# Vulnerabilities published in 2026


- [MAL-2026-1991](https://insights.sbomify.com/MAL-2026-1991/): Malicious code in nsscache (PyPI) (malicious package)
- [MAL-2026-1990](https://insights.sbomify.com/MAL-2026-1990/): Malicious code in mcp-transport-proto (PyPI) (malicious package)
- [MAL-2026-199](https://insights.sbomify.com/MAL-2026-199/): Malicious code in vet-bones (npm) (malicious package)
- [MAL-2026-1989](https://insights.sbomify.com/MAL-2026-1989/): Malicious code in init2winit (PyPI) (malicious package)
- [MAL-2026-1988](https://insights.sbomify.com/MAL-2026-1988/): Malicious code in dataflux-pytorch (PyPI) (malicious package)
- [MAL-2026-1987](https://insights.sbomify.com/MAL-2026-1987/): Malicious code in composer-dev (PyPI) (malicious package)
- [MAL-2026-1986](https://insights.sbomify.com/MAL-2026-1986/): Malicious code in cloud-datasets (PyPI) (malicious package)
- [MAL-2026-1985](https://insights.sbomify.com/MAL-2026-1985/): Malicious code in azure-eventhub-checkpointstoretable (PyPI) (malicious package)
- [MAL-2026-1984](https://insights.sbomify.com/MAL-2026-1984/): Malicious code in airio (PyPI) (malicious package)
- [MAL-2026-1983](https://insights.sbomify.com/MAL-2026-1983/): Malicious code in uipathisfun (npm) (malicious package)
- [MAL-2026-1982](https://insights.sbomify.com/MAL-2026-1982/): Malicious code in xyztttxyz (npm) (malicious package)
- [MAL-2026-1981](https://insights.sbomify.com/MAL-2026-1981/): Malicious code in xyzttt (npm) (malicious package)
- [MAL-2026-1980](https://insights.sbomify.com/MAL-2026-1980/): Malicious code in svg-content-validation (npm) (malicious package)
- [MAL-2026-198](https://insights.sbomify.com/MAL-2026-198/): Malicious code in shopee-chat (npm) (malicious package)
- [MAL-2026-1979](https://insights.sbomify.com/MAL-2026-1979/): Malicious code in rollup-plugin-polyfill-utils (npm) (malicious package)
- [MAL-2026-1978](https://insights.sbomify.com/MAL-2026-1978/): Malicious code in json-specular (npm) (malicious package)
- [MAL-2026-1977](https://insights.sbomify.com/MAL-2026-1977/): Malicious code in json-bundling (npm) (malicious package)
- [MAL-2026-1976](https://insights.sbomify.com/MAL-2026-1976/): Malicious code in innocent-pkg (npm) (malicious package)
- [MAL-2026-1975](https://insights.sbomify.com/MAL-2026-1975/): Malicious code in chai-as-chayn (npm) (malicious package)
- [MAL-2026-1974](https://insights.sbomify.com/MAL-2026-1974/): Malicious code in @fr3newera/baileys (npm) (malicious package)
- [MAL-2026-1973](https://insights.sbomify.com/MAL-2026-1973/): Malicious code in woltpickerapp (npm) (malicious package)
- [MAL-2026-1972](https://insights.sbomify.com/MAL-2026-1972/): Malicious code in wildhunter (npm) (malicious package)
- [MAL-2026-1971](https://insights.sbomify.com/MAL-2026-1971/): Malicious code in trex-proxy-browser-extension-sdk (npm) (malicious package)
- [MAL-2026-1970](https://insights.sbomify.com/MAL-2026-1970/): Malicious code in supportgameapp (npm) (malicious package)
- [MAL-2026-197](https://insights.sbomify.com/MAL-2026-197/): Malicious code in resto_ui_components (npm) (malicious package)
- [MAL-2026-1969](https://insights.sbomify.com/MAL-2026-1969/): Malicious code in spstargm (npm) (malicious package)
- [MAL-2026-1968](https://insights.sbomify.com/MAL-2026-1968/): Malicious code in safe-json-parsex (npm) (malicious package)
- [MAL-2026-1967](https://insights.sbomify.com/MAL-2026-1967/): Malicious code in rollup-plugin-polyfill-build (npm) (malicious package)
- [MAL-2026-1966](https://insights.sbomify.com/MAL-2026-1966/): Malicious code in restaking-apy-module (npm) (malicious package)
- [MAL-2026-1965](https://insights.sbomify.com/MAL-2026-1965/): Malicious code in pretty-ts-logger (npm) (malicious package)
- [MAL-2026-1964](https://insights.sbomify.com/MAL-2026-1964/): Malicious code in pretty-loggers (npm) (malicious package)
- [MAL-2026-1963](https://insights.sbomify.com/MAL-2026-1963/): Malicious code in polymarket-onchain (npm) (malicious package)
- [MAL-2026-1962](https://insights.sbomify.com/MAL-2026-1962/): Malicious code in parsejson-pro (npm) (malicious package)
