# Vulnerabilities published in 2026 - [MAL-2026-2350](https://insights.sbomify.com/MAL-2026-2350/): Malicious code in dotenv-express (npm) (malicious package) - [MAL-2026-235](https://insights.sbomify.com/MAL-2026-235/): Malicious code in tailwindcss-animate-tool (npm) (malicious package) - [MAL-2026-2349](https://insights.sbomify.com/MAL-2026-2349/): Malicious code in deriv_ppetest (npm) (malicious package) - [MAL-2026-2348](https://insights.sbomify.com/MAL-2026-2348/): Malicious code in cursed-module (npm) (malicious package) - [MAL-2026-2347](https://insights.sbomify.com/MAL-2026-2347/): Malicious code in ctf-package-onetimeuseforctf (npm) (malicious package) - [MAL-2026-2346](https://insights.sbomify.com/MAL-2026-2346/): Malicious code in corsair-module (npm) (malicious package) - [MAL-2026-2345](https://insights.sbomify.com/MAL-2026-2345/): Malicious code in codecoverage-tools (npm) (malicious package) - [MAL-2026-2344](https://insights.sbomify.com/MAL-2026-2344/): Malicious code in codeanalysis-common (npm) (malicious package) - [MAL-2026-2343](https://insights.sbomify.com/MAL-2026-2343/): Malicious code in chain-multer (npm) (malicious package) - [MAL-2026-2342](https://insights.sbomify.com/MAL-2026-2342/): Malicious code in chai-set (npm) (malicious package) - [MAL-2026-2341](https://insights.sbomify.com/MAL-2026-2341/): Malicious code in chai-chain-cognivault (npm) (malicious package) - [MAL-2026-2340](https://insights.sbomify.com/MAL-2026-2340/): Malicious code in chai-chain-argon (npm) (malicious package) - [MAL-2026-234](https://insights.sbomify.com/MAL-2026-234/): Malicious code in xml2js-js (npm) (malicious package) - [MAL-2026-2339](https://insights.sbomify.com/MAL-2026-2339/): Malicious code in chai-as-chains (npm) (malicious package) - [MAL-2026-2338](https://insights.sbomify.com/MAL-2026-2338/): Malicious code in chai-as-attached (npm) (malicious package) - [MAL-2026-2337](https://insights.sbomify.com/MAL-2026-2337/): Malicious code in chai-as-aligned (npm) (malicious package) - [MAL-2026-2336](https://insights.sbomify.com/MAL-2026-2336/): Malicious code in cdnjavacss (npm) (malicious package) - [MAL-2026-2335](https://insights.sbomify.com/MAL-2026-2335/): Malicious code in azurestack-common (npm) (malicious package) - [MAL-2026-2334](https://insights.sbomify.com/MAL-2026-2334/): Malicious code in argon-node (npm) (malicious package) - [MAL-2026-2333](https://insights.sbomify.com/MAL-2026-2333/): Malicious code in @pansycareful/github-helper (npm) (malicious package) - [MAL-2026-2332](https://insights.sbomify.com/MAL-2026-2332/): Malicious code in @hsbc-mfe/host (npm) (malicious package) - [MAL-2026-2331](https://insights.sbomify.com/MAL-2026-2331/): Malicious code in @girirajravichandran/corp-build-utils-poc (npm) (malicious package) - [MAL-2026-2330](https://insights.sbomify.com/MAL-2026-2330/): Malicious code in @fyxer-ai/shared (npm) (malicious package) - [MAL-2026-233](https://insights.sbomify.com/MAL-2026-233/): Malicious code in simple-string-utils3 (npm) (malicious package) - [MAL-2026-2329](https://insights.sbomify.com/MAL-2026-2329/): Malicious code in @abi-labs-frontend/standards (npm) (malicious package) - [MAL-2026-2328](https://insights.sbomify.com/MAL-2026-2328/): Malicious code in mcp-server-todo (npm) (malicious package) - [MAL-2026-2327](https://insights.sbomify.com/MAL-2026-2327/): Malicious code in kube-health-tools (PyPI) (malicious package) - [MAL-2026-2326](https://insights.sbomify.com/MAL-2026-2326/): Malicious code in raydium-bs58 (npm) (malicious package) - [MAL-2026-2325](https://insights.sbomify.com/MAL-2026-2325/): Malicious code in jonas-prettier-logger (npm) (malicious package) - [MAL-2026-2324](https://insights.sbomify.com/MAL-2026-2324/): Malicious code in jellyfi-pino-pretty-logger (npm) (malicious package) - [MAL-2026-2323](https://insights.sbomify.com/MAL-2026-2323/): Malicious code in ethersproject-wallet (npm) (malicious package) - [MAL-2026-2322](https://insights.sbomify.com/MAL-2026-2322/): Malicious code in bs58-basic (npm) (malicious package) - [MAL-2026-2321](https://insights.sbomify.com/MAL-2026-2321/): Malicious code in base58-engine (npm) (malicious package) - [MAL-2026-2320](https://insights.sbomify.com/MAL-2026-2320/): Malicious