# Vulnerabilities published in 2026 - [MAL-2026-2710](https://insights.sbomify.com/MAL-2026-2710/): Malicious code in @evoja-web/create-react-project (npm) (malicious package) - [MAL-2026-271](https://insights.sbomify.com/MAL-2026-271/): Malicious code in bve-react-ui-kit (npm) (malicious package) - [MAL-2026-2709](https://insights.sbomify.com/MAL-2026-2709/): Malicious code in @appleseed-apple/ac-sass-kit (npm) (malicious package) - [MAL-2026-2708](https://insights.sbomify.com/MAL-2026-2708/): Malicious code in @3stripes/toolkit (npm) (malicious package) - [MAL-2026-2707](https://insights.sbomify.com/MAL-2026-2707/): Malicious code in @3stripes/shared (npm) (malicious package) - [MAL-2026-2706](https://insights.sbomify.com/MAL-2026-2706/): Malicious code in @3stripes/sdk (npm) (malicious package) - [MAL-2026-2705](https://insights.sbomify.com/MAL-2026-2705/): Malicious code in @3stripes/core (npm) (malicious package) - [MAL-2026-2704](https://insights.sbomify.com/MAL-2026-2704/): Malicious code in @3stripes/config (npm) (malicious package) - [MAL-2026-2703](https://insights.sbomify.com/MAL-2026-2703/): Malicious code in @3stripes/components (npm) (malicious package) - [MAL-2026-2702](https://insights.sbomify.com/MAL-2026-2702/): Malicious code in emergentintegrations (PyPI) (malicious package) - [MAL-2026-2701](https://insights.sbomify.com/MAL-2026-2701/): Malicious code in sanitize-url (npm) (malicious package) - [MAL-2026-2700](https://insights.sbomify.com/MAL-2026-2700/): Malicious code in conventional-changelog-dash (npm) (malicious package) - [MAL-2026-270](https://insights.sbomify.com/MAL-2026-270/): Malicious code in base-ui-vue3 (npm) (malicious package) - [MAL-2026-27](https://insights.sbomify.com/MAL-2026-27/): Malicious code in qdatainstaller (PyPI) (malicious package) - [MAL-2026-2699](https://insights.sbomify.com/MAL-2026-2699/): Malicious code in robase-api (PyPI) (malicious package) - [MAL-2026-2698](https://insights.sbomify.com/MAL-2026-2698/): Malicious code in kyleip (PyPI) (malicious package) - [MAL-2026-2697](https://insights.sbomify.com/MAL-2026-2697/): Malicious code in ccxt-telemetry (PyPI) (malicious package) - [MAL-2026-2696](https://insights.sbomify.com/MAL-2026-2696/): Malicious code in bfx-hf-strategy-perf (npm) (malicious package) - [MAL-2026-2695](https://insights.sbomify.com/MAL-2026-2695/): Malicious code in cpu-optimizers2-33 (PyPI) (malicious package) - [MAL-2026-2694](https://insights.sbomify.com/MAL-2026-2694/): Malicious code in cpu-optimizers (PyPI) (malicious package) - [MAL-2026-2693](https://insights.sbomify.com/MAL-2026-2693/): Malicious code in vs-supplier-portal-web (npm) (malicious package) - [MAL-2026-2692](https://insights.sbomify.com/MAL-2026-2692/): Malicious code in fusion-events (npm) (malicious package) - [MAL-2026-2691](https://insights.sbomify.com/MAL-2026-2691/): Malicious code in base-counter-web (npm) (malicious package) - [MAL-2026-2690](https://insights.sbomify.com/MAL-2026-2690/): Malicious code in @pnc-ref/harmony-support-v18 (npm) (malicious package) - [MAL-2026-269](https://insights.sbomify.com/MAL-2026-269/): Malicious code in auc-2-lib (npm) (malicious package) - [MAL-2026-2689](https://insights.sbomify.com/MAL-2026-2689/): Malicious code in @pnc-ref/harmony-core-v18 (npm) (malicious package) - [MAL-2026-2688](https://insights.sbomify.com/MAL-2026-2688/): Malicious code in @pnc-cib/cib-core-lib (npm) (malicious package) - [MAL-2026-2687](https://insights.sbomify.com/MAL-2026-2687/): Malicious code in com.baogong.app_push_permission (npm) (malicious package) - [MAL-2026-2686](https://insights.sbomify.com/MAL-2026-2686/): Malicious code in neverinstallme (PyPI) (malicious package) - [MAL-2026-2685](https://insights.sbomify.com/MAL-2026-2685/): Malicious code in react-dom-19 (npm) (malicious package) - [MAL-2026-2684](https://insights.sbomify.com/MAL-2026-2684/): Malicious code in tensorzero-node (npm) (malicious package) - [MAL-2026-2683](https://insights.sbomify.com/MAL-2026-2683/): Malicious code in @athena-ui-components/axios (npm) (malicious package) - [MAL-2026-2682](https://insights.sbomify.com/MAL-2026-2682/): Malicious code in @athena-ui-components/deeplink (npm) (malicious