# Vulnerabilities published in 2026 - [MAL-2026-18374](https://insights.sbomify.com/MAL-2026-18374/): Malicious code in dsh-volcengine-provider (npm) (malicious package) - [MAL-2026-18373](https://insights.sbomify.com/MAL-2026-18373/): Malicious code in @zmtcdn/ui (npm) (malicious package) - [MAL-2026-18372](https://insights.sbomify.com/MAL-2026-18372/): Malicious code in @zmtcdn/components (npm) (malicious package) - [MAL-2026-18371](https://insights.sbomify.com/MAL-2026-18371/): Malicious code in mw-test-utils (npm) (malicious package) - [MAL-2026-18370](https://insights.sbomify.com/MAL-2026-18370/): Malicious code in mw-communication-client (npm) (malicious package) - [MAL-2026-1837](https://insights.sbomify.com/MAL-2026-1837/): Malicious code in react-query-core-utils (npm) (malicious package) - [MAL-2026-18369](https://insights.sbomify.com/MAL-2026-18369/): Malicious code in mui-wrapper-x-date-pickers (npm) (malicious package) - [MAL-2026-18368](https://insights.sbomify.com/MAL-2026-18368/): Malicious code in spectral-net-probe (npm) (malicious package) - [MAL-2026-18367](https://insights.sbomify.com/MAL-2026-18367/): Malicious code in identity-two-factor (npm) (malicious package) - [MAL-2026-18366](https://insights.sbomify.com/MAL-2026-18366/): Malicious code in dsh-redteam-mode (npm) (malicious package) - [MAL-2026-18365](https://insights.sbomify.com/MAL-2026-18365/): Malicious code in b20miner (npm) (malicious package) - [MAL-2026-18364](https://insights.sbomify.com/MAL-2026-18364/): Malicious code in @zaip-ai/cli (npm) (malicious package) - [MAL-2026-18363](https://insights.sbomify.com/MAL-2026-18363/): Malicious code in itsa-utils (npm) (malicious package) - [MAL-2026-18362](https://insights.sbomify.com/MAL-2026-18362/): Malicious code in transaction-info-generate-sdk (npm) (malicious package) - [MAL-2026-18361](https://insights.sbomify.com/MAL-2026-18361/): Malicious code in mock-transactions-sdk (npm) (malicious package) - [MAL-2026-18360](https://insights.sbomify.com/MAL-2026-18360/): Malicious code in itsa-react-checkbox (npm) (malicious package) - [MAL-2026-1836](https://insights.sbomify.com/MAL-2026-1836/): Malicious code in react-performance-suite (npm) (malicious package) - [MAL-2026-18359](https://insights.sbomify.com/MAL-2026-18359/): Malicious code in black-spindle (npm) (malicious package) - [MAL-2026-18358](https://insights.sbomify.com/MAL-2026-18358/): Malicious code in @testsecuiitytestme/cache-helper (npm) (malicious package) - [MAL-2026-18357](https://insights.sbomify.com/MAL-2026-18357/): Malicious code in csvflow-schema (npm) (malicious package) - [MAL-2026-18356](https://insights.sbomify.com/MAL-2026-18356/): Malicious code in @webapp-shared/login-vmok (npm) (malicious package) - [MAL-2026-18355](https://insights.sbomify.com/MAL-2026-18355/): Malicious code in glyphmatrix-fixture (npm) (malicious package) - [MAL-2026-18354](https://insights.sbomify.com/MAL-2026-18354/): Malicious code in trajmetrics (PyPI) (malicious package) - [MAL-2026-18353](https://insights.sbomify.com/MAL-2026-18353/): Malicious code in csec-form-validatorr (npm) (malicious package) - [MAL-2026-18352](https://insights.sbomify.com/MAL-2026-18352/): Malicious code in csec-form-validator (npm) (malicious