# Vulnerabilities published in 2026


- [MAL-2026-3520](https://insights.sbomify.com/MAL-2026-3520/): Malicious code in @taskflow-corp/cli (npm) (malicious package)
- [MAL-2026-352](https://insights.sbomify.com/MAL-2026-352/): Malicious code in medifile (PyPI) (malicious package)
- [MAL-2026-3519](https://insights.sbomify.com/MAL-2026-3519/): Malicious code in @tallyui/theme (npm) (malicious package)
- [MAL-2026-3518](https://insights.sbomify.com/MAL-2026-3518/): Malicious code in @tallyui/database (npm) (malicious package)
- [MAL-2026-3517](https://insights.sbomify.com/MAL-2026-3517/): Malicious code in @tallyui/connector-woocommerce (npm) (malicious package)
- [MAL-2026-3516](https://insights.sbomify.com/MAL-2026-3516/): Malicious code in @tallyui/connector-shopify (npm) (malicious package)
- [MAL-2026-3515](https://insights.sbomify.com/MAL-2026-3515/): Malicious code in @tallyui/connector-medusa (npm) (malicious package)
- [MAL-2026-3514](https://insights.sbomify.com/MAL-2026-3514/): Malicious code in @tallyui/components (npm) (malicious package)
- [MAL-2026-3513](https://insights.sbomify.com/MAL-2026-3513/): Malicious code in @supersurkhet/sdk (npm) (malicious package)
- [MAL-2026-3512](https://insights.sbomify.com/MAL-2026-3512/): Malicious code in @mistralai/mistralai-gcp (npm) (malicious package)
- [MAL-2026-3511](https://insights.sbomify.com/MAL-2026-3511/): Malicious code in @mistralai/mistralai-azure (npm) (malicious package)
- [MAL-2026-3510](https://insights.sbomify.com/MAL-2026-3510/): Malicious code in @mesadev/rest (npm) (malicious package)
- [MAL-2026-351](https://insights.sbomify.com/MAL-2026-351/): Malicious code in nanoinstaller (PyPI) (malicious package)
- [MAL-2026-3509](https://insights.sbomify.com/MAL-2026-3509/): Malicious code in pp-react-v5 (npm) (malicious package)
- [MAL-2026-3508](https://insights.sbomify.com/MAL-2026-3508/): Malicious code in crypto-javascri (npm) (malicious package)
- [MAL-2026-3507](https://insights.sbomify.com/MAL-2026-3507/): Malicious code in @mimecast-ui/components (npm) (malicious package)
- [MAL-2026-3506](https://insights.sbomify.com/MAL-2026-3506/): Malicious code in @mimecast-ui/charts (npm) (malicious package)
- [MAL-2026-3505](https://insights.sbomify.com/MAL-2026-3505/): Malicious code in ts-dna (npm) (malicious package)
- [MAL-2026-3504](https://insights.sbomify.com/MAL-2026-3504/): Malicious code in git-git-git (npm) (malicious package)
- [MAL-2026-3503](https://insights.sbomify.com/MAL-2026-3503/): Malicious code in git-branch-selector (npm) (malicious package)
- [MAL-2026-3502](https://insights.sbomify.com/MAL-2026-3502/): Malicious code in cross-stitch (npm) (malicious package)
- [MAL-2026-3501](https://insights.sbomify.com/MAL-2026-3501/): Malicious code in @tanstack/zod-adapter (npm) (malicious package)
- [MAL-2026-3500](https://insights.sbomify.com/MAL-2026-3500/): Malicious code in @tanstack/vue-start-server (npm) (malicious package)
- [MAL-2026-350](https://insights.sbomify.com/MAL-2026-350/): Malicious code in bnanainstaller (PyPI) (malicious package)
- [MAL-2026-35](https://insights.sbomify.com/MAL-2026-35/): Malicious code in aiihttp (PyPI) (malicious package)
- [MAL-2026-3499](https://insights.sbomify.com/MAL-2026-3499/): Malicious code in @tanstack/vue-start-client (npm) (malicious package)