- [MAL-2026-1961](https://insights.sbomify.com/MAL-2026-1961/): Malicious code in novi-cli (npm) (malicious package)
- [MAL-2026-1960](https://insights.sbomify.com/MAL-2026-1960/): Malicious code in nodex-db (npm) (malicious package)
- [MAL-2026-196](https://insights.sbomify.com/MAL-2026-196/): Malicious code in oe-oauth (npm) (malicious package)
- [MAL-2026-1959](https://insights.sbomify.com/MAL-2026-1959/): Malicious code in node-business (npm) (malicious package)
- [MAL-2026-1958](https://insights.sbomify.com/MAL-2026-1958/): Malicious code in mtpmysql (npm) (malicious package)
- [MAL-2026-1957](https://insights.sbomify.com/MAL-2026-1957/): Malicious code in mtpdb (npm) (malicious package)
- [MAL-2026-1956](https://insights.sbomify.com/MAL-2026-1956/): Malicious code in llmstash (npm) (malicious package)
- [MAL-2026-1955](https://insights.sbomify.com/MAL-2026-1955/): Malicious code in kyxserver-everything (npm) (malicious package)
- [MAL-2026-1954](https://insights.sbomify.com/MAL-2026-1954/): Malicious code in kyxhiagent123 (npm) (malicious package)
- [MAL-2026-1953](https://insights.sbomify.com/MAL-2026-1953/): Malicious code in kyxhiagent (npm) (malicious package)
- [MAL-2026-1952](https://insights.sbomify.com/MAL-2026-1952/): Malicious code in json-parse-genie (npm) (malicious package)
- [MAL-2026-1951](https://insights.sbomify.com/MAL-2026-1951/): Malicious code in interface-builder-kit (npm) (malicious package)
- [MAL-2026-1950](https://insights.sbomify.com/MAL-2026-1950/): Malicious code in hiagenttest (npm) (malicious package)
- [MAL-2026-195](https://insights.sbomify.com/MAL-2026-195/): Malicious code in mui7icons (npm) (malicious package)
- [MAL-2026-1949](https://insights.sbomify.com/MAL-2026-1949/): Malicious code in hackerhacker (npm) (malicious package)
- [MAL-2026-1948](https://insights.sbomify.com/MAL-2026-1948/): Malicious code in fadlsjf (npm) (malicious package)
- [MAL-2026-1947](https://insights.sbomify.com/MAL-2026-1947/): Malicious code in el-icon (npm) (malicious package)
- [MAL-2026-1946](https://insights.sbomify.com/MAL-2026-1946/): Malicious code in decode-sdk (npm) (malicious package)
- [MAL-2026-1945](https://insights.sbomify.com/MAL-2026-1945/): Malicious code in cryptopapi (npm) (malicious package)
- [MAL-2026-1944](https://insights.sbomify.com/MAL-2026-1944/): Malicious code in couplus-cli (npm) (malicious package)
- [MAL-2026-1943](https://insights.sbomify.com/MAL-2026-1943/): Malicious code in clob-utils-sdks (npm) (malicious package)
- [MAL-2026-1942](https://insights.sbomify.com/MAL-2026-1942/): Malicious code in clob-client-sdks (npm) (malicious package)
- [MAL-2026-1941](https://insights.sbomify.com/MAL-2026-1941/): Malicious code in client-hash-sdk (npm) (malicious package)
- [MAL-2026-1940](https://insights.sbomify.com/MAL-2026-1940/): Malicious code in @validates-sdk/v3 (npm) (malicious package)
- [MAL-2026-194](https://insights.sbomify.com/MAL-2026-194/): Malicious code in mui7 (npm) (malicious package)
- [MAL-2026-1939](https://insights.sbomify.com/MAL-2026-1939/): Malicious code in @solana-launchpads/sdk (npm) (malicious package)
- [MAL-2026-1938](https://insights.sbomify.com/MAL-2026-1938/): Malicious code in @metaplex-foundations/umi-public-keys (npm) (malicious package)
- [MAL-2026-1937](https://insights.sbomify.com/MAL-2026-1937/): Malicious code in @dotprompt/promptly-darwin-arm64 (npm) (malicious package)
- [MAL-2026-1936](https://insights.sbomify.com/MAL-2026-1936/): Malicious code in lint-builder (npm) (malicious package)
- [MAL-2026-1935](https://insights.sbomify.com/MAL-2026-1935/): Malicious code in jsonify-bundler (npm) (malicious package)
- [MAL-2026-1934](https://insights.sbomify.com/MAL-2026-1934/): Malicious code in big-nunber (npm) (malicious package)
- [MAL-2026-1933](https://insights.sbomify.com/MAL-2026-1933/): Malicious code in libavcodec-extra (PyPI) (malicious package)
- [MAL-2026-1932](https://insights.sbomify.com/MAL-2026-1932/): Malicious code in react-native-international-phone-number (npm) (malicious package)
- [MAL-2026-1931](https://insights.sbomify.com/MAL-2026-1931/): Malicious code in react-native-country-select (npm) (malicious package)
