# Vulnerabilities published in 2026


- [MAL-2026-2260](https://insights.sbomify.com/MAL-2026-2260/): Malicious code in monolith-twirp-pullsd-pullrequestinfo (RubyGems) (malicious package)
- [MAL-2026-226](https://insights.sbomify.com/MAL-2026-226/): Malicious code in jz-test-npm (npm) (malicious package)
- [MAL-2026-2259](https://insights.sbomify.com/MAL-2026-2259/): Malicious code in monolith-twirp-loops-core (RubyGems) (malicious package)
- [MAL-2026-2258](https://insights.sbomify.com/MAL-2026-2258/): Malicious code in current-context-urn (npm) (malicious package)
- [MAL-2026-2257](https://insights.sbomify.com/MAL-2026-2257/): Malicious code in xpna-context (npm) (malicious package)
- [MAL-2026-2256](https://insights.sbomify.com/MAL-2026-2256/): Malicious code in shenxun162938 (npm) (malicious package)
- [MAL-2026-2255](https://insights.sbomify.com/MAL-2026-2255/): Malicious code in thisismytest123 (PyPI) (malicious package)
- [MAL-2026-2254](https://insights.sbomify.com/MAL-2026-2254/): Malicious code in telnyx (PyPI) (malicious package)
- [MAL-2026-2253](https://insights.sbomify.com/MAL-2026-2253/): Malicious code in dgxeon-soket-buttonx (npm) (malicious package)
- [MAL-2026-2252](https://insights.sbomify.com/MAL-2026-2252/): Malicious code in dgxeon-baileys (npm) (malicious package)
- [MAL-2026-2251](https://insights.sbomify.com/MAL-2026-2251/): Malicious code in testtestsharp (npm) (malicious package)
- [MAL-2026-2250](https://insights.sbomify.com/MAL-2026-2250/): Malicious code in test1sharp (npm) (malicious package)
- [MAL-2026-225](https://insights.sbomify.com/MAL-2026-225/): Malicious code in jsdom-js (npm) (malicious package)
- [MAL-2026-2249](https://insights.sbomify.com/MAL-2026-2249/): Malicious code in chai-as-added (npm) (malicious package)
- [MAL-2026-2248](https://insights.sbomify.com/MAL-2026-2248/): Malicious code in shop-republik-ch (npm) (malicious package)
- [MAL-2026-2247](https://insights.sbomify.com/MAL-2026-2247/): Malicious code in cua-primitives-server (npm) (malicious package)
- [MAL-2026-2246](https://insights.sbomify.com/MAL-2026-2246/): Malicious code in @ev-tech/eva-container-api (npm) (malicious package)
- [MAL-2026-2245](https://insights.sbomify.com/MAL-2026-2245/): Malicious code in requests-testik111 (PyPI) (malicious package)
- [MAL-2026-2244](https://insights.sbomify.com/MAL-2026-2244/): Malicious code in fluxhttp (PyPI) (malicious package)
- [MAL-2026-2243](https://insights.sbomify.com/MAL-2026-2243/): Malicious code in browserstack-electron-forge-include-package-plugin (npm) (malicious package)
- [MAL-2026-2242](https://insights.sbomify.com/MAL-2026-2242/): Malicious code in somepentest-test-package (PyPI) (malicious package)
- [MAL-2026-2241](https://insights.sbomify.com/MAL-2026-2241/): Malicious code in pacbot (PyPI) (malicious package)
- [MAL-2026-2240](https://insights.sbomify.com/MAL-2026-2240/): Malicious code in magtape (PyPI) (malicious package)
- [MAL-2026-224](https://insights.sbomify.com/MAL-2026-224/): Malicious code in inquirer-js (npm) (malicious package)
- [MAL-2026-2239](https://insights.sbomify.com/MAL-2026-2239/): Malicious code in chaostoolkit-turbulence (PyPI) (malicious package)
- [MAL-2026-2238](https://insights.sbomify.com/MAL-2026-2238/): Malicious code in spr-i18n-labels (npm) (malicious package)
- [MAL-2026-2237](https://insights.sbomify.com/MAL-2026-2237/): Malicious code in jsonify-builder (npm) (malicious package)
- [MAL-2026-2236](https://insights.sbomify.com/MAL-2026-2236/): Malicious code in onboarding-server (npm) (malicious package)
- [MAL-2026-2235](https://insights.sbomify.com/MAL-2026-2235/): Malicious code in srcsrctest (npm) (malicious package)
- [MAL-2026-2234](https://insights.sbomify.com/MAL-2026-2234/): Malicious code in security-install-analytics (npm) (malicious package)
- [MAL-2026-2233](https://insights.sbomify.com/MAL-2026-2233/): Malicious code in lightmock (PyPI) (malicious package)
- [MAL-2026-2232](https://insights.sbomify.com/MAL-2026-2232/): Malicious code in checkmarx.cx-dev-assist (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2026-2231](https://insights.sbomify.com/MAL-2026-2231/): Malicious code in checkmarx.ast-results (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2026-2230](https://insights.sbomify.com/MAL-2026-2230/): Malicious code in aquasecurityofficial.trivy-vulnerability-scanner (VSCode:https://open-vsx.org) (malicious package)
