Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in parallely (npm) GHSA-rmhx-v9xh-x4jv, MAL-2026-11143 | Malicious | Not scored | 28 Jul, 2026 | npm parallely |
Malicious release: Malicious code in ethers-secure (npm) MAL-2026-11135 | Malicious | Not scored | 28 Jul, 2026 | npm ethers-secure |
Malicious release: Malicious code in tidal-embed-player (npm) GHSA-7w7p-cq73-h3p4, MAL-2026-11152 | Malicious | Not scored | 28 Jul, 2026 | npm tidal-embed-player |
Malicious release: Malicious code in basic-vite (npm) MAL-2026-11131 | Malicious | Not scored | 28 Jul, 2026 | npm basic-vite |
Malicious release: Malicious code in triage_bot_using_sdkv3 (npm) MAL-2026-11153 | Malicious | Not scored | 28 Jul, 2026 | npm triage_bot_using_sdkv3 |
Malicious release: Malicious code in jobber-app-template-react (npm) GHSA-wvfj-f49f-7vqw, MAL-2026-11137 | Malicious | Not scored | 28 Jul, 2026 | npm jobber-app-template-react |
Malicious release: Malicious code in @yancyyu/agentcli (npm) MAL-2026-11123 | Malicious | Not scored | 28 Jul, 2026 | npm @yancyyu/agentcli |
Malicious release: Malicious code in xerohub-discord-voice-v3 (npm) MAL-2026-11155 | Malicious | Not scored | 28 Jul, 2026 | npm xerohub-discord-voice-v3 |
Malicious release: Malicious code in xerohub-discord-voice-v2 (npm) MAL-2026-11154 | Malicious | Not scored | 28 Jul, 2026 | npm xerohub-discord-voice-v2 |
Malicious release: Malicious code in lib-streak-math (npm) MAL-2026-11141 | Malicious | Not scored | 28 Jul, 2026 | npm lib-streak-math |
Malicious release: Malicious code in @ai_/autoprefixers (npm) MAL-2026-11120 | Malicious | Not scored | 28 Jul, 2026 | npm @ai_/autoprefixers |
Malicious release: Malicious code in app-sim-layer (npm) MAL-2026-11126 | Malicious | Not scored | 28 Jul, 2026 | npm app-sim-layer |
Malicious release: Malicious code in app-sima-layer (npm) MAL-2026-11127 | Malicious | Not scored | 28 Jul, 2026 | npm app-sima-layer |
Malicious release: Malicious code in app-svm-layer (npm) MAL-2026-11129 | Malicious | Not scored | 28 Jul, 2026 | npm app-svm-layer |
Malicious release: Malicious code in api-rust-sdk (npm) MAL-2026-11125 | Malicious | Not scored | 28 Jul, 2026 | npm api-rust-sdk |
Malicious release: Malicious code in api-node-sdk (npm) MAL-2026-11124 | Malicious | Not scored | 28 Jul, 2026 | npm api-node-sdk |
Malicious release: Malicious code in fluid-type-ui (npm) GHSA-4w4v-pw3v-q85q, MAL-2026-11136 | Malicious | Not scored | 28 Jul, 2026 | npm fluid-type-ui |
Malicious release: Malicious code in chain-analyze (npm) GHSA-vmj5-cm6w-jrgj, MAL-2026-11133 | Malicious | Not scored | 28 Jul, 2026 | npm chain-analyze |
Malicious release: Malicious code in toll_free (npm) MAL-2026-11159 | Malicious | Not scored | 28 Jul, 2026 | npm toll_free |
Malicious release: Malicious code in app-soda-layer (npm) MAL-2026-11128 | Malicious | Not scored | 28 Jul, 2026 | npm app-soda-layer |
Malicious release: Malicious code in array-sort-helper (npm) MAL-2026-11118 | Malicious | Not scored | 28 Jul, 2026 | npm array-sort-helper |
Malicious release: Malicious code in json-to-table-util (npm) MAL-2026-11119 | Malicious | Not scored | 28 Jul, 2026 | npm json-to-table-util |
Malicious release: Malicious code in num-format-helper (npm) MAL-2026-11107 | Malicious | Not scored | 28 Jul, 2026 | npm num-format-helper |
Malicious release: Malicious code in date-sanitize-helper (npm) MAL-2026-11106 | Malicious | Not scored | 28 Jul, 2026 | npm date-sanitize-helper |
Malicious release: Malicious code in string-format-kit (npm) MAL-2026-11108 | Malicious | Not scored | 28 Jul, 2026 | npm string-format-kit |
Malicious release: Malicious code in @vaultflow/update-flow (npm) GHSA-gv55-mvjq-232h, MAL-2026-11097 | Malicious | Not scored | 28 Jul, 2026 | npm @vaultflow/update-flow |
Malicious release: Malicious code in @vaultflow/create-flow (npm) GHSA-xpp9-qw49-cpw2, MAL-2026-11096 | Malicious | Not scored | 28 Jul, 2026 | npm @vaultflow/create-flow |