package) - [MAL-2026-18351](https://insights.sbomify.com/MAL-2026-18351/): Malicious code in csec-crypto-toolkit (npm) (malicious package) - [MAL-2026-18350](https://insights.sbomify.com/MAL-2026-18350/): Malicious code in ccsseecc-form-validator (npm) (malicious package) - [MAL-2026-1835](https://insights.sbomify.com/MAL-2026-1835/): Malicious code in react-fast-utilsa (npm) (malicious package) - [MAL-2026-18349](https://insights.sbomify.com/MAL-2026-18349/): Malicious code in ccsseecc-crypto-toolkit (npm) (malicious package) - [MAL-2026-18348](https://insights.sbomify.com/MAL-2026-18348/): Malicious code in ccsec-form-validator (npm) (malicious package) - [MAL-2026-18347](https://insights.sbomify.com/MAL-2026-18347/): Malicious code in ccsec-crypto-toolkit (npm) (malicious package) - [MAL-2026-18346](https://insights.sbomify.com/MAL-2026-18346/): Malicious code in agentenact (npm) (malicious package) - [MAL-2026-18345](https://insights.sbomify.com/MAL-2026-18345/): Malicious code in dsh-vm-tester (npm) (malicious package) - [MAL-2026-18344](https://insights.sbomify.com/MAL-2026-18344/): Malicious code in adyen-web-v6 (npm) (malicious package) - [MAL-2026-18343](https://insights.sbomify.com/MAL-2026-18343/): Malicious code in numprint (PyPI) (malicious package) - [MAL-2026-18342](https://insights.sbomify.com/MAL-2026-18342/): Malicious code in string-target-mapper-hash (npm) (malicious package) - [MAL-2026-18341](https://insights.sbomify.com/MAL-2026-18341/): Malicious code in macro-kernel-record-reader (npm) (malicious package) - [MAL-2026-18340](https://insights.sbomify.com/MAL-2026-18340/): Malicious code in fetch-hash-cache-atomic (npm) (malicious package) - [MAL-2026-1834](https://insights.sbomify.com/MAL-2026-1834/): Malicious code in rce-pkg-2 (npm) (malicious package) - [MAL-2026-18339](https://insights.sbomify.com/MAL-2026-18339/): Malicious code in buttoncontent (npm) (malicious package) - [MAL-2026-18338](https://insights.sbomify.com/MAL-2026-18338/): Malicious code in @azure-growth/signup-ux-components (npm) (malicious package) - [MAL-2026-18337](https://insights.sbomify.com/MAL-2026-18337/): Malicious code in @camera.ui/camera-ui-nvr-windows-amd64 (npm) (malicious package) - [MAL-2026-18336](https://insights.sbomify.com/MAL-2026-18336/): Malicious code in h13t0ry-hello-demo (PyPI) (malicious package) - [MAL-2026-18335](https://insights.sbomify.com/MAL-2026-18335/): Malicious code in ctf-agent (npm) (malicious package) - [MAL-2026-18334](https://insights.sbomify.com/MAL-2026-18334/): Malicious code in postcss-semantic-themes (npm) (malicious package) - [MAL-2026-18333](https://insights.sbomify.com/MAL-2026-18333/): Malicious code in path-stream-utils-testmetest (npm) (malicious package) - [MAL-2026-18332](https://insights.sbomify.com/MAL-2026-18332/): Malicious code in harlow-css-mixer (npm) (malicious package) - [MAL-2026-18331](https://insights.sbomify.com/MAL-2026-18331/): Malicious code in birch-css-utils (npm) (malicious package) - [MAL-2026-18330](https://insights.sbomify.com/MAL-2026-18330/): Malicious code in @iobandamwer/native-helper (npm) (malicious package) - [MAL-2026-1833](https://insights.sbomify.com/MAL-2026-1833/): Malicious code in rce-pkg-1 (npm) (malicious