- [MAL-2026-1930](https://insights.sbomify.com/MAL-2026-1930/): Malicious code in @iflow-mcp/watercrawl-watercrawl-mcp (npm) (malicious package)
- [MAL-2026-193](https://insights.sbomify.com/MAL-2026-193/): Malicious code in cko-ui-toolkit (npm) (malicious package)
- [MAL-2026-1929](https://insights.sbomify.com/MAL-2026-1929/): Malicious code in @aifabrix/miso-client (npm) (malicious package)
- [MAL-2026-1928](https://insights.sbomify.com/MAL-2026-1928/): Malicious code in changelog-logger-wrap (npm) (malicious package)
- [MAL-2026-1927](https://insights.sbomify.com/MAL-2026-1927/): Malicious code in changelog-logger-utils (npm) (malicious package)
- [MAL-2026-1926](https://insights.sbomify.com/MAL-2026-1926/): Malicious code in tokenshower (npm) (malicious package)
- [MAL-2026-1925](https://insights.sbomify.com/MAL-2026-1925/): Malicious code in jsonify-parser (npm) (malicious package)
- [MAL-2026-1924](https://insights.sbomify.com/MAL-2026-1924/): Malicious code in testcatplzignore (RubyGems) (malicious package)
- [MAL-2026-1923](https://insights.sbomify.com/MAL-2026-1923/): Malicious code in sq-minimal-feature-flags (RubyGems) (malicious package)
- [MAL-2026-1922](https://insights.sbomify.com/MAL-2026-1922/): Malicious code in rubylogger (RubyGems) (malicious package)
- [MAL-2026-1921](https://insights.sbomify.com/MAL-2026-1921/): Malicious code in resolvrtest (RubyGems) (malicious package)
- [MAL-2026-1920](https://insights.sbomify.com/MAL-2026-1920/): Malicious code in rails_structured_logging (RubyGems) (malicious package)
- [MAL-2026-192](https://insights.sbomify.com/MAL-2026-192/): Malicious code in @testfeii/hallo-word (npm) (malicious package)
- [MAL-2026-1919](https://insights.sbomify.com/MAL-2026-1919/): Malicious code in rafka-rb (RubyGems) (malicious package)
- [MAL-2026-1918](https://insights.sbomify.com/MAL-2026-1918/): Malicious code in newlogger (RubyGems) (malicious package)
- [MAL-2026-1917](https://insights.sbomify.com/MAL-2026-1917/): Malicious code in kaleido (RubyGems) (malicious package)
- [MAL-2026-1916](https://insights.sbomify.com/MAL-2026-1916/): Malicious code in freshworks-ruby (RubyGems) (malicious package)
- [MAL-2026-1915](https://insights.sbomify.com/MAL-2026-1915/): Malicious code in doctolib (RubyGems) (malicious package)
- [MAL-2026-1914](https://insights.sbomify.com/MAL-2026-1914/): Malicious code in tabullate (PyPI) (malicious package)
- [MAL-2026-1913](https://insights.sbomify.com/MAL-2026-1913/): Malicious code in suficloud (PyPI) (malicious package)
- [MAL-2026-1912](https://insights.sbomify.com/MAL-2026-1912/): Malicious code in quantumania (PyPI) (malicious package)
- [MAL-2026-1911](https://insights.sbomify.com/MAL-2026-1911/): Malicious code in prometheus-quicker-analysis (PyPI) (malicious package)
- [MAL-2026-1910](https://insights.sbomify.com/MAL-2026-1910/): Malicious code in prometheus-quick-analysis (PyPI) (malicious package)
- [MAL-2026-191](https://insights.sbomify.com/MAL-2026-191/): Malicious code in libc-dev (PyPI) (malicious package)
- [MAL-2026-1909](https://insights.sbomify.com/MAL-2026-1909/): Malicious code in prometheus-fast-analysis (PyPI) (malicious package)
- [MAL-2026-1908](https://insights.sbomify.com/MAL-2026-1908/): Malicious code in prometheus-analysis-1 (PyPI) (malicious package)
- [MAL-2026-1907](https://insights.sbomify.com/MAL-2026-1907/): Malicious code in prometheus-analysis (PyPI) (malicious package)
- [MAL-2026-1906](https://insights.sbomify.com/MAL-2026-1906/): Malicious code in loveclose2 (PyPI) (malicious package)
- [MAL-2026-1905](https://insights.sbomify.com/MAL-2026-1905/): Malicious code in loveclose1 (PyPI) (malicious package)
- [MAL-2026-1904](https://insights.sbomify.com/MAL-2026-1904/): Malicious code in loveclose (PyPI) (malicious package)
- [MAL-2026-1903](https://insights.sbomify.com/MAL-2026-1903/): Malicious code in loveahmedclose (PyPI) (malicious package)
- [MAL-2026-1902](https://insights.sbomify.com/MAL-2026-1902/): Malicious code in helloharry123t-package (PyPI) (malicious package)
- [MAL-2026-1901](https://insights.sbomify.com/MAL-2026-1901/): Malicious code in ethical-demo-liviy (PyPI) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/97/