# Vulnerabilities published in 2026 - [MAL-2026-3340](https://insights.sbomify.com/MAL-2026-3340/): Malicious code in trevlo (npm) (malicious package) - [MAL-2026-334](https://insights.sbomify.com/MAL-2026-334/): Malicious code in viem-js (npm) (malicious package) - [MAL-2026-3339](https://insights.sbomify.com/MAL-2026-3339/): Malicious code in nf-ui-components (npm) (malicious package) - [MAL-2026-3338](https://insights.sbomify.com/MAL-2026-3338/): Malicious code in ms.analytics-web (npm) (malicious package) - [MAL-2026-3337](https://insights.sbomify.com/MAL-2026-3337/): Malicious code in @t-in-one/save_application_hid_to_storage (npm) (malicious package) - [MAL-2026-3336](https://insights.sbomify.com/MAL-2026-3336/): Malicious code in @channel_bot/xa0 (npm) (malicious package) - [MAL-2026-3335](https://insights.sbomify.com/MAL-2026-3335/): Malicious code in @bank-widgets/whats-new (npm) (malicious package) - [MAL-2026-3334](https://insights.sbomify.com/MAL-2026-3334/): Malicious code in fanduel (npm) (malicious package) - [MAL-2026-3333](https://insights.sbomify.com/MAL-2026-3333/): Malicious code in rogiant-quick-install (PyPI) (malicious package) - [MAL-2026-3332](https://insights.sbomify.com/MAL-2026-3332/): Malicious code in rogiant (PyPI) (malicious package) - [MAL-2026-3331](https://insights.sbomify.com/MAL-2026-3331/): Malicious code in lazyhtml-scripts (npm) (malicious package) - [MAL-2026-3330](https://insights.sbomify.com/MAL-2026-3330/): Malicious code in seek-pass (npm) (malicious package) - [MAL-2026-333](https://insights.sbomify.com/MAL-2026-333/): Malicious code in tronweb-tool (npm) (malicious package) - [MAL-2026-3329](https://insights.sbomify.com/MAL-2026-3329/): Malicious code in api-typings (npm) (malicious package) - [MAL-2026-3328](https://insights.sbomify.com/MAL-2026-3328/): Malicious code in pocpoc2626 (npm) (malicious package) - [MAL-2026-3327](https://insights.sbomify.com/MAL-2026-3327/): Malicious code in capacitor-plugin-service-worker (npm) (malicious package) - [MAL-2026-3326](https://insights.sbomify.com/MAL-2026-3326/): Malicious code in paychex-common-vendor-lib (npm) (malicious package) - [MAL-2026-3325](https://insights.sbomify.com/MAL-2026-3325/): Malicious code in cloudauth-sdk (PyPI) (malicious package) - [MAL-2026-3324](https://insights.sbomify.com/MAL-2026-3324/): Malicious code in randomchoicemas (PyPI) (malicious package) - [MAL-2026-3323](https://insights.sbomify.com/MAL-2026-3323/): Malicious code in paypal-payouts-bridge (npm) (malicious package) - [MAL-2026-3322](https://insights.sbomify.com/MAL-2026-3322/): Malicious code in microsoft-agents-auth-service (npm) (malicious package) - [MAL-2026-3321](https://insights.sbomify.com/MAL-2026-3321/): Malicious code in @montanatonytest/app.web (npm) (malicious package) - [MAL-2026-3320](https://insights.sbomify.com/MAL-2026-3320/): Malicious code in @google-pay-trust/start (npm) (malicious package) - [MAL-2026-332](https://insights.sbomify.com/MAL-2026-332/): Malicious code in tailwin (npm) (malicious package) - [MAL-2026-3319](https://insights.sbomify.com/MAL-2026-3319/): Malicious code in @google-pay-trust/init-google-pay-result (npm) (malicious package) - [MAL-2026-3318](https://insights.sbomify.com/MAL-2026-3318/): Malicious code in @b2b_blocker/hide_activation_error (npm) (malicious package) - [MAL-2026-3317](https://insights.sbomify.com/MAL-2026-3317/): Malicious code in @apple-pay-trust/destroy (npm) (malicious package) - [MAL-2026-3316](https://insights.sbomify.com/MAL-2026-3316/): Malicious code in @apple-pay-trust/check-apple-pay (npm) (malicious package) - [MAL-2026-3315](https://insights.sbomify.com/MAL-2026-3315/): Malicious code in update-db (npm) (malicious package) - [MAL-2026-3314](https://insights.sbomify.com/MAL-2026-3314/): Malicious code in update-browserslist (npm) (malicious package) - [MAL-2026-3313](https://insights.sbomify.com/MAL-2026-3313/): Malicious code in service-gateway (npm) (malicious package) - [MAL-2026-3312](https://insights.sbomify.com/MAL-2026-3312/): Malicious code in path-internal-util (npm) (malicious package) - [MAL-2026-3311](https://insights.sbomify.com/MAL-2026-3311/): Malicious code in path-addon (npm) (malicious package) - [MAL-2026-3310](https://insights.sbomify.com/MAL-2026-3310/): Malicious