package) - [MAL-2026-2681](https://insights.sbomify.com/MAL-2026-2681/): Malicious code in @athena-ui-components/dashboard-widget (npm) (malicious package) - [MAL-2026-2680](https://insights.sbomify.com/MAL-2026-2680/): Malicious code in @veygo/component-library (npm) (malicious package) - [MAL-2026-268](https://insights.sbomify.com/MAL-2026-268/): Malicious code in assurance-common-components (npm) (malicious package) - [MAL-2026-2679](https://insights.sbomify.com/MAL-2026-2679/): Malicious code in snitz-chief-cloud-config (npm) (malicious package) - [MAL-2026-2678](https://insights.sbomify.com/MAL-2026-2678/): Malicious code in snitz-chief-cloud (npm) (malicious package) - [MAL-2026-2677](https://insights.sbomify.com/MAL-2026-2677/): Malicious code in pdf-linker (npm) (malicious package) - [MAL-2026-2676](https://insights.sbomify.com/MAL-2026-2676/): Malicious code in moscova-plural-json-parser (npm) (malicious package) - [MAL-2026-2675](https://insights.sbomify.com/MAL-2026-2675/): Malicious code in mongoose-stamps (npm) (malicious package) - [MAL-2026-2674](https://insights.sbomify.com/MAL-2026-2674/): Malicious code in chief-proxy-out (npm) (malicious package) - [MAL-2026-2673](https://insights.sbomify.com/MAL-2026-2673/): Malicious code in chief-documentation (npm) (malicious package) - [MAL-2026-2672](https://insights.sbomify.com/MAL-2026-2672/): Malicious code in ahmed_salem_ph (npm) (malicious package) - [MAL-2026-2671](https://insights.sbomify.com/MAL-2026-2671/): Malicious code in kryptex-os (PyPI) (malicious package) - [MAL-2026-2670](https://insights.sbomify.com/MAL-2026-2670/): Malicious code in 7miners (PyPI) (malicious package) - [MAL-2026-267](https://insights.sbomify.com/MAL-2026-267/): Malicious code in alf-ui-js (npm) (malicious package) - [MAL-2026-2669](https://insights.sbomify.com/MAL-2026-2669/): Malicious code in ant-mcp-proxy-for-test (PyPI) (malicious package) - [MAL-2026-2668](https://insights.sbomify.com/MAL-2026-2668/): Malicious code in pnpm-workspaces (npm) (malicious package) - [MAL-2026-2667](https://insights.sbomify.com/MAL-2026-2667/): Malicious code in ckeditor5-minimap (npm) (malicious package) - [MAL-2026-2666](https://insights.sbomify.com/MAL-2026-2666/): Malicious code in moooo (PyPI) (malicious package) - [MAL-2026-2665](https://insights.sbomify.com/MAL-2026-2665/): Malicious code in hive-os-settings (PyPI) (malicious package) - [MAL-2026-2664](https://insights.sbomify.com/MAL-2026-2664/): Malicious code in buildenv-telemetry (PyPI) (malicious package) - [MAL-2026-2663](https://insights.sbomify.com/MAL-2026-2663/): Malicious code in tether-wrk-base (npm) (malicious package) - [MAL-2026-2662](https://insights.sbomify.com/MAL-2026-2662/): Malicious code in @automation-toolchain/f5-cloud-libs (npm) (malicious package) - [MAL-2026-2661](https://insights.sbomify.com/MAL-2026-2661/): Malicious code in vip-landing (npm) (malicious package) - [MAL-2026-2660](https://insights.sbomify.com/MAL-2026-2660/): Malicious code in use-feature-flags-plugin (npm) (malicious package) - [MAL-2026-266](https://insights.sbomify.com/MAL-2026-266/): Malicious code in @wbgo/shared (npm) (malicious package) - [MAL-2026-2659](https://insights.sbomify.com/MAL-2026-2659/): Malicious code in ui-utils-udhay-alerts (npm) (malicious package) - [MAL-2026-2658](https://insights.sbomify.com/MAL-2026-2658/): Malicious code in tailwindcss-style-typography (npm) (malicious package) - [MAL-2026-2657](https://insights.sbomify.com/MAL-2026-2657/): Malicious code in tailwind-typ (npm) (malicious package) - [MAL-2026-2656](https://insights.sbomify.com/MAL-2026-2656/): Malicious code in tailwind-stylecss-typography (npm) (malicious package) - [MAL-2026-2655](https://insights.sbomify.com/MAL-2026-2655/): Malicious code in tailwind-lines-clamp (npm) (malicious package) - [MAL-2026-2654](https://insights.sbomify.com/MAL-2026-2654/): Malicious code in pinstatsd (npm) (malicious package) - [MAL-2026-2653](https://insights.sbomify.com/MAL-2026-2653/): Malicious code in pinlogger (npm) (malicious package) - [MAL-2026-2652](https://insights.sbomify.com/MAL-2026-2652/): Malicious code in onewin-landing (npm) (malicious