Malicious release: Malicious code in motion-forge-css (npm) GHSA-3v24-55c2-cpp9, MAL-2026-11101 | Malicious | Not scored | 27 Jul, 2026 | npm motion-forge-css |
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks CVE-2026-54272, GHSA-22jq-vg5j-6vgg | Medium | 0.4% | 27 Jul, 2026 | npm ip-address |
Malicious release: Malicious code in @heartlandone-private/fontawesome-pro (npm) MAL-2026-11093 | Malicious | Not scored | 27 Jul, 2026 | npm @heartlandone-private/fontawesome-pro |
Malicious release: Malicious code in xo-twofa (npm) GHSA-7v73-c7c7-mr5x, MAL-2026-11105 | Malicious | Not scored | 27 Jul, 2026 | npm xo-twofa |
Malicious release: Malicious code in identityauthorizationserv (npm) GHSA-gxvc-xwj7-xghw, MAL-2026-11100 | Malicious | Not scored | 27 Jul, 2026 | npm identityauthorizationserv |
Malicious release: Malicious code in stargateproxyserv (npm) GHSA-h7c2-w78r-3m98, MAL-2026-11103 | Malicious | Not scored | 27 Jul, 2026 | npm stargateproxyserv |
Malicious release: Malicious code in riskunifiedgatewayserv (npm) GHSA-prr3-5jpw-q3v3, MAL-2026-11102 | Malicious | Not scored | 27 Jul, 2026 | npm riskunifiedgatewayserv |
Malicious release: Malicious code in crm-reportinsightserv-paypal (npm) GHSA-xh9p-6mh8-qjhp, MAL-2026-11098 | Malicious | Not scored | 27 Jul, 2026 | npm crm-reportinsightserv-paypal |
Malicious release: Malicious code in demo-awesome-date-parser-test (npm) GHSA-xcf3-mw56-cqm5, MAL-2026-11099 | Malicious | Not scored | 27 Jul, 2026 | npm demo-awesome-date-parser-test |
Malicious release: Malicious code in @array-util/subsearch (npm) GHSA-5xpc-8g9w-cwr8, MAL-2026-11095 | Malicious | Not scored | 27 Jul, 2026 | npm @array-util/subsearch |
Malicious release: Malicious code in tailwind-motionkit (npm) GHSA-wrm7-92jw-pqm9, MAL-2026-11104 | Malicious | Not scored | 27 Jul, 2026 | npm tailwind-motionkit |
Malicious release: Malicious code in kalipto-runtime (npm) GHSA-g6f3-9j93-879j, MAL-2026-11087 | Malicious | Not scored | 27 Jul, 2026 | npm kalipto-runtime |
Malicious release: Malicious code in @thone33/react-helpers (npm) GHSA-vxmg-ff8j-2552, MAL-2026-11078 | Malicious | Not scored | 27 Jul, 2026 | npm @thone33/react-helpers |
Malicious release: Malicious code in edu-npm-helper-alpha (npm) GHSA-jhpp-p77r-39q6, MAL-2026-11082 | Malicious | Not scored | 27 Jul, 2026 | npm edu-npm-helper-alpha |
Malicious release: Malicious code in edu-npm-helper-beta (npm) GHSA-mm62-vp6v-vqq2, MAL-2026-11083 | Malicious | Not scored | 27 Jul, 2026 | npm edu-npm-helper-beta |
Malicious release: Malicious code in txs-builder (npm) GHSA-5g95-w82p-69v9, MAL-2026-11089 | Malicious | Not scored | 27 Jul, 2026 | npm txs-builder |
Malicious release: Malicious code in txs-runner-lib (npm) GHSA-65pq-67vr-g3jp, MAL-2026-11091 | Malicious | Not scored | 27 Jul, 2026 | npm txs-runner-lib |
Malicious release: Malicious code in txs-random-lib (npm) GHSA-c2fc-52mv-g5v6, MAL-2026-11090 | Malicious | Not scored | 27 Jul, 2026 | npm txs-random-lib |
Malicious release: Malicious code in txs-sdk-lib (npm) GHSA-fgmc-rrjh-9m33, MAL-2026-11092 | Malicious | Not scored | 27 Jul, 2026 | npm txs-sdk-lib |
Malicious release: Malicious code in sixbails (npm) GHSA-8cvc-378h-fwqf, MAL-2026-11088 | Malicious | Not scored | 27 Jul, 2026 | npm sixbails |
Malicious release: Malicious code in @vinnxcode/xbailsync (npm) GHSA-fgwc-g3q5-794p, MAL-2026-11080 | Malicious | Not scored | 27 Jul, 2026 | npm @vinnxcode/xbailsync |
Malicious release: Malicious code in @vinnxcode/libsignal-node (npm) GHSA-v9rv-pgqp-436h, MAL-2026-11079 | Malicious | Not scored | 27 Jul, 2026 | npm @vinnxcode/libsignal-node |
Malicious release: Malicious code in amanexzyra-baileys (npm) GHSA-mwwh-7r57-h6v9, MAL-2026-11081 | Malicious | Not scored | 27 Jul, 2026 | npm amanexzyra-baileys |