package) - [MAL-2026-18329](https://insights.sbomify.com/MAL-2026-18329/): Malicious code in @iobandamwer/cache-helper (npm) (malicious package) - [MAL-2026-18328](https://insights.sbomify.com/MAL-2026-18328/): Malicious code in netweavex (PyPI) (malicious package) - [MAL-2026-18327](https://insights.sbomify.com/MAL-2026-18327/): Malicious code in zagents-framework (PyPI) (malicious package) - [MAL-2026-18326](https://insights.sbomify.com/MAL-2026-18326/): Malicious code in changes-lxc-wrapper (PyPI) (malicious package) - [MAL-2026-18325](https://insights.sbomify.com/MAL-2026-18325/): Malicious code in @worca/app (npm) (malicious package) - [MAL-2026-18324](https://insights.sbomify.com/MAL-2026-18324/): Malicious code in publish-poc-test3 (npm) (malicious package) - [MAL-2026-18323](https://insights.sbomify.com/MAL-2026-18323/): Malicious code in publish-poc-base (npm) (malicious package) - [MAL-2026-18322](https://insights.sbomify.com/MAL-2026-18322/): Malicious code in numbors (npm) (malicious package) - [MAL-2026-18321](https://insights.sbomify.com/MAL-2026-18321/): Malicious code in dsh-plugin-blender-3d (npm) (malicious package) - [MAL-2026-18320](https://insights.sbomify.com/MAL-2026-18320/): Malicious code in @walknpm/todo-cli (npm) (malicious package) - [MAL-2026-1832](https://insights.sbomify.com/MAL-2026-1832/): Malicious code in ranko887 (npm) (malicious package) - [MAL-2026-18319](https://insights.sbomify.com/MAL-2026-18319/): Malicious code in @sxm-web/client-sdk-core (npm) (malicious package) - [MAL-2026-18318](https://insights.sbomify.com/MAL-2026-18318/): Malicious code in @greenlake/mfe-login-url (npm) (malicious package) - [MAL-2026-18317](https://insights.sbomify.com/MAL-2026-18317/): Malicious code in @greenlake/context-pane (npm) (malicious package) - [MAL-2026-18316](https://insights.sbomify.com/MAL-2026-18316/): Malicious code in @greenlake/auth (npm) (malicious package) - [MAL-2026-18315](https://insights.sbomify.com/MAL-2026-18315/): Malicious code in dsh-native (npm) (malicious package) - [MAL-2026-18314](https://insights.sbomify.com/MAL-2026-18314/): Malicious code in css-hnhxwd-polyfill (npm) (malicious package) - [MAL-2026-18313](https://insights.sbomify.com/MAL-2026-18313/): Malicious code in css-grid-snap-util (npm) (malicious package) - [MAL-2026-18312](https://insights.sbomify.com/MAL-2026-18312/): Malicious code in css-flexgap-shim (npm) (malicious package) - [MAL-2026-18311](https://insights.sbomify.com/MAL-2026-18311/): Malicious code in bow-test (npm) (malicious package) - [MAL-2026-18310](https://insights.sbomify.com/MAL-2026-18310/): Malicious code in @regex33-hackerone/tb-compat (npm) (malicious package) - [MAL-2026-1831](https://insights.sbomify.com/MAL-2026-1831/): Malicious code in rabbitmq-sdk (npm) (malicious package) - [MAL-2026-18309](https://insights.sbomify.com/MAL-2026-18309/): Malicious code in @s4yhiitestpoc/scan-https-dualuse-e (npm) (malicious package) - [MAL-2026-18308](https://insights.sbomify.com/MAL-2026-18308/): Malicious code in @s4yhiitestpoc/scan-echo-b (npm) (malicious package) - [MAL-2026-18307](https://insights.sbomify.com/MAL-2026-18307/): Malicious code in @s4yhiitestpoc/scan-dns-c (npm) (malicious package) - [MAL-2026-18306](https://insights.sbomify.com/MAL-2026-18306/): Malicious