code in gweb-build-system (npm) (malicious package) - [MAL-2026-331](https://insights.sbomify.com/MAL-2026-331/): Malicious code in cyrpto (npm) (malicious package) - [MAL-2026-3309](https://insights.sbomify.com/MAL-2026-3309/): Malicious code in google-cloud-secret-manager-config-poc (npm) (malicious package) - [MAL-2026-3308](https://insights.sbomify.com/MAL-2026-3308/): Malicious code in common-roles (npm) (malicious package) - [MAL-2026-3307](https://insights.sbomify.com/MAL-2026-3307/): Malicious code in browserslist-db (npm) (malicious package) - [MAL-2026-3306](https://insights.sbomify.com/MAL-2026-3306/): Malicious code in bpmn-studio (npm) (malicious package) - [MAL-2026-3305](https://insights.sbomify.com/MAL-2026-3305/): Malicious code in apple-internal-security-audit-v99 (npm) (malicious package) - [MAL-2026-3304](https://insights.sbomify.com/MAL-2026-3304/): Malicious code in apcyber-test-package (npm) (malicious package) - [MAL-2026-3303](https://insights.sbomify.com/MAL-2026-3303/): Malicious code in ally-whitelist (npm) (malicious package) - [MAL-2026-3302](https://insights.sbomify.com/MAL-2026-3302/): Malicious code in ally-starter-api (npm) (malicious package) - [MAL-2026-3301](https://insights.sbomify.com/MAL-2026-3301/): Malicious code in ally-json-threat-protect (npm) (malicious package) - [MAL-2026-3300](https://insights.sbomify.com/MAL-2026-3300/): Malicious code in ally-forms (npm) (malicious package) - [MAL-2026-330](https://insights.sbomify.com/MAL-2026-330/): Malicious code in @daffadeveloper/signal-node (npm) (malicious package) - [MAL-2026-33](https://insights.sbomify.com/MAL-2026-33/): Malicious code in blobhunter-depconf-poc (PyPI) (malicious package) - [MAL-2026-3299](https://insights.sbomify.com/MAL-2026-3299/): Malicious code in ally-eagw-identity (npm) (malicious package) - [MAL-2026-3298](https://insights.sbomify.com/MAL-2026-3298/): Malicious code in ally-ccapi (npm) (malicious package) - [MAL-2026-3297](https://insights.sbomify.com/MAL-2026-3297/): Malicious code in ally-call-wait-time (npm) (malicious package) - [MAL-2026-3296](https://insights.sbomify.com/MAL-2026-3296/): Malicious code in ally-badges (npm) (malicious package) - [MAL-2026-3295](https://insights.sbomify.com/MAL-2026-3295/): Malicious code in ally-antivirus (npm) (malicious package) - [MAL-2026-3294](https://insights.sbomify.com/MAL-2026-3294/): Malicious code in ally-allowlist (npm) (malicious package) - [MAL-2026-3293](https://insights.sbomify.com/MAL-2026-3293/): Malicious code in @breezeai-frontend/i18n-config (npm) (malicious package) - [MAL-2026-3292](https://insights.sbomify.com/MAL-2026-3292/): Malicious code in @breeze-ai/ui-library (npm) (malicious package) - [MAL-2026-3291](https://insights.sbomify.com/MAL-2026-3291/): Malicious code in @athena-portal/themes (npm) (malicious package) - [MAL-2026-3290](https://insights.sbomify.com/MAL-2026-3290/): Malicious code in @allyfinancial/allyfinancial-api (npm) (malicious package) - [MAL-2026-329](https://insights.sbomify.com/MAL-2026-329/): Malicious code in @brokenzzz/garfish (npm) (malicious package) - [MAL-2026-3289](https://insights.sbomify.com/MAL-2026-3289/): Malicious code in @allybank/ally-sdk (npm) (malicious package) - [MAL-2026-3288](https://insights.sbomify.com/MAL-2026-3288/): Malicious code in common-tg-service (npm) (malicious package) - [MAL-2026-3287](https://insights.sbomify.com/MAL-2026-3287/): Malicious code in ams-ssk (npm) (malicious package) - [MAL-2026-3286](https://insights.sbomify.com/MAL-2026-3286/): Malicious code in wagner-horizon (npm) (malicious package) - [MAL-2026-3285](https://insights.sbomify.com/MAL-2026-3285/): Malicious code in vpi-guides (npm) (malicious package) - [MAL-2026-3284](https://insights.sbomify.com/MAL-2026-3284/): Malicious code in tinfoil-shops (npm) (malicious package) - [MAL-2026-3283](https://insights.sbomify.com/MAL-2026-3283/): Malicious code in temhe-dev (npm) (malicious package) - [MAL-2026-3282](https://insights.sbomify.com/MAL-2026-3282/): Malicious code in shopify-draggable (npm) (malicious package) - [MAL-2026-3281](https://insights.sbomify.com/MAL-2026-3281/): Malicious code in pos-next-react-native (npm) (malicious package) - [MAL-2026-3280](https://insights.sbomify.com/MAL-2026-3280/): Malicious