code in base-x-64 (npm) (malicious package) - [MAL-2026-232](https://insights.sbomify.com/MAL-2026-232/): Malicious code in react-hook-form-js (npm) (malicious package) - [MAL-2026-2319](https://insights.sbomify.com/MAL-2026-2319/): Malicious code in base-or-engine (npm) (malicious package) - [MAL-2026-2318](https://insights.sbomify.com/MAL-2026-2318/): Malicious code in @logcore/pino-pretty-logger (npm) (malicious package) - [MAL-2026-2317](https://insights.sbomify.com/MAL-2026-2317/): Malicious code in pygithub-async-utils (PyPI) (malicious package) - [MAL-2026-2316](https://insights.sbomify.com/MAL-2026-2316/): Malicious code in openai-async-helpers (PyPI) (malicious package) - [MAL-2026-2315](https://insights.sbomify.com/MAL-2026-2315/): Malicious code in latinum-wallet-mcp (PyPI) (malicious package) - [MAL-2026-2314](https://insights.sbomify.com/MAL-2026-2314/): Malicious code in @c8o/nimbus-core (npm) (malicious package) - [MAL-2026-2313](https://insights.sbomify.com/MAL-2026-2313/): Malicious code in coredxloader (PyPI) (malicious package) - [MAL-2026-2312](https://insights.sbomify.com/MAL-2026-2312/): Malicious code in tailwindcss-typeface-inter (npm) (malicious package) - [MAL-2026-2311](https://insights.sbomify.com/MAL-2026-2311/): Malicious code in officepyai (PyPI) (malicious package) - [MAL-2026-2310](https://insights.sbomify.com/MAL-2026-2310/): Malicious code in lakeflow-community-connectors (PyPI) (malicious package) - [MAL-2026-231](https://insights.sbomify.com/MAL-2026-231/): Malicious code in pinecone-js (npm) (malicious package) - [MAL-2026-2309](https://insights.sbomify.com/MAL-2026-2309/): Malicious code in zzzzthisisitwantsafecheckitzzzz (PyPI) (malicious package) - [MAL-2026-2308](https://insights.sbomify.com/MAL-2026-2308/): Malicious code in workingitme (PyPI) (malicious package) - [MAL-2026-2307](https://insights.sbomify.com/MAL-2026-2307/): Malicious code in axios (npm) (malicious package) - [MAL-2026-2306](https://insights.sbomify.com/MAL-2026-2306/): Malicious code in plain-crypto-js (npm) (malicious package) - [MAL-2026-2305](https://insights.sbomify.com/MAL-2026-2305/): Malicious code in databaseroboats (PyPI) (malicious package) - [MAL-2026-2304](https://insights.sbomify.com/MAL-2026-2304/): Malicious code in spanner-client (PyPI) (malicious package) - [MAL-2026-2303](https://insights.sbomify.com/MAL-2026-2303/): Malicious code in prodaccess (PyPI) (malicious package) - [MAL-2026-2302](https://insights.sbomify.com/MAL-2026-2302/): Malicious code in loas (PyPI) (malicious package) - [MAL-2026-2301](https://insights.sbomify.com/MAL-2026-2301/): Malicious code in dremel (PyPI) (malicious package) - [MAL-2026-2300](https://insights.sbomify.com/MAL-2026-2300/): Malicious code in eslint-validator (npm) (malicious package) - [MAL-2026-230](https://insights.sbomify.com/MAL-2026-230/): Malicious code in passport-google-auth-token (npm) (malicious package) - [MAL-2026-23](https://insights.sbomify.com/MAL-2026-23/): Malicious code in showdownxss (npm) (malicious package) - [MAL-2026-2299](https://insights.sbomify.com/MAL-2026-2299/): Malicious code in mnemoniclib (PyPI) (malicious package) - [MAL-2026-2298](https://insights.sbomify.com/MAL-2026-2298/): Malicious code in hiveos-sdk (PyPI) (malicious package) - [MAL-2026-2297](https://insights.sbomify.com/MAL-2026-2297/): Malicious code in earthengine-api (npm) (malicious package) - [MAL-2026-2296](https://insights.sbomify.com/MAL-2026-2296/): Malicious code in bos-decoration-elements (npm) (malicious package) - [MAL-2026-2295](https://insights.sbomify.com/MAL-2026-2295/): Malicious code in databaseroboat (PyPI) (malicious package) - [MAL-2026-2294](https://insights.sbomify.com/MAL-2026-2294/): Malicious code in hiveos (PyPI) (malicious package) - [MAL-2026-2293](https://insights.sbomify.com/MAL-2026-2293/): Malicious code in thisismytestnouser (PyPI) (malicious package) - [MAL-2026-2292](https://insights.sbomify.com/MAL-2026-2292/): Malicious code in safecheckit (PyPI) (malicious package) - [MAL-2026-2291](https://insights.sbomify.com/MAL-2026-2291/): Malicious code in pychatz (PyPI) (malicious package) - [MAL-2026-2290](https://insights.sbomify.com/MAL-2026-2290/): Malicious code in