code in @s4yhiitestpoc/scan-control-a (npm) (malicious package) - [MAL-2026-18305](https://insights.sbomify.com/MAL-2026-18305/): Malicious code in @s4yhiitestpoc/r2-https-dualuse (npm) (malicious package) - [MAL-2026-18304](https://insights.sbomify.com/MAL-2026-18304/): Malicious code in @s4yhiitestpoc/r2-echo (npm) (malicious package) - [MAL-2026-18303](https://insights.sbomify.com/MAL-2026-18303/): Malicious code in @s4yhiitestpoc/r2-dns (npm) (malicious package) - [MAL-2026-18302](https://insights.sbomify.com/MAL-2026-18302/): Malicious code in @s4yhiitestpoc/r2-control (npm) (malicious package) - [MAL-2026-18301](https://insights.sbomify.com/MAL-2026-18301/): Malicious code in dictmerge-lite (PyPI) (malicious package) - [MAL-2026-18300](https://insights.sbomify.com/MAL-2026-18300/): Malicious code in claudeopusenifile (PyPI) (malicious package) - [MAL-2026-1830](https://insights.sbomify.com/MAL-2026-1830/): Malicious code in r1dfg6789 (npm) (malicious package) - [MAL-2026-183](https://insights.sbomify.com/MAL-2026-183/): Malicious code in yunxohang11 (npm) (malicious package) - [MAL-2026-18299](https://insights.sbomify.com/MAL-2026-18299/): Malicious code in claudeopuseni (PyPI) (malicious package) - [MAL-2026-18298](https://insights.sbomify.com/MAL-2026-18298/): Malicious code in claudeopusfile (PyPI) (malicious package) - [MAL-2026-18297](https://insights.sbomify.com/MAL-2026-18297/): Malicious code in nebulallm (PyPI) (malicious package) - [MAL-2026-18296](https://insights.sbomify.com/MAL-2026-18296/): Malicious code in zagents-message-bus (PyPI) (malicious package) - [MAL-2026-18295](https://insights.sbomify.com/MAL-2026-18295/): Malicious code in @capsense/core-ui (npm) (malicious package) - [MAL-2026-18294](https://insights.sbomify.com/MAL-2026-18294/): Malicious code in @capsense/ccx-welcome-page (npm) (malicious package) - [MAL-2026-18293](https://insights.sbomify.com/MAL-2026-18293/): Malicious code in w-mousekey (npm) (malicious package) - [MAL-2026-18292](https://insights.sbomify.com/MAL-2026-18292/): Malicious code in event-bus-lite-testmetest (npm) (malicious package) - [MAL-2026-18291](https://insights.sbomify.com/MAL-2026-18291/): Malicious code in sc-hydrate-carousel-price (npm) (malicious package) - [MAL-2026-18290](https://insights.sbomify.com/MAL-2026-18290/): Malicious code in react-native-bright-sdk (npm) (malicious package) - [MAL-2026-1829](https://insights.sbomify.com/MAL-2026-1829/): Malicious code in pru-lib-ng (npm) (malicious package) - [MAL-2026-18289](https://insights.sbomify.com/MAL-2026-18289/): Malicious code in paychex-pdftron (npm) (malicious package) - [MAL-2026-18288](https://insights.sbomify.com/MAL-2026-18288/): Malicious code in jshelperdependenceny (npm) (malicious package) - [MAL-2026-18287](https://insights.sbomify.com/MAL-2026-18287/): Malicious code in @ppa-web-components/ppa-searchform (npm) (malicious package) - [MAL-2026-18286](https://insights.sbomify.com/MAL-2026-18286/): Malicious code in @ppa-web-components/ppa-navigation (npm) (malicious package) - [MAL-2026-18285](https://insights.sbomify.com/MAL-2026-18285/): Malicious code in @postex/common (npm) (malicious package) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/99/