# Vulnerabilities published in 2026


- [MAL-2026-2981](https://insights.sbomify.com/MAL-2026-2981/): Malicious code in @bmg-web/bmg-button (npm) (malicious package)
- [MAL-2026-2980](https://insights.sbomify.com/MAL-2026-2980/): Malicious code in @bmg-web/bmg-ajax (npm) (malicious package)
- [MAL-2026-298](https://insights.sbomify.com/MAL-2026-298/): Malicious code in omnicore-ds2-sdk2 (npm) (malicious package)
- [MAL-2026-2979](https://insights.sbomify.com/MAL-2026-2979/): Malicious code in tsdoc-build-rig (npm) (malicious package)
- [MAL-2026-2978](https://insights.sbomify.com/MAL-2026-2978/): Malicious code in @oec-settlement/react-router (npm) (malicious package)
- [MAL-2026-2977](https://insights.sbomify.com/MAL-2026-2977/): Malicious code in ts-utils-dev (npm) (malicious package)
- [MAL-2026-2976](https://insights.sbomify.com/MAL-2026-2976/): Malicious code in gleb-js (npm) (malicious package)
- [MAL-2026-2975](https://insights.sbomify.com/MAL-2026-2975/): Malicious code in crypto-keccak-js (npm) (malicious package)
- [MAL-2026-2974](https://insights.sbomify.com/MAL-2026-2974/): Malicious code in claudcode-mcp (npm) (malicious package)
- [MAL-2026-2973](https://insights.sbomify.com/MAL-2026-2973/): Malicious code in claudcode-cli (npm) (malicious package)
- [MAL-2026-2972](https://insights.sbomify.com/MAL-2026-2972/): Malicious code in aven_types (npm) (malicious package)
- [MAL-2026-2971](https://insights.sbomify.com/MAL-2026-2971/): Malicious code in @usealloy/typegen (npm) (malicious package)
- [MAL-2026-2970](https://insights.sbomify.com/MAL-2026-2970/): Malicious code in @usealloy/component-library (npm) (malicious package)
- [MAL-2026-297](https://insights.sbomify.com/MAL-2026-297/): Malicious code in omnicore-ds2-sdk (npm) (malicious package)
- [MAL-2026-2969](https://insights.sbomify.com/MAL-2026-2969/): Malicious code in @usealloy/api-contract (npm) (malicious package)
- [MAL-2026-2968](https://insights.sbomify.com/MAL-2026-2968/): Malicious code in @bitunix/test (npm) (malicious package)
- [MAL-2026-2967](https://insights.sbomify.com/MAL-2026-2967/): Malicious code in 6161test1234 (npm) (malicious package)
- [MAL-2026-2966](https://insights.sbomify.com/MAL-2026-2966/): Malicious code in com.tencent.puerts.agent (npm) (malicious package)
- [MAL-2026-2965](https://insights.sbomify.com/MAL-2026-2965/): Malicious code in build-metadata-logger (PyPI) (malicious package)
- [MAL-2026-2964](https://insights.sbomify.com/MAL-2026-2964/): Malicious code in buildenv-collector (PyPI) (malicious package)
- [MAL-2026-2963](https://insights.sbomify.com/MAL-2026-2963/): Malicious code in typelimagic (PyPI) (malicious package)
- [MAL-2026-2962](https://insights.sbomify.com/MAL-2026-2962/): Malicious code in my-package-jiecub3 (PyPI) (malicious package)
- [MAL-2026-2961](https://insights.sbomify.com/MAL-2026-2961/): Malicious code in apple-internal-security-poc-frank (npm) (malicious package)
- [MAL-2026-2960](https://insights.sbomify.com/MAL-2026-2960/): Malicious code in apple-auth-internal (npm) (malicious package)
- [MAL-2026-296](https://insights.sbomify.com/MAL-2026-296/): Malicious code in nyse-web-tools-common (npm) (malicious package)
- [MAL-2026-2959](https://insights.sbomify.com/MAL-2026-2959/): Malicious code in internal_insights_enabled (npm) (malicious package)
- [MAL-2026-2958](https://insights.sbomify.com/MAL-2026-2958/): Malicious code in mysten_metrics (crates.io) (malicious package)
- [MAL-2026-2957](https://insights.sbomify.com/MAL-2026-2957/): Malicious code in cycode-dev (PyPI) (malicious package)
- [MAL-2026-2956](https://insights.sbomify.com/MAL-2026-2956/): Malicious code in @serasa/core (npm) (malicious package)
- [MAL-2026-2955](https://insights.sbomify.com/MAL-2026-2955/): Malicious code in megabank-worklist (npm) (malicious package)
- [MAL-2026-2954](https://insights.sbomify.com/MAL-2026-2954/): Malicious code in bmg-web-features (npm) (malicious package)
- [MAL-2026-2953](https://insights.sbomify.com/MAL-2026-2953/): Malicious code in bmg-web (npm) (malicious package)
- [MAL-2026-2952](https://insights.sbomify.com/MAL-2026-2952/): Malicious code in @settle-sea/supporting-documents (npm) (malicious package)
