# Vulnerabilities published in 2026


- [MAL-2026-2800](https://insights.sbomify.com/MAL-2026-2800/): Malicious code in separadordeinfo (npm) (malicious package)
- [MAL-2026-280](https://insights.sbomify.com/MAL-2026-280/): Malicious code in dws-dx (npm) (malicious package)
- [MAL-2026-28](https://insights.sbomify.com/MAL-2026-28/): Malicious code in chrome-stealth (PyPI) (malicious package)
- [MAL-2026-2799](https://insights.sbomify.com/MAL-2026-2799/): Malicious code in rtxaspnet (npm) (malicious package)
- [MAL-2026-2798](https://insights.sbomify.com/MAL-2026-2798/): Malicious code in request-easy-validator (npm) (malicious package)
- [MAL-2026-2797](https://insights.sbomify.com/MAL-2026-2797/): Malicious code in relion-node (npm) (malicious package)
- [MAL-2026-2796](https://insights.sbomify.com/MAL-2026-2796/): Malicious code in relion-chain (npm) (malicious package)
- [MAL-2026-2795](https://insights.sbomify.com/MAL-2026-2795/): Malicious code in react-appfabric-shell (npm) (malicious package)
- [MAL-2026-2794](https://insights.sbomify.com/MAL-2026-2794/): Malicious code in puzzle-fragment (npm) (malicious package)
- [MAL-2026-2793](https://insights.sbomify.com/MAL-2026-2793/): Malicious code in pil2-stark-js (npm) (malicious package)
- [MAL-2026-2792](https://insights.sbomify.com/MAL-2026-2792/): Malicious code in pil2-proofman-js (npm) (malicious package)
- [MAL-2026-2791](https://insights.sbomify.com/MAL-2026-2791/): Malicious code in payments-ui (npm) (malicious package)
- [MAL-2026-2790](https://insights.sbomify.com/MAL-2026-2790/): Malicious code in package-with-import-assertions (npm) (malicious package)
- [MAL-2026-279](https://insights.sbomify.com/MAL-2026-279/): Malicious code in dibels8-content (npm) (malicious package)
- [MAL-2026-2789](https://insights.sbomify.com/MAL-2026-2789/): Malicious code in otomi-tasks (npm) (malicious package)
- [MAL-2026-2788](https://insights.sbomify.com/MAL-2026-2788/): Malicious code in otomi-console (npm) (malicious package)
- [MAL-2026-2787](https://insights.sbomify.com/MAL-2026-2787/): Malicious code in node-syncora (npm) (malicious package)
- [MAL-2026-2786](https://insights.sbomify.com/MAL-2026-2786/): Malicious code in node-metrica (npm) (malicious package)
- [MAL-2026-2785](https://insights.sbomify.com/MAL-2026-2785/): Malicious code in nemo-jaws (npm) (malicious package)
- [MAL-2026-2784](https://insights.sbomify.com/MAL-2026-2784/): Malicious code in nemo-datadrive (npm) (malicious package)
- [MAL-2026-2783](https://insights.sbomify.com/MAL-2026-2783/): Malicious code in mypeopledoc (npm) (malicious package)
- [MAL-2026-2782](https://insights.sbomify.com/MAL-2026-2782/): Malicious code in mybibilabu (npm) (malicious package)
- [MAL-2026-2781](https://insights.sbomify.com/MAL-2026-2781/): Malicious code in minecraft_image_to_blocks (npm) (malicious package)
- [MAL-2026-2780](https://insights.sbomify.com/MAL-2026-2780/): Malicious code in metrify-node (npm) (malicious package)
- [MAL-2026-278](https://insights.sbomify.com/MAL-2026-278/): Malicious code in comstrap (npm) (malicious package)
- [MAL-2026-2779](https://insights.sbomify.com/MAL-2026-2779/): Malicious code in metrify-chain (npm) (malicious package)
- [MAL-2026-2778](https://insights.sbomify.com/MAL-2026-2778/): Malicious code in marketing-analytics (npm) (malicious package)
- [MAL-2026-2777](https://insights.sbomify.com/MAL-2026-2777/): Malicious code in linode-developers (npm) (malicious package)
- [MAL-2026-2776](https://insights.sbomify.com/MAL-2026-2776/): Malicious code in int-browsing-gateway (npm) (malicious package)
- [MAL-2026-2775](https://insights.sbomify.com/MAL-2026-2775/): Malicious code in insomnia-smoke-test (npm) (malicious package)
- [MAL-2026-2774](https://insights.sbomify.com/MAL-2026-2774/): Malicious code in insomnia-scripting-environment (npm) (malicious package)
- [MAL-2026-2773](https://insights.sbomify.com/MAL-2026-2773/): Malicious code in insomnia-api (npm) (malicious package)
- [MAL-2026-2772](https://insights.sbomify.com/MAL-2026-2772/): Malicious code in idaasfinancialnodeserv (npm) (malicious package)
- [MAL-2026-2771](https://insights.sbomify.com/MAL-2026-2771/): Malicious code in icims-express-dot-engine (npm) (malicious package)
