# Vulnerabilities published in 2026 - [MAL-2026-2440](https://insights.sbomify.com/MAL-2026-2440/): Malicious code in experedzss (npm) (malicious package) - [MAL-2026-244](https://insights.sbomify.com/MAL-2026-244/): Malicious code in helium-module (npm) (malicious package) - [MAL-2026-2439](https://insights.sbomify.com/MAL-2026-2439/): Malicious code in expeewas (npm) (malicious package) - [MAL-2026-2438](https://insights.sbomify.com/MAL-2026-2438/): Malicious code in expeedsxs (npm) (malicious package) - [MAL-2026-2437](https://insights.sbomify.com/MAL-2026-2437/): Malicious code in exaprse (npm) (malicious package) - [MAL-2026-2436](https://insights.sbomify.com/MAL-2026-2436/): Malicious code in eixp4ressz (npm) (malicious package) - [MAL-2026-2435](https://insights.sbomify.com/MAL-2026-2435/): Malicious code in 4xperss (npm) (malicious package) - [MAL-2026-2434](https://insights.sbomify.com/MAL-2026-2434/): Malicious code in 4exepreds (npm) (malicious package) - [MAL-2026-2433](https://insights.sbomify.com/MAL-2026-2433/): Malicious code in pycolorlib3 (PyPI) (malicious package) - [MAL-2026-2432](https://insights.sbomify.com/MAL-2026-2432/): Malicious code in nwin64tls (PyPI) (malicious package) - [MAL-2026-2431](https://insights.sbomify.com/MAL-2026-2431/): Malicious code in nwin32tls (PyPI) (malicious package) - [MAL-2026-2430](https://insights.sbomify.com/MAL-2026-2430/): Malicious code in k8s-node-health (PyPI) (malicious package) - [MAL-2026-243](https://insights.sbomify.com/MAL-2026-243/): Malicious code in francium-web-visitors (npm) (malicious package) - [MAL-2026-2429](https://insights.sbomify.com/MAL-2026-2429/): Malicious code in vv-ftend-core (npm) (malicious package) - [MAL-2026-2428](https://insights.sbomify.com/MAL-2026-2428/): Malicious code in vv-ftend-api (npm) (malicious package) - [MAL-2026-2427](https://insights.sbomify.com/MAL-2026-2427/): Malicious code in partner-tracker-api (npm) (malicious package) - [MAL-2026-2426](https://insights.sbomify.com/MAL-2026-2426/): Malicious code in partner-tracker (npm) (malicious package) - [MAL-2026-2425](https://insights.sbomify.com/MAL-2026-2425/): Malicious code in bytefrontier-tracker (npm) (malicious package) - [MAL-2026-2424](https://insights.sbomify.com/MAL-2026-2424/): Malicious code in bytefrontier-sdk (npm) (malicious package) - [MAL-2026-2423](https://insights.sbomify.com/MAL-2026-2423/): Malicious code in bytefrontier-partner (npm) (malicious package) - [MAL-2026-2422](https://insights.sbomify.com/MAL-2026-2422/): Malicious code in bytefrontier-api (npm) (malicious package) - [MAL-2026-2421](https://insights.sbomify.com/MAL-2026-2421/): Malicious code in @mgcrae/pino-pretty-logger (npm) (malicious package) - [MAL-2026-2420](https://insights.sbomify.com/MAL-2026-2420/): Malicious code in @_wnpm/wnpm-cli (npm) (malicious package) - [MAL-2026-242](https://insights.sbomify.com/MAL-2026-242/): Malicious code in francium-utils (npm) (malicious package) - [MAL-2026-2419](https://insights.sbomify.com/MAL-2026-2419/): Malicious code in express-session-js (npm) (malicious package) - [MAL-2026-2418](https://insights.sbomify.com/MAL-2026-2418/): Malicious code in tombac-chronos (npm) (malicious package) - [MAL-2026-2417](https://insights.sbomify.com/MAL-2026-2417/): Malicious code in oc-navbar-module-client (npm) (malicious package) - [MAL-2026-2416](https://insights.sbomify.com/MAL-2026-2416/): Malicious code in oc-ccp-module-client (npm) (malicious package) - [MAL-2026-2415](https://insights.sbomify.com/MAL-2026-2415/): Malicious code in oc-aa-module-client (npm) (malicious package) - [MAL-2026-2414](https://insights.sbomify.com/MAL-2026-2414/): Malicious code in ftapi-core (npm) (malicious package) - [MAL-2026-2413](https://insights.sbomify.com/MAL-2026-2413/): Malicious code in cclr-component-resources (npm) (malicious package) - [MAL-2026-2412](https://insights.sbomify.com/MAL-2026-2412/): Malicious code in @wame/ngx-frf-utilities (npm) (malicious package) - [MAL-2026-2411](https://insights.sbomify.com/MAL-2026-2411/): Malicious code in @wame/ngx-adfs (npm) (malicious package) - [MAL-2026-2410](https://insights.sbomify.com/MAL-2026-2410/): Malicious