Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in wagmi-react (npm) MAL-2026-12498 | Malicious | Not scored | 05 Aug, 2026 | npm wagmi-react |
Malicious release: Malicious code in cors-security (npm) MAL-2026-12357 | Malicious | Not scored | 05 Aug, 2026 | npm cors-security |
Malicious release: Malicious code in shift-sdk-v5 (npm) MAL-2026-12436 | Malicious | Not scored | 05 Aug, 2026 | npm shift-sdk-v5 |
Malicious release: Malicious code in react-native-ui-message (npm) GHSA-w3j6-3pww-qfcw, MAL-2026-12424 | Malicious | Not scored | 05 Aug, 2026 | npm react-native-ui-message |
Malicious release: Malicious code in table-ui-new (npm) MAL-2026-12473 | Malicious | Not scored | 05 Aug, 2026 | npm table-ui-new |
Malicious release: Malicious code in com.db.dbk.ui-forms (npm) MAL-2026-12355 | Malicious | Not scored | 05 Aug, 2026 | npm com.db.dbk.ui-forms |
Malicious release: Malicious code in @offa/offa-uwk (npm) MAL-2026-12326 | Malicious | Not scored | 05 Aug, 2026 | npm @offa/offa-uwk |
Malicious release: Malicious code in gekko-trading-bot (npm) MAL-2026-12388 | Malicious | Not scored | 05 Aug, 2026 | npm gekko-trading-bot |
Malicious release: Malicious code in express-middle (npm) MAL-2026-12376 | Malicious | Not scored | 05 Aug, 2026 | npm express-middle |
Malicious release: Malicious code in caldora (npm) MAL-2026-12344 | Malicious | Not scored | 05 Aug, 2026 | npm caldora |
Malicious release: Malicious code in chai-assertions-plus (npm) MAL-2026-12349 | Malicious | Not scored | 05 Aug, 2026 | npm chai-assertions-plus |
Malicious release: Malicious code in wallet-analytics (npm) GHSA-xf3p-c585-94jr, MAL-2026-12499 | Malicious | Not scored | 05 Aug, 2026 | npm wallet-analytics |
Malicious release: Malicious code in ventrix-kit (npm) MAL-2026-12494 | Malicious | Not scored | 05 Aug, 2026 | npm ventrix-kit |
Malicious release: Malicious code in @ccfly/setup-darwin-x64 (npm) MAL-2026-12313 | Malicious | Not scored | 05 Aug, 2026 | npm @ccfly/setup-darwin-x64 |
Malicious release: Malicious code in new-native-tools-linux-x64-gnu (npm) MAL-2026-12402 | Malicious | Not scored | 05 Aug, 2026 | npm new-native-tools-linux-x64-gnu |
Malicious release: Malicious code in streak-bucket-core (npm) MAL-2026-12457 | Malicious | Not scored | 05 Aug, 2026 | npm streak-bucket-core |
Malicious release: Malicious code in prokit-core (npm) MAL-2026-12420 | Malicious | Not scored | 05 Aug, 2026 | npm prokit-core |
Malicious release: Malicious code in pfp-block-mobile-past-meetup-list (npm) GHSA-qxjp-57vp-657q, MAL-2026-12409 | Malicious | Not scored | 05 Aug, 2026 | npm pfp-block-mobile-past-meetup-list |
Malicious release: Malicious code in pfa-errors (npm) GHSA-c4mr-v4hr-px3m, MAL-2026-12406 | Malicious | Not scored | 05 Aug, 2026 | npm pfa-errors |
Malicious release: Malicious code in statist-browser-typed-client-sme.platform.mobile.voip.common.events (npm) GHSA-9qrw-ccpr-p9w3, MAL-2026-12452 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-sme.platform.mobile.voip.common.events |
Malicious release: Malicious code in fb-forms-form-boilerplate-contacts (npm) GHSA-rrc5-66g2-j59f, MAL-2026-12380 | Malicious | Not scored | 05 Aug, 2026 | npm fb-forms-form-boilerplate-contacts |
Malicious release: Malicious code in @wololasod/tiny-id (npm) MAL-2026-12331 | Malicious | Not scored | 05 Aug, 2026 | npm @wololasod/tiny-id |
Malicious release: Malicious code in viem-toolkit (npm) MAL-2026-12495 | Malicious | Not scored | 05 Aug, 2026 | npm viem-toolkit |
Malicious release: Malicious code in pfp-block-mobile-vacancy-description (npm) GHSA-57wq-2hqh-pr73, MAL-2026-12411 | Malicious | Not scored | 05 Aug, 2026 | npm pfp-block-mobile-vacancy-description |
Malicious release: Malicious code in @agenthub-ai/agent (npm) GHSA-p2hv-cfx8-pv93, MAL-2026-12312 | Malicious | Not scored | 05 Aug, 2026 | npm @agenthub-ai/agent |
Malicious release: Malicious code in streak-math-lib (npm) GHSA-h6vq-775w-5ccg, MAL-2026-12469 | Malicious | Not scored | 05 Aug, 2026 | npm streak-math-lib |
