# Vulnerabilities published in 2026


- [MAL-2026-2530](https://insights.sbomify.com/MAL-2026-2530/): Malicious code in noonhelpers (PyPI) (malicious package)
- [MAL-2026-253](https://insights.sbomify.com/MAL-2026-253/): Malicious code in clipcord (PyPI) (malicious package)
- [MAL-2026-2529](https://insights.sbomify.com/MAL-2026-2529/): Malicious code in use-form-builder-plugin (npm) (malicious package)
- [MAL-2026-2528](https://insights.sbomify.com/MAL-2026-2528/): Malicious code in sjs-lint-build1 (npm) (malicious package)
- [MAL-2026-2527](https://insights.sbomify.com/MAL-2026-2527/): Malicious code in sjs-biginteger (npm) (malicious package)
- [MAL-2026-2526](https://insights.sbomify.com/MAL-2026-2526/): Malicious code in request-js-validator (npm) (malicious package)
- [MAL-2026-2525](https://insights.sbomify.com/MAL-2026-2525/): Malicious code in frontend-backoffice (npm) (malicious package)
- [MAL-2026-2524](https://insights.sbomify.com/MAL-2026-2524/): Malicious code in a2a-chat-canvas (npm) (malicious package)
- [MAL-2026-2523](https://insights.sbomify.com/MAL-2026-2523/): Malicious code in @telekom-wfa/auth-core (npm) (malicious package)
- [MAL-2026-2522](https://insights.sbomify.com/MAL-2026-2522/): Malicious code in st-payment (PyPI) (malicious package)
- [MAL-2026-2521](https://insights.sbomify.com/MAL-2026-2521/): Malicious code in gc-grocery-api (PyPI) (malicious package)
- [MAL-2026-2520](https://insights.sbomify.com/MAL-2026-2520/): Malicious code in @signals-notebook/utils (npm) (malicious package)
- [MAL-2026-252](https://insights.sbomify.com/MAL-2026-252/): Malicious code in solana-program (PyPI) (malicious package)
- [MAL-2026-2519](https://insights.sbomify.com/MAL-2026-2519/): Malicious code in just4testlm (PyPI) (malicious package)
- [MAL-2026-2518](https://insights.sbomify.com/MAL-2026-2518/): Malicious code in viewer-assets-generator (npm) (malicious package)
- [MAL-2026-2517](https://insights.sbomify.com/MAL-2026-2517/): Malicious code in kraken-trader (PyPI) (malicious package)
- [MAL-2026-2516](https://insights.sbomify.com/MAL-2026-2516/): Malicious code in sentinel-tool (PyPI) (malicious package)
- [MAL-2026-2515](https://insights.sbomify.com/MAL-2026-2515/): Malicious code in granulate-utils (PyPI) (malicious package)
- [MAL-2026-2514](https://insights.sbomify.com/MAL-2026-2514/): Malicious code in gprofiler-logging (PyPI) (malicious package)
- [MAL-2026-2513](https://insights.sbomify.com/MAL-2026-2513/): Malicious code in gprofiler (npm) (malicious package)
- [MAL-2026-2512](https://insights.sbomify.com/MAL-2026-2512/): Malicious code in roboat-utils (PyPI) (malicious package)
- [MAL-2026-2511](https://insights.sbomify.com/MAL-2026-2511/): Malicious code in argon2-napi (npm) (malicious package)
- [MAL-2026-2510](https://insights.sbomify.com/MAL-2026-2510/): Malicious code in @velora-dex/sdk (npm) (malicious package)
- [MAL-2026-251](https://insights.sbomify.com/MAL-2026-251/): Malicious code in soupclaw (PyPI) (malicious package)
- [MAL-2026-2509](https://insights.sbomify.com/MAL-2026-2509/): Malicious code in @langgraphjs/toolkit (npm) (malicious package)
- [MAL-2026-2508](https://insights.sbomify.com/MAL-2026-2508/): Malicious code in @fairwords/websocket (npm) (malicious package)
- [MAL-2026-2507](https://insights.sbomify.com/MAL-2026-2507/): Malicious code in @fairwords/loopback-connector-es (npm) (malicious package)
- [MAL-2026-2506](https://insights.sbomify.com/MAL-2026-2506/): Malicious code in @fairwords/encryption (npm) (malicious package)
- [MAL-2026-2505](https://insights.sbomify.com/MAL-2026-2505/): Malicious code in @aspect-security/argon2 (npm) (malicious package)
- [MAL-2026-2504](https://insights.sbomify.com/MAL-2026-2504/): Malicious code in strapi-plugin-cache (npm) (malicious package)
- [MAL-2026-2503](https://insights.sbomify.com/MAL-2026-2503/): Malicious code in genesis-1p-tools-rpm-bundle (PyPI) (malicious package)
- [MAL-2026-2502](https://insights.sbomify.com/MAL-2026-2502/): Malicious code in databasenaps (PyPI) (malicious package)
- [MAL-2026-2501](https://insights.sbomify.com/MAL-2026-2501/): Malicious code in databaselooks (PyPI) (malicious package)
- [MAL-2026-2500](https://insights.sbomify.com/MAL-2026-2500/): Malicious code in totally-safe-util (npm) (malicious package)
