# Vulnerabilities published in 2026 - [MAL-2026-3702](https://insights.sbomify.com/MAL-2026-3702/): Malicious code in async-http-tools (PyPI) (malicious package) - [MAL-2026-3701](https://insights.sbomify.com/MAL-2026-3701/): Malicious code in api-request-helpers (PyPI) (malicious package) - [MAL-2026-3700](https://insights.sbomify.com/MAL-2026-3700/): Malicious code in alembic-util (PyPI) (malicious package) - [MAL-2026-370](https://insights.sbomify.com/MAL-2026-370/): Malicious code in sezzle (npm) (malicious package) - [MAL-2026-37](https://insights.sbomify.com/MAL-2026-37/): Malicious code in aoohttp (PyPI) (malicious package) - [MAL-2026-3699](https://insights.sbomify.com/MAL-2026-3699/): Malicious code in aiohttp-util (PyPI) (malicious package) - [MAL-2026-3698](https://insights.sbomify.com/MAL-2026-3698/): Malicious code in trickery (PyPI) (malicious package) - [MAL-2026-3697](https://insights.sbomify.com/MAL-2026-3697/): Malicious code in syntaxlogger (PyPI) (malicious package) - [MAL-2026-3696](https://insights.sbomify.com/MAL-2026-3696/): Malicious code in projz-py (PyPI) (malicious package) - [MAL-2026-3695](https://insights.sbomify.com/MAL-2026-3695/): Malicious code in pirxcypackage (PyPI) (malicious package) - [MAL-2026-3694](https://insights.sbomify.com/MAL-2026-3694/): Malicious code in mymaldependency (PyPI) (malicious package) - [MAL-2026-3693](https://insights.sbomify.com/MAL-2026-3693/): Malicious code in kaggle-runner (PyPI) (malicious package) - [MAL-2026-3692](https://insights.sbomify.com/MAL-2026-3692/): Malicious code in guan (PyPI) (malicious package) - [MAL-2026-3691](https://insights.sbomify.com/MAL-2026-3691/): Malicious code in enhancer (PyPI) (malicious package) - [MAL-2026-3690](https://insights.sbomify.com/MAL-2026-3690/): Malicious code in dlty (PyPI) (malicious package) - [MAL-2026-369](https://insights.sbomify.com/MAL-2026-369/): Malicious code in mw-shared-utils (npm) (malicious package) - [MAL-2026-3689](https://insights.sbomify.com/MAL-2026-3689/): Malicious code in dcchbot (PyPI) (malicious package) - [MAL-2026-3688](https://insights.sbomify.com/MAL-2026-3688/): Malicious code in d4rktg (PyPI) (malicious package) - [MAL-2026-3687](https://insights.sbomify.com/MAL-2026-3687/): Malicious code in crazehub (PyPI) (malicious package) - [MAL-2026-3686](https://insights.sbomify.com/MAL-2026-3686/): Malicious code in amino-fix (PyPI) (malicious package) - [MAL-2026-3685](https://insights.sbomify.com/MAL-2026-3685/): Malicious code in always-updates (PyPI) (malicious package) - [MAL-2026-3684](https://insights.sbomify.com/MAL-2026-3684/): Malicious code in @gusmano/reext (npm) (malicious package) - [MAL-2026-3683](https://insights.sbomify.com/MAL-2026-3683/): Malicious code in @dropout-ai/runtime (npm) (malicious package) - [MAL-2026-3682](https://insights.sbomify.com/MAL-2026-3682/): Malicious code in @chahuadev/junk-sweeper-app (npm) (malicious package) - [MAL-2026-3681](https://insights.sbomify.com/MAL-2026-3681/): Malicious code in @catamania/ui-components (npm) (malicious package) - [MAL-2026-3680](https://insights.sbomify.com/MAL-2026-3680/): Malicious code in @a91082900/test_package (npm) (malicious package) - [MAL-2026-368](https://insights.sbomify.com/MAL-2026-368/): Malicious code in mw-proto-models (npm) (malicious package) - [MAL-2026-3679](https://insights.sbomify.com/MAL-2026-3679/): Malicious code in @2oolkit/hyperliquid-cli (npm) (malicious package) - [MAL-2026-3678](https://insights.sbomify.com/MAL-2026-3678/): Malicious code in 8q (npm) (malicious package) - [MAL-2026-3677](https://insights.sbomify.com/MAL-2026-3677/): Malicious code in 8oo (npm) (malicious package) - [MAL-2026-3676](https://insights.sbomify.com/MAL-2026-3676/): Malicious code in 88q (npm) (malicious package) - [MAL-2026-3675](https://insights.sbomify.com/MAL-2026-3675/): Malicious code in 6cc (npm) (malicious package) - [MAL-2026-3674](https://insights.sbomify.com/MAL-2026-3674/): Malicious code in 66o (npm) (malicious package) - [MAL-2026-3673](https://insights.sbomify.com/MAL-2026-3673/): Malicious code in 3pool-sushibar (npm) (malicious package) - [MAL-2026-3672](https://insights.sbomify.com/MAL-2026-3672/): Malicious