAL-2026-3837/): Malicious code in @antv/g-image-exporter (npm) (malicious package)
- [MAL-2026-3836](https://insights.sbomify.com/MAL-2026-3836/): Malicious code in ctf-flare (npm) (malicious package)
- [MAL-2026-3835](https://insights.sbomify.com/MAL-2026-3835/): Malicious code in solana-web3-alt (PyPI) (malicious package)
- [MAL-2026-3834](https://insights.sbomify.com/MAL-2026-3834/): Malicious code in foundry-utils (PyPI) (malicious package)
- [MAL-2026-3833](https://insights.sbomify.com/MAL-2026-3833/): Malicious code in zentra-sdk (npm) (malicious package)
- [MAL-2026-3832](https://insights.sbomify.com/MAL-2026-3832/): Malicious code in zentra-finance (npm) (malicious package)
- [MAL-2026-3831](https://insights.sbomify.com/MAL-2026-3831/): Malicious code in citrea-utils (npm) (malicious package)
- [MAL-2026-3830](https://insights.sbomify.com/MAL-2026-3830/): Malicious code in @zentrafinance/contracts (npm) (malicious package)
- [MAL-2026-383](https://insights.sbomify.com/MAL-2026-383/): Malicious code in @mikudev/ridwan-signal (npm) (malicious package)
- [MAL-2026-3829](https://insights.sbomify.com/MAL-2026-3829/): Malicious code in pyenvprep (PyPI) (malicious package)
- [MAL-2026-3828](https://insights.sbomify.com/MAL-2026-3828/): Malicious code in validate-api-key (npm) (malicious package)
- [MAL-2026-3827](https://insights.sbomify.com/MAL-2026-3827/): Malicious code in string-manipulation-typescript (npm) (malicious package)
- [MAL-2026-3826](https://insights.sbomify.com/MAL-2026-3826/): Malicious code in secure-env-loader (npm) (malicious package)
- [MAL-2026-3825](https://insights.sbomify.com/MAL-2026-3825/): Malicious code in safe-env-reader (npm) (malicious package)
- [MAL-2026-3824](https://insights.sbomify.com/MAL-2026-3824/): Malicious code in parse-regex-string (npm) (malicious package)
- [MAL-2026-3823](https://insights.sbomify.com/MAL-2026-3823/): Malicious code in parse-escape-regex-string (npm) (malicious package)
- [MAL-2026-3822](https://insights.sbomify.com/MAL-2026-3822/): Malicious code in clementine-sdk (npm) (malicious package)
- [MAL-2026-3821](https://insights.sbomify.com/MAL-2026-3821/): Malicious code in citrea-sdk (npm) (malicious package)
- [MAL-2026-3820](https://insights.sbomify.com/MAL-2026-3820/): Malicious code in citrea-bridge (npm) (malicious package)
- [MAL-2026-382](https://insights.sbomify.com/MAL-2026-382/): Malicious code in @mikudev/ridwan-baileys-mod (npm) (malicious package)
- [MAL-2026-3819](https://insights.sbomify.com/MAL-2026-3819/): Malicious code in apexpro-node (npm) (malicious package)
- [MAL-2026-3818](https://insights.sbomify.com/MAL-2026-3818/): Malicious code in apexomni-node (npm) (malicious package)
- [MAL-2026-3817](https://insights.sbomify.com/MAL-2026-3817/): Malicious code in apex-trading (npm) (malicious package)
- [MAL-2026-3816](https://insights.sbomify.com/MAL-2026-3816/): Malicious code in apex-connector (npm) (malicious package)
- [MAL-2026-3815](https://insights.sbomify.com/MAL-2026-3815/): Malicious code in @zentrafinance/types (npm) (malicious package)
- [MAL-2026-3814](https://insights.sbomify.com/MAL-2026-3814/): Malicious code in @zentrafinance/sdk (npm) (malicious package)
- [MAL-2026-3813](https://insights.sbomify.com/MAL-2026-3813/): Malicious code in @zentrafinance/protocol-config (npm) (malicious package)