- [MAL-2026-250](https://insights.sbomify.com/MAL-2026-250/): Malicious code in transitive-req (PyPI) (malicious package)
- [MAL-2026-25](https://insights.sbomify.com/MAL-2026-25/): Malicious code in usaa-authentication-mocks (npm) (malicious package)
- [MAL-2026-2499](https://insights.sbomify.com/MAL-2026-2499/): Malicious code in nerite-security-audit (npm) (malicious package)
- [MAL-2026-2498](https://insights.sbomify.com/MAL-2026-2498/): Malicious code in df-sandbox-test (npm) (malicious package)
- [MAL-2026-2497](https://insights.sbomify.com/MAL-2026-2497/): Malicious code in commerce-utils (npm) (malicious package)
- [MAL-2026-2496](https://insights.sbomify.com/MAL-2026-2496/): Malicious code in chess-sec-ssrf1 (npm) (malicious package)
- [MAL-2026-2495](https://insights.sbomify.com/MAL-2026-2495/): Malicious code in cloudera (npm) (malicious package)
- [MAL-2026-2494](https://insights.sbomify.com/MAL-2026-2494/): Malicious code in databasetapes (PyPI) (malicious package)
- [MAL-2026-2493](https://insights.sbomify.com/MAL-2026-2493/): Malicious code in cloudera-poc (npm) (malicious package)
- [MAL-2026-2492](https://insights.sbomify.com/MAL-2026-2492/): Malicious code in admin0911 (npm) (malicious package)
- [MAL-2026-2491](https://insights.sbomify.com/MAL-2026-2491/): Malicious code in @not-nemo/crypto-tracker (npm) (malicious package)
- [MAL-2026-2490](https://insights.sbomify.com/MAL-2026-2490/): Malicious code in databaserotacos (PyPI) (malicious package)
- [MAL-2026-249](https://insights.sbomify.com/MAL-2026-249/): Malicious code in @flipster/utils (npm) (malicious package)
- [MAL-2026-2489](https://insights.sbomify.com/MAL-2026-2489/): Malicious code in databaserobooms (PyPI) (malicious package)
- [MAL-2026-2488](https://insights.sbomify.com/MAL-2026-2488/): Malicious code in photo-extractor (PyPI) (malicious package)
- [MAL-2026-2487](https://insights.sbomify.com/MAL-2026-2487/): Malicious code in discord-request (PyPI) (malicious package)
- [MAL-2026-2486](https://insights.sbomify.com/MAL-2026-2486/): Malicious code in gangomodule (PyPI) (malicious package)
- [MAL-2026-2485](https://insights.sbomify.com/MAL-2026-2485/): Malicious code in strapi-plugin-sync (npm) (malicious package)
- [MAL-2026-2484](https://insights.sbomify.com/MAL-2026-2484/): Malicious code in strapi-plugin-sitemap-gen (npm) (malicious package)
- [MAL-2026-2483](https://insights.sbomify.com/MAL-2026-2483/): Malicious code in strapi-plugin-server (npm) (malicious package)
- [MAL-2026-2482](https://insights.sbomify.com/MAL-2026-2482/): Malicious code in strapi-plugin-seed (npm) (malicious package)
- [MAL-2026-2481](https://insights.sbomify.com/MAL-2026-2481/): Malicious code in strapi-plugin-notify (npm) (malicious package)
- [MAL-2026-2480](https://insights.sbomify.com/MAL-2026-2480/): Malicious code in strapi-plugin-nordica-vhost (npm) (malicious package)
- [MAL-2026-248](https://insights.sbomify.com/MAL-2026-248/): Malicious code in dify-api (PyPI) (malicious package)
- [MAL-2026-2479](https://insights.sbomify.com/MAL-2026-2479/): Malicious code in strapi-plugin-nordica-tools (npm) (malicious package)
- [MAL-2026-2478](https://insights.sbomify.com/MAL-2026-2478/): Malicious code in strapi-plugin-nordica-sync (npm) (malicious package)
- [MAL-2026-2477](https://insights.sbomify.com/MAL-2026-2477/): Malicious code in strapi-plugin-nordica-stage (npm) (malicious package)
- [MAL-2026-2476](https://insights.sbomify.com/MAL-2026-2476/): Malicious code in strapi-plugin-nordica-recon (npm) (malicious package)
- [MAL-2026-2475](https://insights.sbomify.com/MAL-2026-2475/): Malicious code in strapi-plugin-nordica-lite (npm) (malicious package)
- [MAL-2026-2474](https://insights.sbomify.com/MAL-2026-2474/): Malicious code in strapi-plugin-nordica-deep (npm) (malicious package)
- [MAL-2026-2473](https://insights.sbomify.com/MAL-2026-2473/): Malicious code in strapi-plugin-nordica-cms (npm) (malicious package)
- [MAL-2026-2472](https://insights.sbomify.com/MAL-2026-2472/): Malicious code in strapi-plugin-nordica-api (npm) (malicious package)
- [MAL-2026-2471](https://insights.sbomify.com/MAL-2026-2471/): Malicious code in strapi-plugin-nordica (npm) (malicious package)
