Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in channel-worker (npm) MAL-2026-10729 | Malicious | Not scored | 16 Jul, 2026 | npm channel-worker |
Malicious release: Malicious code in memtry-cli (npm) MAL-2026-10736 | Malicious | Not scored | 16 Jul, 2026 | npm memtry-cli |
Malicious release: Malicious code in bvm-core (npm) MAL-2026-10728 | Malicious | Not scored | 16 Jul, 2026 | npm bvm-core |
Malicious release: Malicious code in @whalent/agent (npm) MAL-2026-10721 | Malicious | Not scored | 16 Jul, 2026 | npm @whalent/agent |
Malicious release: Malicious code in @agentvox/host (npm) MAL-2026-10706 | Malicious | Not scored | 16 Jul, 2026 | npm @agentvox/host |
Malicious release: Malicious code in @thepayulink/server (npm) MAL-2026-10719 | Malicious | Not scored | 16 Jul, 2026 | npm @thepayulink/server |
Malicious release: Malicious code in axios-test-one (npm) MAL-2026-10727 | Malicious | Not scored | 16 Jul, 2026 | npm axios-test-one |
Malicious release: Malicious code in telemetry-metrics (npm) MAL-2026-10750 | Malicious | Not scored | 16 Jul, 2026 | npm telemetry-metrics |
Malicious release: Malicious code in codeam-cli (npm) MAL-2026-10730 | Malicious | Not scored | 16 Jul, 2026 | npm codeam-cli |
Malicious release: Malicious code in @yeaft/webchat-agent (npm) MAL-2026-10723 | Malicious | Not scored | 16 Jul, 2026 | npm @yeaft/webchat-agent |
Malicious release: Malicious code in agentto (npm) MAL-2026-10725 | Malicious | Not scored | 16 Jul, 2026 | npm agentto |
Malicious release: Malicious code in sakuraai (npm) MAL-2026-10746 | Malicious | Not scored | 16 Jul, 2026 | npm sakuraai |
Malicious release: Malicious code in @sciagent/cli (npm) MAL-2026-10718 | Malicious | Not scored | 16 Jul, 2026 | npm @sciagent/cli |
Malicious release: Malicious code in sensorium-mcp (npm) MAL-2026-10747 | Malicious | Not scored | 16 Jul, 2026 | npm sensorium-mcp |
Malicious release: Malicious code in hehehe (npm) GHSA-f5qh-v92x-xcxj, MAL-2026-10732 | Malicious | Not scored | 16 Jul, 2026 | npm hehehe |
Malicious release: Malicious code in @onescience/onecode (npm) MAL-2026-10717 | Malicious | Not scored | 16 Jul, 2026 | npm @onescience/onecode |
Malicious release: Malicious code in @agent-link/agent (npm) MAL-2026-10705 | Malicious | Not scored | 16 Jul, 2026 | npm @agent-link/agent |
Malicious release: Malicious code in @whalent/agent-core (npm) MAL-2026-10722 | Malicious | Not scored | 16 Jul, 2026 | npm @whalent/agent-core |
Malicious release: Malicious code in netcontrol-agent (npm) MAL-2026-10741 | Malicious | Not scored | 16 Jul, 2026 | npm netcontrol-agent |
Malicious release: Malicious code in @vibelet/cli (npm) MAL-2026-10720 | Malicious | Not scored | 16 Jul, 2026 | npm @vibelet/cli |
Malicious release: Malicious code in vanexa-agent (npm) MAL-2026-10751 | Malicious | Not scored | 16 Jul, 2026 | npm vanexa-agent |
Malicious release: Malicious code in @yuandc/aica (npm) MAL-2026-10724 | Malicious | Not scored | 16 Jul, 2026 | npm @yuandc/aica |
Malicious release: Malicious code in infrastructure-common (npm) MAL-2026-10734 | Malicious | Not scored | 16 Jul, 2026 | npm infrastructure-common |
Malicious release: Malicious code in myreviews-core (npm) MAL-2026-10740 | Malicious | Not scored | 16 Jul, 2026 | npm myreviews-core |
Malicious release: Malicious code in mw-server-util (npm) MAL-2026-10739 | Malicious | Not scored | 16 Jul, 2026 | npm mw-server-util |
Malicious release: Malicious code in date-utils-light (npm) MAL-2026-10731 | Malicious | Not scored | 16 Jul, 2026 | npm date-utils-light |