- [MAL-2026-3812](https://insights.sbomify.com/MAL-2026-3812/): Malicious code in @easytipsportal/node-helper (npm) (malicious package)
- [MAL-2026-3811](https://insights.sbomify.com/MAL-2026-3811/): Malicious code in claude-code-base-action (npm) (malicious package)
- [MAL-2026-3810](https://insights.sbomify.com/MAL-2026-3810/): Malicious code in @pluxee-connect/account-db-api-client (npm) (malicious package)
- [MAL-2026-381](https://insights.sbomify.com/MAL-2026-381/): Malicious code in @mikudev/beles (npm) (malicious package)
- [MAL-2026-3809](https://insights.sbomify.com/MAL-2026-3809/): Malicious code in @tc-core/campus-service (npm) (malicious package)
- [MAL-2026-3808](https://insights.sbomify.com/MAL-2026-3808/): Malicious code in @citi-icg-158830/icgds-react-css (npm) (malicious package)
- [MAL-2026-3807](https://insights.sbomify.com/MAL-2026-3807/): Malicious code in @citi-icg-158830/elemental-ui-react (npm) (malicious package)
- [MAL-2026-3806](https://insights.sbomify.com/MAL-2026-3806/): Malicious code in @citi-icg-158830/elemental-chameleon (npm) (malicious package)
- [MAL-2026-3805](https://insights.sbomify.com/MAL-2026-3805/): Malicious code in netping (PyPI) (malicious package)
- [MAL-2026-3804](https://insights.sbomify.com/MAL-2026-3804/): Malicious code in bui-react-10components (npm) (malicious package)
- [MAL-2026-3803](https://insights.sbomify.com/MAL-2026-3803/): Malicious code in venv-utils (PyPI) (malicious package)
- [MAL-2026-3802](https://insights.sbomify.com/MAL-2026-3802/): Malicious code in @datatrain/passenger-v3 (npm) (malicious package)
- [MAL-2026-3801](https://insights.sbomify.com/MAL-2026-3801/): Malicious code in the_secret_of_running_by_hans_van_dijk_ron_van_megen_02jsk (npm) (malicious package)
- [MAL-2026-3800](https://insights.sbomify.com/MAL-2026-3800/): Malicious code in dowload_ebok_the_upside_of_unrequited_by_becky_albertalli_2jgmw (npm) (malicious package)
- [MAL-2026-380](https://insights.sbomify.com/MAL-2026-380/): Malicious code in @kyriba/platform-frontend (npm) (malicious package)
- [MAL-2026-38](https://insights.sbomify.com/MAL-2026-38/): Malicious code in auohttp (PyPI) (malicious package)
- [MAL-2026-3799](https://insights.sbomify.com/MAL-2026-3799/): Malicious code in dowload_ebok_the_testament_of_solomon_by_king_solomon_frederick_cornwallis_conybeare_5201c (npm) (malicious package)
- [MAL-2026-3798](https://insights.sbomify.com/MAL-2026-3798/): Malicious code in dowload_ebok_terra_incognita_urania_by_ian_mcdonald_um4vu (npm) (malicious package)
- [MAL-2026-3797](https://insights.sbomify.com/MAL-2026-3797/): Malicious code in dowload_ebok_stalking_jack_the_ripper_by_kerri_maniscalco_james_patterson_b529t (npm) (malicious package)
- [MAL-2026-3796](https://insights.sbomify.com/MAL-2026-3796/): Malicious code in dowload_ebok_los_enemigos_del_comercio_by_antonio_escohotado_6t2l4 (npm) (malicious package)
- [MAL-2026-3795](https://insights.sbomify.com/MAL-2026-3795/): Malicious code in dowload_ebok_como_leer_el_futbol_by_ruud_gullit_8qd97 (npm) (malicious package)
- [MAL-2026-3794](https://insights.sbomify.com/MAL-2026-3794/): Malicious code in dowload_ebok_also_an_octopus_by_maggie_tokuda_hall_ah2ip (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/76/