- [MAL-2026-2470](https://insights.sbomify.com/MAL-2026-2470/): Malicious code in strapi-plugin-monitor (npm) (malicious package)
- [MAL-2026-247](https://insights.sbomify.com/MAL-2026-247/): Malicious code in ts-tweetnacl (npm) (malicious package)
- [MAL-2026-2469](https://insights.sbomify.com/MAL-2026-2469/): Malicious code in strapi-plugin-logger (npm) (malicious package)
- [MAL-2026-2468](https://insights.sbomify.com/MAL-2026-2468/): Malicious code in strapi-plugin-locale (npm) (malicious package)
- [MAL-2026-2467](https://insights.sbomify.com/MAL-2026-2467/): Malicious code in strapi-plugin-hooks (npm) (malicious package)
- [MAL-2026-2466](https://insights.sbomify.com/MAL-2026-2466/): Malicious code in strapi-plugin-hextest (npm) (malicious package)
- [MAL-2026-2465](https://insights.sbomify.com/MAL-2026-2465/): Malicious code in strapi-plugin-health-check (npm) (malicious package)
- [MAL-2026-2464](https://insights.sbomify.com/MAL-2026-2464/): Malicious code in strapi-plugin-health (npm) (malicious package)
- [MAL-2026-2463](https://insights.sbomify.com/MAL-2026-2463/): Malicious code in strapi-plugin-guardarian-ext (npm) (malicious package)
- [MAL-2026-2462](https://insights.sbomify.com/MAL-2026-2462/): Malicious code in strapi-plugin-form (npm) (malicious package)
- [MAL-2026-2461](https://insights.sbomify.com/MAL-2026-2461/): Malicious code in strapi-plugin-finseven (npm) (malicious package)
- [MAL-2026-2460](https://insights.sbomify.com/MAL-2026-2460/): Malicious code in strapi-plugin-events (npm) (malicious package)
- [MAL-2026-246](https://insights.sbomify.com/MAL-2026-246/): Malicious code in admin1001 (npm) (malicious package)
- [MAL-2026-2459](https://insights.sbomify.com/MAL-2026-2459/): Malicious code in strapi-plugin-debug-tools (npm) (malicious package)
- [MAL-2026-2458](https://insights.sbomify.com/MAL-2026-2458/): Malicious code in strapi-plugin-database (npm) (malicious package)
- [MAL-2026-2457](https://insights.sbomify.com/MAL-2026-2457/): Malicious code in strapi-plugin-cron (npm) (malicious package)
- [MAL-2026-2456](https://insights.sbomify.com/MAL-2026-2456/): Malicious code in strapi-plugin-core (npm) (malicious package)
- [MAL-2026-2455](https://insights.sbomify.com/MAL-2026-2455/): Malicious code in strapi-plugin-content-sync (npm) (malicious package)
- [MAL-2026-2454](https://insights.sbomify.com/MAL-2026-2454/): Malicious code in strapi-plugin-config (npm) (malicious package)
- [MAL-2026-2453](https://insights.sbomify.com/MAL-2026-2453/): Malicious code in strapi-plugin-cms-tools (npm) (malicious package)
- [MAL-2026-2452](https://insights.sbomify.com/MAL-2026-2452/): Malicious code in strapi-plugin-blurhash (npm) (malicious package)
- [MAL-2026-2451](https://insights.sbomify.com/MAL-2026-2451/): Malicious code in strapi-plugin-api (npm) (malicious package)
- [MAL-2026-2450](https://insights.sbomify.com/MAL-2026-2450/): Malicious code in strapi-plugin-advanced-uuid (npm) (malicious package)
- [MAL-2026-245](https://insights.sbomify.com/MAL-2026-245/): Malicious code in cnamts-captcha-component (npm) (malicious package)
- [MAL-2026-2449](https://insights.sbomify.com/MAL-2026-2449/): Malicious code in mgc (npm) (malicious package)
- [MAL-2026-2448](https://insights.sbomify.com/MAL-2026-2448/): Malicious code in supervisors (PyPI) (malicious package)
- [MAL-2026-2447](https://insights.sbomify.com/MAL-2026-2447/): Malicious code in @toprank/partner (npm) (malicious package)
- [MAL-2026-2446](https://insights.sbomify.com/MAL-2026-2446/): Malicious code in @corpweb-ui/wmkt-library (npm) (malicious package)
- [MAL-2026-2445](https://insights.sbomify.com/MAL-2026-2445/): Malicious code in pro-express (npm) (malicious package)
- [MAL-2026-2444](https://insights.sbomify.com/MAL-2026-2444/): Malicious code in exszpe3szs (npm) (malicious package)
- [MAL-2026-2443](https://insights.sbomify.com/MAL-2026-2443/): Malicious code in exprrrress (npm) (malicious package)
- [MAL-2026-2442](https://insights.sbomify.com/MAL-2026-2442/): Malicious code in expreeeess (npm) (malicious package)
- [MAL-2026-2441](https://insights.sbomify.com/MAL-2026-2441/): Malicious code in expirs (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/91/