# Vulnerabilities published in 2026 - [MAL-2026-3070](https://insights.sbomify.com/MAL-2026-3070/): Malicious code in @tw-marionette/clipboard (npm) (malicious package) - [MAL-2026-307](https://insights.sbomify.com/MAL-2026-307/): Malicious code in sd-conversation-history-module-client (npm) (malicious package) - [MAL-2026-3069](https://insights.sbomify.com/MAL-2026-3069/): Malicious code in @tochka-ui/foundation (npm) (malicious package) - [MAL-2026-3068](https://insights.sbomify.com/MAL-2026-3068/): Malicious code in @sbt_gitverse/analytics-client (npm) (malicious package) - [MAL-2026-3067](https://insights.sbomify.com/MAL-2026-3067/): Malicious code in @ozon-complt/split (npm) (malicious package) - [MAL-2026-3066](https://insights.sbomify.com/MAL-2026-3066/): Malicious code in @ozon-complt/antibot-handler (npm) (malicious package) - [MAL-2026-3065](https://insights.sbomify.com/MAL-2026-3065/): Malicious code in @m0ntana/app.web (npm) (malicious package) - [MAL-2026-3064](https://insights.sbomify.com/MAL-2026-3064/): Malicious code in @google-pay-trust/init-google-pay (npm) (malicious package) - [MAL-2026-3063](https://insights.sbomify.com/MAL-2026-3063/): Malicious code in @google-pay-trust/finish (npm) (malicious package) - [MAL-2026-3062](https://insights.sbomify.com/MAL-2026-3062/): Malicious code in @google-pay-trust/cancelled (npm) (malicious package) - [MAL-2026-3061](https://insights.sbomify.com/MAL-2026-3061/): Malicious code in @google-pay-trust/authorize-payment (npm) (malicious package) - [MAL-2026-3060](https://insights.sbomify.com/MAL-2026-3060/): Malicious code in @frengki0707/google-cloud-clone (npm) (malicious package) - [MAL-2026-306](https://insights.sbomify.com/MAL-2026-306/): Malicious code in sd-cip-module-client (npm) (malicious package) - [MAL-2026-3059](https://insights.sbomify.com/MAL-2026-3059/): Malicious code in @clearpool/utils (npm) (malicious package) - [MAL-2026-3058](https://insights.sbomify.com/MAL-2026-3058/): Malicious code in @clearpool/table (npm) (malicious package) - [MAL-2026-3057](https://insights.sbomify.com/MAL-2026-3057/): Malicious code in @clearpool/streaming (npm) (malicious package) - [MAL-2026-3056](https://insights.sbomify.com/MAL-2026-3056/): Malicious code in @clearpool/comms (npm) (malicious package) - [MAL-2026-3055](https://insights.sbomify.com/MAL-2026-3055/): Malicious code in @apple-pay-trust/validate-merchant (npm) (malicious package) - [MAL-2026-3054](https://insights.sbomify.com/MAL-2026-3054/): Malicious code in @apple-pay-trust/start (npm) (malicious package) - [MAL-2026-3053](https://insights.sbomify.com/MAL-2026-3053/): Malicious code in @apple-pay-trust/merchant-session (npm) (malicious package) - [MAL-2026-3052](https://insights.sbomify.com/MAL-2026-3052/): Malicious code in @alfa.life.mapp/app.web (npm) (malicious package) - [MAL-2026-3051](https://insights.sbomify.com/MAL-2026-3051/): Malicious code in shopify-app-extension-template (npm) (malicious package) - [MAL-2026-3050](https://insights.sbomify.com/MAL-2026-3050/): Malicious code in robase-fast-install (PyPI) (malicious package) - [MAL-2026-305](https://insights.sbomify.com/MAL-2026-305/): Malicious code in sd-ccp-module-client (npm) (malicious package) - [MAL-2026-3049](https://insights.sbomify.com/MAL-2026-3049/): Malicious code in classlink (npm) (malicious package) - [MAL-2026-3048](https://insights.sbomify.com/MAL-2026-3048/): Malicious code in robase-gui-api (PyPI) (malicious package) - [MAL-2026-3047](https://insights.sbomify.com/MAL-2026-3047/): Malicious code in robase-gui (PyPI) (malicious package) - [MAL-2026-3046](https://insights.sbomify.com/MAL-2026-3046/): Malicious code in swisscom-ai-research-keyphrase (PyPI) (malicious package) - [MAL-2026-3045](https://insights.sbomify.com/MAL-2026-3045/): Malicious code in quicktestybesty (PyPI) (malicious package) - [MAL-2026-3044](https://insights.sbomify.com/MAL-2026-3044/): Malicious code in quicksolving (PyPI) (malicious package) - [MAL-2026-3043](https://insights.sbomify.com/MAL-2026-3043/): Malicious code in rosolver (PyPI) (malicious package) - [MAL-2026-3042](https://insights.sbomify.com/MAL-2026-3042/): Malicious code in pycolorlib001 (PyPI) (malicious package) - [MAL-2026-3041](https://insights.sbomify.com/MAL-2026-3041/): Malicious