Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in n8n-nodes-task-runner (npm) MAL-2026-10999 | Malicious | Not scored | 22 Jul, 2026 | npm n8n-nodes-task-runner |
Malicious release: Malicious code in kijai (npm) GHSA-5mgj-24pj-pj6f, MAL-2026-11014 | Malicious | Not scored | 22 Jul, 2026 | npm kijai |
Malicious release: Malicious code in vantora (npm) GHSA-4fm5-fwqx-8r39, MAL-2026-11016 | Malicious | Not scored | 22 Jul, 2026 | npm vantora |
Malicious release: Malicious code in veskr (npm) GHSA-77c3-35xp-6chp, MAL-2026-11019 | Malicious | Not scored | 22 Jul, 2026 | npm veskr |
Malicious release: Malicious code in calmora (npm) GHSA-7wwx-476f-c8gm, MAL-2026-11009 | Malicious | Not scored | 22 Jul, 2026 | npm calmora |
Malicious release: Malicious code in caldryn (npm) GHSA-h9c8-8wq8-r6q2, MAL-2026-11008 | Malicious | Not scored | 22 Jul, 2026 | npm caldryn |
Malicious release: Malicious code in calvora (npm) GHSA-jwm3-4ffq-hr73, MAL-2026-11010 | Malicious | Not scored | 22 Jul, 2026 | npm calvora |
Malicious release: Malicious code in veldora (npm) GHSA-wxrm-vmq9-jp23, MAL-2026-11018 | Malicious | Not scored | 22 Jul, 2026 | npm veldora |
Malicious release: Malicious code in vectormark (npm) GHSA-g48p-2cr5-5hm2, MAL-2026-11017 | Malicious | Not scored | 22 Jul, 2026 | npm vectormark |
Malicious release: Malicious code in react-tabulix-query (npm) GHSA-4rrq-g9w7-39c3, MAL-2026-11015 | Malicious | Not scored | 22 Jul, 2026 | npm react-tabulix-query |
Malicious release: Malicious code in react-tabulix-extended (npm) MAL-2026-11040 | Malicious | Not scored | 22 Jul, 2026 | npm react-tabulix-extended |
Malicious release: Malicious code in streak-calendar (npm) GHSA-2p69-mmpj-h84r, MAL-2026-10981 | Malicious | Not scored | 21 Jul, 2026 | npm streak-calendar |
Malicious release: Malicious code in streak-daycount (npm) GHSA-2v57-6hmf-hpfj, MAL-2026-10982 | Malicious | Not scored | 21 Jul, 2026 | npm streak-daycount |
Malicious release: Malicious code in svelte-streaks (npm) GHSA-8vq2-5c69-fm3w, MAL-2026-10983 | Malicious | Not scored | 21 Jul, 2026 | npm svelte-streaks |
Malicious release: Malicious code in @apexfdn/apex (npm) GHSA-w63r-vpcf-2wwf, MAL-2026-10979 | Malicious | Not scored | 21 Jul, 2026 | npm @apexfdn/apex |
Malicious release: Malicious code in veskra (npm) GHSA-pr2p-6xpw-q8vw, MAL-2026-10984 | Malicious | Not scored | 21 Jul, 2026 | npm veskra |
Malicious release: Malicious code in nolby (npm) GHSA-x724-q7wp-wx6q, MAL-2026-10980 | Malicious | Not scored | 21 Jul, 2026 | npm nolby |
Malicious release: Malicious code in react-tabulix-ui (npm) GHSA-5jr9-f9w4-93v3, MAL-2026-10988 | Malicious | Not scored | 21 Jul, 2026 | npm react-tabulix-ui |
Malicious release: Malicious code in react-tabulix-virtual (npm) MAL-2026-10989 | Malicious | Not scored | 21 Jul, 2026 | npm react-tabulix-virtual |
Malicious release: Malicious code in react-tabulix-core (npm) GHSA-5w4q-8fc9-88f4, MAL-2026-10987 | Malicious | Not scored | 21 Jul, 2026 | npm react-tabulix-core |
Malicious release: Malicious code in commonweb-rewards (npm) GHSA-p7jm-wh46-6hxx, MAL-2026-10968 | Malicious | Not scored | 21 Jul, 2026 | npm commonweb-rewards |
Malicious release: Malicious code in consumerweb-calurls (npm) GHSA-2fpw-cmmr-5j84, MAL-2026-10970 | Malicious | Not scored | 21 Jul, 2026 | npm consumerweb-calurls |
Malicious release: Malicious code in commonweb-card (npm) GHSA-cr8q-p657-jfpv, MAL-2026-10966 | Malicious | Not scored | 21 Jul, 2026 | npm commonweb-card |
Malicious release: Malicious code in commonweb-moneymovement (npm) GHSA-j4gf-r356-ff9m, MAL-2026-10967 | Malicious | Not scored | 21 Jul, 2026 | npm commonweb-moneymovement |
Malicious release: Malicious code in signzy-field-level-encrypter (npm) MAL-2026-10972 | Malicious | Not scored | 21 Jul, 2026 | npm signzy-field-level-encrypter |