iwantsafecheckit (PyPI) (malicious package) - [MAL-2026-229](https://insights.sbomify.com/MAL-2026-229/): Malicious code in milvus-js (npm) (malicious package) - [MAL-2026-2289](https://insights.sbomify.com/MAL-2026-2289/): Malicious code in database-roblox (PyPI) (malicious package) - [MAL-2026-2288](https://insights.sbomify.com/MAL-2026-2288/): Malicious code in merchservicingnodeserv (npm) (malicious package) - [MAL-2026-2287](https://insights.sbomify.com/MAL-2026-2287/): Malicious code in f0-state-manager (npm) (malicious package) - [MAL-2026-2286](https://insights.sbomify.com/MAL-2026-2286/): Malicious code in sn3akysnak3-test (npm) (malicious package) - [MAL-2026-2285](https://insights.sbomify.com/MAL-2026-2285/): Malicious code in dial-app-version (npm) (malicious package) - [MAL-2026-2284](https://insights.sbomify.com/MAL-2026-2284/): Malicious code in bizsignupnodeweb (npm) (malicious package) - [MAL-2026-2283](https://insights.sbomify.com/MAL-2026-2283/): Malicious code in interwebz (PyPI) (malicious package) - [MAL-2026-2282](https://insights.sbomify.com/MAL-2026-2282/): Malicious code in @adac-fahrzeugplattform/ui (npm) (malicious package) - [MAL-2026-2281](https://insights.sbomify.com/MAL-2026-2281/): Malicious code in roboats-addition (PyPI) (malicious package) - [MAL-2026-2280](https://insights.sbomify.com/MAL-2026-2280/): Malicious code in roboat-additions (PyPI) (malicious package) - [MAL-2026-228](https://insights.sbomify.com/MAL-2026-228/): Malicious code in luxon-js (npm) (malicious package) - [MAL-2026-2279](https://insights.sbomify.com/MAL-2026-2279/): Malicious code in roboat-addition (PyPI) (malicious package) - [MAL-2026-2278](https://insights.sbomify.com/MAL-2026-2278/): Malicious code in python-aiogram-telegram-updater (PyPI) (malicious package) - [MAL-2026-2277](https://insights.sbomify.com/MAL-2026-2277/): Malicious code in aiogram-photo-updater (PyPI) (malicious package) - [MAL-2026-2276](https://insights.sbomify.com/MAL-2026-2276/): Malicious code in payerpath-customer-lib (npm) (malicious package) - [MAL-2026-2275](https://insights.sbomify.com/MAL-2026-2275/): Malicious code in npmamzs (npm) (malicious package) - [MAL-2026-2274](https://insights.sbomify.com/MAL-2026-2274/): Malicious code in autoshipment-public-front (npm) (malicious package) - [MAL-2026-2273](https://insights.sbomify.com/MAL-2026-2273/): Malicious code in trustwallet (PyPI) (malicious package) - [MAL-2026-2272](https://insights.sbomify.com/MAL-2026-2272/): Malicious code in solana-api (PyPI) (malicious package) - [MAL-2026-2271](https://insights.sbomify.com/MAL-2026-2271/): Malicious code in metamask-api (PyPI) (malicious package) - [MAL-2026-2270](https://insights.sbomify.com/MAL-2026-2270/): Malicious code in copytrading (PyPI) (malicious package) - [MAL-2026-227](https://insights.sbomify.com/MAL-2026-227/): Malicious code in llamaindex-js (npm) (malicious package) - [MAL-2026-2269](https://insights.sbomify.com/MAL-2026-2269/): Malicious code in claude-lite (PyPI) (malicious package) - [MAL-2026-2268](https://insights.sbomify.com/MAL-2026-2268/): Malicious code in gemini-ai-api (PyPI) (malicious package) - [MAL-2026-2267](https://insights.sbomify.com/MAL-2026-2267/): Malicious code in monolith-twirp-partitioning-pull_requests (RubyGems) (malicious package) - [MAL-2026-2266](https://insights.sbomify.com/MAL-2026-2266/): Malicious code in monolith-twirp-copilot-registry (RubyGems) (malicious package) - [MAL-2026-2265](https://insights.sbomify.com/MAL-2026-2265/): Malicious code in monolith-twirp-codingagentintegrations-codingagentintegrations (RubyGems) (malicious package) - [MAL-2026-2264](https://insights.sbomify.com/MAL-2026-2264/): Malicious code in monolith-twirp-scribe-scribe (RubyGems) (malicious package) - [MAL-2026-2263](https://insights.sbomify.com/MAL-2026-2263/): Malicious code in monolith-twirp-reposinsights-reposinsights (RubyGems) (malicious package) - [MAL-2026-2262](https://insights.sbomify.com/MAL-2026-2262/): Malicious code in monolith-twirp-pullsd-teams (RubyGems) (malicious package) - [MAL-2026-2261](https://insights.sbomify.com/MAL-2026-2261/): Malicious code in monolith-twirp-pullsd-repositories (RubyGems) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/93/