code in robase-library-quick-install (PyPI) (malicious package) - [MAL-2026-3040](https://insights.sbomify.com/MAL-2026-3040/): Malicious code in apollo-vertex (npm) (malicious package) - [MAL-2026-304](https://insights.sbomify.com/MAL-2026-304/): Malicious code in sd-agent-toolbar-module-client (npm) (malicious package) - [MAL-2026-3039](https://insights.sbomify.com/MAL-2026-3039/): Malicious code in process-app-task (npm) (malicious package) - [MAL-2026-3038](https://insights.sbomify.com/MAL-2026-3038/): Malicious code in apollo-landing (npm) (malicious package) - [MAL-2026-3037](https://insights.sbomify.com/MAL-2026-3037/): Malicious code in standalone-apps (npm) (malicious package) - [MAL-2026-3036](https://insights.sbomify.com/MAL-2026-3036/): Malicious code in uipath-ui-widgets (npm) (malicious package) - [MAL-2026-3035](https://insights.sbomify.com/MAL-2026-3035/): Malicious code in promptflow-runtime (PyPI) (malicious package) - [MAL-2026-3034](https://insights.sbomify.com/MAL-2026-3034/): Malicious code in ort-moe (PyPI) (malicious package) - [MAL-2026-3033](https://insights.sbomify.com/MAL-2026-3033/): Malicious code in tether-base (npm) (malicious package) - [MAL-2026-3032](https://insights.sbomify.com/MAL-2026-3032/): Malicious code in js-component-explorer (npm) (malicious package) - [MAL-2026-3031](https://insights.sbomify.com/MAL-2026-3031/): Malicious code in swampo (PyPI) (malicious package) - [MAL-2026-3030](https://insights.sbomify.com/MAL-2026-3030/): Malicious code in model-poc-suhail (npm) (malicious package) - [MAL-2026-303](https://insights.sbomify.com/MAL-2026-303/): Malicious code in sd-active-conversation-module-client (npm) (malicious package) - [MAL-2026-3029](https://insights.sbomify.com/MAL-2026-3029/): Malicious code in eth-logger (npm) (malicious package) - [MAL-2026-3028](https://insights.sbomify.com/MAL-2026-3028/): Malicious code in amplitude-ma-ts (npm) (malicious package) - [MAL-2026-3027](https://insights.sbomify.com/MAL-2026-3027/): Malicious code in wrapped-logger-utils (npm) (malicious package) - [MAL-2026-3026](https://insights.sbomify.com/MAL-2026-3026/): Malicious code in sagat-core (npm) (malicious package) - [MAL-2026-3025](https://insights.sbomify.com/MAL-2026-3025/): Malicious code in next-rwa (npm) (malicious package) - [MAL-2026-3024](https://insights.sbomify.com/MAL-2026-3024/): Malicious code in auth0-ui-components-docs (npm) (malicious package) - [MAL-2026-3023](https://insights.sbomify.com/MAL-2026-3023/): Malicious code in test-pkg-jie (PyPI) (malicious package) - [MAL-2026-3022](https://insights.sbomify.com/MAL-2026-3022/): Malicious code in jie-utility-package (PyPI) (malicious package) - [MAL-2026-3021](https://insights.sbomify.com/MAL-2026-3021/): Malicious code in lightspark-js (npm) (malicious package) - [MAL-2026-3020](https://insights.sbomify.com/MAL-2026-3020/): Malicious code in @bitwarden/cli (npm) (malicious package) - [MAL-2026-302](https://insights.sbomify.com/MAL-2026-302/): Malicious code in s3-cache-handler (npm) (malicious package) - [MAL-2026-3019](https://insights.sbomify.com/MAL-2026-3019/): Malicious code in hls.js (npm) (malicious package) - [MAL-2026-3018](https://insights.sbomify.com/MAL-2026-3018/): Malicious code in microsoft-employee-experience (npm) (malicious package) - [MAL-2026-3017](https://insights.sbomify.com/MAL-2026-3017/): Malicious code in react-spa-npm (npm) (malicious package) - [MAL-2026-3016](https://insights.sbomify.com/MAL-2026-3016/): Malicious code in amazon-q-developer-streaming-client (npm) (malicious package) - [MAL-2026-3015](https://insights.sbomify.com/MAL-2026-3015/): Malicious code in lyroxcoder (PyPI) (malicious package) - [MAL-2026-3014](https://insights.sbomify.com/MAL-2026-3014/): Malicious code in vime-azl (npm) (malicious package) - [MAL-2026-3013](https://insights.sbomify.com/MAL-2026-3013/): Malicious code in undicy-http (npm) (malicious package) - [MAL-2026-3012](https://insights.sbomify.com/MAL-2026-3012/): Malicious code in ts-moduler (npm) (malicious package) - [MAL-2026-3011](https://insights.sbomify.com/MAL-2026-3011/): Malicious code in ts-bing (npm) (malicious package) - [MAL-2026-3010](https://insights.sbomify.com/MAL-2026-3010/): Malicious code in