# Vulnerabilities published in 2026


- [MAL-2026-3250](https://insights.sbomify.com/MAL-2026-3250/): Malicious code in rostilesolver (PyPI) (malicious package)
- [MAL-2026-325](https://insights.sbomify.com/MAL-2026-325/): Malicious code in marshel (PyPI) (malicious package)
- [MAL-2026-3249](https://insights.sbomify.com/MAL-2026-3249/): Malicious code in internal-company-module-test-1337 (npm) (malicious package)
- [MAL-2026-3248](https://insights.sbomify.com/MAL-2026-3248/): Malicious code in pwn-control (PyPI) (malicious package)
- [MAL-2026-3247](https://insights.sbomify.com/MAL-2026-3247/): Malicious code in metoopro (PyPI) (malicious package)
- [MAL-2026-3246](https://insights.sbomify.com/MAL-2026-3246/): Malicious code in win-update-helper-tool-v2 (PyPI) (malicious package)
- [MAL-2026-3245](https://insights.sbomify.com/MAL-2026-3245/): Malicious code in system-update-tool (PyPI) (malicious package)
- [MAL-2026-3244](https://insights.sbomify.com/MAL-2026-3244/): Malicious code in puan4 (PyPI) (malicious package)
- [MAL-2026-3243](https://insights.sbomify.com/MAL-2026-3243/): Malicious code in puan3 (PyPI) (malicious package)
- [MAL-2026-3242](https://insights.sbomify.com/MAL-2026-3242/): Malicious code in sf-vmeval-requests (PyPI) (malicious package)
- [MAL-2026-3241](https://insights.sbomify.com/MAL-2026-3241/): Malicious code in nextjs-chat-with-ai-service (npm) (malicious package)
- [MAL-2026-3240](https://insights.sbomify.com/MAL-2026-3240/): Malicious code in timesmcplib (PyPI) (malicious package)
- [MAL-2026-324](https://insights.sbomify.com/MAL-2026-324/): Malicious code in typedoc-plugin-fuel-variants (npm) (malicious package)
- [MAL-2026-3239](https://insights.sbomify.com/MAL-2026-3239/): Malicious code in timermcplib (PyPI) (malicious package)
- [MAL-2026-3238](https://insights.sbomify.com/MAL-2026-3238/): Malicious code in timemcplib (PyPI) (malicious package)
- [MAL-2026-3237](https://insights.sbomify.com/MAL-2026-3237/): Malicious code in protocol-stub-generator (PyPI) (malicious package)
- [MAL-2026-3236](https://insights.sbomify.com/MAL-2026-3236/): Malicious code in aocl-sparse-v3 (PyPI) (malicious package)
- [MAL-2026-3235](https://insights.sbomify.com/MAL-2026-3235/): Malicious code in apexomni-client (PyPI) (malicious package)
- [MAL-2026-3234](https://insights.sbomify.com/MAL-2026-3234/): Malicious code in apexpro (npm) (malicious package)
- [MAL-2026-3233](https://insights.sbomify.com/MAL-2026-3233/): Malicious code in apexomni (npm) (malicious package)
- [MAL-2026-3232](https://insights.sbomify.com/MAL-2026-3232/): Malicious code in codewhisperer-streaming (npm) (malicious package)
- [MAL-2026-3231](https://insights.sbomify.com/MAL-2026-3231/): Malicious code in timermcp (PyPI) (malicious package)
- [MAL-2026-3230](https://insights.sbomify.com/MAL-2026-3230/): Malicious code in currenttimerpy (PyPI) (malicious package)
- [MAL-2026-323](https://insights.sbomify.com/MAL-2026-323/): Malicious code in eslint-plugin-fuel-react (npm) (malicious package)
- [MAL-2026-3229](https://insights.sbomify.com/MAL-2026-3229/): Malicious code in currenttimerlib (PyPI) (malicious package)
- [MAL-2026-3228](https://insights.sbomify.com/MAL-2026-3228/): Malicious code in ziugxfbvo (PyPI) (malicious package)
- [MAL-2026-3227](https://insights.sbomify.com/MAL-2026-3227/): Malicious code in timingmcp (PyPI) (malicious package)
- [MAL-2026-3226](https://insights.sbomify.com/MAL-2026-3226/): Malicious code in timesmcp (PyPI) (malicious package)
- [MAL-2026-3225](https://insights.sbomify.com/MAL-2026-3225/): Malicious code in as89ufnaisufn (PyPI) (malicious package)
- [MAL-2026-3224](https://insights.sbomify.com/MAL-2026-3224/): Malicious code in graphicctx (PyPI) (malicious package)
- [MAL-2026-3223](https://insights.sbomify.com/MAL-2026-3223/): Malicious code in oracle-lag-sniper (PyPI) (malicious package)
- [MAL-2026-3222](https://insights.sbomify.com/MAL-2026-3222/): Malicious code in graphicsctxs (PyPI) (malicious package)
- [MAL-2026-3221](https://insights.sbomify.com/MAL-2026-3221/): Malicious code in aocl-sparse-v2 (PyPI) (malicious package)
- [MAL-2026-3220](https://insights.sbomify.com/MAL-2026-3220/): Malicious code in py-clob-clients (PyPI) (malicious package)
