Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in digital-interview-digital-interview-core (npm) GHSA-q8v7-w9cp-xx9g, MAL-2026-12362 | Malicious | Not scored | 05 Aug, 2026 | npm digital-interview-digital-interview-core |
Malicious release: Malicious code in time-linters-webapp-eslint-config (npm) GHSA-xm67-8mvr-77j7, MAL-2026-12479 | Malicious | Not scored | 05 Aug, 2026 | npm time-linters-webapp-eslint-config |
Malicious release: Malicious code in chart-data-utils (npm) MAL-2026-12350 | Malicious | Not scored | 05 Aug, 2026 | npm chart-data-utils |
Malicious release: Malicious code in statist-browser-typed-client-automlplatform.nlppl.searchy (npm) GHSA-w6p7-7c73-jqc9, MAL-2026-12443 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-automlplatform.nlppl.searchy |
Malicious release: Malicious code in react-fontawesome-icons (npm) GHSA-xvfg-jp9r-63q2, MAL-2026-12423 | Malicious | Not scored | 05 Aug, 2026 | npm react-fontawesome-icons |
Malicious release: Malicious code in boxy-fixture-allure (npm) GHSA-cq8x-34cv-8xxm, MAL-2026-12342 | Malicious | Not scored | 05 Aug, 2026 | npm boxy-fixture-allure |
Malicious release: Malicious code in streak-int-lib (npm) GHSA-266j-4pvf-xhwr, MAL-2026-12467 | Malicious | Not scored | 05 Aug, 2026 | npm streak-int-lib |
Malicious release: Malicious code in pvm-autodoc (npm) GHSA-9352-468r-x8fr, MAL-2026-12421 | Malicious | Not scored | 05 Aug, 2026 | npm pvm-autodoc |
Malicious release: Malicious code in statist-browser-typed-client-twork.tsales.nitro.metrics (npm) MAL-2026-12455 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-twork.tsales.nitro.metrics |
Malicious release: Malicious code in streak-metricsa (npm) MAL-2026-12470 | Malicious | Not scored | 05 Aug, 2026 | npm streak-metricsa |
Malicious release: Malicious code in foodi (npm) MAL-2026-12383 | Malicious | Not scored | 05 Aug, 2026 | npm foodi |
Malicious release: Malicious code in tcb-web-copy-to-clipboard (npm) GHSA-3pj2-pfvc-578w, MAL-2026-12475 | Malicious | Not scored | 05 Aug, 2026 | npm tcb-web-copy-to-clipboard |
Malicious release: Malicious code in streak-day-engine (npm) MAL-2026-12462 | Malicious | Not scored | 05 Aug, 2026 | npm streak-day-engine |
Malicious release: Malicious code in statist-browser-typed-client-social.shorts.editor (npm) GHSA-47qq-jwjf-m75c, MAL-2026-12454 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-social.shorts.editor |
Malicious release: Malicious code in pfp-forms-mobile-sme-group-tiles (npm) GHSA-9vp2-g2wh-59wm, MAL-2026-12413 | Malicious | Not scored | 05 Aug, 2026 | npm pfp-forms-mobile-sme-group-tiles |
Malicious release: Malicious code in @copilot-mcp/apex (npm) MAL-2026-12314 | Malicious | Not scored | 05 Aug, 2026 | npm @copilot-mcp/apex |
Malicious release: Malicious code in @zahlen/checkout-react (npm) GHSA-x74p-x7r9-958g, MAL-2026-12333 | Malicious | Not scored | 05 Aug, 2026 | npm @zahlen/checkout-react |
Malicious release: Malicious code in statist-browser-typed-client-sme.rko.finance.web (npm) GHSA-xp46-hchp-5mhp, MAL-2026-12453 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-sme.rko.finance.web |
Malicious release: Malicious code in statist-browser-typed-client-eventea.projects.pfpacquiring (npm) GHSA-p42f-p569-4px5, MAL-2026-12445 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-eventea.projects.pfpacquiring |
Malicious release: Malicious code in streak-daykit (npm) GHSA-7vmx-4mxx-6vxr, MAL-2026-12466 | Malicious | Not scored | 05 Aug, 2026 | npm streak-daykit |
Malicious release: Malicious code in postcss-animate-css-vars (npm) GHSA-432g-6qr7-8hvh, MAL-2026-12418 | Malicious | Not scored | 05 Aug, 2026 | npm postcss-animate-css-vars |
Malicious release: Malicious code in dolyame-boxy-atom-bnpl-email-form (npm) GHSA-5984-qppr-c9h5, MAL-2026-12363 | Malicious | Not scored | 05 Aug, 2026 | npm dolyame-boxy-atom-bnpl-email-form |
Malicious release: Malicious code in hubert-verify-primary-email-am (npm) GHSA-9pwr-3vg2-xwcw, MAL-2026-12391 | Malicious | Not scored | 05 Aug, 2026 | npm hubert-verify-primary-email-am |
Malicious release: Malicious code in dolyame-boxy-independent-bnpl-info-images (npm) GHSA-r7x5-x2pm-qx2v, MAL-2026-12365 | Malicious | Not scored | 05 Aug, 2026 | npm dolyame-boxy-independent-bnpl-info-images |
