# Vulnerabilities published in 2026 - [MAL-2026-2620](https://insights.sbomify.com/MAL-2026-2620/): Malicious code in upstartportal (npm) (malicious package) - [MAL-2026-262](https://insights.sbomify.com/MAL-2026-262/): Malicious code in @spx-smartsorting/vue (npm) (malicious package) - [MAL-2026-2619](https://insights.sbomify.com/MAL-2026-2619/): Malicious code in upstartloans (npm) (malicious package) - [MAL-2026-2618](https://insights.sbomify.com/MAL-2026-2618/): Malicious code in upstartdr (npm) (malicious package) - [MAL-2026-2617](https://insights.sbomify.com/MAL-2026-2617/): Malicious code in upstartautoretailadmin (npm) (malicious package) - [MAL-2026-2616](https://insights.sbomify.com/MAL-2026-2616/): Malicious code in upstartapplicationstatus (npm) (malicious package) - [MAL-2026-2615](https://insights.sbomify.com/MAL-2026-2615/): Malicious code in upstartadmindashboard- (npm) (malicious package) - [MAL-2026-2614](https://insights.sbomify.com/MAL-2026-2614/): Malicious code in upstart.previewcss (npm) (malicious package) - [MAL-2026-2613](https://insights.sbomify.com/MAL-2026-2613/): Malicious code in upstart-offer-container (npm) (malicious package) - [MAL-2026-2612](https://insights.sbomify.com/MAL-2026-2612/): Malicious code in upstart-loan-status (npm) (malicious package) - [MAL-2026-2611](https://insights.sbomify.com/MAL-2026-2611/): Malicious code in upstart-lending-status (npm) (malicious package) - [MAL-2026-2610](https://insights.sbomify.com/MAL-2026-2610/): Malicious code in twilio-video.js (npm) (malicious package) - [MAL-2026-261](https://insights.sbomify.com/MAL-2026-261/): Malicious code in @spx-delivery/react (npm) (malicious package) - [MAL-2026-2609](https://insights.sbomify.com/MAL-2026-2609/): Malicious code in trade-in-lib (npm) (malicious package) - [MAL-2026-2608](https://insights.sbomify.com/MAL-2026-2608/): Malicious code in symphony-core (npm) (malicious package) - [MAL-2026-2607](https://insights.sbomify.com/MAL-2026-2607/): Malicious code in stats-api-js-client (npm) (malicious package) - [MAL-2026-2606](https://insights.sbomify.com/MAL-2026-2606/): Malicious code in mdb-react-sortable (npm) (malicious package) - [MAL-2026-2605](https://insights.sbomify.com/MAL-2026-2605/): Malicious code in kaltura-ngx-client (npm) (malicious package) - [MAL-2026-2604](https://insights.sbomify.com/MAL-2026-2604/): Malicious code in ih-icon (npm) (malicious package) - [MAL-2026-2603](https://insights.sbomify.com/MAL-2026-2603/): Malicious code in experian-design-system-themes (npm) (malicious package) - [MAL-2026-2602](https://insights.sbomify.com/MAL-2026-2602/): Malicious code in etsy-advocacy (npm) (malicious package) - [MAL-2026-2601](https://insights.sbomify.com/MAL-2026-2601/): Malicious code in dwaiter-company-web (npm) (malicious package) - [MAL-2026-2600](https://insights.sbomify.com/MAL-2026-2600/): Malicious code in cms-site-api-js-client (npm) (malicious package) - [MAL-2026-260](https://insights.sbomify.com/MAL-2026-260/): Malicious code in @servicepoint/vue-project (npm) (malicious package) - [MAL-2026-26](https://insights.sbomify.com/MAL-2026-26/): Malicious code in pdatainstaller (PyPI) (malicious package) - [MAL-2026-2599](https://insights.sbomify.com/MAL-2026-2599/): Malicious code in ccn-common-react-library (npm) (malicious package) - [MAL-2026-2598](https://insights.sbomify.com/MAL-2026-2598/): Malicious code in babel-plugin-fbtee (npm) (malicious package) - [MAL-2026-2597](https://insights.sbomify.com/MAL-2026-2597/): Malicious code in @zgny/onboarding-consumer (npm) (malicious package) - [MAL-2026-2596](https://insights.sbomify.com/MAL-2026-2596/): Malicious code in @spreadjs/js-calc (npm) (malicious package) - [MAL-2026-2595](https://insights.sbomify.com/MAL-2026-2595/): Malicious code in @sports-api/api-sdk (npm) (malicious package) - [MAL-2026-2594](https://insights.sbomify.com/MAL-2026-2594/): Malicious code in @spoonflower/ui (npm) (malicious package) - [MAL-2026-2593](https://insights.sbomify.com/MAL-2026-2593/): Malicious code in @sage-active/ui (npm) (malicious package) - [MAL-2026-2592](https://insights.sbomify.com/MAL-2026-2592/): Malicious code in @relxui/react (npm) (malicious