Malicious release: Malicious code in commonweb-wallet (npm) GHSA-583v-m69g-vj4g, MAL-2026-10969 | Malicious | Not scored | 21 Jul, 2026 | npm commonweb-wallet |
Malicious release: Malicious code in cxpw-offers (npm) GHSA-9mr2-w7h5-r8c8, MAL-2026-10971 | Malicious | Not scored | 21 Jul, 2026 | npm cxpw-offers |
Malicious release: Malicious code in requestor-util (npm) GHSA-mchg-8mp7-q4m6, MAL-2026-10965 | Malicious | Not scored | 21 Jul, 2026 | npm requestor-util |
Malicious release: Malicious code in chai-leaf (npm) GHSA-m3c7-2j38-rjh7, MAL-2026-10940 | Malicious | Not scored | 21 Jul, 2026 | npm chai-leaf |
Malicious release: Malicious code in chai-as-reddit (npm) GHSA-vc32-h28h-pmhm, MAL-2026-10939 | Malicious | Not scored | 21 Jul, 2026 | npm chai-as-reddit |
Malicious release: Malicious code in ts-vitest (npm) GHSA-2g3m-3343-pgvq, MAL-2026-10990 | Malicious | Not scored | 21 Jul, 2026 | npm ts-vitest |
Malicious release: Malicious code in date-format-utils-xz (npm) MAL-2026-11001 | Malicious | Not scored | 21 Jul, 2026 | npm date-format-utils-xz |
Malicious release: Malicious code in faust-cont (npm) MAL-2026-11042 | Malicious | Not scored | 21 Jul, 2026 | npm faust-cont |
Malicious release: Malicious code in upjsma (npm) GHSA-9g67-fm87-8p6v, MAL-2026-10928 | Malicious | Not scored | 20 Jul, 2026 | npm upjsma |
Malicious release: Malicious code in tilaver-mfa (npm) GHSA-4j5x-wjw6-qvq5, MAL-2026-10925 | Malicious | Not scored | 20 Jul, 2026 | npm tilaver-mfa |
Malicious release: Malicious code in s3-lambda-dynamodb-cdk (npm) GHSA-6xqw-c34f-9275, MAL-2026-10924 | Malicious | Not scored | 20 Jul, 2026 | npm s3-lambda-dynamodb-cdk |
Malicious release: Malicious code in alb-lambda-cdk (npm) GHSA-crmc-3m53-3crf, MAL-2026-10920 | Malicious | Not scored | 20 Jul, 2026 | npm alb-lambda-cdk |
Malicious release: Malicious code in lambda-cloudwatch-cdk (npm) GHSA-m74r-g438-3r92, MAL-2026-10922 | Malicious | Not scored | 20 Jul, 2026 | npm lambda-cloudwatch-cdk |
Malicious release: Malicious code in iot-kfh-s3 (npm) GHSA-qg52-c79f-3q5c, MAL-2026-10921 | Malicious | Not scored | 20 Jul, 2026 | npm iot-kfh-s3 |
Malicious release: Malicious code in lwc-slds-lbc (npm) GHSA-xm8f-w286-57x5, MAL-2026-10923 | Malicious | Not scored | 20 Jul, 2026 | npm lwc-slds-lbc |
Malicious release: Malicious code in your-unique-package-name1337 (npm) GHSA-3w8q-c7m7-62q5, MAL-2026-10906 | Malicious | Not scored | 20 Jul, 2026 | npm your-unique-package-name1337 |
Malicious release: Malicious code in win-build-utils (npm) GHSA-7ffq-88v5-rmwc, MAL-2026-10905 | Malicious | Not scored | 20 Jul, 2026 | npm win-build-utils |
Malicious release: Malicious code in solana-web3-v1 (npm) GHSA-x736-hhp7-jrh7, MAL-2026-10904 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-v1 |
Malicious release: Malicious code in solana-web3-lts (npm) GHSA-8wj2-r9xj-g9p3, MAL-2026-10901 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-lts |
Malicious release: Malicious code in solana-web3-stable (npm) GHSA-c26v-wr8c-3xj8, MAL-2026-10903 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-stable |
Malicious release: Malicious code in solana-web3-patched (npm) GHSA-p492-8qvf-j49c, MAL-2026-10902 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-patched |
Malicious release: Malicious code in solana-web3-fork (npm) GHSA-rf7g-mf44-5m44, MAL-2026-10900 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-fork |
Malicious release: Malicious code in solana-web3-fixed (npm) GHSA-vc55-fvgr-m9jv, MAL-2026-10899 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-fixed |
Malicious release: Malicious code in solana-rpc-client (npm) GHSA-p7xx-6w55-gfrg, MAL-2026-10898 | Malicious | Not scored | 20 Jul, 2026 | npm solana-rpc-client |
Malicious release: Malicious code in golan125-homepage-test (npm) GHSA-6p3c-6jvh-3pg8, MAL-2026-10897 | Malicious | Not scored | 20 Jul, 2026 | npm golan125-homepage-test |