# Vulnerabilities published in 2026 - [MAL-2026-2170](https://insights.sbomify.com/MAL-2026-2170/): Malicious code in fairness-bias (PyPI) (malicious package) - [MAL-2026-217](https://insights.sbomify.com/MAL-2026-217/): Malicious code in experimental-utils (npm) (malicious package) - [MAL-2026-2169](https://insights.sbomify.com/MAL-2026-2169/): Malicious code in console-loggers (npm) (malicious package) - [MAL-2026-2168](https://insights.sbomify.com/MAL-2026-2168/): Malicious code in chai-patch (npm) (malicious package) - [MAL-2026-2167](https://insights.sbomify.com/MAL-2026-2167/): Malicious code in @shennmine/libsignal-node (npm) (malicious package) - [MAL-2026-2166](https://insights.sbomify.com/MAL-2026-2166/): Malicious code in @shennmine/baileys (npm) (malicious package) - [MAL-2026-2165](https://insights.sbomify.com/MAL-2026-2165/): Malicious code in @rexxtheproject/keyed-db (npm) (malicious package) - [MAL-2026-2164](https://insights.sbomify.com/MAL-2026-2164/): Malicious code in @rexxtheproject/elaina-libsignal (npm) (malicious package) - [MAL-2026-2163](https://insights.sbomify.com/MAL-2026-2163/): Malicious code in @rexxtheproject/elaina-baileys (npm) (malicious package) - [MAL-2026-2162](https://insights.sbomify.com/MAL-2026-2162/): Malicious code in svg-sizer-responsive (npm) (malicious package) - [MAL-2026-2161](https://insights.sbomify.com/MAL-2026-2161/): Malicious code in path-external (npm) (malicious package) - [MAL-2026-2160](https://insights.sbomify.com/MAL-2026-2160/): Malicious code in chai-as-chain (npm) (malicious package) - [MAL-2026-216](https://insights.sbomify.com/MAL-2026-216/): Malicious code in cors-base (npm) (malicious package) - [MAL-2026-2159](https://insights.sbomify.com/MAL-2026-2159/): Malicious code in @eric-orderbuddyinfo/react-noval (npm) (malicious package) - [MAL-2026-2158](https://insights.sbomify.com/MAL-2026-2158/): Malicious code in torchunmix (PyPI) (malicious package) - [MAL-2026-2157](https://insights.sbomify.com/MAL-2026-2157/): Malicious code in transitive_lib (npm) (malicious package) - [MAL-2026-2156](https://insights.sbomify.com/MAL-2026-2156/): Malicious code in tailwind-animationbasis (npm) (malicious package) - [MAL-2026-2155](https://insights.sbomify.com/MAL-2026-2155/): Malicious code in pino-pretty-log (npm) (malicious package) - [MAL-2026-2154](https://insights.sbomify.com/MAL-2026-2154/): Malicious code in chai-as-emitted (npm) (malicious package) - [MAL-2026-2153](https://insights.sbomify.com/MAL-2026-2153/): Malicious code in @xvortexsockets/baileys (npm) (malicious package) - [MAL-2026-2152](https://insights.sbomify.com/MAL-2026-2152/): Malicious code in target-iceberg (PyPI) (malicious package) - [MAL-2026-2151](https://insights.sbomify.com/MAL-2026-2151/): Malicious code in tap-wordpress (PyPI) (malicious package) - [MAL-2026-2150](https://insights.sbomify.com/MAL-2026-2150/): Malicious code in snooty (PyPI) (malicious package) - [MAL-2026-215](https://insights.sbomify.com/MAL-2026-215/): Malicious code in auth-types (npm) (malicious package) - [MAL-2026-2149](https://insights.sbomify.com/MAL-2026-2149/): Malicious code in sentry-filter-forks (PyPI) (malicious package) - [MAL-2026-2148](https://insights.sbomify.com/MAL-2026-2148/): Malicious code in mattermost-data-warehouse (PyPI) (malicious package) - [MAL-2026-2147](https://insights.sbomify.com/MAL-2026-2147/): Malicious code in mattermost-airflow (PyPI) (malicious package) - [MAL-2026-2146](https://insights.sbomify.com/MAL-2026-2146/): Malicious code in databricks-clean-room-orchestrator (PyPI) (malicious package) - [MAL-2026-2145](https://insights.sbomify.com/MAL-2026-2145/): Malicious code in compose-rl (PyPI) (malicious package) - [MAL-2026-2144](https://insights.sbomify.com/MAL-2026-2144/): Malicious code in litellm (PyPI) (malicious package) - [MAL-2026-2143](https://insights.sbomify.com/MAL-2026-2143/): Malicious code in roboated (PyPI) (malicious package) - [MAL-2026-2142](https://insights.sbomify.com/MAL-2026-2142/): Malicious code in roboat-util (PyPI) (malicious package) - [MAL-2026-2141](https://insights.sbomify.com/MAL-2026-2141/): Malicious code in corexloader (PyPI) (malicious