# Vulnerabilities published in 2026 - [MAL-2026-2080](https://insights.sbomify.com/MAL-2026-2080/): Malicious code in cit-playwright-tests (npm) (malicious package) - [MAL-2026-208](https://insights.sbomify.com/MAL-2026-208/): Malicious code in @gwp-gtmt-components/event-listener (npm) (malicious package) - [MAL-2026-2079](https://insights.sbomify.com/MAL-2026-2079/): Malicious code in @emilgroup/task-sdk-node (npm) (malicious package) - [MAL-2026-2078](https://insights.sbomify.com/MAL-2026-2078/): Malicious code in @emilgroup/task-sdk (npm) (malicious package) - [MAL-2026-2077](https://insights.sbomify.com/MAL-2026-2077/): Malicious code in @emilgroup/public-api-sdk-node (npm) (malicious package) - [MAL-2026-2076](https://insights.sbomify.com/MAL-2026-2076/): Malicious code in @emilgroup/document-uploader (npm) (malicious package) - [MAL-2026-2075](https://insights.sbomify.com/MAL-2026-2075/): Malicious code in @emilgroup/document-sdk-node (npm) (malicious package) - [MAL-2026-2074](https://insights.sbomify.com/MAL-2026-2074/): Malicious code in @emilgroup/discount-sdk (npm) (malicious package) - [MAL-2026-2073](https://insights.sbomify.com/MAL-2026-2073/): Malicious code in @airtm/uuid-base32 (npm) (malicious package) - [MAL-2026-2072](https://insights.sbomify.com/MAL-2026-2072/): Malicious code in react-leaflet-heatmap-layer (npm) (malicious package) - [MAL-2026-2071](https://insights.sbomify.com/MAL-2026-2071/): Malicious code in react-leaflet-cluster-layer (npm) (malicious package) - [MAL-2026-2070](https://insights.sbomify.com/MAL-2026-2070/): Malicious code in jest-preset-ppf (npm) (malicious package) - [MAL-2026-207](https://insights.sbomify.com/MAL-2026-207/): Malicious code in yargs-js (npm) (malicious package) - [MAL-2026-2069](https://insights.sbomify.com/MAL-2026-2069/): Malicious code in eslint-config-service-users (npm) (malicious package) - [MAL-2026-2068](https://insights.sbomify.com/MAL-2026-2068/): Malicious code in eslint-config-ppf (npm) (malicious package) - [MAL-2026-2067](https://insights.sbomify.com/MAL-2026-2067/): Malicious code in babel-plugin-react-pure-component (npm) (malicious package) - [MAL-2026-2066](https://insights.sbomify.com/MAL-2026-2066/): Malicious code in @teale.io/eslint-config (npm) (malicious package) - [MAL-2026-2065](https://insights.sbomify.com/MAL-2026-2065/): Malicious code in @opengov/ppf-eslint-config (npm) (malicious package) - [MAL-2026-2064](https://insights.sbomify.com/MAL-2026-2064/): Malicious code in @opengov/ppf-backend-types (npm) (malicious package) - [MAL-2026-2063](https://insights.sbomify.com/MAL-2026-2063/): Malicious code in @opengov/form-utils (npm) (malicious package) - [MAL-2026-2062](https://insights.sbomify.com/MAL-2026-2062/): Malicious code in @leafnoise/mirage (npm) (malicious package) - [MAL-2026-2061](https://insights.sbomify.com/MAL-2026-2061/): Malicious code in @emilgroup/tenant-sdk-node (npm) (malicious package) - [MAL-2026-2060](https://insights.sbomify.com/MAL-2026-2060/): Malicious code in @emilgroup/tenant-sdk (npm) (malicious package) - [MAL-2026-206](https://insights.sbomify.com/MAL-2026-206/): Malicious code in terser-js (npm) (malicious package) - [MAL-2026-2059](https://insights.sbomify.com/MAL-2026-2059/): Malicious