Malicious release: Malicious code in idlive-document-capture-web (npm) MAL-2026-10733 | Malicious | Not scored | 16 Jul, 2026 | npm idlive-document-capture-web |
Malicious release: Malicious code in @equans-services/codex (npm) MAL-2026-10710 | Malicious | Not scored | 16 Jul, 2026 | npm @equans-services/codex |
Malicious release: Malicious code in mmagrt (npm) MAL-2026-10737 | Malicious | Not scored | 16 Jul, 2026 | npm mmagrt |
Malicious release: Malicious code in xxdxa (npm) MAL-2026-10752 | Malicious | Not scored | 16 Jul, 2026 | npm xxdxa |
Malicious release: Malicious code in mui-option (npm) MAL-2026-10738 | Malicious | Not scored | 16 Jul, 2026 | npm mui-option |
Malicious release: Malicious code in sync-grove (npm) MAL-2026-10749 | Malicious | Not scored | 16 Jul, 2026 | npm sync-grove |
Malicious release: Malicious code in @hibachi-xyz/common (npm) MAL-2026-10712 | Malicious | Not scored | 16 Jul, 2026 | npm @hibachi-xyz/common |
Malicious release: Malicious code in isite (npm) GHSA-hmvc-prpq-wwcr, MAL-2026-10735 | Malicious | Not scored | 16 Jul, 2026 | npm isite |
Malicious release: Malicious code in @funny-booth/agent-core (npm) MAL-2026-10711 | Malicious | Not scored | 16 Jul, 2026 | npm @funny-booth/agent-core |
Malicious release: Malicious code in node-as-api (npm) MAL-2026-10742 | Malicious | Not scored | 16 Jul, 2026 | npm node-as-api |
Malicious release: Malicious code in string-formatter-pro (npm) MAL-2026-10748 | Malicious | Not scored | 16 Jul, 2026 | npm string-formatter-pro |
Prompty: Arbitrary file read via file reference expansion CVE-2026-53598, GHSA-wxhm-2mq7-7697, PYSEC-2026-3538 | High | 1.3% | 16 Jul, 2026 | NuGet Prompty.Core PyPI prompty crates.io prompty npm @prompty/core |
Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader CVE-2026-53597, GHSA-c4gh-rv8h-q9vw | High | 1.0% | 16 Jul, 2026 | npm @prompty/core |
Malicious release: Malicious code in time-format-kit (npm) MAL-2026-10700 | Malicious | Not scored | 16 Jul, 2026 | npm time-format-kit |
Malicious release: Malicious code in http-req-lite (npm) MAL-2026-10699 | Malicious | Not scored | 16 Jul, 2026 | npm http-req-lite |
Malicious release: Malicious code in @across-toolkit/eslint-config (npm) MAL-2026-10703 | Malicious | Not scored | 16 Jul, 2026 | npm @across-toolkit/eslint-config |
Malicious release: Malicious code in @hibachi-xyz/types (npm) MAL-2026-10715 | Malicious | Not scored | 16 Jul, 2026 | npm @hibachi-xyz/types |
Malicious release: Malicious code in @hibachi-xyz/config (npm) MAL-2026-10713 | Malicious | Not scored | 16 Jul, 2026 | npm @hibachi-xyz/config |
Malicious release: Malicious code in @hibachi-xyz/ui (npm) MAL-2026-10716 | Malicious | Not scored | 16 Jul, 2026 | npm @hibachi-xyz/ui |
Malicious release: Malicious code in @hibachi-xyz/sdk (npm) MAL-2026-10714 | Malicious | Not scored | 16 Jul, 2026 | npm @hibachi-xyz/sdk |
Malicious release: Malicious code in ai-p2p (npm) GHSA-g5cv-hmr5-x42p, MAL-2026-10695 | Malicious | Not scored | 16 Jul, 2026 | npm ai-p2p |
Malicious release: Malicious code in loader1 (npm) GHSA-wp48-4xqv-v7fq, MAL-2026-10696 | Malicious | Not scored | 16 Jul, 2026 | npm loader1 |
Malicious release: Malicious code in websight-p2p (npm) GHSA-f4xq-pw58-878h, MAL-2026-10697 | Malicious | Not scored | 16 Jul, 2026 | npm websight-p2p |
Malicious release: Malicious code in websight2-p2p (npm) GHSA-jqc8-qp8m-m77v, MAL-2026-10698 | Malicious | Not scored | 16 Jul, 2026 | npm websight2-p2p |