code in @the-coca-cola-company/ngps-global-common-utils (npm) (malicious package) - [MAL-2026-241](https://insights.sbomify.com/MAL-2026-241/): Malicious code in francium-ui (npm) (malicious package) - [MAL-2026-2409](https://insights.sbomify.com/MAL-2026-2409/): Malicious code in @phonos/types (npm) (malicious package) - [MAL-2026-2408](https://insights.sbomify.com/MAL-2026-2408/): Malicious code in @cloudsop/hmoment (npm) (malicious package) - [MAL-2026-2407](https://insights.sbomify.com/MAL-2026-2407/): Malicious code in @ceeferenderer/itg-renderer-sdk (npm) (malicious package) - [MAL-2026-2406](https://insights.sbomify.com/MAL-2026-2406/): Malicious code in @ceeferenderer/fe-renderer-sdk (npm) (malicious package) - [MAL-2026-2405](https://insights.sbomify.com/MAL-2026-2405/): Malicious code in eht-account (PyPI) (malicious package) - [MAL-2026-2404](https://insights.sbomify.com/MAL-2026-2404/): Malicious code in ether-account (PyPI) (malicious package) - [MAL-2026-2403](https://insights.sbomify.com/MAL-2026-2403/): Malicious code in polymarkets-sdk (PyPI) (malicious package) - [MAL-2026-2402](https://insights.sbomify.com/MAL-2026-2402/): Malicious code in plugin-gem-example (RubyGems) (malicious package) - [MAL-2026-2401](https://insights.sbomify.com/MAL-2026-2401/): Malicious code in rocketpill (PyPI) (malicious package) - [MAL-2026-2400](https://insights.sbomify.com/MAL-2026-2400/): Malicious code in kube-node-health (PyPI) (malicious package) - [MAL-2026-240](https://insights.sbomify.com/MAL-2026-240/): Malicious code in extended-path (npm) (malicious package) - [MAL-2026-24](https://insights.sbomify.com/MAL-2026-24/): Malicious code in tickncook-robot (npm) (malicious package) - [MAL-2026-2399](https://insights.sbomify.com/MAL-2026-2399/): Malicious code in flycalc (PyPI) (malicious package) - [MAL-2026-2398](https://insights.sbomify.com/MAL-2026-2398/): Malicious code in xrpl-hooks-ide (npm) (malicious package) - [MAL-2026-2397](https://insights.sbomify.com/MAL-2026-2397/): Malicious code in wraith-module (npm) (malicious package) - [MAL-2026-2396](https://insights.sbomify.com/MAL-2026-2396/): Malicious code in voodoo-internal-api (npm) (malicious package) - [MAL-2026-2395](https://insights.sbomify.com/MAL-2026-2395/): Malicious code in uuidvalidatorarabis (npm) (malicious package) - [MAL-2026-2394](https://insights.sbomify.com/MAL-2026-2394/): Malicious code in typescript-mock-data (npm) (malicious package) - [MAL-2026-2393](https://insights.sbomify.com/MAL-2026-2393/): Malicious code in this-is-my-test-package (npm) (malicious package) - [MAL-2026-2392](https://insights.sbomify.com/MAL-2026-2392/): Malicious code in stormbreaker-shade (npm) (malicious package) - [MAL-2026-2391](https://insights.sbomify.com/MAL-2026-2391/): Malicious code in ssr-catalogue-sfcc (npm) (malicious package) - [MAL-2026-2390](https://insights.sbomify.com/MAL-2026-2390/): Malicious code in ssh-common (npm) (malicious package) - [MAL-2026-239](https://insights.sbomify.com/MAL-2026-239/): Malicious code in chai-as-enhanced (npm) (malicious package) - [MAL-2026-2389](https://insights.sbomify.com/MAL-2026-2389/): Malicious code in spectral-module (npm) (malicious package) - [MAL-2026-2388](https://insights.sbomify.com/MAL-2026-2388/): Malicious code in spectral-engine (npm) (malicious package) - [MAL-2026-2387](https://insights.sbomify.com/MAL-2026-2387/): Malicious code in securefiles-common (npm) (malicious package) - [MAL-2026-2386](https://insights.sbomify.com/MAL-2026-2386/): Malicious code in react-native-forter (npm) (malicious package) - [MAL-2026-2385](https://insights.sbomify.com/MAL-2026-2385/): Malicious code in product-status (npm) (malicious package) - [MAL-2026-2384](https://insights.sbomify.com/MAL-2026-2384/): Malicious code in piyush_test_vadapav (npm) (malicious package) - [MAL-2026-2383](https://insights.sbomify.com/MAL-2026-2383/): Malicious code in phantom-module (npm) (malicious package) - [MAL-2026-2382](https://insights.sbomify.com/MAL-2026-2382/): Malicious code in osc-datagrid-validator (npm) (malicious package) - [MAL-2026-2381](https://insights.sbomify.com/MAL-2026-2381/): Malicious