# Vulnerabilities published in 2026 - [MAL-2026-2891](https://insights.sbomify.com/MAL-2026-2891/): Malicious code in chai-as-init (npm) (malicious package) - [MAL-2026-2890](https://insights.sbomify.com/MAL-2026-2890/): Malicious code in chai-as-ide (npm) (malicious package) - [MAL-2026-289](https://insights.sbomify.com/MAL-2026-289/): Malicious code in js-observability (npm) (malicious package) - [MAL-2026-2889](https://insights.sbomify.com/MAL-2026-2889/): Malicious code in chai-as-evm (npm) (malicious package) - [MAL-2026-2888](https://insights.sbomify.com/MAL-2026-2888/): Malicious code in chai-as-encrypted (npm) (malicious package) - [MAL-2026-2887](https://insights.sbomify.com/MAL-2026-2887/): Malicious code in chai-as-elevated (npm) (malicious package) - [MAL-2026-2886](https://insights.sbomify.com/MAL-2026-2886/): Malicious code in chai-as-chain-v2 (npm) (malicious package) - [MAL-2026-2885](https://insights.sbomify.com/MAL-2026-2885/): Malicious code in chai-as-adapter (npm) (malicious package) - [MAL-2026-2884](https://insights.sbomify.com/MAL-2026-2884/): Malicious code in forge-jsx (npm) (malicious package) - [MAL-2026-2883](https://insights.sbomify.com/MAL-2026-2883/): Malicious code in ts-lint-builds (npm) (malicious package) - [MAL-2026-2882](https://insights.sbomify.com/MAL-2026-2882/): Malicious code in cjs-biginteger (npm) (malicious package) - [MAL-2026-2881](https://insights.sbomify.com/MAL-2026-2881/): Malicious code in bjs-lint-builders (npm) (malicious package) - [MAL-2026-2880](https://insights.sbomify.com/MAL-2026-2880/): Malicious code in bjs-lint-builder (npm) (malicious package) - [MAL-2026-288](https://insights.sbomify.com/MAL-2026-288/): Malicious code in insightvm-ui-nav-menus (npm) (malicious package) - [MAL-2026-2879](https://insights.sbomify.com/MAL-2026-2879/): Malicious code in bjs-biginteger (npm) (malicious package) - [MAL-2026-2878](https://insights.sbomify.com/MAL-2026-2878/): Malicious code in unisys-sdk (npm) (malicious package) - [MAL-2026-2877](https://insights.sbomify.com/MAL-2026-2877/): Malicious code in unisys-core (npm) (malicious package) - [MAL-2026-2876](https://insights.sbomify.com/MAL-2026-2876/): Malicious code in unisys-common (npm) (malicious package) - [MAL-2026-2875](https://insights.sbomify.com/MAL-2026-2875/): Malicious code in unisys-auth (npm) (malicious package) - [MAL-2026-2874](https://insights.sbomify.com/MAL-2026-2874/): Malicious code in unisys-agentic-ai-playground (npm) (malicious package) - [MAL-2026-2873](https://insights.sbomify.com/MAL-2026-2873/): Malicious code in ts-schema-helpers (npm) (malicious package) - [MAL-2026-2872](https://insights.sbomify.com/MAL-2026-2872/): Malicious code in ts-form-helpers (npm) (malicious package) - [MAL-2026-2871](https://insights.sbomify.com/MAL-2026-2871/): Malicious code in devkitx (npm) (malicious package) - [MAL-2026-2870](https://insights.sbomify.com/MAL-2026-2870/): Malicious code in black-moon-js (npm) (malicious package) - [MAL-2026-287](https://insights.sbomify.com/MAL-2026-287/): Malicious code in idel2-content (npm) (malicious package) - [MAL-2026-2869](https://insights.sbomify.com/MAL-2026-2869/): Malicious code in arlo-meeting-assistant-rtms (npm) (malicious package) - [MAL-2026-2868](https://insights.sbomify.com/MAL-2026-2868/): Malicious code in arlo-meeting-assistant-frontend (npm) (malicious package) - [MAL-2026-2867](https://insights.sbomify.com/MAL-2026-2867/): Malicious code in arlo-meeting-assistant-backend (npm) (malicious package) - [MAL-2026-2866](https://insights.sbomify.com/MAL-2026-2866/): Malicious code in @tableau__catalog-messages/database_lower (npm) (malicious package) - [MAL-2026-2865](https://insights.sbomify.com/MAL-2026-2865/): Malicious code in @sie-ppr-web-checkout/app (npm) (malicious package) - [MAL-2026-2864](https://insights.sbomify.com/MAL-2026-2864/): Malicious code in robase-setup (PyPI) (malicious package) - [MAL-2026-2863](https://insights.sbomify.com/MAL-2026-2863/): Malicious code in rblx-studio-api (PyPI) (malicious package) - [MAL-2026-2862](https://insights.sbomify.com/MAL-2026-2862/): Malicious code in rtms-manager (npm) (malicious package) - [MAL-2026-2861](https://insights.sbomify.com/MAL-2026-2861/): Malicious