- [MAL-2026-2951](https://insights.sbomify.com/MAL-2026-2951/): Malicious code in hifromhere1 (npm) (malicious package)
- [MAL-2026-2950](https://insights.sbomify.com/MAL-2026-2950/): Malicious code in tailwind-text-fill (npm) (malicious package)
- [MAL-2026-295](https://insights.sbomify.com/MAL-2026-295/): Malicious code in lusha-widgets (npm) (malicious package)
- [MAL-2026-2949](https://insights.sbomify.com/MAL-2026-2949/): Malicious code in pathjoin (PyPI) (malicious package)
- [MAL-2026-2948](https://insights.sbomify.com/MAL-2026-2948/): Malicious code in leavemealone (PyPI) (malicious package)
- [MAL-2026-2947](https://insights.sbomify.com/MAL-2026-2947/): Malicious code in moonbit-schema-utils (PyPI) (malicious package)
- [MAL-2026-2946](https://insights.sbomify.com/MAL-2026-2946/): Malicious code in moonbit-metrics-validator (PyPI) (malicious package)
- [MAL-2026-2945](https://insights.sbomify.com/MAL-2026-2945/): Malicious code in moonbit-locale-compat (PyPI) (malicious package)
- [MAL-2026-2944](https://insights.sbomify.com/MAL-2026-2944/): Malicious code in turbo-leven (npm) (malicious package)
- [MAL-2026-2943](https://insights.sbomify.com/MAL-2026-2943/): Malicious code in turbo-he (npm) (malicious package)
- [MAL-2026-2942](https://insights.sbomify.com/MAL-2026-2942/): Malicious code in optimized-fastest-levenshtein (npm) (malicious package)
- [MAL-2026-2941](https://insights.sbomify.com/MAL-2026-2941/): Malicious code in npm-doc-deploy (npm) (malicious package)
- [MAL-2026-2940](https://insights.sbomify.com/MAL-2026-2940/): Malicious code in mailcraftjs (npm) (malicious package)
- [MAL-2026-294](https://insights.sbomify.com/MAL-2026-294/): Malicious code in lusha-ui-components (npm) (malicious package)
- [MAL-2026-2939](https://insights.sbomify.com/MAL-2026-2939/): Malicious code in krdfonts (npm) (malicious package)
- [MAL-2026-2938](https://insights.sbomify.com/MAL-2026-2938/): Malicious code in bignum-ts-v2 (npm) (malicious package)
- [MAL-2026-2937](https://insights.sbomify.com/MAL-2026-2937/): Malicious code in @tushar-br/file11 (npm) (malicious package)
- [MAL-2026-2936](https://insights.sbomify.com/MAL-2026-2936/): Malicious code in @tushar-br/editing-pack (npm) (malicious package)
- [MAL-2026-2935](https://insights.sbomify.com/MAL-2026-2935/): Malicious code in @tushar-br/desktop (npm) (malicious package)
- [MAL-2026-2934](https://insights.sbomify.com/MAL-2026-2934/): Malicious code in @otaxayuns/baileys (npm) (malicious package)
- [MAL-2026-2933](https://insights.sbomify.com/MAL-2026-2933/): Malicious code in @kjma/mailcraft (npm) (malicious package)
- [MAL-2026-2932](https://insights.sbomify.com/MAL-2026-2932/): Malicious code in sy-editor-v3 (npm) (malicious package)
- [MAL-2026-2931](https://insights.sbomify.com/MAL-2026-2931/): Malicious code in react-spa-shadcn (npm) (malicious package)
- [MAL-2026-2930](https://insights.sbomify.com/MAL-2026-2930/): Malicious code in path-internal (npm) (malicious package)
- [MAL-2026-293](https://insights.sbomify.com/MAL-2026-293/): Malicious code in lusha-micro-app-messages (npm) (malicious package)
- [MAL-2026-2929](https://insights.sbomify.com/MAL-2026-2929/): Malicious code in path-extend (npm) (malicious package)
- [MAL-2026-2928](https://insights.sbomify.com/MAL-2026-2928/): Malicious code in pa-marked-internal (npm) (malicious package)
- [MAL-2026-2927](https://insights.sbomify.com/MAL-2026-2927/): Malicious code in pa-marked (npm) (malicious package)
- [MAL-2026-2926](https://insights.sbomify.com/MAL-2026-2926/): Malicious code in material-ui-plugin-cache-endpoint (npm) (malicious package)
- [MAL-2026-2925](https://insights.sbomify.com/MAL-2026-2925/): Malicious code in cktool.internal (npm) (malicious package)
- [MAL-2026-2924](https://insights.sbomify.com/MAL-2026-2924/): Malicious code in cktool.core.internal (npm) (malicious package)
- [MAL-2026-2923](https://insights.sbomify.com/MAL-2026-2923/): Malicious code in cktool.config (npm) (malicious package)
- [MAL-2026-2922](https://insights.sbomify.com/MAL-2026-2922/): Malicious code in cktool.api (npm) (malicious package)
- [MAL-2026-2921](https://insights.sbomify.com/MAL-2026-2921/): Malicious code in chandan-module-test (npm) (malicious package)