code in @emilgroup/setting-sdk-node (npm) (malicious package) - [MAL-2026-2058](https://insights.sbomify.com/MAL-2026-2058/): Malicious code in @emilgroup/public-api-sdk (npm) (malicious package) - [MAL-2026-2057](https://insights.sbomify.com/MAL-2026-2057/): Malicious code in @emilgroup/payment-sdk-node (npm) (malicious package) - [MAL-2026-2056](https://insights.sbomify.com/MAL-2026-2056/): Malicious code in @emilgroup/payment-sdk (npm) (malicious package) - [MAL-2026-2055](https://insights.sbomify.com/MAL-2026-2055/): Malicious code in @emilgroup/partner-sdk-node (npm) (malicious package) - [MAL-2026-2054](https://insights.sbomify.com/MAL-2026-2054/): Malicious code in @emilgroup/partner-portal-sdk-node (npm) (malicious package) - [MAL-2026-2053](https://insights.sbomify.com/MAL-2026-2053/): Malicious code in @emilgroup/partner-portal-sdk (npm) (malicious package) - [MAL-2026-2052](https://insights.sbomify.com/MAL-2026-2052/): Malicious code in @emilgroup/notification-sdk-node (npm) (malicious package) - [MAL-2026-2051](https://insights.sbomify.com/MAL-2026-2051/): Malicious code in @emilgroup/insurance-sdk-node (npm) (malicious package) - [MAL-2026-2050](https://insights.sbomify.com/MAL-2026-2050/): Malicious code in @emilgroup/insurance-sdk (npm) (malicious package) - [MAL-2026-205](https://insights.sbomify.com/MAL-2026-205/): Malicious code in rxjs-js (npm) (malicious package) - [MAL-2026-2049](https://insights.sbomify.com/MAL-2026-2049/): Malicious code in @emilgroup/gdv-sdk-node (npm) (malicious package) - [MAL-2026-2048](https://insights.sbomify.com/MAL-2026-2048/): Malicious code in @emilgroup/gdv-sdk (npm) (malicious package) - [MAL-2026-2047](https://insights.sbomify.com/MAL-2026-2047/): Malicious code in @emilgroup/docxtemplater-util (npm) (malicious package) - [MAL-2026-2046](https://insights.sbomify.com/MAL-2026-2046/): Malicious code in @emilgroup/document-sdk (npm) (malicious package) - [MAL-2026-2045](https://insights.sbomify.com/MAL-2026-2045/): Malicious code in @emilgroup/customer-sdk-node (npm) (malicious package) - [MAL-2026-2044](https://insights.sbomify.com/MAL-2026-2044/): Malicious code in @emilgroup/customer-sdk (npm) (malicious package) - [MAL-2026-2043](https://insights.sbomify.com/MAL-2026-2043/): Malicious code in @emilgroup/commission-sdk-node (npm) (malicious package) - [MAL-2026-2042](https://insights.sbomify.com/MAL-2026-2042/): Malicious code in @emilgroup/claim-sdk-node (npm) (malicious package) - [MAL-2026-2041](https://insights.sbomify.com/MAL-2026-2041/): Malicious code in @emilgroup/claim-sdk (npm) (malicious package) - [MAL-2026-2040](https://insights.sbomify.com/MAL-2026-2040/): Malicious code in @emilgroup/changelog-sdk-node (npm) (malicious package) - [MAL-2026-204](https://insights.sbomify.com/MAL-2026-204/): Malicious code in pako-js (npm) (malicious package) - [MAL-2026-2039](https://insights.sbomify.com/MAL-2026-2039/): Malicious code in @emilgroup/billing-sdk-node (npm) (malicious package) - [MAL-2026-2038](https://insights.sbomify.com/MAL-2026-2038/): Malicious code in @emilgroup/billing-sdk (npm) (malicious package) - [MAL-2026-2037](https://insights.sbomify.com/MAL-2026-2037/): Malicious code in @emilgroup/auth-sdk-node (npm) (malicious package) - [MAL-2026-2036](https://insights.sbomify.com/MAL-2026-2036/): Malicious code in @emilgroup/auth-sdk (npm) (malicious package) - [MAL-2026-2035](https://insights.sbomify.com/MAL-2026-2035/): Malicious code in @emilgroup/api-documentation (npm) (malicious package) - [MAL-2026-2034](https://insights.sbomify.com/MAL-2026-2034/): Malicious code in @emilgroup/accounting-sdk-node (npm) (malicious package) - [MAL-2026-2033](https://insights.sbomify.com/MAL-2026-2033/): Malicious code in @emilgroup/accounting-sdk (npm) (malicious package) - [MAL-2026-2032](https://insights.sbomify.com/MAL-2026-2032/): Malicious code in @emilgroup/account-sdk-node (npm) (malicious package) - [MAL-2026-2031](https://insights.sbomify.com/MAL-2026-2031/): Malicious code in @emilgroup/account-sdk (npm) (malicious package) - [MAL-2026-2030](https://insights.sbomify.com/MAL-2026-2030/): Malicious code in @pypestream/floating-ui-dom (npm) (malicious package) - [MAL-2026-203](https://insights.sbomify.com/MAL-2026-203/): Malicious code in body-parser-js (npm) (malicious package) - [MAL-2026-2029](https://insights.sbomify.com/MAL-2026-2029/): Malicious code in pipinpeace-reverse (PyPI) (malicious package) - [MAL-2026-2028](https://insights.sbomify.com/MAL-2026-2028/): Malicious code in pipinpeace-bind (PyPI) (malicious package) - [MAL-2026-2027](https://insights.sbomify.com/MAL-2026-2027/): Malicious code in opengov-k6-core (npm) (malicious package) - [MAL-2026-2026](https://insights.sbomify.com/MAL-2026-2026/): Malicious code in pipinpeace-env (PyPI) (malicious package) - [MAL-2026-2025](https://insights.sbomify.com/MAL-2026-2025/): Malicious code in remitly-blog (npm) (malicious package) - [MAL-2026-2024](https://insights.sbomify.com/MAL-2026-2024/): Malicious code in @mesh-helpers/themehelper (npm) (malicious package) - [MAL-2026-2023](https://insights.sbomify.com/MAL-2026-2023/): Malicious code in @mesh-components/customthemeprovider (npm) (malicious package) - [MAL-2026-2022](https://insights.sbomify.com/MAL-2026-2022/): Malicious code in @mesh-components/card (npm) (malicious package) - [MAL-2026-2021](https://insights.sbomify.com/MAL-2026-2021/): Malicious code in @mesh-helpers/common (npm) (malicious package) - [MAL-2026-2020](https://insights.sbomify.com/MAL-2026-2020/): Malicious code in aiolrucache (PyPI) (malicious package) - [MAL-2026-202](https://insights.sbomify.com/MAL-2026-202/): Malicious code in wac-relay-runtime (npm) (malicious package) - [MAL-2026-2019](https://insights.sbomify.com/MAL-2026-2019/): Malicious code in @modals/layout (npm) (malicious package) - [MAL-2026-2018](https://insights.sbomify.com/MAL-2026-2018/): Malicious code in @modals/blockchain (npm) (malicious package) - [MAL-2026-2017](https://insights.sbomify.com/MAL-2026-2017/): Malicious code in thisismytest (PyPI) (malicious package) - [MAL-2026-2016](https://insights.sbomify.com/MAL-2026-2016/): Malicious code in qyrm-pipinject4 (PyPI) (malicious package) - [MAL-2026-2015](https://insights.sbomify.com/MAL-2026-2015/): Malicious code in lingewindows (npm) (malicious package) - [MAL-2026-2014](https://insights.sbomify.com/MAL-2026-2014/): Malicious code in address-autocompletetest (npm) (malicious package) - [MAL-2026-2013](https://insights.sbomify.com/MAL-2026-2013/): Malicious code in nump (PyPI) (malicious package) - [MAL-2026-2012](https://insights.sbomify.com/MAL-2026-2012/): Malicious code in characterai-poc (npm) (malicious package) - [MAL-2026-2011](https://insights.sbomify.com/MAL-2026-2011/): Malicious code in cms-catalogue (npm) (malicious package) - [MAL-2026-2010](https://insights.sbomify.com/MAL-2026-2010/): Malicious code in yelp-react-component-badge (npm) (malicious package) - [MAL-2026-201](https://insights.sbomify.com/MAL-2026-201/): Malicious code in wac-react-dom (npm) (malicious package) - [MAL-2026-2009](https://insights.sbomify.com/MAL-2026-2009/): Malicious code in repo-typescript-config (npm) (malicious package) - [MAL-2026-2008](https://insights.sbomify.com/MAL-2026-2008/): Malicious code in nintendoamerica-ncom (npm) (malicious package) - [MAL-2026-2007](https://insights.sbomify.com/MAL-2026-2007/): Malicious code in uniswap-info (npm) (malicious package) - [MAL-2026-2006](https://insights.sbomify.com/MAL-2026-2006/): Malicious code in mangrove-sdk (PyPI) (malicious package) - [MAL-2026-2005](https://insights.sbomify.com/MAL-2026-2005/): Malicious code in efghr-honeybee-sdk (PyPI) (malicious package) - [MAL-2026-2004](https://insights.sbomify.com/MAL-2026-2004/): Malicious code in flyio-token-client-efgh (PyPI) (malicious package) - [MAL-2026-2003](https://insights.sbomify.com/MAL-2026-2003/): Malicious code in shakti-strings (npm) (malicious package) - [MAL-2026-2002](https://insights.sbomify.com/MAL-2026-2002/): Malicious code in nflx-cmisc (npm) (malicious package) - [MAL-2026-2001](https://insights.sbomify.com/MAL-2026-2001/): Malicious code in laserlogsink (npm) (malicious package) - [MAL-2026-2000](https://insights.sbomify.com/MAL-2026-2000/): Malicious code in cfgmgr-sync (PyPI) (malicious package) - [MAL-2026-200](https://insights.sbomify.com/MAL-2026-200/): Malicious code in wac-react (npm) (malicious package) - [MAL-2026-20](https://insights.sbomify.com/MAL-2026-20/): Malicious code in kid-api (npm) (malicious package) - [MAL-2026-2](https://insights.sbomify.com/MAL-2026-2/): Malicious code in common-cli-utils (npm) (malicious package) - [MAL-2026-1999](https://insights.sbomify.com/MAL-2026-1999/): Malicious code in cfgmgr-syn (PyPI) (malicious package) - [MAL-2026-1998](https://insights.sbomify.com/MAL-2026-1998/): Malicious code in delphoi (npm) (malicious package) - [MAL-2026-1997](https://insights.sbomify.com/MAL-2026-1997/): Malicious code in ty-web-session (npm) (malicious package) - [MAL-2026-1996](https://insights.sbomify.com/MAL-2026-1996/): Malicious code in puzzle-gateway (npm) (malicious package) - [MAL-2026-1995](https://insights.sbomify.com/MAL-2026-1995/): Malicious code in bic-seo (npm) (malicious package) - [MAL-2026-1994](https://insights.sbomify.com/MAL-2026-1994/): Malicious code in spatialmedia (PyPI) (malicious package) - [MAL-2026-1993](https://insights.sbomify.com/MAL-2026-1993/): Malicious code in pubsub2inbox (PyPI) (malicious package) - [MAL-2026-1992](https://insights.sbomify.com/MAL-2026-1992/): Malicious code in perfkitbenchmarker (PyPI) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/96/