code in vinext-monorepo (npm) (malicious package) - [MAL-2026-2860](https://insights.sbomify.com/MAL-2026-2860/): Malicious code in mylib-utils (PyPI) (malicious package) - [MAL-2026-286](https://insights.sbomify.com/MAL-2026-286/): Malicious code in forms-new-design (npm) (malicious package) - [MAL-2026-2859](https://insights.sbomify.com/MAL-2026-2859/): Malicious code in rblx-api (PyPI) (malicious package) - [MAL-2026-2858](https://insights.sbomify.com/MAL-2026-2858/): Malicious code in @source-row/source-container (npm) (malicious package) - [MAL-2026-2857](https://insights.sbomify.com/MAL-2026-2857/): Malicious code in @shoobx/types (npm) (malicious package) - [MAL-2026-2856](https://insights.sbomify.com/MAL-2026-2856/): Malicious code in @ataslkit/profilecard (npm) (malicious package) - [MAL-2026-2855](https://insights.sbomify.com/MAL-2026-2855/): Malicious code in react-resource-router-next (npm) (malicious package) - [MAL-2026-2854](https://insights.sbomify.com/MAL-2026-2854/): Malicious code in stringhelp (PyPI) (malicious package) - [MAL-2026-2853](https://insights.sbomify.com/MAL-2026-2853/): Malicious code in react-hook-form (npm) (malicious package) - [MAL-2026-2852](https://insights.sbomify.com/MAL-2026-2852/): Malicious code in aet-test (PyPI) (malicious package) - [MAL-2026-2851](https://insights.sbomify.com/MAL-2026-2851/): Malicious code in @indriver-poc/whisperwind (npm) (malicious package) - [MAL-2026-2850](https://insights.sbomify.com/MAL-2026-2850/): Malicious code in value-slider (npm) (malicious package) - [MAL-2026-285](https://insights.sbomify.com/MAL-2026-285/): Malicious code in focus-trap-v2 (npm) (malicious package) - [MAL-2026-2849](https://insights.sbomify.com/MAL-2026-2849/): Malicious code in @than1st/baileys (npm) (malicious package) - [MAL-2026-2848](https://insights.sbomify.com/MAL-2026-2848/): Malicious code in @than-xs/libsignal-node (npm) (malicious package) - [MAL-2026-2847](https://insights.sbomify.com/MAL-2026-2847/): Malicious code in shan-lib (PyPI) (malicious package) - [MAL-2026-2846](https://insights.sbomify.com/MAL-2026-2846/): Malicious code in eslint-plugin-totara (npm) (malicious package) - [MAL-2026-2845](https://insights.sbomify.com/MAL-2026-2845/): Malicious code in node-red-contrib-yolo-object-detection (npm) (malicious package) - [MAL-2026-2844](https://insights.sbomify.com/MAL-2026-2844/): Malicious code in shelipp (PyPI) (malicious package) - [MAL-2026-2843](https://insights.sbomify.com/MAL-2026-2843/): Malicious code in shan-lib-poc (PyPI) (malicious package) - [MAL-2026-2842](https://insights.sbomify.com/MAL-2026-2842/): Malicious code in looopiw (PyPI) (malicious package) - [MAL-2026-2841](https://insights.sbomify.com/MAL-2026-2841/): Malicious code in lixxyly (PyPI) (malicious package) - [MAL-2026-2840](https://insights.sbomify.com/MAL-2026-2840/): Malicious code in sher-server-tool (PyPI) (malicious package) - [MAL-2026-284](https://insights.sbomify.com/MAL-2026-284/): Malicious code in flag-v211 (npm) (malicious package) - [MAL-2026-2839](https://insights.sbomify.com/MAL-2026-2839/): Malicious code in sher-net (PyPI) (malicious package) - [MAL-2026-2838](https://insights.sbomify.com/MAL-2026-2838/): Malicious code in koa-v3 (npm) (malicious package) - [MAL-2026-2837](https://insights.sbomify.com/MAL-2026-2837/): Malicious code in solanakit (PyPI) (malicious package) - [MAL-2026-2836](https://insights.sbomify.com/MAL-2026-2836/): Malicious code in restasv3 (PyPI) (malicious package) - [MAL-2026-2835](https://insights.sbomify.com/MAL-2026-2835/): Malicious code in procoder (PyPI) (malicious package) - [MAL-2026-2834](https://insights.sbomify.com/MAL-2026-2834/): Malicious code in loadcoremwassistant (PyPI) (malicious package) - [MAL-2026-2833](https://insights.sbomify.com/MAL-2026-2833/): Malicious code in keystackutilities (PyPI) (malicious package) - [MAL-2026-2832](https://insights.sbomify.com/MAL-2026-2832/): Malicious code in ixosrestinterface (PyPI) (malicious package) - [MAL-2026-2831](https://insights.sbomify.com/MAL-2026-2831/): Malicious code in azure-ai-agentserver-githubcopilot (PyPI) (malicious