# Vulnerabilities published in 2026 - [MAL-2026-3610](https://insights.sbomify.com/MAL-2026-3610/): Malicious code in housecallpro (npm) (malicious package) - [MAL-2026-361](https://insights.sbomify.com/MAL-2026-361/): Malicious code in gu-global-ec-uikit (npm) (malicious package) - [MAL-2026-3609](https://insights.sbomify.com/MAL-2026-3609/): Malicious code in forge-jsxy (npm) (malicious package) - [MAL-2026-3608](https://insights.sbomify.com/MAL-2026-3608/): Malicious code in mistralai (PyPI) (malicious package) - [MAL-2026-3607](https://insights.sbomify.com/MAL-2026-3607/): Malicious code in guardrails-ai (PyPI) (malicious package) - [MAL-2026-3606](https://insights.sbomify.com/MAL-2026-3606/): Malicious code in ml-toolkit-ts (npm) (malicious package) - [MAL-2026-3605](https://insights.sbomify.com/MAL-2026-3605/): Malicious code in agentwork-cli (npm) (malicious package) - [MAL-2026-3604](https://insights.sbomify.com/MAL-2026-3604/): Malicious code in @tallyui/storage-sqlite (npm) (malicious package) - [MAL-2026-3603](https://insights.sbomify.com/MAL-2026-3603/): Malicious code in @tallyui/core (npm) (malicious package) - [MAL-2026-3602](https://insights.sbomify.com/MAL-2026-3602/): Malicious code in @ml-toolkit-ts/xgboost (npm) (malicious package) - [MAL-2026-3601](https://insights.sbomify.com/MAL-2026-3601/): Malicious code in @ml-toolkit-ts/preprocessing (npm) (malicious package) - [MAL-2026-3600](https://insights.sbomify.com/MAL-2026-3600/): Malicious code in @mesadev/sdk (npm) (malicious package) - [MAL-2026-360](https://insights.sbomify.com/MAL-2026-360/): Malicious code in excel-to-json-test (npm) (malicious package) - [MAL-2026-36](https://insights.sbomify.com/MAL-2026-36/): Malicious code in aiohtto (PyPI) (malicious package) - [MAL-2026-3599](https://insights.sbomify.com/MAL-2026-3599/): Malicious code in @mesadev/saguaro (npm) (malicious package) - [MAL-2026-3598](https://insights.sbomify.com/MAL-2026-3598/): Malicious code in @draftlab/db (npm) (malicious package) - [MAL-2026-3597](https://insights.sbomify.com/MAL-2026-3597/): Malicious code in @draftlab/auth-router (npm) (malicious package) - [MAL-2026-3596](https://insights.sbomify.com/MAL-2026-3596/): Malicious code in @draftlab/auth (npm) (malicious package) - [MAL-2026-3595](https://insights.sbomify.com/MAL-2026-3595/): Malicious code in @draftauth/core (npm) (malicious package) - [MAL-2026-3594](https://insights.sbomify.com/MAL-2026-3594/): Malicious code in @draftauth/client (npm) (malicious package) - [MAL-2026-3593](https://insights.sbomify.com/MAL-2026-3593/): Malicious code in @dirigible-ai/sdk (npm) (malicious package) - [MAL-2026-3592](https://insights.sbomify.com/MAL-2026-3592/): Malicious code in hedwig-tsconfig (npm) (malicious package) - [MAL-2026-3591](https://insights.sbomify.com/MAL-2026-3591/): Malicious code in wot-api (npm) (malicious package) - [MAL-2026-3590](https://insights.sbomify.com/MAL-2026-3590/): Malicious code in safe-action (npm) (malicious package) - [MAL-2026-359](https://insights.sbomify.com/MAL-2026-359/): Malicious code in dreame-claude (npm) (malicious package) - [MAL-2026-3589](https://insights.sbomify.com/MAL-2026-3589/): Malicious code in nextmove-mcp (npm) (malicious