- [MAL-2026-2920](https://insights.sbomify.com/MAL-2026-2920/): Malicious code in buffer-util-extend (npm) (malicious package)
- [MAL-2026-292](https://insights.sbomify.com/MAL-2026-292/): Malicious code in lusha-integrations-widgets (npm) (malicious package)
- [MAL-2026-2919](https://insights.sbomify.com/MAL-2026-2919/): Malicious code in apple-idms-internal (npm) (malicious package)
- [MAL-2026-2918](https://insights.sbomify.com/MAL-2026-2918/): Malicious code in apple-cloudkit-internal (npm) (malicious package)
- [MAL-2026-2917](https://insights.sbomify.com/MAL-2026-2917/): Malicious code in ac-sasskit-internal (npm) (malicious package)
- [MAL-2026-2916](https://insights.sbomify.com/MAL-2026-2916/): Malicious code in @jesusvizcaino2021/com.baogong.app-push-permission (npm) (malicious package)
- [MAL-2026-2915](https://insights.sbomify.com/MAL-2026-2915/): Malicious code in bitu-staking (npm) (malicious package)
- [MAL-2026-2914](https://insights.sbomify.com/MAL-2026-2914/): Malicious code in modern-events (npm) (malicious package)
- [MAL-2026-2913](https://insights.sbomify.com/MAL-2026-2913/): Malicious code in vite-plugin-compress-plus (npm) (malicious package)
- [MAL-2026-2912](https://insights.sbomify.com/MAL-2026-2912/): Malicious code in trgrip (npm) (malicious package)
- [MAL-2026-2911](https://insights.sbomify.com/MAL-2026-2911/): Malicious code in terminal-formatter (npm) (malicious package)
- [MAL-2026-2910](https://insights.sbomify.com/MAL-2026-2910/): Malicious code in tailwindthml-flips (npm) (malicious package)
- [MAL-2026-291](https://insights.sbomify.com/MAL-2026-291/): Malicious code in lead-ion (npm) (malicious package)
- [MAL-2026-2909](https://insights.sbomify.com/MAL-2026-2909/): Malicious code in tailwind-typography-cssstyle (npm) (malicious package)
- [MAL-2026-2908](https://insights.sbomify.com/MAL-2026-2908/): Malicious code in pretty-logger-js (npm) (malicious package)
- [MAL-2026-2907](https://insights.sbomify.com/MAL-2026-2907/): Malicious code in nj-logger (npm) (malicious package)
- [MAL-2026-2906](https://insights.sbomify.com/MAL-2026-2906/): Malicious code in swplayer-react-sl (npm) (malicious package)
- [MAL-2026-2905](https://insights.sbomify.com/MAL-2026-2905/): Malicious code in simple-auth-basic (npm) (malicious package)
- [MAL-2026-2904](https://insights.sbomify.com/MAL-2026-2904/): Malicious code in trackora-node (npm) (malicious package)
- [MAL-2026-2903](https://insights.sbomify.com/MAL-2026-2903/): Malicious code in trackora-chain (npm) (malicious package)
- [MAL-2026-2902](https://insights.sbomify.com/MAL-2026-2902/): Malicious code in lockedin-chai-chain (npm) (malicious package)
- [MAL-2026-2901](https://insights.sbomify.com/MAL-2026-2901/): Malicious code in env_express (npm) (malicious package)
- [MAL-2026-2900](https://insights.sbomify.com/MAL-2026-2900/): Malicious code in dotenv-pack (npm) (malicious package)
- [MAL-2026-290](https://insights.sbomify.com/MAL-2026-290/): Malicious code in kc-fe-cli (npm) (malicious package)
- [MAL-2026-29](https://insights.sbomify.com/MAL-2026-29/): Malicious code in ipvision-selfcare (npm) (malicious package)
- [MAL-2026-2899](https://insights.sbomify.com/MAL-2026-2899/): Malicious code in chai-use-chains (npm) (malicious package)
- [MAL-2026-2898](https://insights.sbomify.com/MAL-2026-2898/): Malicious code in chai-str (npm) (malicious package)
- [MAL-2026-2897](https://insights.sbomify.com/MAL-2026-2897/): Malicious code in chai-beta (npm) (malicious package)
- [MAL-2026-2896](https://insights.sbomify.com/MAL-2026-2896/): Malicious code in chai-as-stream (npm) (malicious package)
- [MAL-2026-2895](https://insights.sbomify.com/MAL-2026-2895/): Malicious code in chai-as-optimized (npm) (malicious package)
- [MAL-2026-2894](https://insights.sbomify.com/MAL-2026-2894/): Malicious code in chai-as-nobj (npm) (malicious package)
- [MAL-2026-2893](https://insights.sbomify.com/MAL-2026-2893/): Malicious code in chai-as-mobj (npm) (malicious package)
- [MAL-2026-2892](https://insights.sbomify.com/MAL-2026-2892/): Malicious code in chai-as-inserted (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/86/