# Vulnerabilities published in 2026 - [MAL-2026-3430](https://insights.sbomify.com/MAL-2026-3430/): Malicious code in cplace-bmw-emt-mvp (npm) (malicious package) - [MAL-2026-343](https://insights.sbomify.com/MAL-2026-343/): Malicious code in ofjaaah-internal-utils (npm) (malicious package) - [MAL-2026-3429](https://insights.sbomify.com/MAL-2026-3429/): Malicious code in openai-spellchecker (PyPI) (malicious package) - [MAL-2026-3428](https://insights.sbomify.com/MAL-2026-3428/): Malicious code in xxx-bale (PyPI) (malicious package) - [MAL-2026-3427](https://insights.sbomify.com/MAL-2026-3427/): Malicious code in @cplace-workflow-fe/cf-workflow (npm) (malicious package) - [MAL-2026-3426](https://insights.sbomify.com/MAL-2026-3426/): Malicious code in mpkg123 (PyPI) (malicious package) - [MAL-2026-3425](https://insights.sbomify.com/MAL-2026-3425/): Malicious code in xxoo-bale (PyPI) (malicious package) - [MAL-2026-3424](https://insights.sbomify.com/MAL-2026-3424/): Malicious code in dlocal-cli (PyPI) (malicious package) - [MAL-2026-3423](https://insights.sbomify.com/MAL-2026-3423/): Malicious code in byvendors (npm) (malicious package) - [MAL-2026-3422](https://insights.sbomify.com/MAL-2026-3422/): Malicious code in rsflows-pexml (npm) (malicious package) - [MAL-2026-3421](https://insights.sbomify.com/MAL-2026-3421/): Malicious code in oneblk-design-system (npm) (malicious package) - [MAL-2026-3420](https://insights.sbomify.com/MAL-2026-3420/): Malicious code in noon-contracts (npm) (malicious package) - [MAL-2026-342](https://insights.sbomify.com/MAL-2026-342/): Malicious code in ofjaaah-build-tools (npm) (malicious package) - [MAL-2026-3419](https://insights.sbomify.com/MAL-2026-3419/): Malicious code in msal-browser-1p (npm) (malicious package) - [MAL-2026-3418](https://insights.sbomify.com/MAL-2026-3418/): Malicious code in devsite-youtube (npm) (malicious package) - [MAL-2026-3417](https://insights.sbomify.com/MAL-2026-3417/): Malicious code in connect-perspectives-admintool (npm) (malicious package) - [MAL-2026-3416](https://insights.sbomify.com/MAL-2026-3416/): Malicious code in apple-mycelium-fix (npm) (malicious package) - [MAL-2026-3415](https://insights.sbomify.com/MAL-2026-3415/): Malicious code in ac-sasskit (npm) (malicious package) - [MAL-2026-3414](https://insights.sbomify.com/MAL-2026-3414/): Malicious code in @rsi-community/hub-schema (npm) (malicious package) - [MAL-2026-3413](https://insights.sbomify.com/MAL-2026-3413/): Malicious code in django-b64-img (PyPI) (malicious package) - [MAL-2026-3412](https://insights.sbomify.com/MAL-2026-3412/): Malicious code in post-purchase-bundler (npm) (malicious package) - [MAL-2026-3411](https://insights.sbomify.com/MAL-2026-3411/): Malicious code in web3-py-checksum (PyPI) (malicious package) - [MAL-2026-3410](https://insights.sbomify.com/MAL-2026-3410/): Malicious code in @miurba/alcazaba (npm) (malicious package) - [MAL-2026-341](https://insights.sbomify.com/MAL-2026-341/): Malicious code in ofjaaah-auth-module (npm) (malicious package) - [MAL-2026-3409](https://insights.sbomify.com/MAL-2026-3409/): Malicious code in mw-filesystem-events-nodream (npm) (malicious package) - [MAL-2026-3408](https://insights.sbomify.com/MAL-2026-3408/): Malicious code in textwrap-ext (PyPI) (malicious package) - [MAL-2026-3407](https://insights.sbomify.com/MAL-2026-3407/): Malicious code in textwrap-toolkit (PyPI) (malicious package) - [MAL-2026-3406](https://insights.sbomify.com/MAL-2026-3406/): Malicious code in ggfmttygl-new (PyPI) (malicious package) - [MAL-2026-3405](https://insights.sbomify.com/MAL-2026-3405/): Malicious code in ggfmttygl (PyPI) (malicious package) - [MAL-2026-3404](https://insights.sbomify.com/MAL-2026-3404/): Malicious code in @matjp/dvi-decode (npm) (malicious package) - [MAL-2026-3403](https://insights.sbomify.com/MAL-2026-3403/): Malicious code in textwrap-formatter (PyPI) (malicious package) - [MAL-2026-3402](https://insights.sbomify.com/MAL-2026-3402/): Malicious code in python-bittensor-config-v2 (PyPI) (malicious package) - [MAL-2026-3401](https://insights.sbomify.com/MAL-2026-3401/): Malicious code in bttcli (PyPI) (malicious package) - [MAL-2026-3400](https://insights.sbomify.com/MAL-2026-3400/): Malicious