package) - [MAL-2026-3588](https://insights.sbomify.com/MAL-2026-3588/): Malicious code in cmux-agent-mcp (npm) (malicious package) - [MAL-2026-3587](https://insights.sbomify.com/MAL-2026-3587/): Malicious code in @uipath/widget.sdk (npm) (malicious package) - [MAL-2026-3586](https://insights.sbomify.com/MAL-2026-3586/): Malicious code in @uipath/vss (npm) (malicious package) - [MAL-2026-3585](https://insights.sbomify.com/MAL-2026-3585/): Malicious code in @uipath/vertical-solutions-tool (npm) (malicious package) - [MAL-2026-3584](https://insights.sbomify.com/MAL-2026-3584/): Malicious code in @uipath/uipath-python-bridge (npm) (malicious package) - [MAL-2026-3583](https://insights.sbomify.com/MAL-2026-3583/): Malicious code in @uipath/ui-widgets-multi-file-upload (npm) (malicious package) - [MAL-2026-3582](https://insights.sbomify.com/MAL-2026-3582/): Malicious code in @uipath/traces-tool (npm) (malicious package) - [MAL-2026-3581](https://insights.sbomify.com/MAL-2026-3581/): Malicious code in @uipath/tool-workflowcompiler (npm) (malicious package) - [MAL-2026-3580](https://insights.sbomify.com/MAL-2026-3580/): Malicious code in @uipath/test-manager-tool (npm) (malicious package) - [MAL-2026-358](https://insights.sbomify.com/MAL-2026-358/): Malicious code in dot-env-buffer (npm) (malicious package) - [MAL-2026-3579](https://insights.sbomify.com/MAL-2026-3579/): Malicious code in @uipath/telemetry (npm) (malicious package) - [MAL-2026-3578](https://insights.sbomify.com/MAL-2026-3578/): Malicious code in @uipath/tasks-tool (npm) (malicious package) - [MAL-2026-3577](https://insights.sbomify.com/MAL-2026-3577/): Malicious code in @uipath/solutionpackager-tool-core (npm) (malicious package) - [MAL-2026-3576](https://insights.sbomify.com/MAL-2026-3576/): Malicious code in @uipath/solutionpackager-sdk (npm) (malicious package) - [MAL-2026-3575](https://insights.sbomify.com/MAL-2026-3575/): Malicious code in @uipath/solution-tool (npm) (malicious package) - [MAL-2026-3574](https://insights.sbomify.com/MAL-2026-3574/): Malicious code in @uipath/solution-packager (npm) (malicious package) - [MAL-2026-3573](https://insights.sbomify.com/MAL-2026-3573/): Malicious code in @uipath/rpa-tool (npm) (malicious package) - [MAL-2026-3572](https://insights.sbomify.com/MAL-2026-3572/): Malicious code in @uipath/rpa-legacy-tool (npm) (malicious package) - [MAL-2026-3571](https://insights.sbomify.com/MAL-2026-3571/): Malicious code in @uipath/robot (npm) (malicious package) - [MAL-2026-3570](https://insights.sbomify.com/MAL-2026-3570/): Malicious code in @uipath/resources-tool (npm) (malicious package) - [MAL-2026-357](https://insights.sbomify.com/MAL-2026-357/): Malicious code in chai-bin (npm) (malicious package) - [MAL-2026-3569](https://insights.sbomify.com/MAL-2026-3569/): Malicious code in @uipath/resourcecatalog-tool (npm) (malicious package) - [MAL-2026-3568](https://insights.sbomify.com/MAL-2026-3568/): Malicious code in @uipath/resource-tool (npm) (malicious package) - [MAL-2026-3567](https://insights.sbomify.com/MAL-2026-3567/): Malicious code in @uipath/project-packager (npm) (malicious package) - [MAL-2026-3566](https://insights.sbomify.com/MAL-2026-3566/): Malicious code in @uipath/platform-tool (npm) (malicious package) - [MAL-2026-3565](https://insights.sbomify.com/MAL-2026-3565/): Malicious code in @uipath/packager-tool-workflowcompiler-browser (npm) (malicious package) - [MAL-2026-3564](https://insights.sbomify.com/MAL-2026-3564/): Malicious code in @uipath/packager-tool-workflowcompiler (npm) (malicious package) - [MAL-2026-3563](https://insights.sbomify.com/MAL-2026-3563/): Malicious code in @uipath/packager-tool-webapp (npm) (malicious package) - [MAL-2026-3562](https://insights.sbomify.com/MAL-2026-3562/): Malicious code in @uipath/packager-tool-functions (npm) (malicious package) - [MAL-2026-3561](https://insights.sbomify.com/MAL-2026-3561/): Malicious code in @uipath/packager-tool-flow (npm) (malicious package) - [MAL-2026-3560](https://insights.sbomify.com/MAL-2026-3560/): Malicious code in @uipath/packager-tool-connector (npm) (malicious package) - [MAL-2026-356](https://insights.sbomify.com/MAL-2026-356/): Malicious code in react-server-dom-unbundled (npm) (malicious package) - [MAL-2026-3559](https://insights.sbomify.com/MAL-2026-3559/): Malicious code in @uipath/packager-tool-case (npm) (malicious package) - [MAL-2026-3558](https://insights.sbomify.com/MAL-2026-3558/): Malicious code in @uipath/packager-tool-bpmn (npm) (malicious package) - [MAL-2026-3557](https://insights.sbomify.com/MAL-2026-3557/): Malicious code in @uipath/packager-tool-apiworkflow (npm) (malicious package) - [MAL-2026-3556](https://insights.sbomify.com/MAL-2026-3556/): Malicious code in @uipath/orchestrator-tool (npm) (malicious package) - [MAL-2026-3555](https://insights.sbomify.com/MAL-2026-3555/): Malicious code in @uipath/maestro-tool (npm) (malicious package) - [MAL-2026-3554](https://insights.sbomify.com/MAL-2026-3554/): Malicious code in @uipath/maestro-sdk (npm) (malicious package) - [MAL-2026-3553](https://insights.sbomify.com/MAL-2026-3553/): Malicious code in @uipath/llmgw-tool (npm) (malicious package) - [MAL-2026-3552](https://insights.sbomify.com/MAL-2026-3552/): Malicious code in @uipath/integrationservice-tool (npm) (malicious package) - [MAL-2026-3551](https://insights.sbomify.com/MAL-2026-3551/): Malicious code in @uipath/integrationservice-sdk (npm) (malicious package) - [MAL-2026-3550](https://insights.sbomify.com/MAL-2026-3550/): Malicious code in @uipath/insights-tool (npm) (malicious package) - [MAL-2026-355](https://insights.sbomify.com/MAL-2026-355/): Malicious code in dux-portal-privacy (npm) (malicious package) - [MAL-2026-3549](https://insights.sbomify.com/MAL-2026-3549/): Malicious code in @uipath/insights-sdk (npm) (malicious package) - [MAL-2026-3548](https://insights.sbomify.com/MAL-2026-3548/): Malicious code in @uipath/identity-tool (npm) (malicious package) - [MAL-2026-3547](https://insights.sbomify.com/MAL-2026-3547/): Malicious code in @uipath/gov-tool (npm) (malicious package) - [MAL-2026-3546](https://insights.sbomify.com/MAL-2026-3546/): Malicious code in @uipath/functions-tool (npm) (malicious package) - [MAL-2026-3545](https://insights.sbomify.com/MAL-2026-3545/): Malicious code in @uipath/flow-tool (npm) (malicious package) - [MAL-2026-3544](https://insights.sbomify.com/MAL-2026-3544/): Malicious code in @uipath/filesystem (npm) (malicious