- [MAL-2026-322](https://insights.sbomify.com/MAL-2026-322/): Malicious code in admin10001 (npm) (malicious package)
- [MAL-2026-3219](https://insights.sbomify.com/MAL-2026-3219/): Malicious code in tns-py (PyPI) (malicious package)
- [MAL-2026-3218](https://insights.sbomify.com/MAL-2026-3218/): Malicious code in my-pipeline-watcher-poc (PyPI) (malicious package)
- [MAL-2026-3217](https://insights.sbomify.com/MAL-2026-3217/): Malicious code in aocl-sparse (PyPI) (malicious package)
- [MAL-2026-3216](https://insights.sbomify.com/MAL-2026-3216/): Malicious code in httpx-utils (PyPI) (malicious package)
- [MAL-2026-3215](https://insights.sbomify.com/MAL-2026-3215/): Malicious code in archetype-style (npm) (malicious package)
- [MAL-2026-3214](https://insights.sbomify.com/MAL-2026-3214/): Malicious code in renderkitcore (PyPI) (malicious package)
- [MAL-2026-3213](https://insights.sbomify.com/MAL-2026-3213/): Malicious code in funkratov-renderkit (PyPI) (malicious package)
- [MAL-2026-3212](https://insights.sbomify.com/MAL-2026-3212/): Malicious code in chalk-fancy (PyPI) (malicious package)
- [MAL-2026-3211](https://insights.sbomify.com/MAL-2026-3211/): Malicious code in pycryptcore (PyPI) (malicious package)
- [MAL-2026-3210](https://insights.sbomify.com/MAL-2026-3210/): Malicious code in graphicsctxr (PyPI) (malicious package)
- [MAL-2026-321](https://insights.sbomify.com/MAL-2026-321/): Malicious code in flip-prx (npm) (malicious package)
- [MAL-2026-3209](https://insights.sbomify.com/MAL-2026-3209/): Malicious code in apple-internal-security-library-v99 (npm) (malicious package)
- [MAL-2026-3208](https://insights.sbomify.com/MAL-2026-3208/): Malicious code in bxiucnxcb (PyPI) (malicious package)
- [MAL-2026-3207](https://insights.sbomify.com/MAL-2026-3207/): Malicious code in renderctx (PyPI) (malicious package)
- [MAL-2026-3206](https://insights.sbomify.com/MAL-2026-3206/): Malicious code in currentclock (PyPI) (malicious package)
- [MAL-2026-3205](https://insights.sbomify.com/MAL-2026-3205/): Malicious code in doisomgcxog (PyPI) (malicious package)
- [MAL-2026-3204](https://insights.sbomify.com/MAL-2026-3204/): Malicious code in intercom-client (npm) (malicious package)
- [MAL-2026-3203](https://insights.sbomify.com/MAL-2026-3203/): Malicious code in buffparser (PyPI) (malicious package)
- [MAL-2026-3202](https://insights.sbomify.com/MAL-2026-3202/): Malicious code in eslint-plugin-skyscanner-dates (npm) (malicious package)
- [MAL-2026-3201](https://insights.sbomify.com/MAL-2026-3201/): Malicious code in lightning (PyPI) (malicious package)
- [MAL-2026-3200](https://insights.sbomify.com/MAL-2026-3200/): Malicious code in sirens-lament (npm) (malicious package)
- [MAL-2026-320](https://insights.sbomify.com/MAL-2026-320/): Malicious code in zis-common-lib (npm) (malicious package)
- [MAL-2026-32](https://insights.sbomify.com/MAL-2026-32/): Malicious code in blobhunter-depconf-poc (npm) (malicious package)
- [MAL-2026-3199](https://insights.sbomify.com/MAL-2026-3199/): Malicious code in blackbeards-navigator (npm) (malicious package)
- [MAL-2026-3198](https://insights.sbomify.com/MAL-2026-3198/): Malicious code in timecurrently (PyPI) (malicious package)
- [MAL-2026-3197](https://insights.sbomify.com/MAL-2026-3197/): Malicious code in sdoihgio9sudghsiudbg (PyPI) (malicious package)
- [MAL-2026-3196](https://insights.sbomify.com/MAL-2026-3196/): Malicious code in react-dnd-14 (npm) (malicious package)
- [MAL-2026-3195](https://insights.sbomify.com/MAL-2026-3195/): Malicious code in secrets-manager-wrapper (npm) (malicious package)
- [MAL-2026-3194](https://insights.sbomify.com/MAL-2026-3194/): Malicious code in robase-dnb (PyPI) (malicious package)
- [MAL-2026-3193](https://insights.sbomify.com/MAL-2026-3193/): Malicious code in rblx-http (PyPI) (malicious package)
- [MAL-2026-3192](https://insights.sbomify.com/MAL-2026-3192/): Malicious code in ro-db (PyPI) (malicious package)
- [MAL-2026-3191](https://insights.sbomify.com/MAL-2026-3191/): Malicious code in rblx-https (PyPI) (malicious package)
- [MAL-2026-3190](https://insights.sbomify.com/MAL-2026-3190/): Malicious code in tanstack (npm) (malicious package)