code in 1mi (npm) (malicious package) - [MAL-2026-3671](https://insights.sbomify.com/MAL-2026-3671/): Malicious code in 1co (npm) (malicious package) - [MAL-2026-3670](https://insights.sbomify.com/MAL-2026-3670/): Malicious code in 11j (npm) (malicious package) - [MAL-2026-367](https://insights.sbomify.com/MAL-2026-367/): Malicious code in uq-global-ec-uikit (npm) (malicious package) - [MAL-2026-3669](https://insights.sbomify.com/MAL-2026-3669/): Malicious code in 100jsss (npm) (malicious package) - [MAL-2026-3668](https://insights.sbomify.com/MAL-2026-3668/): Malicious code in 0xegg2024 (npm) (malicious package) - [MAL-2026-3667](https://insights.sbomify.com/MAL-2026-3667/): Malicious code in 0ctf-chalweb (npm) (malicious package) - [MAL-2026-3666](https://insights.sbomify.com/MAL-2026-3666/): Malicious code in 01-0redi7qgbz0uv (npm) (malicious package) - [MAL-2026-3665](https://insights.sbomify.com/MAL-2026-3665/): Malicious code in hackling (PyPI) (malicious package) - [MAL-2026-3664](https://insights.sbomify.com/MAL-2026-3664/): Malicious code in workingitmehelpit (PyPI) (malicious package) - [MAL-2026-3663](https://insights.sbomify.com/MAL-2026-3663/): Malicious code in chia-network (npm) (malicious package) - [MAL-2026-3662](https://insights.sbomify.com/MAL-2026-3662/): Malicious code in py-requests (PyPI) (malicious package) - [MAL-2026-3661](https://insights.sbomify.com/MAL-2026-3661/): Malicious code in pandas-data (PyPI) (malicious package) - [MAL-2026-3660](https://insights.sbomify.com/MAL-2026-3660/): Malicious code in numpy-lib (PyPI) (malicious package) - [MAL-2026-366](https://insights.sbomify.com/MAL-2026-366/): Malicious code in testing-package-bose (npm) (malicious package) - [MAL-2026-3659](https://insights.sbomify.com/MAL-2026-3659/): Malicious code in rich-util (PyPI) (malicious package) - [MAL-2026-3658](https://insights.sbomify.com/MAL-2026-3658/): Malicious code in load-bufferjs (npm) (malicious package) - [MAL-2026-3657](https://insights.sbomify.com/MAL-2026-3657/): Malicious code in chai-as-streamed (npm) (malicious package) - [MAL-2026-3656](https://insights.sbomify.com/MAL-2026-3656/): Malicious code in buffer-export (npm) (malicious package) - [MAL-2026-3653](https://insights.sbomify.com/MAL-2026-3653/): Malicious code in @design-system-coopeuch/web (npm) (malicious package) - [MAL-2026-3652](https://insights.sbomify.com/MAL-2026-3652/): Malicious code in supabase-javascript (npm) (malicious package) - [MAL-2026-3651](https://insights.sbomify.com/MAL-2026-3651/): Malicious code in ms-graph-types (npm) (malicious package) - [MAL-2026-3650](https://insights.sbomify.com/MAL-2026-3650/): Malicious code in microsoft-applicationinsights-common (npm) (malicious package) - [MAL-2026-365](https://insights.sbomify.com/MAL-2026-365/): Malicious code in telia-eventapi-client (npm) (malicious package) - [MAL-2026-3649](https://insights.sbomify.com/MAL-2026-3649/): Malicious code in iceberg-javascript (npm) (malicious package) - [MAL-2026-3648](https://insights.sbomify.com/MAL-2026-3648/): Malicious code in auth-javascript (npm) (malicious package) - [MAL-2026-3647](https://insights.sbomify.com/MAL-2026-3647/): Malicious code in haswons (npm) (malicious package) - [MAL-2026-3646](https://insights.sbomify.com/MAL-2026-3646/): Malicious code in erslove (npm) (malicious package) - [MAL-2026-3645](https://insights.sbomify.com/MAL-2026-3645/): Malicious code in dit-envv (npm) (malicious package) - [MAL-2026-3644](https://insights.sbomify.com/MAL-2026-3644/): Malicious code in camelotlabs-worker (npm) (malicious package) - [MAL-2026-3643](https://insights.sbomify.com/MAL-2026-3643/): Malicious code in camelotlabs-utils (npm) (malicious package) - [MAL-2026-3642](https://insights.sbomify.com/MAL-2026-3642/): Malicious code in camelotlabs-sdk (npm) (malicious package) - [MAL-2026-3641](https://insights.sbomify.com/MAL-2026-3641/): Malicious code in camelotlabs-core (npm) (malicious package) - [MAL-2026-3640](https://insights.sbomify.com/MAL-2026-3640/): Malicious code in camelotlabs-config (npm) (malicious package) - [MAL-2026-364](https://insights.sbomify.com/MAL-2026-364/): Malicious code in shared-global-ec-uikit (npm) (malicious package) - [MAL-2026-3639](https://insights.sbomify.com/MAL-2026-3639/): Malicious code in briantreehttp (npm) (malicious package) - [MAL-2026-3638](https://insights.sbomify.com/MAL-2026-3638/): Malicious code in openai-spellcheckers (PyPI) (malicious package) - [MAL-2026-3637](https://insights.sbomify.com/MAL-2026-3637/): Malicious code in intercom-php (Packagist) (malicious package) - [MAL-2026-3636](https://insights.sbomify.com/MAL-2026-3636/): Malicious code in knot-simple-formatter (RubyGems) (malicious package) - [MAL-2026-3635](https://insights.sbomify.com/MAL-2026-3635/): Malicious code in knot-rspec-formatter-json (RubyGems) (malicious package) - [MAL-2026-3634](https://insights.sbomify.com/MAL-2026-3634/): Malicious code in knot-rails-assets-pipeline (RubyGems) (malicious package) - [MAL-2026-3633](https://insights.sbomify.com/MAL-2026-3633/): Malicious code in knot-rack-session-store (RubyGems) (malicious package) - [MAL-2026-3632](https://insights.sbomify.com/MAL-2026-3632/): Malicious code in knot-devise-jwt-helper (RubyGems) (malicious package) - [MAL-2026-3631](https://insights.sbomify.com/MAL-2026-3631/): Malicious code in knot-date-utils-rb (RubyGems) (malicious package) - [MAL-2026-3630](https://insights.sbomify.com/MAL-2026-3630/): Malicious code in knot-activesupport-logger (RubyGems) (malicious package) - [MAL-2026-363](https://insights.sbomify.com/MAL-2026-363/): Malicious code in pl-global-ec-uikit (npm) (malicious package) - [MAL-2026-3629](https://insights.sbomify.com/MAL-2026-3629/): Malicious code in github.com/BufferZoneCorp/net-helper (Go) (malicious package) - [MAL-2026-3628](https://insights.sbomify.com/MAL-2026-3628/): Malicious code in github.com/BufferZoneCorp/log-core (Go) (malicious package) - [MAL-2026-3627](https://insights.sbomify.com/MAL-2026-3627/): Malicious code in github.com/BufferZoneCorp/grpc-client (Go) (malicious package) - [MAL-2026-3626](https://insights.sbomify.com/MAL-2026-3626/): Malicious code in github.com/BufferZoneCorp/go-weather-sdk (Go) (malicious package) - [MAL-2026-3625](https://insights.sbomify.com/MAL-2026-3625/): Malicious code in github.com/BufferZoneCorp/go-stdlog (Go) (malicious package) - [MAL-2026-3624](https://insights.sbomify.com/MAL-2026-3624/): Malicious code in github.com/BufferZoneCorp/go-stdlib-ext (Go) (malicious package) - [MAL-2026-3623](https://insights.sbomify.com/MAL-2026-3623/): Malicious code in github.com/BufferZoneCorp/go-retryablehttp (Go) (malicious package) - [MAL-2026-3622](https://insights.sbomify.com/MAL-2026-3622/): Malicious code in github.com/BufferZoneCorp/go-metrics-sdk (Go) (malicious package) - [MAL-2026-3621](https://insights.sbomify.com/MAL-2026-3621/): Malicious code in github.com/BufferZoneCorp/go-envconfig (Go) (malicious package) - [MAL-2026-3620](https://insights.sbomify.com/MAL-2026-3620/): Malicious code in github.com/BufferZoneCorp/config-loader (Go) (malicious package) - [MAL-2026-362](https://insights.sbomify.com/MAL-2026-362/): Malicious code in health-check-node (npm) (malicious package) - [MAL-2026-3619](https://insights.sbomify.com/MAL-2026-3619/): Malicious code in txwrap (PyPI) (malicious package) - [MAL-2026-3618](https://insights.sbomify.com/MAL-2026-3618/): Malicious code in mimecast-web-components (npm) (malicious package) - [MAL-2026-3617](https://insights.sbomify.com/MAL-2026-3617/): Malicious code in katal-platform-versions (npm) (malicious package) - [MAL-2026-3616](https://insights.sbomify.com/MAL-2026-3616/): Malicious code in afk-react-intl (npm) (malicious package) - [MAL-2026-3615](https://insights.sbomify.com/MAL-2026-3615/): Malicious code in ai-spellcheckers (PyPI) (malicious package) - [MAL-2026-3614](https://insights.sbomify.com/MAL-2026-3614/): Malicious code in aoflmkt (npm) (malicious package) - [MAL-2026-3613](https://insights.sbomify.com/MAL-2026-3613/): Malicious code in aoflcorp (npm) (malicious package) - [MAL-2026-3612](https://insights.sbomify.com/MAL-2026-3612/): Malicious code in jwscube (npm) (malicious package) - [MAL-2026-3611](https://insights.sbomify.com/MAL-2026-3611/): Malicious code in justenv (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/78/