Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in websight-p2p (npm) GHSA-f4xq-pw58-878h, MAL-2026-10697 | Malicious | Not scored | 16 Jul, 2026 | npm websight-p2p |
Malicious release: Malicious code in websight2-p2p (npm) GHSA-jqc8-qp8m-m77v, MAL-2026-10698 | Malicious | Not scored | 16 Jul, 2026 | npm websight2-p2p |
Malicious release: Malicious code in vor8zakon (npm) GHSA-9f89-97fj-pqmp, MAL-2026-10694 | Malicious | Not scored | 16 Jul, 2026 | npm vor8zakon |
Malicious release: Malicious code in nordpass (npm) MAL-2026-10743 | Malicious | Not scored | 16 Jul, 2026 | npm nordpass |
Malicious release: Malicious code in nyt-cms (npm) GHSA-r98c-r926-c796, MAL-2026-10692 | Malicious | Not scored | 16 Jul, 2026 | npm nyt-cms |
Malicious release: Malicious code in @edgecommons/streamlog-node (npm) GHSA-4rqf-6883-f59f, MAL-2026-10763 | Malicious | Not scored | 16 Jul, 2026 | npm @edgecommons/streamlog-node |
Malicious release: Malicious code in @edgecommons/edgecommons (npm) GHSA-8p39-h6xv-p2g9, MAL-2026-10762 | Malicious | Not scored | 16 Jul, 2026 | npm @edgecommons/edgecommons |
Malicious release: Malicious code in @across-toolkit/typescript-config (npm) MAL-2026-10704 | Malicious | Not scored | 16 Jul, 2026 | npm @across-toolkit/typescript-config |
Malicious release: Malicious code in syft-acp-atoms (npm) MAL-2026-10764 | Malicious | Not scored | 16 Jul, 2026 | npm syft-acp-atoms |
Malicious release: Malicious code in syft-acp-core (npm) MAL-2026-10765 | Malicious | Not scored | 16 Jul, 2026 | npm syft-acp-core |
Malicious release: Malicious code in syft-acp-uikit (npm) MAL-2026-10766 | Malicious | Not scored | 16 Jul, 2026 | npm syft-acp-uikit |
Malicious release: Malicious code in syft-acp-util (npm) MAL-2026-10767 | Malicious | Not scored | 16 Jul, 2026 | npm syft-acp-util |
Malicious release: Malicious code in internallib_v907 (npm) GHSA-4jf7-q8jf-84cg, MAL-2026-10691 | Malicious | Not scored | 15 Jul, 2026 | npm internallib_v907 |
Malicious release: Malicious code in selparsecss-selector (npm) MAL-2026-10687 | Malicious | Not scored | 15 Jul, 2026 | npm selparsecss-selector |
Malicious release: Malicious code in @ddh-libraries/analytics (npm) MAL-2026-10686 | Malicious | Not scored | 15 Jul, 2026 | npm @ddh-libraries/analytics |
Malicious release: Malicious code in react-hook-scripts (npm) MAL-2026-10684 | Malicious | Not scored | 15 Jul, 2026 | npm react-hook-scripts |
Malicious release: Malicious code in code-formatter-setup (npm) GHSA-fr6r-7qpj-x22g, MAL-2026-10682 | Malicious | Not scored | 15 Jul, 2026 | npm code-formatter-setup |
Malicious release: Malicious code in formatters.ts (npm) MAL-2026-10683 | Malicious | Not scored | 15 Jul, 2026 | npm formatters.ts |
Malicious release: Malicious code in rakibox (npm) MAL-2026-10679 | Malicious | Not scored | 15 Jul, 2026 | npm rakibox |
Malicious release: Malicious code in ls-env-config (npm) MAL-2026-10678 | Malicious | Not scored | 15 Jul, 2026 | npm ls-env-config |
Malicious release: Malicious code in deployowl (npm) MAL-2026-10677 | Malicious | Not scored | 15 Jul, 2026 | npm deployowl |
Malicious release: Malicious code in syncgrove (npm) MAL-2026-10680 | Malicious | Not scored | 15 Jul, 2026 | npm syncgrove |
Malicious release: Malicious code in commonjs-assert (npm) GHSA-hcmm-fvc7-pjv3, MAL-2026-10676 | Malicious | Not scored | 15 Jul, 2026 | npm commonjs-assert |
Malicious release: Malicious code in ac-raf-emitter (npm) MAL-2026-10675 | Malicious | Not scored | 15 Jul, 2026 | npm ac-raf-emitter |
Malicious release: Malicious code in gulp-jscrambler (npm) GHSA-2cjx-v4hm-f5gf, MAL-2026-10673 | Malicious | Not scored | 15 Jul, 2026 | npm gulp-jscrambler |