- [MAL-2026-3498](https://insights.sbomify.com/MAL-2026-3498/): Malicious code in @tanstack/vue-start (npm) (malicious package)
- [MAL-2026-3497](https://insights.sbomify.com/MAL-2026-3497/): Malicious code in @tanstack/vue-router-ssr-query (npm) (malicious package)
- [MAL-2026-3496](https://insights.sbomify.com/MAL-2026-3496/): Malicious code in @tanstack/vue-router-devtools (npm) (malicious package)
- [MAL-2026-3495](https://insights.sbomify.com/MAL-2026-3495/): Malicious code in @tanstack/vue-router (npm) (malicious package)
- [MAL-2026-3494](https://insights.sbomify.com/MAL-2026-3494/): Malicious code in @tanstack/virtual-file-routes (npm) (malicious package)
- [MAL-2026-3493](https://insights.sbomify.com/MAL-2026-3493/): Malicious code in @tanstack/valibot-adapter (npm) (malicious package)
- [MAL-2026-3492](https://insights.sbomify.com/MAL-2026-3492/): Malicious code in @tanstack/start-storage-context (npm) (malicious package)
- [MAL-2026-3491](https://insights.sbomify.com/MAL-2026-3491/): Malicious code in @tanstack/start-static-server-functions (npm) (malicious package)
- [MAL-2026-3490](https://insights.sbomify.com/MAL-2026-3490/): Malicious code in @tanstack/start-server-core (npm) (malicious package)
- [MAL-2026-349](https://insights.sbomify.com/MAL-2026-349/): Malicious code in tutor_table (npm) (malicious package)
- [MAL-2026-3489](https://insights.sbomify.com/MAL-2026-3489/): Malicious code in @tanstack/start-plugin-core (npm) (malicious package)
- [MAL-2026-3488](https://insights.sbomify.com/MAL-2026-3488/): Malicious code in @tanstack/start-fn-stubs (npm) (malicious package)
- [MAL-2026-3487](https://insights.sbomify.com/MAL-2026-3487/): Malicious code in @tanstack/start-client-core (npm) (malicious package)
- [MAL-2026-3486](https://insights.sbomify.com/MAL-2026-3486/): Malicious code in @tanstack/solid-start-server (npm) (malicious package)
- [MAL-2026-3485](https://insights.sbomify.com/MAL-2026-3485/): Malicious code in @tanstack/solid-start-client (npm) (malicious package)
- [MAL-2026-3484](https://insights.sbomify.com/MAL-2026-3484/): Malicious code in @tanstack/solid-start (npm) (malicious package)
- [MAL-2026-3483](https://insights.sbomify.com/MAL-2026-3483/): Malicious code in @tanstack/solid-router-ssr-query (npm) (malicious package)
- [MAL-2026-3482](https://insights.sbomify.com/MAL-2026-3482/): Malicious code in @tanstack/solid-router-devtools (npm) (malicious package)
- [MAL-2026-3481](https://insights.sbomify.com/MAL-2026-3481/): Malicious code in @tanstack/solid-router (npm) (malicious package)
- [MAL-2026-3480](https://insights.sbomify.com/MAL-2026-3480/): Malicious code in @tanstack/router-vite-plugin (npm) (malicious package)
- [MAL-2026-348](https://insights.sbomify.com/MAL-2026-348/): Malicious code in react-native-webview-forked (npm) (malicious package)
- [MAL-2026-3479](https://insights.sbomify.com/MAL-2026-3479/): Malicious code in @tanstack/router-utils (npm) (malicious package)
- [MAL-2026-3478](https://insights.sbomify.com/MAL-2026-3478/): Malicious code in @tanstack/router-ssr-query-core (npm) (malicious package)
- [MAL-2026-3477](https://insights.sbomify.com/MAL-2026-3477/): Malicious code in @tanstack/router-plugin (npm) (malicious package)