- [MAL-2026-2770](https://insights.sbomify.com/MAL-2026-2770/): Malicious code in helios-components (npm) (malicious package)
- [MAL-2026-277](https://insights.sbomify.com/MAL-2026-277/): Malicious code in cognito-auth-plugin (npm) (malicious package)
- [MAL-2026-2769](https://insights.sbomify.com/MAL-2026-2769/): Malicious code in hardhat-starter-kit (npm) (malicious package)
- [MAL-2026-2768](https://insights.sbomify.com/MAL-2026-2768/): Malicious code in h3-next (npm) (malicious package)
- [MAL-2026-2767](https://insights.sbomify.com/MAL-2026-2767/): Malicious code in ground-platform (npm) (malicious package)
- [MAL-2026-2766](https://insights.sbomify.com/MAL-2026-2766/): Malicious code in gke-net (npm) (malicious package)
- [MAL-2026-2765](https://insights.sbomify.com/MAL-2026-2765/): Malicious code in ghscan-pkgcheck-test-001 (npm) (malicious package)
- [MAL-2026-2764](https://insights.sbomify.com/MAL-2026-2764/): Malicious code in gemini-cli-vscode-ide-companion (npm) (malicious package)
- [MAL-2026-2763](https://insights.sbomify.com/MAL-2026-2763/): Malicious code in gemini-ai-checker (npm) (malicious package)
- [MAL-2026-2762](https://insights.sbomify.com/MAL-2026-2762/): Malicious code in farikku-util (npm) (malicious package)
- [MAL-2026-2761](https://insights.sbomify.com/MAL-2026-2761/): Malicious code in f0-fpti-tracking (npm) (malicious package)
- [MAL-2026-2760](https://insights.sbomify.com/MAL-2026-2760/): Malicious code in f0-email-verification (npm) (malicious package)
- [MAL-2026-276](https://insights.sbomify.com/MAL-2026-276/): Malicious code in closure-net (npm) (malicious package)
- [MAL-2026-2759](https://insights.sbomify.com/MAL-2026-2759/): Malicious code in express-auth-basic (npm) (malicious package)
- [MAL-2026-2758](https://insights.sbomify.com/MAL-2026-2758/): Malicious code in estaspnet (npm) (malicious package)
- [MAL-2026-2757](https://insights.sbomify.com/MAL-2026-2757/): Malicious code in docai-sheets (npm) (malicious package)
- [MAL-2026-2756](https://insights.sbomify.com/MAL-2026-2756/): Malicious code in digitallogger (npm) (malicious package)
- [MAL-2026-2755](https://insights.sbomify.com/MAL-2026-2755/): Malicious code in devops-debug-tool-ctf (npm) (malicious package)
- [MAL-2026-2754](https://insights.sbomify.com/MAL-2026-2754/): Malicious code in deployer-kit (npm) (malicious package)
- [MAL-2026-2753](https://insights.sbomify.com/MAL-2026-2753/): Malicious code in declarative-tracker (npm) (malicious package)
- [MAL-2026-2752](https://insights.sbomify.com/MAL-2026-2752/): Malicious code in country-specialization (npm) (malicious package)
- [MAL-2026-2751](https://insights.sbomify.com/MAL-2026-2751/): Malicious code in coremeshnode (npm) (malicious package)
- [MAL-2026-2750](https://insights.sbomify.com/MAL-2026-2750/): Malicious code in coremesh (npm) (malicious package)
- [MAL-2026-275](https://insights.sbomify.com/MAL-2026-275/): Malicious code in chakra-ui-2--theme-tools (npm) (malicious package)
- [MAL-2026-2749](https://insights.sbomify.com/MAL-2026-2749/): Malicious code in conversation-relay (npm) (malicious package)
- [MAL-2026-2748](https://insights.sbomify.com/MAL-2026-2748/): Malicious code in collect-rangers (npm) (malicious package)
- [MAL-2026-2747](https://insights.sbomify.com/MAL-2026-2747/): Malicious code in cloud-run-microservice-template (npm) (malicious package)
- [MAL-2026-2746](https://insights.sbomify.com/MAL-2026-2746/): Malicious code in chainlink-docs (npm) (malicious package)
- [MAL-2026-2745](https://insights.sbomify.com/MAL-2026-2745/): Malicious code in chain-syncora (npm) (malicious package)
- [MAL-2026-2744](https://insights.sbomify.com/MAL-2026-2744/): Malicious code in chain-metrica (npm) (malicious package)
- [MAL-2026-2743](https://insights.sbomify.com/MAL-2026-2743/): Malicious code in chai-use-chain (npm) (malicious package)
- [MAL-2026-2742](https://insights.sbomify.com/MAL-2026-2742/): Malicious code in chai-extensions-extra (npm) (malicious package)
- [MAL-2026-2741](https://insights.sbomify.com/MAL-2026-2741/): Malicious code in chai-chain-coremesh (npm) (malicious package)
- [MAL-2026-2740](https://insights.sbomify.com/MAL-2026-2740/): Malicious code in chai-as-type (npm) (malicious package)