package) - [MAL-2026-2140](https://insights.sbomify.com/MAL-2026-2140/): Malicious code in coreloader (PyPI) (malicious package) - [MAL-2026-214](https://insights.sbomify.com/MAL-2026-214/): Malicious code in analytics-browser (npm) (malicious package) - [MAL-2026-2139](https://insights.sbomify.com/MAL-2026-2139/): Malicious code in stats-helpers (PyPI) (malicious package) - [MAL-2026-2138](https://insights.sbomify.com/MAL-2026-2138/): Malicious code in open-vp-cal (PyPI) (malicious package) - [MAL-2026-2137](https://insights.sbomify.com/MAL-2026-2137/): Malicious code in @one-site/europcar (npm) (malicious package) - [MAL-2026-2136](https://insights.sbomify.com/MAL-2026-2136/): Malicious code in yelp-react-component-rating (npm) (malicious package) - [MAL-2026-2135](https://insights.sbomify.com/MAL-2026-2135/): Malicious code in yelp-react-component-photo-upload (npm) (malicious package) - [MAL-2026-2134](https://insights.sbomify.com/MAL-2026-2134/): Malicious code in yelp-biz-action-constants-js-generated (npm) (malicious package) - [MAL-2026-2133](https://insights.sbomify.com/MAL-2026-2133/): Malicious code in server-fpti (npm) (malicious package) - [MAL-2026-2132](https://insights.sbomify.com/MAL-2026-2132/): Malicious code in sbx-mask (npm) (malicious package) - [MAL-2026-2131](https://insights.sbomify.com/MAL-2026-2131/): Malicious code in nemo-fpti (npm) (malicious package) - [MAL-2026-2130](https://insights.sbomify.com/MAL-2026-2130/): Malicious code in fancode-web-app (npm) (malicious package) - [MAL-2026-213](https://insights.sbomify.com/MAL-2026-213/): Malicious code in @maxcointech/simple-string-utils (npm) (malicious package) - [MAL-2026-2129](https://insights.sbomify.com/MAL-2026-2129/): Malicious code in express-session-validator (npm) (malicious package) - [MAL-2026-2128](https://insights.sbomify.com/MAL-2026-2128/): Malicious code in express-session-vailidator (npm) (malicious package) - [MAL-2026-2127](https://insights.sbomify.com/MAL-2026-2127/): Malicious code in agoda-test-poc (npm) (malicious package) - [MAL-2026-2126](https://insights.sbomify.com/MAL-2026-2126/): Malicious code in agoda-dep-confusion (npm) (malicious package) - [MAL-2026-2125](https://insights.sbomify.com/MAL-2026-2125/): Malicious code in customerdigital-ui-components-lib (npm) (malicious package) - [MAL-2026-2124](https://insights.sbomify.com/MAL-2026-2124/): Malicious code in mgrcfg (PyPI) (malicious package) - [MAL-2026-2123](https://insights.sbomify.com/MAL-2026-2123/): Malicious code in yelp-mobile-site-common (npm) (malicious package) - [MAL-2026-2122](https://insights.sbomify.com/MAL-2026-2122/): Malicious code in rowrapee (PyPI) (malicious package) - [MAL-2026-2121](https://insights.sbomify.com/MAL-2026-2121/): Malicious code in roboat (PyPI) (malicious package) - [MAL-2026-2120](https://insights.sbomify.com/MAL-2026-2120/): Malicious code in logutilkit (PyPI) (malicious package) - [MAL-2026-212](https://insights.sbomify.com/MAL-2026-212/): Malicious code in lyonscg (npm) (malicious package) - [MAL-2026-2119](https://insights.sbomify.com/MAL-2026-2119/): Malicious code in apachelicense (PyPI) (malicious package) - [MAL-2026-2118](https://insights.sbomify.com/MAL-2026-2118/): Malicious code in hash-utils-py (PyPI) (malicious package) - [MAL-2026-2117](https://insights.sbomify.com/MAL-2026-2117/): Malicious code in tui-ascii-art (PyPI) (malicious package) - [MAL-2026-2116](https://insights.sbomify.com/MAL-2026-2116/): Malicious code in reqpack (PyPI) (malicious package) - [MAL-2026-2115](https://insights.sbomify.com/MAL-2026-2115/): Malicious code in nspack (PyPI) (malicious package) - [MAL-2026-2114](https://insights.sbomify.com/MAL-2026-2114/): Malicious code in indpack (PyPI) (malicious package) - [MAL-2026-2113](https://insights.sbomify.com/MAL-2026-2113/): Malicious code in gcpipwrap (PyPI) (malicious package) - [MAL-2026-2112](https://insights.sbomify.com/MAL-2026-2112/): Malicious code in apply-hive-table (PyPI) (malicious package) - [MAL-2026-2111](https://insights.sbomify.com/MAL-2026-2111/): Malicious code in tailwind-font-inter (npm) (malicious package) - [MAL-2026-2110](https://insights.sbomify.com/MAL-2026-2110/): Malicious code in react-tailwindcss-style (npm) (malicious