- [MAL-2026-223](https://insights.sbomify.com/MAL-2026-223/): Malicious code in immer-js (npm) (malicious package)
- [MAL-2026-2229](https://insights.sbomify.com/MAL-2026-2229/): Malicious code in @zecho/libsignal (npm) (malicious package)
- [MAL-2026-2228](https://insights.sbomify.com/MAL-2026-2228/): Malicious code in @zecho/baileys-mod (npm) (malicious package)
- [MAL-2026-2227](https://insights.sbomify.com/MAL-2026-2227/): Malicious code in validator-lut-sdk (npm) (malicious package)
- [MAL-2026-2226](https://insights.sbomify.com/MAL-2026-2226/): Malicious code in node-coremesh (npm) (malicious package)
- [MAL-2026-2225](https://insights.sbomify.com/MAL-2026-2225/): Malicious code in neanderthal-validator (npm) (malicious package)
- [MAL-2026-2224](https://insights.sbomify.com/MAL-2026-2224/): Malicious code in jito-validator-sdk (npm) (malicious package)
- [MAL-2026-2223](https://insights.sbomify.com/MAL-2026-2223/): Malicious code in cr-static-shared-components (npm) (malicious package)
- [MAL-2026-2222](https://insights.sbomify.com/MAL-2026-2222/): Malicious code in chain-coremesh (npm) (malicious package)
- [MAL-2026-2221](https://insights.sbomify.com/MAL-2026-2221/): Malicious code in @validator-lut-sdk/v3 (npm) (malicious package)
- [MAL-2026-2220](https://insights.sbomify.com/MAL-2026-2220/): Malicious code in @universeorg/dotenv (npm) (malicious package)
- [MAL-2026-222](https://insights.sbomify.com/MAL-2026-222/): Malicious code in huggingface-js (npm) (malicious package)
- [MAL-2026-2219](https://insights.sbomify.com/MAL-2026-2219/): Malicious code in @solmasterv3/solana-metadata-sdk (npm) (malicious package)
- [MAL-2026-2218](https://insights.sbomify.com/MAL-2026-2218/): Malicious code in @solana-ipfs/sdk (npm) (malicious package)
- [MAL-2026-2217](https://insights.sbomify.com/MAL-2026-2217/): Malicious code in @rexorg/config (npm) (malicious package)
- [MAL-2026-2216](https://insights.sbomify.com/MAL-2026-2216/): Malicious code in @pumpfun-ipfs/sdk (npm) (malicious package)
- [MAL-2026-2215](https://insights.sbomify.com/MAL-2026-2215/): Malicious code in react-leaflet-marker-layer (npm) (malicious package)
- [MAL-2026-2214](https://insights.sbomify.com/MAL-2026-2214/): Malicious code in react-autolink-text (npm) (malicious package)
- [MAL-2026-2213](https://insights.sbomify.com/MAL-2026-2213/): Malicious code in @virtahealth/substrate-root (npm) (malicious package)
- [MAL-2026-2212](https://insights.sbomify.com/MAL-2026-2212/): Malicious code in @opengov/qa-record-types-api (npm) (malicious package)
- [MAL-2026-2211](https://insights.sbomify.com/MAL-2026-2211/): Malicious code in @opengov/form-renderer (npm) (malicious package)
- [MAL-2026-2210](https://insights.sbomify.com/MAL-2026-2210/): Malicious code in @opengov/form-builder (npm) (malicious package)
- [MAL-2026-221](https://insights.sbomify.com/MAL-2026-221/): Malicious code in gradle-plugin (npm) (malicious package)
- [MAL-2026-2209](https://insights.sbomify.com/MAL-2026-2209/): Malicious code in @emilgroup/translation-sdk-node (npm) (malicious package)
- [MAL-2026-2208](https://insights.sbomify.com/MAL-2026-2208/): Malicious code in @emilgroup/setting-sdk (npm) (malicious package)
- [MAL-2026-2207](https://insights.sbomify.com/MAL-2026-2207/): Malicious code in @emilgroup/process-manager-sdk-node (npm) (malicious package)
- [MAL-2026-2206](https://insights.sbomify.com/MAL-2026-2206/): Malicious code in @emilgroup/process-manager-sdk (npm) (malicious package)
- [MAL-2026-2205](https://insights.sbomify.com/MAL-2026-2205/): Malicious code in @emilgroup/partner-sdk (npm) (malicious package)
- [MAL-2026-2204](https://insights.sbomify.com/MAL-2026-2204/): Malicious code in @emilgroup/numbergenerator-sdk-node (npm) (malicious package)
- [MAL-2026-2203](https://insights.sbomify.com/MAL-2026-2203/): Malicious code in @emilgroup/discount-sdk-node (npm) (malicious package)
- [MAL-2026-2202](https://insights.sbomify.com/MAL-2026-2202/): Malicious code in @emilgroup/commission-sdk (npm) (malicious package)
- [MAL-2026-2201](https://insights.sbomify.com/MAL-2026-2201/): Malicious code in privaton-beacon-img-8f3603448690bdde-png (PyPI) (malicious package)
