Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in xzvexpzcbailey (npm) GHSA-73c8-rgvx-fw82, MAL-2026-17412 | Malicious | Not scored | 11 days ago | npm xzvexpzcbailey |
Malicious release: Malicious code in prastzy (npm) GHSA-mwjq-f2w5-934c, MAL-2026-17448 | Malicious | Not scored | 11 days ago | npm prastzy |
Malicious release: Malicious code in @fmr-ap149494/apex-base-component (npm) MAL-2026-17929 | Malicious | Not scored | 11 days ago | npm @fmr-ap149494/apex-base-component |
Malicious release: Malicious code in @fcsmc/commercial-analytics (npm) MAL-2026-17928 | Malicious | Not scored | 11 days ago | npm @fcsmc/commercial-analytics |
Malicious release: Malicious code in @fluxionii/baileys (npm) GHSA-98x4-5hvc-62qx, MAL-2026-17925 | Malicious | Not scored | 11 days ago | npm @fluxionii/baileys |
Malicious release: Malicious code in @ostyado/baileys (npm) GHSA-v73c-2rgc-m2jx, MAL-2026-17372 | Malicious | Not scored | 11 days ago | npm @ostyado/baileys |
Malicious release: Malicious code in animate-tailwind-kit (npm) MAL-2026-18065 | Malicious | Not scored | 11 days ago | npm animate-tailwind-kit |
Malicious release: Malicious code in animate-twcss-bridge (npm) MAL-2026-18066 | Malicious | Not scored | 11 days ago | npm animate-twcss-bridge |
Malicious release: Malicious code in animate-twcss-pack (npm) MAL-2026-18067 | Malicious | Not scored | 11 days ago | npm animate-twcss-pack |
Malicious release: Malicious code in animatecss-tailwind-binary (npm) MAL-2026-18068 | Malicious | Not scored | 11 days ago | npm animatecss-tailwind-binary |
Malicious release: Malicious code in animatecss-tailwind-graphic (npm) MAL-2026-18069 | Malicious | Not scored | 11 days ago | npm animatecss-tailwind-graphic |
Malicious release: Malicious code in animatecss-tailwind-helper (npm) MAL-2026-18070 | Malicious | Not scored | 11 days ago | npm animatecss-tailwind-helper |
Malicious release: Malicious code in animatecss-tailwind-luminary (npm) MAL-2026-18071 | Malicious | Not scored | 11 days ago | npm animatecss-tailwind-luminary |
Malicious release: Malicious code in animatecss-tailwind-plugin (npm) MAL-2026-18072 | Malicious | Not scored | 11 days ago | npm animatecss-tailwind-plugin |
Malicious release: Malicious code in animatecss-tailwind-presets (npm) MAL-2026-18073 | Malicious | Not scored | 11 days ago | npm animatecss-tailwind-presets |
Malicious release: Malicious code in animatecss-tailwind-vectrix (npm) MAL-2026-18074 | Malicious | Not scored | 11 days ago | npm animatecss-tailwind-vectrix |
Malicious release: Malicious code in signalledger-bridge (npm) MAL-2026-18075 | Malicious | Not scored | 11 days ago | npm signalledger-bridge |
Malicious release: Malicious code in signalledger-diagnostics (npm) MAL-2026-18076 | Malicious | Not scored | 11 days ago | npm signalledger-diagnostics |
Malicious release: Malicious code in tailwind-animaflow-kit (npm) MAL-2026-18077 | Malicious | Not scored | 11 days ago | npm tailwind-animaflow-kit |
Malicious release: Malicious code in tailwind-animate-kit (npm) GHSA-w9j6-p46m-xvp4, MAL-2026-18078 | Malicious | Not scored | 11 days ago | npm tailwind-animate-kit |
Malicious release: Malicious code in tailwind-animatecss-kit (npm) MAL-2026-18079 | Malicious | Not scored | 11 days ago | npm tailwind-animatecss-kit |
Malicious release: Malicious code in tailwind-animationlab (npm) GHSA-7cm4-74gj-gfp2, MAL-2026-18080 | Malicious | Not scored | 11 days ago | npm tailwind-animationlab |
Malicious release: Malicious code in tailwind-css-keyframes (npm) MAL-2026-18081 | Malicious | Not scored | 11 days ago | npm tailwind-css-keyframes |
Malicious release: Malicious code in tailwind-fabric (npm) MAL-2026-18082 | Malicious | Not scored | 11 days ago | npm tailwind-fabric |
Malicious release: Malicious code in tailwind-keyframes (npm) GHSA-vh6h-8m24-j9mj, MAL-2026-18083 | Malicious | Not scored | 11 days ago | npm tailwind-keyframes |
Malicious release: Malicious code in tailwind-kinetic (npm) GHSA-j2r4-xxhh-xx58, MAL-2026-18084 | Malicious | Not scored | 11 days ago | npm tailwind-kinetic |