- [MAL-2026-274](https://insights.sbomify.com/MAL-2026-274/): Malicious code in chakra-ui-2--styled-system (npm) (malicious package)
- [MAL-2026-2739](https://insights.sbomify.com/MAL-2026-2739/): Malicious code in ccip-starter-kit-hardhat (npm) (malicious package)
- [MAL-2026-2738](https://insights.sbomify.com/MAL-2026-2738/): Malicious code in cardreadermgmtserv (npm) (malicious package)
- [MAL-2026-2737](https://insights.sbomify.com/MAL-2026-2737/): Malicious code in business-data (npm) (malicious package)
- [MAL-2026-2736](https://insights.sbomify.com/MAL-2026-2736/): Malicious code in buildkite-test-collector-vitest-example (npm) (malicious package)
- [MAL-2026-2735](https://insights.sbomify.com/MAL-2026-2735/): Malicious code in buildkite-test-collector-playwright-example (npm) (malicious package)
- [MAL-2026-2734](https://insights.sbomify.com/MAL-2026-2734/): Malicious code in buildkite-test-collector-mocha-example (npm) (malicious package)
- [MAL-2026-2733](https://insights.sbomify.com/MAL-2026-2733/): Malicious code in buildkite-test-collector-jest-example (npm) (malicious package)
- [MAL-2026-2732](https://insights.sbomify.com/MAL-2026-2732/): Malicious code in buildkite-test-collector-jasmine-example (npm) (malicious package)
- [MAL-2026-2731](https://insights.sbomify.com/MAL-2026-2731/): Malicious code in buildkite-test-collector-cypress-example (npm) (malicious package)
- [MAL-2026-2730](https://insights.sbomify.com/MAL-2026-2730/): Malicious code in browserstack-utils (npm) (malicious package)
- [MAL-2026-273](https://insights.sbomify.com/MAL-2026-273/): Malicious code in chakra-ui-2--react-utils (npm) (malicious package)
- [MAL-2026-2729](https://insights.sbomify.com/MAL-2026-2729/): Malicious code in apl-github-test (npm) (malicious package)
- [MAL-2026-2728](https://insights.sbomify.com/MAL-2026-2728/): Malicious code in apl-announcements (npm) (malicious package)
- [MAL-2026-2727](https://insights.sbomify.com/MAL-2026-2727/): Malicious code in agent-starter (npm) (malicious package)
- [MAL-2026-2726](https://insights.sbomify.com/MAL-2026-2726/): Malicious code in agent-scheduler (npm) (malicious package)
- [MAL-2026-2725](https://insights.sbomify.com/MAL-2026-2725/): Malicious code in agent-framework-web (npm) (malicious package)
- [MAL-2026-2724](https://insights.sbomify.com/MAL-2026-2724/): Malicious code in agdebugger-frontend (npm) (malicious package)
- [MAL-2026-2723](https://insights.sbomify.com/MAL-2026-2723/): Malicious code in actions-label-commenter (npm) (malicious package)
- [MAL-2026-2722](https://insights.sbomify.com/MAL-2026-2722/): Malicious code in action-setup-enos (npm) (malicious package)
- [MAL-2026-2721](https://insights.sbomify.com/MAL-2026-2721/): Malicious code in access-worker-test (npm) (malicious package)
- [MAL-2026-2720](https://insights.sbomify.com/MAL-2026-2720/): Malicious code in aca-review-apps (npm) (malicious package)
- [MAL-2026-272](https://insights.sbomify.com/MAL-2026-272/): Malicious code in chakra-ui-2--react (npm) (malicious package)
- [MAL-2026-2719](https://insights.sbomify.com/MAL-2026-2719/): Malicious code in @youcanneverguessthisonereally/test-pkg (npm) (malicious package)
- [MAL-2026-2718](https://insights.sbomify.com/MAL-2026-2718/): Malicious code in @the-coca-cola-company/receipt-scanner-admin-lib (npm) (malicious package)
- [MAL-2026-2717](https://insights.sbomify.com/MAL-2026-2717/): Malicious code in @tax-taxdev/tools-scripts (npm) (malicious package)
- [MAL-2026-2716](https://insights.sbomify.com/MAL-2026-2716/): Malicious code in @needl-ai/common (npm) (malicious package)
- [MAL-2026-2715](https://insights.sbomify.com/MAL-2026-2715/): Malicious code in @mesh-atoms/typography (npm) (malicious package)
- [MAL-2026-2714](https://insights.sbomify.com/MAL-2026-2714/): Malicious code in @gameforge/http-server (npm) (malicious package)
- [MAL-2026-2713](https://insights.sbomify.com/MAL-2026-2713/): Malicious code in @fuego-tools/analytics (npm) (malicious package)
- [MAL-2026-2712](https://insights.sbomify.com/MAL-2026-2712/): Malicious code in @evoja-web/redaction (npm) (malicious package)
- [MAL-2026-2711](https://insights.sbomify.com/MAL-2026-2711/): Malicious code in @evoja-web/react-login (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/88/