- [MAL-2026-2200](https://insights.sbomify.com/MAL-2026-2200/): Malicious code in json-lucide (npm) (malicious package)
- [MAL-2026-220](https://insights.sbomify.com/MAL-2026-220/): Malicious code in framer-motion-js (npm) (malicious package)
- [MAL-2026-22](https://insights.sbomify.com/MAL-2026-22/): Malicious code in pkg1bate5apg1 (npm) (malicious package)
- [MAL-2026-2199](https://insights.sbomify.com/MAL-2026-2199/): Malicious code in omicnavigatorwebapp (npm) (malicious package)
- [MAL-2026-2198](https://insights.sbomify.com/MAL-2026-2198/): Malicious code in omaronsec (npm) (malicious package)
- [MAL-2026-2197](https://insights.sbomify.com/MAL-2026-2197/): Malicious code in allergan (npm) (malicious package)
- [MAL-2026-2196](https://insights.sbomify.com/MAL-2026-2196/): Malicious code in tailwind-compile (npm) (malicious package)
- [MAL-2026-2195](https://insights.sbomify.com/MAL-2026-2195/): Malicious code in super-alias (npm) (malicious package)
- [MAL-2026-2194](https://insights.sbomify.com/MAL-2026-2194/): Malicious code in ffsixx (npm) (malicious package)
- [MAL-2026-2193](https://insights.sbomify.com/MAL-2026-2193/): Malicious code in @sixcore/baileys (npm) (malicious package)
- [MAL-2026-2192](https://insights.sbomify.com/MAL-2026-2192/): Malicious code in changelog-utils-wrapper (npm) (malicious package)
- [MAL-2026-2191](https://insights.sbomify.com/MAL-2026-2191/): Malicious code in changelog-utils-logger (npm) (malicious package)
- [MAL-2026-2190](https://insights.sbomify.com/MAL-2026-2190/): Malicious code in ts-bign (npm) (malicious package)
- [MAL-2026-219](https://insights.sbomify.com/MAL-2026-219/): Malicious code in firestore-types (npm) (malicious package)
- [MAL-2026-2189](https://insights.sbomify.com/MAL-2026-2189/): Malicious code in simple-util-kit (npm) (malicious package)
- [MAL-2026-2188](https://insights.sbomify.com/MAL-2026-2188/): Malicious code in levex-refa (npm) (malicious package)
- [MAL-2026-2187](https://insights.sbomify.com/MAL-2026-2187/): Malicious code in vision-service-python-client-internal (PyPI) (malicious package)
- [MAL-2026-2186](https://insights.sbomify.com/MAL-2026-2186/): Malicious code in vision-service-python-client (PyPI) (malicious package)
- [MAL-2026-2185](https://insights.sbomify.com/MAL-2026-2185/): Malicious code in hy-api-utilities (PyPI) (malicious package)
- [MAL-2026-2184](https://insights.sbomify.com/MAL-2026-2184/): Malicious code in auth0-ai-ms-agent (PyPI) (malicious package)
- [MAL-2026-2183](https://insights.sbomify.com/MAL-2026-2183/): Malicious code in yeshsurya (PyPI) (malicious package)
- [MAL-2026-2182](https://insights.sbomify.com/MAL-2026-2182/): Malicious code in sonic-yang-mgmt (PyPI) (malicious package)
- [MAL-2026-2181](https://insights.sbomify.com/MAL-2026-2181/): Malicious code in sonic-platform-common (PyPI) (malicious package)
- [MAL-2026-2180](https://insights.sbomify.com/MAL-2026-2180/): Malicious code in sonic-config-engine (PyPI) (malicious package)
- [MAL-2026-218](https://insights.sbomify.com/MAL-2026-218/): Malicious code in express-sessions-id (npm) (malicious package)
- [MAL-2026-2179](https://insights.sbomify.com/MAL-2026-2179/): Malicious code in python-glue (PyPI) (malicious package)
- [MAL-2026-2178](https://insights.sbomify.com/MAL-2026-2178/): Malicious code in lm-sys (PyPI) (malicious package)
- [MAL-2026-2177](https://insights.sbomify.com/MAL-2026-2177/): Malicious code in linting (PyPI) (malicious package)
- [MAL-2026-2176](https://insights.sbomify.com/MAL-2026-2176/): Malicious code in kusto (PyPI) (malicious package)
- [MAL-2026-2175](https://insights.sbomify.com/MAL-2026-2175/): Malicious code in facebookresearch (PyPI) (malicious package)
- [MAL-2026-2174](https://insights.sbomify.com/MAL-2026-2174/): Malicious code in batch-shipyard (PyPI) (malicious package)
- [MAL-2026-2173](https://insights.sbomify.com/MAL-2026-2173/): Malicious code in aristanetworks (PyPI) (malicious package)
- [MAL-2026-2172](https://insights.sbomify.com/MAL-2026-2172/): Malicious code in v2-8-3 (PyPI) (malicious package)
- [MAL-2026-2171](https://insights.sbomify.com/MAL-2026-2171/): Malicious code in globally (PyPI) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/94/