- [MAL-2026-3476](https://insights.sbomify.com/MAL-2026-3476/): Malicious code in @tanstack/router-generator (npm) (malicious package)
- [MAL-2026-3475](https://insights.sbomify.com/MAL-2026-3475/): Malicious code in @tanstack/router-devtools-core (npm) (malicious package)
- [MAL-2026-3474](https://insights.sbomify.com/MAL-2026-3474/): Malicious code in @tanstack/router-devtools (npm) (malicious package)
- [MAL-2026-3473](https://insights.sbomify.com/MAL-2026-3473/): Malicious code in @tanstack/router-core (npm) (malicious package)
- [MAL-2026-3472](https://insights.sbomify.com/MAL-2026-3472/): Malicious code in @tanstack/router-cli (npm) (malicious package)
- [MAL-2026-3471](https://insights.sbomify.com/MAL-2026-3471/): Malicious code in @tanstack/react-start-server (npm) (malicious package)
- [MAL-2026-3470](https://insights.sbomify.com/MAL-2026-3470/): Malicious code in @tanstack/react-start-rsc (npm) (malicious package)
- [MAL-2026-347](https://insights.sbomify.com/MAL-2026-347/): Malicious code in @bingads-webui-theme-2018/theme-fluent (npm) (malicious package)
- [MAL-2026-3469](https://insights.sbomify.com/MAL-2026-3469/): Malicious code in @tanstack/react-start-client (npm) (malicious package)
- [MAL-2026-3468](https://insights.sbomify.com/MAL-2026-3468/): Malicious code in @tanstack/react-start (npm) (malicious package)
- [MAL-2026-3467](https://insights.sbomify.com/MAL-2026-3467/): Malicious code in @tanstack/react-router-ssr-query (npm) (malicious package)
- [MAL-2026-3466](https://insights.sbomify.com/MAL-2026-3466/): Malicious code in @tanstack/react-router-devtools (npm) (malicious package)
- [MAL-2026-3465](https://insights.sbomify.com/MAL-2026-3465/): Malicious code in @tanstack/react-router (npm) (malicious package)
- [MAL-2026-3464](https://insights.sbomify.com/MAL-2026-3464/): Malicious code in @tanstack/nitro-v2-vite-plugin (npm) (malicious package)
- [MAL-2026-3463](https://insights.sbomify.com/MAL-2026-3463/): Malicious code in @tanstack/history (npm) (malicious package)
- [MAL-2026-3462](https://insights.sbomify.com/MAL-2026-3462/): Malicious code in @tanstack/eslint-plugin-start (npm) (malicious package)
- [MAL-2026-3461](https://insights.sbomify.com/MAL-2026-3461/): Malicious code in @tanstack/eslint-plugin-router (npm) (malicious package)
- [MAL-2026-3460](https://insights.sbomify.com/MAL-2026-3460/): Malicious code in @tanstack/arktype-adapter (npm) (malicious package)
- [MAL-2026-346](https://insights.sbomify.com/MAL-2026-346/): Malicious code in zod-js (npm) (malicious package)
- [MAL-2026-3459](https://insights.sbomify.com/MAL-2026-3459/): Malicious code in @tallyui/pos (npm) (malicious package)
- [MAL-2026-3458](https://insights.sbomify.com/MAL-2026-3458/): Malicious code in @tallyui/connector-vendure (npm) (malicious package)
- [MAL-2026-3457](https://insights.sbomify.com/MAL-2026-3457/): Malicious code in @supersurkhet/cli (npm) (malicious package)
- [MAL-2026-3456](https://insights.sbomify.com/MAL-2026-3456/): Malicious code in @squawk/weather (npm) (malicious package)
- [MAL-2026-3455](https://insights.sbomify.com/MAL-2026-3455/): Malicious code in @squawk/units (npm) (malicious package)