package) - [MAL-2026-2591](https://insights.sbomify.com/MAL-2026-2591/): Malicious code in @pes-ui/components (npm) (malicious package) - [MAL-2026-2590](https://insights.sbomify.com/MAL-2026-2590/): Malicious code in @op-microfrontends/config (npm) (malicious package) - [MAL-2026-259](https://insights.sbomify.com/MAL-2026-259/): Malicious code in @riag-libs/pattern-library-react-hooks (npm) (malicious package) - [MAL-2026-2589](https://insights.sbomify.com/MAL-2026-2589/): Malicious code in @mx-shared/utils (npm) (malicious package) - [MAL-2026-2588](https://insights.sbomify.com/MAL-2026-2588/): Malicious code in @lamoda/seller-ui-kit (npm) (malicious package) - [MAL-2026-2587](https://insights.sbomify.com/MAL-2026-2587/): Malicious code in @kucoin-gbiz-next/tools (npm) (malicious package) - [MAL-2026-2586](https://insights.sbomify.com/MAL-2026-2586/): Malicious code in @ids-alpha/theme (npm) (malicious package) - [MAL-2026-2585](https://insights.sbomify.com/MAL-2026-2585/): Malicious code in @hrb-web/nuxt (npm) (malicious package) - [MAL-2026-2584](https://insights.sbomify.com/MAL-2026-2584/): Malicious code in @hpcc/js-api (npm) (malicious package) - [MAL-2026-2583](https://insights.sbomify.com/MAL-2026-2583/): Malicious code in @hmm-app/api (npm) (malicious package) - [MAL-2026-2582](https://insights.sbomify.com/MAL-2026-2582/): Malicious code in @guards-lib/auth (npm) (malicious package) - [MAL-2026-2581](https://insights.sbomify.com/MAL-2026-2581/): Malicious code in @dtc-campaign-wizard/campaign-wizard (npm) (malicious package) - [MAL-2026-2580](https://insights.sbomify.com/MAL-2026-2580/): Malicious code in @cash-web/no-hardcoded-font-styles (npm) (malicious package) - [MAL-2026-258](https://insights.sbomify.com/MAL-2026-258/): Malicious code in webmd-page-common (npm) (malicious package) - [MAL-2026-2579](https://insights.sbomify.com/MAL-2026-2579/): Malicious code in @bookiply/core (npm) (malicious package) - [MAL-2026-2578](https://insights.sbomify.com/MAL-2026-2578/): Malicious code in @bokehjs/core (npm) (malicious package) - [MAL-2026-2577](https://insights.sbomify.com/MAL-2026-2577/): Malicious code in @b2b-portal/kit (npm) (malicious package) - [MAL-2026-2576](https://insights.sbomify.com/MAL-2026-2576/): Malicious code in @b2b-portal/core (npm) (malicious package) - [MAL-2026-2575](https://insights.sbomify.com/MAL-2026-2575/): Malicious code in @ascend-ops/web-client (npm) (malicious package) - [MAL-2026-2574](https://insights.sbomify.com/MAL-2026-2574/): Malicious code in @amplify-js/datastore (npm) (malicious package) - [MAL-2026-2573](https://insights.sbomify.com/MAL-2026-2573/): Malicious code in @aircall-ecosystem/integrations-msteams-frontend (npm) (malicious package) - [MAL-2026-2572](https://insights.sbomify.com/MAL-2026-2572/): Malicious code in hiveos-setting (PyPI) (malicious package) - [MAL-2026-2571](https://insights.sbomify.com/MAL-2026-2571/): Malicious code in hiveos-settings (PyPI) (malicious package) - [MAL-2026-2570](https://insights.sbomify.com/MAL-2026-2570/): Malicious code in robase-app (PyPI) (malicious package) - [MAL-2026-257](https://insights.sbomify.com/MAL-2026-257/): Malicious code in silvermine (npm) (malicious package) - [MAL-2026-2569](https://insights.sbomify.com/MAL-2026-2569/): Malicious code in bloxy-api (PyPI) (malicious package) - [MAL-2026-2568](https://insights.sbomify.com/MAL-2026-2568/): Malicious code in pt-sc-logger (npm) (malicious package) - [MAL-2026-2567](https://insights.sbomify.com/MAL-2026-2567/): Malicious code in pt-sc-demo-app (npm) (malicious package) - [MAL-2026-2566](https://insights.sbomify.com/MAL-2026-2566/): Malicious code in wm-plugin-visions-recorder (npm) (malicious package) - [MAL-2026-2565](https://insights.sbomify.com/MAL-2026-2565/): Malicious code in portal-common-ui (npm) (malicious package) - [MAL-2026-2564](https://insights.sbomify.com/MAL-2026-2564/): Malicious code in gp-auth-lib (npm) (malicious package) - [MAL-2026-2563](https://insights.sbomify.com/MAL-2026-2563/): Malicious code in robase-installer (PyPI) (malicious package) - [MAL-2026-2562](https://insights.sbomify.com/MAL-2026-2562/): Malicious code in robase-fallback (PyPI) (malicious package) - [MAL-2026-2561](https://insights.sbomify.com/MAL-2026-2561/): Malicious code in robase-help (PyPI) (malicious package) - [MAL-2026-2560](https://insights.sbomify.com/MAL-2026-2560/): Malicious code in @b2b-portal/uch (npm) (malicious package) - [MAL-2026-256](https://insights.sbomify.com/MAL-2026-256/): Malicious code in legendevil1 (PyPI) (malicious package) - [MAL-2026-2559](https://insights.sbomify.com/MAL-2026-2559/): Malicious code in databasesupalake (PyPI) (malicious package) - [MAL-2026-2558](https://insights.sbomify.com/MAL-2026-2558/): Malicious code in robase-utils (PyPI) (malicious package) - [MAL-2026-2557](https://insights.sbomify.com/MAL-2026-2557/): Malicious code in databasesupasafe (PyPI) (malicious package) - [MAL-2026-2556](https://insights.sbomify.com/MAL-2026-2556/): Malicious code in api-analysis (PyPI) (malicious package) - [MAL-2026-2555](https://insights.sbomify.com/MAL-2026-2555/): Malicious code in api-feature (PyPI) (malicious package) - [MAL-2026-2554](https://insights.sbomify.com/MAL-2026-2554/): Malicious code in paysafe-venmo (npm) (malicious package) - [MAL-2026-2553](https://insights.sbomify.com/MAL-2026-2553/): Malicious code in paysafe-payments-sdk-common (npm) (malicious package) - [MAL-2026-2552](https://insights.sbomify.com/MAL-2026-2552/): Malicious code in paysafe-google-pay (npm) (malicious package) - [MAL-2026-2551](https://insights.sbomify.com/MAL-2026-2551/): Malicious code in paysafe-card-payments (npm) (malicious package) - [MAL-2026-2550](https://insights.sbomify.com/MAL-2026-2550/): Malicious code in paysafe-apple-pay (npm) (malicious package) - [MAL-2026-255](https://insights.sbomify.com/MAL-2026-255/): Malicious code in haqawi (PyPI) (malicious package) - [MAL-2026-2549](https://insights.sbomify.com/MAL-2026-2549/): Malicious code in python-aickerso (PyPI) (malicious package) - [MAL-2026-2548](https://insights.sbomify.com/MAL-2026-2548/): Malicious code in ks-hex2pcap (PyPI) (malicious package) - [MAL-2026-2547](https://insights.sbomify.com/MAL-2026-2547/): Malicious code in ixosmonitoring (PyPI) (malicious package) - [MAL-2026-2546](https://insights.sbomify.com/MAL-2026-2546/): Malicious code in hex2pcap (PyPI) (malicious package) - [MAL-2026-2545](https://insights.sbomify.com/MAL-2026-2545/): Malicious code in @sap-px/pxapi (npm) (malicious package) - [MAL-2026-2544](https://insights.sbomify.com/MAL-2026-2544/): Malicious code in roboat-utilities (PyPI) (malicious package) - [MAL-2026-2543](https://insights.sbomify.com/MAL-2026-2543/): Malicious code in robase (PyPI) (malicious package) - [MAL-2026-2542](https://insights.sbomify.com/MAL-2026-2542/): Malicious code in databasetrace (PyPI) (malicious package) - [MAL-2026-2541](https://insights.sbomify.com/MAL-2026-2541/): Malicious code in gd-auth-sso (PyPI) (malicious package) - [MAL-2026-2540](https://insights.sbomify.com/MAL-2026-2540/): Malicious code in gd-auth (PyPI) (malicious package) - [MAL-2026-254](https://insights.sbomify.com/MAL-2026-254/): Malicious code in hairest (PyPI) (malicious package) - [MAL-2026-2539](https://insights.sbomify.com/MAL-2026-2539/): Malicious code in customer-local-ops (PyPI) (malicious package) - [MAL-2026-2538](https://insights.sbomify.com/MAL-2026-2538/): Malicious code in bogus-nydus-op (PyPI) (malicious package) - [MAL-2026-2537](https://insights.sbomify.com/MAL-2026-2537/): Malicious code in @b2b-portal/form (npm) (malicious package) - [MAL-2026-2536](https://insights.sbomify.com/MAL-2026-2536/): Malicious code in yhaplo1 (PyPI) (malicious package) - [MAL-2026-2535](https://insights.sbomify.com/MAL-2026-2535/): Malicious code in ttam (PyPI) (malicious package) - [MAL-2026-2534](https://insights.sbomify.com/MAL-2026-2534/): Malicious code in siempyl-sumo (PyPI) (malicious package) - [MAL-2026-2533](https://insights.sbomify.com/MAL-2026-2533/): Malicious code in phasedibd (PyPI) (malicious package) - [MAL-2026-2532](https://insights.sbomify.com/MAL-2026-2532/): Malicious code in emd-ext (PyPI) (malicious package) - [MAL-2026-2531](https://insights.sbomify.com/MAL-2026-2531/): Malicious code in bonsaitree1 (PyPI) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/90/