- [MAL-2026-319](https://insights.sbomify.com/MAL-2026-319/): Malicious code in vue_frontend_rpc (npm) (malicious package)
- [MAL-2026-3189](https://insights.sbomify.com/MAL-2026-3189/): Malicious code in react-video-canvas (npm) (malicious package)
- [MAL-2026-3188](https://insights.sbomify.com/MAL-2026-3188/): Malicious code in apple-security-internal-scanner-v3 (npm) (malicious package)
- [MAL-2026-3187](https://insights.sbomify.com/MAL-2026-3187/): Malicious code in apple-appstore-full-library-utility (npm) (malicious package)
- [MAL-2026-3186](https://insights.sbomify.com/MAL-2026-3186/): Malicious code in ac-sasskit-beta (npm) (malicious package)
- [MAL-2026-3185](https://insights.sbomify.com/MAL-2026-3185/): Malicious code in @saif777/codemirror5 (npm) (malicious package)
- [MAL-2026-3184](https://insights.sbomify.com/MAL-2026-3184/): Malicious code in @breezeai-frontend/tailwind-config (npm) (malicious package)
- [MAL-2026-3183](https://insights.sbomify.com/MAL-2026-3183/): Malicious code in @breezeai-frontend/cargo-ui (npm) (malicious package)
- [MAL-2026-3182](https://insights.sbomify.com/MAL-2026-3182/): Malicious code in redeem-onchain-sdk (npm) (malicious package)
- [MAL-2026-3181](https://insights.sbomify.com/MAL-2026-3181/): Malicious code in period-newline (npm) (malicious package)
- [MAL-2026-3180](https://insights.sbomify.com/MAL-2026-3180/): Malicious code in nicegui (npm) (malicious package)
- [MAL-2026-318](https://insights.sbomify.com/MAL-2026-318/): Malicious code in victim-package-a (npm) (malicious package)
- [MAL-2026-3179](https://insights.sbomify.com/MAL-2026-3179/): Malicious code in mbt (npm) (malicious package)
- [MAL-2026-3178](https://insights.sbomify.com/MAL-2026-3178/): Malicious code in @cap-js/sqlite (npm) (malicious package)
- [MAL-2026-3177](https://insights.sbomify.com/MAL-2026-3177/): Malicious code in @cap-js/postgres (npm) (malicious package)
- [MAL-2026-3176](https://insights.sbomify.com/MAL-2026-3176/): Malicious code in @cap-js/db-service (npm) (malicious package)
- [MAL-2026-3175](https://insights.sbomify.com/MAL-2026-3175/): Malicious code in bbranger (PyPI) (malicious package)
- [MAL-2026-3174](https://insights.sbomify.com/MAL-2026-3174/): Malicious code in internal-sys-audit-check (npm) (malicious package)
- [MAL-2026-3173](https://insights.sbomify.com/MAL-2026-3173/): Malicious code in gcp-internal-research-poc (npm) (malicious package)
- [MAL-2026-3172](https://insights.sbomify.com/MAL-2026-3172/): Malicious code in frank-newton3-user-hunt (npm) (malicious package)
- [MAL-2026-3171](https://insights.sbomify.com/MAL-2026-3171/): Malicious code in frank-newton3-final-audit (npm) (malicious package)
- [MAL-2026-3170](https://insights.sbomify.com/MAL-2026-3170/): Malicious code in frank-newton3-db-poc (npm) (malicious package)
- [MAL-2026-317](https://insights.sbomify.com/MAL-2026-317/): Malicious code in textual-sorter-lib (npm) (malicious package)
- [MAL-2026-3169](https://insights.sbomify.com/MAL-2026-3169/): Malicious code in frank-newton3-db-final (npm) (malicious package)
- [MAL-2026-3168](https://insights.sbomify.com/MAL-2026-3168/): Malicious code in apple-internal-config (npm) (malicious package)
- [MAL-2026-3167](https://insights.sbomify.com/MAL-2026-3167/): Malicious code in apple-infra-stealth-audit (npm) (malicious package)
- [MAL-2026-3166](https://insights.sbomify.com/MAL-2026-3166/): Malicious code in apple-infra-escape-audit (npm) (malicious package)
- [MAL-2026-3165](https://insights.sbomify.com/MAL-2026-3165/): Malicious code in chai-as-redeployed (npm) (malicious package)
- [MAL-2026-3164](https://insights.sbomify.com/MAL-2026-3164/): Malicious code in chai-as-char (npm) (malicious package)
- [MAL-2026-3163](https://insights.sbomify.com/MAL-2026-3163/): Malicious code in npm-global-util (npm) (malicious package)
- [MAL-2026-3162](https://insights.sbomify.com/MAL-2026-3162/): Malicious code in apple-pki-cert-validator (npm) (malicious package)
- [MAL-2026-3161](https://insights.sbomify.com/MAL-2026-3161/): Malicious code in apple-internal-telemetry-service (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/83/