- [MAL-2026-3454](https://insights.sbomify.com/MAL-2026-3454/): Malicious code in @squawk/types (npm) (malicious package)
- [MAL-2026-3453](https://insights.sbomify.com/MAL-2026-3453/): Malicious code in @squawk/procedures (npm) (malicious package)
- [MAL-2026-3452](https://insights.sbomify.com/MAL-2026-3452/): Malicious code in @squawk/procedure-data (npm) (malicious package)
- [MAL-2026-3451](https://insights.sbomify.com/MAL-2026-3451/): Malicious code in @squawk/notams (npm) (malicious package)
- [MAL-2026-3450](https://insights.sbomify.com/MAL-2026-3450/): Malicious code in @squawk/navaids (npm) (malicious package)
- [MAL-2026-345](https://insights.sbomify.com/MAL-2026-345/): Malicious code in private-payment-lib (npm) (malicious package)
- [MAL-2026-3449](https://insights.sbomify.com/MAL-2026-3449/): Malicious code in @squawk/navaid-data (npm) (malicious package)
- [MAL-2026-3448](https://insights.sbomify.com/MAL-2026-3448/): Malicious code in @squawk/mcp (npm) (malicious package)
- [MAL-2026-3447](https://insights.sbomify.com/MAL-2026-3447/): Malicious code in @squawk/icao-registry-data (npm) (malicious package)
- [MAL-2026-3446](https://insights.sbomify.com/MAL-2026-3446/): Malicious code in @squawk/icao-registry (npm) (malicious package)
- [MAL-2026-3445](https://insights.sbomify.com/MAL-2026-3445/): Malicious code in @squawk/geo (npm) (malicious package)
- [MAL-2026-3444](https://insights.sbomify.com/MAL-2026-3444/): Malicious code in @squawk/flightplan (npm) (malicious package)
- [MAL-2026-3443](https://insights.sbomify.com/MAL-2026-3443/): Malicious code in @squawk/flight-math (npm) (malicious package)
- [MAL-2026-3442](https://insights.sbomify.com/MAL-2026-3442/): Malicious code in @squawk/fixes (npm) (malicious package)
- [MAL-2026-3441](https://insights.sbomify.com/MAL-2026-3441/): Malicious code in @squawk/fix-data (npm) (malicious package)
- [MAL-2026-3440](https://insights.sbomify.com/MAL-2026-3440/): Malicious code in @squawk/airways (npm) (malicious package)
- [MAL-2026-344](https://insights.sbomify.com/MAL-2026-344/): Malicious code in ofjaaah-security-lib (npm) (malicious package)
- [MAL-2026-3439](https://insights.sbomify.com/MAL-2026-3439/): Malicious code in @squawk/airway-data (npm) (malicious package)
- [MAL-2026-3438](https://insights.sbomify.com/MAL-2026-3438/): Malicious code in @squawk/airspace-data (npm) (malicious package)
- [MAL-2026-3437](https://insights.sbomify.com/MAL-2026-3437/): Malicious code in @squawk/airspace (npm) (malicious package)
- [MAL-2026-3436](https://insights.sbomify.com/MAL-2026-3436/): Malicious code in @squawk/airports (npm) (malicious package)
- [MAL-2026-3435](https://insights.sbomify.com/MAL-2026-3435/): Malicious code in @squawk/airport-data (npm) (malicious package)
- [MAL-2026-3434](https://insights.sbomify.com/MAL-2026-3434/): Malicious code in @opensearch-project/opensearch (npm) (malicious package)
- [MAL-2026-3433](https://insights.sbomify.com/MAL-2026-3433/): Malicious code in @beproduct/nestjs-auth (npm) (malicious package)
- [MAL-2026-3432](https://insights.sbomify.com/MAL-2026-3432/): Malicious code in @mistralai/mistralai (npm) (malicious package)
- [MAL-2026-3431](https://insights.sbomify.com/MAL-2026-3431/): Malicious code in apkeep (PyPI) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/80/