Malicious release: Malicious code in jscrambler-metro-plugin (npm) GHSA-v442-7fpg-636g, MAL-2026-10674 | Malicious | Not scored | 15 Jul, 2026 | npm jscrambler-metro-plugin |
Malicious release: Malicious code in chain-as-log (npm) MAL-2026-10668 | Malicious | Not scored | 15 Jul, 2026 | npm chain-as-log |
Malicious release: Malicious code in spytrack (npm) MAL-2026-10671 | Malicious | Not scored | 15 Jul, 2026 | npm spytrack |
Malicious release: Malicious code in dbconnectify (npm) GHSA-p5xv-vqcx-vm42, MAL-2026-10669 | Malicious | Not scored | 15 Jul, 2026 | npm dbconnectify |
Malicious release: Malicious code in eslintcmd (npm) GHSA-73c6-pgjj-9v82, MAL-2026-10670 | Malicious | Not scored | 15 Jul, 2026 | npm eslintcmd |
Malicious release: Malicious code in @fhkry/baileys-v2 (npm) GHSA-g5qp-fx35-w54m, MAL-2026-10664 | Malicious | Not scored | 15 Jul, 2026 | npm @fhkry/baileys-v2 |
Malicious release: Malicious code in @fhkry/x-baileys (npm) GHSA-mxxc-f6p6-98j7, MAL-2026-10665 | Malicious | Not scored | 15 Jul, 2026 | npm @fhkry/x-baileys |
Malicious release: Malicious code in crypto-hasher (npm) GHSA-886f-w6pq-7w7j, MAL-2026-10666 | Malicious | Not scored | 15 Jul, 2026 | npm crypto-hasher |
Malicious release: Malicious code in true (npm) GHSA-f59f-vj5q-c725, MAL-2026-10667 | Malicious | Not scored | 15 Jul, 2026 | npm true |
Malicious release: Malicious code in @sauruslord/eslint-config (npm) GHSA-j2wh-xp56-gp35, MAL-2026-10658 | Malicious | Not scored | 15 Jul, 2026 | npm @sauruslord/eslint-config |
Malicious release: Malicious code in ssweb-wp (npm) GHSA-mcxp-9g3h-6rjx, MAL-2026-10662 | Malicious | Not scored | 15 Jul, 2026 | npm ssweb-wp |
Malicious release: Malicious code in @sauruslord/libsignal (npm) GHSA-p9pv-49fq-8f6m, MAL-2026-10659 | Malicious | Not scored | 15 Jul, 2026 | npm @sauruslord/libsignal |
Malicious release: Malicious code in zaldy-baileys (npm) GHSA-chjv-gxch-4gwg, MAL-2026-10663 | Malicious | Not scored | 15 Jul, 2026 | npm zaldy-baileys |
Malicious release: Malicious code in @sauruslord/baileys (npm) GHSA-gq5v-w47h-r596, MAL-2026-10657 | Malicious | Not scored | 15 Jul, 2026 | npm @sauruslord/baileys |
Malicious release: Malicious code in sauruslord-baileys (npm) GHSA-h2r9-2p5m-9f8g, MAL-2026-10661 | Malicious | Not scored | 15 Jul, 2026 | npm sauruslord-baileys |
Malicious release: Malicious code in saurus-assets (npm) GHSA-hp4j-58vc-g6px, MAL-2026-10660 | Malicious | Not scored | 15 Jul, 2026 | npm saurus-assets |
Malicious release: Malicious code in @debile/require-dir (npm) MAL-2026-10654 | Malicious | Not scored | 15 Jul, 2026 | npm @debile/require-dir |
Malicious release: Malicious code in gmail-changer (npm) MAL-2026-10635 | Malicious | Not scored | 15 Jul, 2026 | npm gmail-changer |
Malicious release: Malicious code in monogrok (npm) GHSA-548c-qh8j-h895, MAL-2026-10638 | Malicious | Not scored | 15 Jul, 2026 | npm monogrok |
Malicious release: Malicious code in core-dotenv (npm) GHSA-h5mc-5vgx-x5xq, MAL-2026-10631 | Malicious | Not scored | 15 Jul, 2026 | npm core-dotenv |
Malicious release: Malicious code in estore-client (npm) MAL-2026-10634 | Malicious | Not scored | 15 Jul, 2026 | npm estore-client |
Malicious release: Malicious code in ogensec-sdk (npm) MAL-2026-10639 | Malicious | Not scored | 15 Jul, 2026 | npm ogensec-sdk |
Malicious release: Malicious code in creditgauge (npm) MAL-2026-10633 | Malicious | Not scored | 15 Jul, 2026 | npm creditgauge |
Malicious release: Malicious code in polygon-toolkit-validator (npm) GHSA-67fh-9pjj-6cpw, MAL-2026-10641 | Malicious | Not scored | 15 Jul, 2026 | npm polygon-toolkit-validator |
Malicious release: Malicious code in webpack-session-cache (npm) GHSA-93h2-wqcj-75h4, MAL-2026-10653 | Malicious | Not scored | 15 Jul, 2026 | npm webpack-session-cache |