package) - [MAL-2026-3543](https://insights.sbomify.com/MAL-2026-3543/): Malicious code in @uipath/docsai-tool (npm) (malicious package) - [MAL-2026-3542](https://insights.sbomify.com/MAL-2026-3542/): Malicious code in @uipath/data-fabric-tool (npm) (malicious package) - [MAL-2026-3541](https://insights.sbomify.com/MAL-2026-3541/): Malicious code in @uipath/context-grounding-tool (npm) (malicious package) - [MAL-2026-3540](https://insights.sbomify.com/MAL-2026-3540/): Malicious code in @uipath/common (npm) (malicious package) - [MAL-2026-354](https://insights.sbomify.com/MAL-2026-354/): Malicious code in dux-portal (npm) (malicious package) - [MAL-2026-3539](https://insights.sbomify.com/MAL-2026-3539/): Malicious code in @uipath/codedapp-tool (npm) (malicious package) - [MAL-2026-3538](https://insights.sbomify.com/MAL-2026-3538/): Malicious code in @uipath/codedagents-tool (npm) (malicious package) - [MAL-2026-3537](https://insights.sbomify.com/MAL-2026-3537/): Malicious code in @uipath/codedagent-tool (npm) (malicious package) - [MAL-2026-3536](https://insights.sbomify.com/MAL-2026-3536/): Malicious code in @uipath/cli (npm) (malicious package) - [MAL-2026-3535](https://insights.sbomify.com/MAL-2026-3535/): Malicious code in @uipath/case-tool (npm) (malicious package) - [MAL-2026-3534](https://insights.sbomify.com/MAL-2026-3534/): Malicious code in @uipath/auth (npm) (malicious package) - [MAL-2026-3533](https://insights.sbomify.com/MAL-2026-3533/): Malicious code in @uipath/apollo-wind (npm) (malicious package) - [MAL-2026-3532](https://insights.sbomify.com/MAL-2026-3532/): Malicious code in @uipath/apollo-react (npm) (malicious package) - [MAL-2026-3531](https://insights.sbomify.com/MAL-2026-3531/): Malicious code in @uipath/apollo-core (npm) (malicious package) - [MAL-2026-3530](https://insights.sbomify.com/MAL-2026-3530/): Malicious code in @uipath/api-workflow-tool (npm) (malicious package) - [MAL-2026-353](https://insights.sbomify.com/MAL-2026-353/): Malicious code in advanced-svg-fetcher (npm) (malicious package) - [MAL-2026-3529](https://insights.sbomify.com/MAL-2026-3529/): Malicious code in @uipath/ap-chat (npm) (malicious package) - [MAL-2026-3528](https://insights.sbomify.com/MAL-2026-3528/): Malicious code in @uipath/aops-policy-tool (npm) (malicious package) - [MAL-2026-3527](https://insights.sbomify.com/MAL-2026-3527/): Malicious code in @uipath/agent.sdk (npm) (malicious package) - [MAL-2026-3526](https://insights.sbomify.com/MAL-2026-3526/): Malicious code in @uipath/agent-tool (npm) (malicious package) - [MAL-2026-3525](https://insights.sbomify.com/MAL-2026-3525/): Malicious code in @uipath/agent-sdk (npm) (malicious package) - [MAL-2026-3524](https://insights.sbomify.com/MAL-2026-3524/): Malicious code in @uipath/admin-tool (npm) (malicious package) - [MAL-2026-3523](https://insights.sbomify.com/MAL-2026-3523/): Malicious code in @uipath/access-policy-tool (npm) (malicious package) - [MAL-2026-3522](https://insights.sbomify.com/MAL-2026-3522/): Malicious code in @uipath/access-policy-sdk (npm) (malicious package) - [MAL-2026-3521](https://insights.sbomify.com/MAL-2026-3521/): Malicious code in @tolka/cli (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/79/