package) - [MAL-2026-2830](https://insights.sbomify.com/MAL-2026-2830/): Malicious code in renovate-config-doctolib (npm) (malicious package) - [MAL-2026-283](https://insights.sbomify.com/MAL-2026-283/): Malicious code in flag-v21 (npm) (malicious package) - [MAL-2026-2829](https://insights.sbomify.com/MAL-2026-2829/): Malicious code in paddle-internal-scripts (npm) (malicious package) - [MAL-2026-2828](https://insights.sbomify.com/MAL-2026-2828/): Malicious code in express-security-policy (npm) (malicious package) - [MAL-2026-2827](https://insights.sbomify.com/MAL-2026-2827/): Malicious code in js-logger-pack (npm) (malicious package) - [MAL-2026-2826](https://insights.sbomify.com/MAL-2026-2826/): Malicious code in dom-utils-lite (npm) (malicious package) - [MAL-2026-2825](https://insights.sbomify.com/MAL-2026-2825/): Malicious code in centralogger (npm) (malicious package) - [MAL-2026-2824](https://insights.sbomify.com/MAL-2026-2824/): Malicious code in unisys-uka (npm) (malicious package) - [MAL-2026-2823](https://insights.sbomify.com/MAL-2026-2823/): Malicious code in @genoma-ui/components (npm) (malicious package) - [MAL-2026-2822](https://insights.sbomify.com/MAL-2026-2822/): Malicious code in ing-web-v5 (npm) (malicious package) - [MAL-2026-2821](https://insights.sbomify.com/MAL-2026-2821/): Malicious code in robase-quick-install (PyPI) (malicious package) - [MAL-2026-2820](https://insights.sbomify.com/MAL-2026-2820/): Malicious code in chainutils (PyPI) (malicious package) - [MAL-2026-282](https://insights.sbomify.com/MAL-2026-282/): Malicious code in experian-design-system (npm) (malicious package) - [MAL-2026-2819](https://insights.sbomify.com/MAL-2026-2819/): Malicious code in pynosist (PyPI) (malicious package) - [MAL-2026-2818](https://insights.sbomify.com/MAL-2026-2818/): Malicious code in genosys (PyPI) (malicious package) - [MAL-2026-2817](https://insights.sbomify.com/MAL-2026-2817/): Malicious code in lightweight-charts-4.1 (npm) (malicious package) - [MAL-2026-2816](https://insights.sbomify.com/MAL-2026-2816/): Malicious code in monolith-twirp-pullsd-users (RubyGems) (malicious package) - [MAL-2026-2815](https://insights.sbomify.com/MAL-2026-2815/): Malicious code in monolith-twirp-pullsd-authorization (RubyGems) (malicious package) - [MAL-2026-2814](https://insights.sbomify.com/MAL-2026-2814/): Malicious code in gitlab-orchestrator (RubyGems) (malicious package) - [MAL-2026-2813](https://insights.sbomify.com/MAL-2026-2813/): Malicious code in requests-testik11 (PyPI) (malicious package) - [MAL-2026-2812](https://insights.sbomify.com/MAL-2026-2812/): Malicious code in requests-test-test44 (PyPI) (malicious package) - [MAL-2026-2811](https://insights.sbomify.com/MAL-2026-2811/): Malicious code in requests-test-test3 (PyPI) (malicious package) - [MAL-2026-2810](https://insights.sbomify.com/MAL-2026-2810/): Malicious code in requests-test-test2 (PyPI) (malicious package) - [MAL-2026-281](https://insights.sbomify.com/MAL-2026-281/): Malicious code in eniram-web-common-ui (npm) (malicious package) - [MAL-2026-2809](https://insights.sbomify.com/MAL-2026-2809/): Malicious code in bombonsec-test-123 (PyPI) (malicious package) - [MAL-2026-2808](https://insights.sbomify.com/MAL-2026-2808/): Malicious code in wpfuihelpercore (NuGet) (malicious package) - [MAL-2026-2807](https://insights.sbomify.com/MAL-2026-2807/): Malicious code in jjrawlins.cdkiampolicybuilderhelper (NuGet) (malicious package) - [MAL-2026-2806](https://insights.sbomify.com/MAL-2026-2806/): Malicious code in youpin (npm) (malicious package) - [MAL-2026-2805](https://insights.sbomify.com/MAL-2026-2805/): Malicious code in winston-prisma (npm) (malicious package) - [MAL-2026-2804](https://insights.sbomify.com/MAL-2026-2804/): Malicious code in transcript-viewer-ui-demo (npm) (malicious package) - [MAL-2026-2803](https://insights.sbomify.com/MAL-2026-2803/): Malicious code in tailwind-configuration (npm) (malicious package) - [MAL-2026-2802](https://insights.sbomify.com/MAL-2026-2802/): Malicious code in synthetics-sdk-node (npm) (malicious package) - [MAL-2026-2801](https://insights.sbomify.com/MAL-2026-2801/): Malicious code in sfx-data (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/87/