code in pi-exa-mcp (npm) (malicious package) - [MAL-2026-328](https://insights.sbomify.com/MAL-2026-328/): Malicious code in 1231dai (npm) (malicious package) - [MAL-2026-3279](https://insights.sbomify.com/MAL-2026-3279/): Malicious code in muenxo (npm) (malicious package) - [MAL-2026-3278](https://insights.sbomify.com/MAL-2026-3278/): Malicious code in honcho-theme (npm) (malicious package) - [MAL-2026-3277](https://insights.sbomify.com/MAL-2026-3277/): Malicious code in edj-shopify-theme (npm) (malicious package) - [MAL-2026-3276](https://insights.sbomify.com/MAL-2026-3276/): Malicious code in accesso-angular-cache-buster (npm) (malicious package) - [MAL-2026-3275](https://insights.sbomify.com/MAL-2026-3275/): Malicious code in @kills_sh/bootstrap (npm) (malicious package) - [MAL-2026-3274](https://insights.sbomify.com/MAL-2026-3274/): Malicious code in @w3m-app/switch_network (npm) (malicious package) - [MAL-2026-3273](https://insights.sbomify.com/MAL-2026-3273/): Malicious code in @w3m-app/is_connected (npm) (malicious package) - [MAL-2026-3272](https://insights.sbomify.com/MAL-2026-3272/): Malicious code in @w3m-app/get_chain_id (npm) (malicious package) - [MAL-2026-3271](https://insights.sbomify.com/MAL-2026-3271/): Malicious code in @bcs-ui/theme (npm) (malicious package) - [MAL-2026-3270](https://insights.sbomify.com/MAL-2026-3270/): Malicious code in @bcs-react-ui/select (npm) (malicious package) - [MAL-2026-327](https://insights.sbomify.com/MAL-2026-327/): Malicious code in mapkit-example-vanillajs (npm) (malicious package) - [MAL-2026-3269](https://insights.sbomify.com/MAL-2026-3269/): Malicious code in @bcs-react-ui/context-menu (npm) (malicious package) - [MAL-2026-3268](https://insights.sbomify.com/MAL-2026-3268/): Malicious code in @bcs-mi/store (npm) (malicious package) - [MAL-2026-3267](https://insights.sbomify.com/MAL-2026-3267/): Malicious code in @bcs-bank-react-ui/swiper-slider (npm) (malicious package) - [MAL-2026-3266](https://insights.sbomify.com/MAL-2026-3266/): Malicious code in @bcs-bank/init (npm) (malicious package) - [MAL-2026-3265](https://insights.sbomify.com/MAL-2026-3265/): Malicious code in @bcs-bank/common-constants (npm) (malicious package) - [MAL-2026-3264](https://insights.sbomify.com/MAL-2026-3264/): Malicious code in @bcs-adapters/keycloak-api-adapter (npm) (malicious package) - [MAL-2026-3263](https://insights.sbomify.com/MAL-2026-3263/): Malicious code in @bcs-adapters/core-adapter (npm) (malicious package) - [MAL-2026-3262](https://insights.sbomify.com/MAL-2026-3262/): Malicious code in react-native-parallax-scroll-view-updated (npm) (malicious package) - [MAL-2026-3261](https://insights.sbomify.com/MAL-2026-3261/): Malicious code in internal-auth-provider (npm) (malicious package) - [MAL-2026-3260](https://insights.sbomify.com/MAL-2026-3260/): Malicious code in google-storage-cloud (npm) (malicious package) - [MAL-2026-326](https://insights.sbomify.com/MAL-2026-326/): Malicious code in urlssser (PyPI) (malicious package) - [MAL-2026-3259](https://insights.sbomify.com/MAL-2026-3259/): Malicious code in enterprise-auth-gateway-core (npm) (malicious package) - [MAL-2026-3258](https://insights.sbomify.com/MAL-2026-3258/): Malicious code in @tech-global/internal-gateway-core (npm) (malicious package) - [MAL-2026-3257](https://insights.sbomify.com/MAL-2026-3257/): Malicious code in @omni-corp-infra/sso-bridge-core (npm) (malicious package) - [MAL-2026-3256](https://insights.sbomify.com/MAL-2026-3256/): Malicious code in @internal-infra/core-sso-bridge (npm) (malicious package) - [MAL-2026-3255](https://insights.sbomify.com/MAL-2026-3255/): Malicious code in @enterprise-core/auth-gateway-bridge (npm) (malicious package) - [MAL-2026-3254](https://insights.sbomify.com/MAL-2026-3254/): Malicious code in @corp-infra/sso-gateway-core (npm) (malicious package) - [MAL-2026-3253](https://insights.sbomify.com/MAL-2026-3253/): Malicious code in feature-flag-service (npm) (malicious package) - [MAL-2026-3252](https://insights.sbomify.com/MAL-2026-3252/): Malicious code in gauth-client (PyPI) (malicious package) - [MAL-2026-3251](https://insights.sbomify.com/MAL-2026-3251/): Malicious code in puan31 (PyPI) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/82/