separadordeinfocc (npm) (malicious package) - [MAL-2026-301](https://insights.sbomify.com/MAL-2026-301/): Malicious code in react-sitecore-library (npm) (malicious package) - [MAL-2026-3009](https://insights.sbomify.com/MAL-2026-3009/): Malicious code in rollup-plugin-polyfill-route (npm) (malicious package) - [MAL-2026-3008](https://insights.sbomify.com/MAL-2026-3008/): Malicious code in json-spacer (npm) (malicious package) - [MAL-2026-3007](https://insights.sbomify.com/MAL-2026-3007/): Malicious code in json-dec (npm) (malicious package) - [MAL-2026-3006](https://insights.sbomify.com/MAL-2026-3006/): Malicious code in changelog-utils-structured-logger (npm) (malicious package) - [MAL-2026-3005](https://insights.sbomify.com/MAL-2026-3005/): Malicious code in changelog-cli-logger (npm) (malicious package) - [MAL-2026-3004](https://insights.sbomify.com/MAL-2026-3004/): Malicious code in @nklkas/hyperliquid (npm) (malicious package) - [MAL-2026-3003](https://insights.sbomify.com/MAL-2026-3003/): Malicious code in @amsterdam-local/forms-component-library (npm) (malicious package) - [MAL-2026-3002](https://insights.sbomify.com/MAL-2026-3002/): Malicious code in lyrox (PyPI) (malicious package) - [MAL-2026-3001](https://insights.sbomify.com/MAL-2026-3001/): Malicious code in process-support (PyPI) (malicious package) - [MAL-2026-3000](https://insights.sbomify.com/MAL-2026-3000/): Malicious code in xinference (PyPI) (malicious package) - [MAL-2026-300](https://insights.sbomify.com/MAL-2026-300/): Malicious code in presentation-test-utilities (npm) (malicious package) - [MAL-2026-30](https://insights.sbomify.com/MAL-2026-30/): Malicious code in dstny-utils (npm) (malicious package) - [MAL-2026-3](https://insights.sbomify.com/MAL-2026-3/): Malicious code in rules-deployer (npm) (malicious package) - [MAL-2026-2999](https://insights.sbomify.com/MAL-2026-2999/): Malicious code in pypdf-fork (PyPI) (malicious package) - [MAL-2026-2998](https://insights.sbomify.com/MAL-2026-2998/): Malicious code in @spinstorm/shared (npm) (malicious package) - [MAL-2026-2997](https://insights.sbomify.com/MAL-2026-2997/): Malicious code in @stlm/common-ui (npm) (malicious package) - [MAL-2026-2996](https://insights.sbomify.com/MAL-2026-2996/): Malicious code in sparkling-sdk (npm) (malicious package) - [MAL-2026-2995](https://insights.sbomify.com/MAL-2026-2995/): Malicious code in color-studio (npm) (malicious package) - [MAL-2026-2994](https://insights.sbomify.com/MAL-2026-2994/): Malicious code in @openwebconcept/theme-owc (npm) (malicious package) - [MAL-2026-2993](https://insights.sbomify.com/MAL-2026-2993/): Malicious code in @openwebconcept/design-tokens (npm) (malicious package) - [MAL-2026-2992](https://insights.sbomify.com/MAL-2026-2992/): Malicious code in @automagik/genie (npm) (malicious package) - [MAL-2026-2991](https://insights.sbomify.com/MAL-2026-2991/): Malicious code in pgserve (npm) (malicious package) - [MAL-2026-2990](https://insights.sbomify.com/MAL-2026-2990/): Malicious code in etsyapp (npm) (malicious package) - [MAL-2026-299](https://insights.sbomify.com/MAL-2026-299/): Malicious code in origin_response_handler (npm) (malicious package) - [MAL-2026-2989](https://insights.sbomify.com/MAL-2026-2989/): Malicious code in @bmg-web-features/bmg-user-interaction-tracker (npm) (malicious package) - [MAL-2026-2988](https://insights.sbomify.com/MAL-2026-2988/): Malicious code in @bmg-web/bmg-grid (npm) (malicious package) - [MAL-2026-2987](https://insights.sbomify.com/MAL-2026-2987/): Malicious code in @bmg-web/bmg-external-link (npm) (malicious package) - [MAL-2026-2986](https://insights.sbomify.com/MAL-2026-2986/): Malicious code in @bmg-web/bmg-dropdown (npm) (malicious package) - [MAL-2026-2985](https://insights.sbomify.com/MAL-2026-2985/): Malicious code in @bmg-web/bmg-dialog (npm) (malicious package) - [MAL-2026-2984](https://insights.sbomify.com/MAL-2026-2984/): Malicious code in @bmg-web/bmg-collapse (npm) (malicious package) - [MAL-2026-2983](https://insights.sbomify.com/MAL-2026-2983/): Malicious code in @bmg-web/bmg-checkbox (npm) (malicious package) - [MAL-2026-2982](https://insights.sbomify.com/MAL-2026-2982/): Malicious code in @bmg-web/bmg-card (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/85/