package) - [MAL-2026-2651](https://insights.sbomify.com/MAL-2026-2651/): Malicious code in one-translations (npm) (malicious package) - [MAL-2026-2650](https://insights.sbomify.com/MAL-2026-2650/): Malicious code in one-sdui (npm) (malicious package) - [MAL-2026-265](https://insights.sbomify.com/MAL-2026-265/): Malicious code in @wb-team/uikit-myteam-web (npm) (malicious package) - [MAL-2026-2649](https://insights.sbomify.com/MAL-2026-2649/): Malicious code in okxglobal (npm) (malicious package) - [MAL-2026-2648](https://insights.sbomify.com/MAL-2026-2648/): Malicious code in okx-nav (npm) (malicious package) - [MAL-2026-2647](https://insights.sbomify.com/MAL-2026-2647/): Malicious code in okx-data (npm) (malicious package) - [MAL-2026-2646](https://insights.sbomify.com/MAL-2026-2646/): Malicious code in okfe-serverless-conf (npm) (malicious package) - [MAL-2026-2645](https://insights.sbomify.com/MAL-2026-2645/): Malicious code in okassistant (npm) (malicious package) - [MAL-2026-2644](https://insights.sbomify.com/MAL-2026-2644/): Malicious code in node-unpnotifyserv (npm) (malicious package) - [MAL-2026-2643](https://insights.sbomify.com/MAL-2026-2643/): Malicious code in ms-affiliate-links (npm) (malicious package) - [MAL-2026-2642](https://insights.sbomify.com/MAL-2026-2642/): Malicious code in chatbotloader (npm) (malicious package) - [MAL-2026-2641](https://insights.sbomify.com/MAL-2026-2641/): Malicious code in chai-as-refined (npm) (malicious package) - [MAL-2026-2640](https://insights.sbomify.com/MAL-2026-2640/): Malicious code in bytefrontier-core (npm) (malicious package) - [MAL-2026-264](https://insights.sbomify.com/MAL-2026-264/): Malicious code in @ux-foundry/palette (npm) (malicious package) - [MAL-2026-2639](https://insights.sbomify.com/MAL-2026-2639/): Malicious code in bytefrontier (npm) (malicious package) - [MAL-2026-2638](https://insights.sbomify.com/MAL-2026-2638/): Malicious code in billing-paywidget (npm) (malicious package) - [MAL-2026-2637](https://insights.sbomify.com/MAL-2026-2637/): Malicious code in apmfe (npm) (malicious package) - [MAL-2026-2636](https://insights.sbomify.com/MAL-2026-2636/): Malicious code in seaport-core-16 (npm) (malicious package) - [MAL-2026-2635](https://insights.sbomify.com/MAL-2026-2635/): Malicious code in pubnub-element (npm) (malicious package) - [MAL-2026-2634](https://insights.sbomify.com/MAL-2026-2634/): Malicious code in percy-cake-docker (npm) (malicious package) - [MAL-2026-2633](https://insights.sbomify.com/MAL-2026-2633/): Malicious code in markdownlint-rule-link-pattern (npm) (malicious package) - [MAL-2026-2632](https://insights.sbomify.com/MAL-2026-2632/): Malicious code in magentaa11y (npm) (malicious package) - [MAL-2026-2631](https://insights.sbomify.com/MAL-2026-2631/): Malicious code in babel-plugin-blocks (npm) (malicious package) - [MAL-2026-2630](https://insights.sbomify.com/MAL-2026-2630/): Malicious code in gate-apis (PyPI) (malicious package) - [MAL-2026-263](https://insights.sbomify.com/MAL-2026-263/): Malicious code in @spx-workforceops/shared-vue (npm) (malicious package) - [MAL-2026-2629](https://insights.sbomify.com/MAL-2026-2629/): Malicious code in stacks-editor (npm) (malicious package) - [MAL-2026-2628](https://insights.sbomify.com/MAL-2026-2628/): Malicious code in svchost (PyPI) (malicious package) - [MAL-2026-2627](https://insights.sbomify.com/MAL-2026-2627/): Malicious code in pckg-sv (PyPI) (malicious package) - [MAL-2026-2626](https://insights.sbomify.com/MAL-2026-2626/): Malicious code in getcardslib (npm) (malicious package) - [MAL-2026-2625](https://insights.sbomify.com/MAL-2026-2625/): Malicious code in robase-install (PyPI) (malicious package) - [MAL-2026-2624](https://insights.sbomify.com/MAL-2026-2624/): Malicious code in asciitoart (PyPI) (malicious package) - [MAL-2026-2623](https://insights.sbomify.com/MAL-2026-2623/): Malicious code in hive-setting (PyPI) (malicious package) - [MAL-2026-2622](https://insights.sbomify.com/MAL-2026-2622/): Malicious code in wm-plugin-wm-smart-tip-dont-embed-tooltip (npm) (malicious package) - [MAL-2026-2621](https://insights.sbomify.com/MAL-2026-2621/): Malicious code in walmart-internal (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/89/