Malicious release: Malicious code in @mgor/fw-canary-3333 (npm) MAL-2026-12322 | Malicious | Not scored | 05 Aug, 2026 | npm @mgor/fw-canary-3333 |
Malicious release: Malicious code in streak-core-insights (npm) GHSA-v7qq-2qm4-hcjx, MAL-2026-12459 | Malicious | Not scored | 05 Aug, 2026 | npm streak-core-insights |
Malicious release: Malicious code in pfa-prettier-config (npm) GHSA-qmmm-73xw-c3f2, MAL-2026-12407 | Malicious | Not scored | 05 Aug, 2026 | npm pfa-prettier-config |
Malicious release: Malicious code in tui-react-tooltip (npm) GHSA-m4vv-cf6m-g553, MAL-2026-12489 | Malicious | Not scored | 05 Aug, 2026 | npm tui-react-tooltip |
Malicious release: Malicious code in pfp-forms-sme-loan (npm) GHSA-p37j-6hr3-m2q3, MAL-2026-12414 | Malicious | Not scored | 05 Aug, 2026 | npm pfp-forms-sme-loan |
Malicious release: Malicious code in tcb-web-header (npm) GHSA-v68w-vmp6-9p6v, MAL-2026-12476 | Malicious | Not scored | 05 Aug, 2026 | npm tcb-web-header |
Malicious release: Malicious code in streak-day-primitives (npm) GHSA-792g-8w6v-23q8, MAL-2026-12463 | Malicious | Not scored | 05 Aug, 2026 | npm streak-day-primitives |
Malicious release: Malicious code in @zahlen/checkout-angular (npm) GHSA-x4vv-h5rq-v2hm, MAL-2026-12332 | Malicious | Not scored | 05 Aug, 2026 | npm @zahlen/checkout-angular |
Malicious release: Malicious code in streak-daybucket (npm) GHSA-6hxq-4f7r-8562, MAL-2026-12464 | Malicious | Not scored | 05 Aug, 2026 | npm streak-daybucket |
Malicious release: Malicious code in github-app-sts-action (npm) GHSA-wmg2-8x3r-rg73, MAL-2026-12389 | Malicious | Not scored | 05 Aug, 2026 | npm github-app-sts-action |
Malicious release: Malicious code in streak-daily-core (npm) GHSA-8vjj-vq79-pf8g, MAL-2026-12461 | Malicious | Not scored | 05 Aug, 2026 | npm streak-daily-core |
Malicious release: Malicious code in react-table-core (npm) MAL-2026-12425 | Malicious | Not scored | 05 Aug, 2026 | npm react-table-core |
Malicious release: Malicious code in sme-foundation-frame-manager (npm) GHSA-v4gj-p36r-rv6m, MAL-2026-12439 | Malicious | Not scored | 05 Aug, 2026 | npm sme-foundation-frame-manager |
Malicious release: Malicious code in dolyame-boxy-independent-bnpl-open-api (npm) GHSA-8hvr-g6xj-288x, MAL-2026-12366 | Malicious | Not scored | 05 Aug, 2026 | npm dolyame-boxy-independent-bnpl-open-api |
Malicious release: Malicious code in eventea-diag (npm) GHSA-c86h-3ch7-5r5g, MAL-2026-12373 | Malicious | Not scored | 05 Aug, 2026 | npm eventea-diag |
Malicious release: Malicious code in eth-crypto-utils (npm) MAL-2026-12372 | Malicious | Not scored | 05 Aug, 2026 | npm eth-crypto-utils |
Malicious release: Malicious code in async-mutex-hook (npm) MAL-2026-12339 | Malicious | Not scored | 05 Aug, 2026 | npm async-mutex-hook |
Malicious release: Malicious code in evo-web-base-analytics-data (npm) GHSA-qcvh-54j6-qmcr, MAL-2026-12375 | Malicious | Not scored | 05 Aug, 2026 | npm evo-web-base-analytics-data |
Malicious release: Malicious code in statist-browser-typed-client-mb.product.mclaccount (npm) GHSA-jgcr-c5v4-547r, MAL-2026-12447 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-mb.product.mclaccount |
Malicious release: Malicious code in afisha-storybook-default (npm) MAL-2026-12336 | Malicious | Not scored | 05 Aug, 2026 | npm afisha-storybook-default |
Malicious release: Malicious code in post-css-transfer (npm) GHSA-f5h9-q436-8chv, MAL-2026-12417 | Malicious | Not scored | 05 Aug, 2026 | npm post-css-transfer |
Malicious release: Malicious code in gekko-mev-bot (npm) MAL-2026-12387 | Malicious | Not scored | 05 Aug, 2026 | npm gekko-mev-bot |
Malicious release: Malicious code in fry-page-maker-types (npm) GHSA-h63m-5wpm-mh34, MAL-2026-12385 | Malicious | Not scored | 05 Aug, 2026 | npm fry-page-maker-types |
Malicious release: Malicious code in eventea-router (npm) GHSA-h6vh-72w4-x86w, MAL-2026-12374 | Malicious | Not scored | 05 Aug, 2026 | npm eventea-router |