Malicious release: Malicious code in saas-f-testing (npm) GHSA-fvrj-4h6r-8rcg, MAL-2026-12434 | Malicious | Not scored | 05 Aug, 2026 | npm saas-f-testing |
Malicious release: Malicious code in @lizhao1/memorax-code-internal (npm) MAL-2026-12320 | Malicious | Not scored | 05 Aug, 2026 | npm @lizhao1/memorax-code-internal |
Malicious release: Malicious code in quorvex (npm) MAL-2026-12422 | Malicious | Not scored | 05 Aug, 2026 | npm quorvex |
Malicious release: Malicious code in rollup-packages-node-polyfills (npm) GHSA-gp6f-mxh4-x3mh, MAL-2026-12428 | Malicious | Not scored | 05 Aug, 2026 | npm rollup-packages-node-polyfills |
Malicious release: Malicious code in warp-drive-internal-tooling (npm) MAL-2026-12500 | Malicious | Not scored | 05 Aug, 2026 | npm warp-drive-internal-tooling |
Malicious release: Malicious code in aegis-runtime (npm) MAL-2026-12335 | Malicious | Not scored | 05 Aug, 2026 | npm aegis-runtime |
Malicious release: Malicious code in calendar-streak-core (npm) MAL-2026-12345 | Malicious | Not scored | 05 Aug, 2026 | npm calendar-streak-core |
Malicious release: Malicious code in ccxt-trading (npm) MAL-2026-12347 | Malicious | Not scored | 05 Aug, 2026 | npm ccxt-trading |
Malicious release: Malicious code in @rentwise/common (npm) GHSA-x23q-mgjg-53mq, MAL-2026-12328 | Malicious | Not scored | 05 Aug, 2026 | npm @rentwise/common |
Malicious release: Malicious code in statist-browser-typed-client-coretech.web.metrics (npm) GHSA-426h-xcw5-2p4m, MAL-2026-12444 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-coretech.web.metrics |
Malicious release: Malicious code in utility-kit-ts (npm) GHSA-p66g-m465-g72x, MAL-2026-12493 | Malicious | Not scored | 05 Aug, 2026 | npm utility-kit-ts |
Malicious release: Malicious code in dolyame-boxy-atom-bnpl-store-button (npm) GHSA-j5r7-jm3x-rgch, MAL-2026-12364 | Malicious | Not scored | 05 Aug, 2026 | npm dolyame-boxy-atom-bnpl-store-button |
Malicious release: Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm) GHSA-vfcf-g2jc-xm3x, MAL-2026-12440 | Malicious | Not scored | 05 Aug, 2026 | npm sme-rko-finance-front-shared-entity-groups-models |
Malicious release: Malicious code in travel-core-utils-object (npm) GHSA-m3rm-367q-8gf3, MAL-2026-12487 | Malicious | Not scored | 05 Aug, 2026 | npm travel-core-utils-object |
Malicious release: Malicious code in william-data-formatter-x (npm) MAL-2026-12501 | Malicious | Not scored | 05 Aug, 2026 | npm william-data-formatter-x |
Malicious release: Malicious code in streak-count-core (npm) GHSA-6qqq-g7qr-g756, MAL-2026-12460 | Malicious | Not scored | 05 Aug, 2026 | npm streak-count-core |
Malicious release: Malicious code in pfp-block-mobile-steps (npm) GHSA-627r-73p5-f9mm, MAL-2026-12410 | Malicious | Not scored | 05 Aug, 2026 | npm pfp-block-mobile-steps |
Malicious release: Malicious code in express-mongo-santi (npm) MAL-2026-12377 | Malicious | Not scored | 05 Aug, 2026 | npm express-mongo-santi |
Malicious release: Malicious code in tt-help-cli-ycl (npm) MAL-2026-12488 | Malicious | Not scored | 05 Aug, 2026 | npm tt-help-cli-ycl |
Malicious release: Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm) GHSA-wc3c-f696-mj8v, MAL-2026-12310 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-sme.platform.web.teasers |
Malicious release: Malicious code in statist-browser-typed-client-jumptaxi.feature.contacts (npm) MAL-2026-12309 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-jumptaxi.feature.contacts |
Malicious release: Malicious code in streak-calc-metrics (npm) GHSA-7m7x-hmq7-rwm9, MAL-2026-12311 | Malicious | Not scored | 05 Aug, 2026 | npm streak-calc-metrics |
Malicious release: Malicious code in time-utils-helper (npm) MAL-2026-12225 | Malicious | Not scored | 05 Aug, 2026 | npm time-utils-helper |
Malicious release: Malicious code in sme-auth-core (npm) GHSA-prp3-9g6q-wp6v, MAL-2026-12207 | Malicious | Not scored | 05 Aug, 2026 | npm sme-auth-core |
Malicious release: Malicious code in pfp-integration-mobile-heading (npm) GHSA-w5mx-8jxc-vmcw, MAL-2026-12188 | Malicious | Not scored | 05 Aug, 2026 | npm pfp-integration-mobile-heading |
Malicious release: Malicious code in arbocrate-sla-prober-arbocrate-sla-prober-core (npm) MAL-2026-12140 | Malicious | Not scored | 05 Aug, 2026 | npm arbocrate-sla-prober-arbocrate-sla-prober-core |