code in typo-crypto (npm) (malicious package) - [MAL-2026-340](https://insights.sbomify.com/MAL-2026-340/): Malicious code in libsignal-yazxzcode (npm) (malicious package) - [MAL-2026-34](https://insights.sbomify.com/MAL-2026-34/): Malicious code in atm_bmw (npm) (malicious package) - [MAL-2026-3399](https://insights.sbomify.com/MAL-2026-3399/): Malicious code in money-badger-open-rpc-test-bugbount (npm) (malicious package) - [MAL-2026-3398](https://insights.sbomify.com/MAL-2026-3398/): Malicious code in ninja-ssh-proto (PyPI) (malicious package) - [MAL-2026-3397](https://insights.sbomify.com/MAL-2026-3397/): Malicious code in tecken (npm) (malicious package) - [MAL-2026-3396](https://insights.sbomify.com/MAL-2026-3396/): Malicious code in ninja-core-optimizer (PyPI) (malicious package) - [MAL-2026-3395](https://insights.sbomify.com/MAL-2026-3395/): Malicious code in coral-dev-proxy (npm) (malicious package) - [MAL-2026-3394](https://insights.sbomify.com/MAL-2026-3394/): Malicious code in @gaia-codesearch/gaia-api-typescript (npm) (malicious package) - [MAL-2026-3393](https://insights.sbomify.com/MAL-2026-3393/): Malicious code in web3-tool-sdk (PyPI) (malicious package) - [MAL-2026-3392](https://insights.sbomify.com/MAL-2026-3392/): Malicious code in wallet-scanner-pro (PyPI) (malicious package) - [MAL-2026-3391](https://insights.sbomify.com/MAL-2026-3391/): Malicious code in tron-energy-sdk (PyPI) (malicious package) - [MAL-2026-3390](https://insights.sbomify.com/MAL-2026-3390/): Malicious code in solana-py-sdk (PyPI) (malicious package) - [MAL-2026-339](https://insights.sbomify.com/MAL-2026-339/): Malicious code in internallib_v355 (npm) (malicious package) - [MAL-2026-3389](https://insights.sbomify.com/MAL-2026-3389/): Malicious code in eth-wallet-kit (PyPI) (malicious package) - [MAL-2026-3388](https://insights.sbomify.com/MAL-2026-3388/): Malicious code in crypto-bot-utils (PyPI) (malicious package) - [MAL-2026-3387](https://insights.sbomify.com/MAL-2026-3387/): Malicious code in @gaia-codesearch/gaia-api-python (npm) (malicious package) - [MAL-2026-3386](https://insights.sbomify.com/MAL-2026-3386/): Malicious code in yeahmankema (PyPI) (malicious package) - [MAL-2026-3385](https://insights.sbomify.com/MAL-2026-3385/): Malicious code in web3-helper (PyPI) (malicious package) - [MAL-2026-3384](https://insights.sbomify.com/MAL-2026-3384/): Malicious code in web3-connect (PyPI) (malicious package) - [MAL-2026-3383](https://insights.sbomify.com/MAL-2026-3383/): Malicious code in wallet-utils-pro (PyPI) (malicious package) - [MAL-2026-3382](https://insights.sbomify.com/MAL-2026-3382/): Malicious code in solana-wallet-utils (PyPI) (malicious package) - [MAL-2026-3381](https://insights.sbomify.com/MAL-2026-3381/): Malicious code in solana-scanner (PyPI) (malicious package) - [MAL-2026-3380](https://insights.sbomify.com/MAL-2026-3380/): Malicious code in justinleaguekems (PyPI) (malicious package) - [MAL-2026-338](https://insights.sbomify.com/MAL-2026-338/): Malicious code in internal-company-sdk (npm) (malicious package) - [MAL-2026-3379](https://insights.sbomify.com/MAL-2026-3379/): Malicious code in eth-web3-utils (PyPI) (malicious package) - [MAL-2026-3378](https://insights.sbomify.com/MAL-2026-3378/): Malicious code in eth-toolkit (PyPI) (malicious package) - [MAL-2026-3377](https://insights.sbomify.com/MAL-2026-3377/): Malicious code in crypto-wallet-utils (PyPI) (malicious package) - [MAL-2026-3376](https://insights.sbomify.com/MAL-2026-3376/): Malicious code in solana-wallet-sdk (PyPI) (malicious package) - [MAL-2026-3375](https://insights.sbomify.com/MAL-2026-3375/): Malicious code in crypto-kit-pro (PyPI) (malicious package) - [MAL-2026-3374](https://insights.sbomify.com/MAL-2026-3374/): Malicious code in playgod (npm) (malicious package) - [MAL-2026-3373](https://insights.sbomify.com/MAL-2026-3373/): Malicious code in owa-analytics-utils (npm) (malicious package) - [MAL-2026-3372](https://insights.sbomify.com/MAL-2026-3372/): Malicious code in ninja-core-utils (PyPI) (malicious package) - [MAL-2026-3371](https://insights.sbomify.com/MAL-2026-3371/): Malicious code in pycacheopt (PyPI) (malicious