Malicious release: Malicious code in tailwindcss-animate-catalog (npm) GHSA-4mf5-57pc-vj85, MAL-2026-18085 | Malicious | Not scored | 11 days ago | npm tailwindcss-animate-catalog |
Malicious release: Malicious code in tailwindcss-animatemotion (npm) MAL-2026-18086 | Malicious | Not scored | 11 days ago | npm tailwindcss-animatemotion |
Malicious release: Malicious code in tailwindcss-effect-lab (npm) MAL-2026-18087 | Malicious | Not scored | 11 days ago | npm tailwindcss-effect-lab |
Malicious release: Malicious code in tailwindcss-keyframe-kit (npm) MAL-2026-18088 | Malicious | Not scored | 11 days ago | npm tailwindcss-keyframe-kit |
Malicious release: Malicious code in tailwindcss-motionanimate (npm) MAL-2026-18089 | Malicious | Not scored | 11 days ago | npm tailwindcss-motionanimate |
Malicious release: Malicious code in tailwindcss-visual-kit (npm) MAL-2026-18090 | Malicious | Not scored | 11 days ago | npm tailwindcss-visual-kit |
Malicious release: Malicious code in @pkgship/frpc-linux-arm64 (npm) GHSA-753f-gx8g-q88w, MAL-2026-17922 | Malicious | Not scored | 11 days ago | npm @pkgship/frpc-linux-arm64 |
Malicious release: Malicious code in rootaccessxvv-bbmarker (npm) MAL-2026-18108 | Malicious | Not scored | 12 days ago | npm rootaccessxvv-bbmarker |
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process CVE-2026-111997, GHSA-rxp7-6hxx-x8q5 | Medium | 0.3% | 12 days ago | npm ip-address |
Malicious release: Malicious code in itsa-react-maskedinput (npm) GHSA-hhr5-rjw6-9hr5, MAL-2026-17911 | Malicious | Not scored | 13 days ago | npm itsa-react-maskedinput |
Malicious release: Malicious code in itsa-react-focuscontainer (npm) GHSA-8c34-p746-v5rq, MAL-2026-17910 | Malicious | Not scored | 13 days ago | npm itsa-react-focuscontainer |
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out) CVE-2026-76894, GHSA-vqff-r82h-9crc | Low | Not scored | 13 days ago | npm @aborruso/ckan-mcp-server |
Malicious release: Malicious code in @beloved-lenora/opencode-orchestrator (npm) GHSA-7wq2-8pc2-wm26, MAL-2026-17905 | Malicious | Not scored | 13 days ago | npm @beloved-lenora/opencode-orchestrator |
Malicious release: Malicious code in @beloved-lenora/opencode-shared-rpc (npm) GHSA-8c9g-fwgq-rqq5, MAL-2026-17906 | Malicious | Not scored | 13 days ago | npm @beloved-lenora/opencode-shared-rpc |
Malicious release: Malicious code in @beloved-lenora/opencode-todo (npm) GHSA-9rjq-6mhc-46c5, MAL-2026-17909 | Malicious | Not scored | 13 days ago | npm @beloved-lenora/opencode-todo |
Malicious release: Malicious code in @beloved-lenora/opencode-goal (npm) GHSA-c78h-wwhq-g6j8, MAL-2026-17904 | Malicious | Not scored | 13 days ago | npm @beloved-lenora/opencode-goal |
Malicious release: Malicious code in @beloved-lenora/opencode-stats (npm) GHSA-f4h2-68pg-ffhj, MAL-2026-17908 | Malicious | Not scored | 13 days ago | npm @beloved-lenora/opencode-stats |
Malicious release: Malicious code in @beloved-lenora/opencode-shell-guard (npm) GHSA-pm76-w63j-7j29, MAL-2026-17907 | Malicious | Not scored | 13 days ago | npm @beloved-lenora/opencode-shell-guard |
Malicious release: Malicious code in @beloved-lenora/opencode-btw (npm) GHSA-xv54-6gmc-3xph, MAL-2026-17903 | Malicious | Not scored | 13 days ago | npm @beloved-lenora/opencode-btw |
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint CVE-2026-109461, GHSA-xcx6-jx8p-x3h5 | High | 0.4% | 13 days ago | npm @azure/msal-node |
Malicious release: Malicious code in @xatancchii/natabaileys (npm) GHSA-cgq9-cff6-pf33, MAL-2026-17901 | Malicious | Not scored | 13 days ago | npm @xatancchii/natabaileys |
Malicious release: Malicious code in parxleys (npm) GHSA-rg3c-8x72-6pmc, MAL-2026-17902 | Malicious | Not scored | 13 days ago | npm parxleys |
Malicious release: Malicious code in @flexmr/survey-conversation (npm) GHSA-hc8w-gq4q-fr74, MAL-2026-17899 | Malicious | Not scored | 14 days ago | npm @flexmr/survey-conversation |
Malicious release: Malicious code in @flexmr/survey-client (npm) GHSA-rh7q-f888-q36c, MAL-2026-17898 | Malicious | Not scored | 14 days ago | npm @flexmr/survey-client |