package) - [MAL-2026-211](https://insights.sbomify.com/MAL-2026-211/): Malicious code in @workleap-widgets/client (npm) (malicious package) - [MAL-2026-2109](https://insights.sbomify.com/MAL-2026-2109/): Malicious code in pyregions-snowflake (PyPI) (malicious package) - [MAL-2026-2108](https://insights.sbomify.com/MAL-2026-2108/): Malicious code in modelconftranslator (PyPI) (malicious package) - [MAL-2026-2107](https://insights.sbomify.com/MAL-2026-2107/): Malicious code in financial-crimes-general-utils (PyPI) (malicious package) - [MAL-2026-2106](https://insights.sbomify.com/MAL-2026-2106/): Malicious code in dmclc (PyPI) (malicious package) - [MAL-2026-2105](https://insights.sbomify.com/MAL-2026-2105/): Malicious code in ty-search-suggestion (npm) (malicious package) - [MAL-2026-2104](https://insights.sbomify.com/MAL-2026-2104/): Malicious code in ty-fragment-core (npm) (malicious package) - [MAL-2026-2103](https://insights.sbomify.com/MAL-2026-2103/): Malicious code in ty-config-provider (npm) (malicious package) - [MAL-2026-2102](https://insights.sbomify.com/MAL-2026-2102/): Malicious code in storefront-logger (npm) (malicious package) - [MAL-2026-2101](https://insights.sbomify.com/MAL-2026-2101/): Malicious code in sidebar-basket (npm) (malicious package) - [MAL-2026-2100](https://insights.sbomify.com/MAL-2026-2100/): Malicious code in shakti-pwa (npm) (malicious package) - [MAL-2026-210](https://insights.sbomify.com/MAL-2026-210/): Malicious code in @workleap-ai/shared (npm) (malicious package) - [MAL-2026-21](https://insights.sbomify.com/MAL-2026-21/): Malicious code in orchestration-node-common-errors (npm) (malicious package) - [MAL-2026-2099](https://insights.sbomify.com/MAL-2026-2099/): Malicious code in sfx-event-bridge (npm) (malicious package) - [MAL-2026-2098](https://insights.sbomify.com/MAL-2026-2098/): Malicious code in sd-basket-highlight (npm) (malicious package) - [MAL-2026-2097](https://insights.sbomify.com/MAL-2026-2097/): Malicious code in puzzle-render-kit (npm) (malicious package) - [MAL-2026-2096](https://insights.sbomify.com/MAL-2026-2096/): Malicious code in puzzle-asset (npm) (malicious package) - [MAL-2026-2095](https://insights.sbomify.com/MAL-2026-2095/): Malicious code in pulse-shop-section (npm) (malicious package) - [MAL-2026-2094](https://insights.sbomify.com/MAL-2026-2094/): Malicious code in pulse-scroll-triggered-list-items (npm) (malicious package) - [MAL-2026-2093](https://insights.sbomify.com/MAL-2026-2093/): Malicious code in pulse-rsvp-card-entity (npm) (malicious package) - [MAL-2026-2092](https://insights.sbomify.com/MAL-2026-2092/): Malicious code in pulse-feature-flag (npm) (malicious package) - [MAL-2026-2091](https://insights.sbomify.com/MAL-2026-2091/): Malicious code in netflixidentity (npm) (malicious package) - [MAL-2026-2090](https://insights.sbomify.com/MAL-2026-2090/): Malicious code in netflixid (npm) (malicious package) - [MAL-2026-209](https://insights.sbomify.com/MAL-2026-209/): Malicious code in @t4i-cms-components/contact-card (npm) (malicious package) - [MAL-2026-2089](https://insights.sbomify.com/MAL-2026-2089/): Malicious code in milla-migration (npm) (malicious package) - [MAL-2026-2088](https://insights.sbomify.com/MAL-2026-2088/): Malicious code in internal-linking (npm) (malicious package) - [MAL-2026-2087](https://insights.sbomify.com/MAL-2026-2087/): Malicious code in in-app-marketing (npm) (malicious package) - [MAL-2026-2086](https://insights.sbomify.com/MAL-2026-2086/): Malicious code in falcor-server (npm) (malicious package) - [MAL-2026-2085](https://insights.sbomify.com/MAL-2026-2085/): Malicious code in uipagain (npm) (malicious package) - [MAL-2026-2084](https://insights.sbomify.com/MAL-2026-2084/): Malicious code in license-utils-kit (PyPI) (malicious package) - [MAL-2026-2083](https://insights.sbomify.com/MAL-2026-2083/): Malicious code in anduril-sdk (PyPI) (malicious package) - [MAL-2026-2082](https://insights.sbomify.com/MAL-2026-2082/): Malicious code in unhandledrejection1 (npm) (malicious package) - [MAL-2026-2081](https://insights.sbomify.com/MAL-2026-2081/): Malicious code in @thiagoemmanuell/unhandledrejection (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/95/