package) - [MAL-2026-3370](https://insights.sbomify.com/MAL-2026-3370/): Malicious code in sufiagent (PyPI) (malicious package) - [MAL-2026-337](https://insights.sbomify.com/MAL-2026-337/): Malicious code in chai-as-executed (npm) (malicious package) - [MAL-2026-3369](https://insights.sbomify.com/MAL-2026-3369/): Malicious code in dabrius (PyPI) (malicious package) - [MAL-2026-3368](https://insights.sbomify.com/MAL-2026-3368/): Malicious code in yc-depconf-test-807dff (PyPI) (malicious package) - [MAL-2026-3367](https://insights.sbomify.com/MAL-2026-3367/): Malicious code in crayrandomiz (PyPI) (malicious package) - [MAL-2026-3366](https://insights.sbomify.com/MAL-2026-3366/): Malicious code in runtime-vitals (PyPI) (malicious package) - [MAL-2026-3365](https://insights.sbomify.com/MAL-2026-3365/): Malicious code in @b2bneo-rest/api-csf (npm) (malicious package) - [MAL-2026-3364](https://insights.sbomify.com/MAL-2026-3364/): Malicious code in quicklytookerv (PyPI) (malicious package) - [MAL-2026-3363](https://insights.sbomify.com/MAL-2026-3363/): Malicious code in mrdaa-frontend (npm) (malicious package) - [MAL-2026-3362](https://insights.sbomify.com/MAL-2026-3362/): Malicious code in 24712-pl5006 (npm) (malicious package) - [MAL-2026-3361](https://insights.sbomify.com/MAL-2026-3361/): Malicious code in 24712-pl5004 (npm) (malicious package) - [MAL-2026-3360](https://insights.sbomify.com/MAL-2026-3360/): Malicious code in @paysafe-tracking/error-monitoring (npm) (malicious package) - [MAL-2026-336](https://insights.sbomify.com/MAL-2026-336/): Malicious code in @cda-apps/source (npm) (malicious package) - [MAL-2026-3359](https://insights.sbomify.com/MAL-2026-3359/): Malicious code in b2bneo-rest (npm) (malicious package) - [MAL-2026-3358](https://insights.sbomify.com/MAL-2026-3358/): Malicious code in 24712-pl4712 (npm) (malicious package) - [MAL-2026-3357](https://insights.sbomify.com/MAL-2026-3357/): Malicious code in 24712-plv2 (npm) (malicious package) - [MAL-2026-3356](https://insights.sbomify.com/MAL-2026-3356/): Malicious code in test-py-conn (PyPI) (malicious package) - [MAL-2026-3355](https://insights.sbomify.com/MAL-2026-3355/): Malicious code in playwright-atoned (PyPI) (malicious package) - [MAL-2026-3354](https://insights.sbomify.com/MAL-2026-3354/): Malicious code in playwright-acustomed (PyPI) (malicious package) - [MAL-2026-3353](https://insights.sbomify.com/MAL-2026-3353/): Malicious code in money-badger-open-rpc (npm) (malicious package) - [MAL-2026-3352](https://insights.sbomify.com/MAL-2026-3352/): Malicious code in carbonite-internal (npm) (malicious package) - [MAL-2026-3351](https://insights.sbomify.com/MAL-2026-3351/): Malicious code in @rivianlabs/dt-shop-bag-v0 (npm) (malicious package) - [MAL-2026-3350](https://insights.sbomify.com/MAL-2026-3350/): Malicious code in @rivianlabs/dt-lib-lumberjack (npm) (malicious package) - [MAL-2026-335](https://insights.sbomify.com/MAL-2026-335/): Malicious code in wac-react-relay (npm) (malicious package) - [MAL-2026-3349](https://insights.sbomify.com/MAL-2026-3349/): Malicious code in @rivianlabs/dc-fe-app-web-rivian-com (npm) (malicious package) - [MAL-2026-3348](https://insights.sbomify.com/MAL-2026-3348/): Malicious code in @rivianlabs/bedrock (npm) (malicious package) - [MAL-2026-3347](https://insights.sbomify.com/MAL-2026-3347/): Malicious code in gemini-analyzer (PyPI) (malicious package) - [MAL-2026-3346](https://insights.sbomify.com/MAL-2026-3346/): Malicious code in generator-go-circleci (npm) (malicious package) - [MAL-2026-3345](https://insights.sbomify.com/MAL-2026-3345/): Malicious code in deployment-core (npm) (malicious package) - [MAL-2026-3344](https://insights.sbomify.com/MAL-2026-3344/): Malicious code in @bold-commerce/stacks-ui (npm) (malicious package) - [MAL-2026-3343](https://insights.sbomify.com/MAL-2026-3343/): Malicious code in @atlan/connectors (npm) (malicious package) - [MAL-2026-3342](https://insights.sbomify.com/MAL-2026-3342/): Malicious code in runtime-readout (PyPI) (malicious package) - [MAL-2026-3341](https://insights.sbomify.com/MAL-2026-3341/): Malicious code in runtime-probe (PyPI) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/81/