code in onb-enrichment (npm) (malicious package) - [MAL-2026-2380](https://insights.sbomify.com/MAL-2026-2380/): Malicious code in nodecognivault (npm) (malicious package) - [MAL-2026-238](https://insights.sbomify.com/MAL-2026-238/): Malicious code in paytmsiddlewaree (npm) (malicious package) - [MAL-2026-2379](https://insights.sbomify.com/MAL-2026-2379/): Malicious code in node-neurograde (npm) (malicious package) - [MAL-2026-2378](https://insights.sbomify.com/MAL-2026-2378/): Malicious code in node-multer (npm) (malicious package) - [MAL-2026-2377](https://insights.sbomify.com/MAL-2026-2377/): Malicious code in no-function-declare-after-return (npm) (malicious package) - [MAL-2026-2376](https://insights.sbomify.com/MAL-2026-2376/): Malicious code in nf-promise-state-machine (npm) (malicious package) - [MAL-2026-2375](https://insights.sbomify.com/MAL-2026-2375/): Malicious code in nf-console (npm) (malicious package) - [MAL-2026-2374](https://insights.sbomify.com/MAL-2026-2374/): Malicious code in my-not-little-durgham (npm) (malicious package) - [MAL-2026-2373](https://insights.sbomify.com/MAL-2026-2373/): Malicious code in my-little-durgham (npm) (malicious package) - [MAL-2026-2372](https://insights.sbomify.com/MAL-2026-2372/): Malicious code in mollie-api-adapter-poc (npm) (malicious package) - [MAL-2026-2371](https://insights.sbomify.com/MAL-2026-2371/): Malicious code in merchant-rps (npm) (malicious package) - [MAL-2026-2370](https://insights.sbomify.com/MAL-2026-2370/): Malicious code in mcc-data (npm) (malicious package) - [MAL-2026-237](https://insights.sbomify.com/MAL-2026-237/): Malicious code in formater (PyPI) (malicious package) - [MAL-2026-2369](https://insights.sbomify.com/MAL-2026-2369/): Malicious code in loadshh (npm) (malicious package) - [MAL-2026-2368](https://insights.sbomify.com/MAL-2026-2368/): Malicious code in json-mapping-token (npm) (malicious package) - [MAL-2026-2367](https://insights.sbomify.com/MAL-2026-2367/): Malicious code in json-mapping-fetch (npm) (malicious package) - [MAL-2026-2366](https://insights.sbomify.com/MAL-2026-2366/): Malicious code in ghost-module (npm) (malicious package) - [MAL-2026-2365](https://insights.sbomify.com/MAL-2026-2365/): Malicious code in env-nodejs (npm) (malicious package) - [MAL-2026-2364](https://insights.sbomify.com/MAL-2026-2364/): Malicious code in env-node-cli (npm) (malicious package) - [MAL-2026-2363](https://insights.sbomify.com/MAL-2026-2363/): Malicious code in env-extend (npm) (malicious package) - [MAL-2026-2362](https://insights.sbomify.com/MAL-2026-2362/): Malicious code in env-express-cli (npm) (malicious package) - [MAL-2026-2361](https://insights.sbomify.com/MAL-2026-2361/): Malicious code in env-express (npm) (malicious package) - [MAL-2026-2360](https://insights.sbomify.com/MAL-2026-2360/): Malicious code in env-expanded (npm) (malicious package) - [MAL-2026-236](https://insights.sbomify.com/MAL-2026-236/): Malicious code in graponater (PyPI) (malicious package) - [MAL-2026-2359](https://insights.sbomify.com/MAL-2026-2359/): Malicious code in env-embed (npm) (malicious package) - [MAL-2026-2358](https://insights.sbomify.com/MAL-2026-2358/): Malicious code in env-cli-express (npm) (malicious package) - [MAL-2026-2357](https://insights.sbomify.com/MAL-2026-2357/): Malicious code in ectoplast-spirit (npm) (malicious package) - [MAL-2026-2356](https://insights.sbomify.com/MAL-2026-2356/): Malicious code in ecto-spirit-core (npm) (malicious package) - [MAL-2026-2355](https://insights.sbomify.com/MAL-2026-2355/): Malicious code in ecto-spirit (npm) (malicious package) - [MAL-2026-2354](https://insights.sbomify.com/MAL-2026-2354/): Malicious code in ecto-registry (npm) (malicious package) - [MAL-2026-2353](https://insights.sbomify.com/MAL-2026-2353/): Malicious code in ecto-engine (npm) (malicious package) - [MAL-2026-2352](https://insights.sbomify.com/MAL-2026-2352/): Malicious code in ecto-corsair-lwirz (npm) (malicious package) - [MAL-2026-2351](https://insights.sbomify.com/MAL-2026-2351/): Malicious code in dotenv-xtend (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/92/