Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @sauruslord/eslint-config (npm) GHSA-j2wh-xp56-gp35, MAL-2026-10658 | Malicious | Not scored | 15 Jul, 2026 | npm @sauruslord/eslint-config |
Malicious release: Malicious code in ssweb-wp (npm) GHSA-mcxp-9g3h-6rjx, MAL-2026-10662 | Malicious | Not scored | 15 Jul, 2026 | npm ssweb-wp |
Malicious release: Malicious code in @sauruslord/libsignal (npm) GHSA-p9pv-49fq-8f6m, MAL-2026-10659 | Malicious | Not scored | 15 Jul, 2026 | npm @sauruslord/libsignal |
Malicious release: Malicious code in zaldy-baileys (npm) GHSA-chjv-gxch-4gwg, MAL-2026-10663 | Malicious | Not scored | 15 Jul, 2026 | npm zaldy-baileys |
Malicious release: Malicious code in @sauruslord/baileys (npm) GHSA-gq5v-w47h-r596, MAL-2026-10657 | Malicious | Not scored | 15 Jul, 2026 | npm @sauruslord/baileys |
Malicious release: Malicious code in sauruslord-baileys (npm) GHSA-h2r9-2p5m-9f8g, MAL-2026-10661 | Malicious | Not scored | 15 Jul, 2026 | npm sauruslord-baileys |
Malicious release: Malicious code in saurus-assets (npm) GHSA-hp4j-58vc-g6px, MAL-2026-10660 | Malicious | Not scored | 15 Jul, 2026 | npm saurus-assets |
Malicious release: Malicious code in @debile/require-dir (npm) MAL-2026-10654 | Malicious | Not scored | 15 Jul, 2026 | npm @debile/require-dir |
Malicious release: Malicious code in gmail-changer (npm) MAL-2026-10635 | Malicious | Not scored | 15 Jul, 2026 | npm gmail-changer |
Malicious release: Malicious code in monogrok (npm) GHSA-548c-qh8j-h895, MAL-2026-10638 | Malicious | Not scored | 15 Jul, 2026 | npm monogrok |
Malicious release: Malicious code in core-dotenv (npm) GHSA-h5mc-5vgx-x5xq, MAL-2026-10631 | Malicious | Not scored | 15 Jul, 2026 | npm core-dotenv |
Malicious release: Malicious code in estore-client (npm) MAL-2026-10634 | Malicious | Not scored | 15 Jul, 2026 | npm estore-client |
Malicious release: Malicious code in ogensec-sdk (npm) MAL-2026-10639 | Malicious | Not scored | 15 Jul, 2026 | npm ogensec-sdk |
Malicious release: Malicious code in creditgauge (npm) MAL-2026-10633 | Malicious | Not scored | 15 Jul, 2026 | npm creditgauge |
Malicious release: Malicious code in polygon-toolkit-validator (npm) GHSA-67fh-9pjj-6cpw, MAL-2026-10641 | Malicious | Not scored | 15 Jul, 2026 | npm polygon-toolkit-validator |
Malicious release: Malicious code in webpack-session-cache (npm) GHSA-93h2-wqcj-75h4, MAL-2026-10653 | Malicious | Not scored | 15 Jul, 2026 | npm webpack-session-cache |
Malicious release: Malicious code in polygon-toolkit-validation (npm) MAL-2026-10640 | Malicious | Not scored | 15 Jul, 2026 | npm polygon-toolkit-validation |
Malicious release: Malicious code in @bcs-mi-ui/message (npm) GHSA-4ppp-p4x6-p4w5, MAL-2026-10645 | Malicious | Not scored | 15 Jul, 2026 | npm @bcs-mi-ui/message |
Malicious release: Malicious code in @bcs-mi-ui/test1243npmpacket76 (npm) GHSA-9gp9-4wmv-j8qf, MAL-2026-10647 | Malicious | Not scored | 15 Jul, 2026 | npm @bcs-mi-ui/test1243npmpacket76 |
Malicious release: Malicious code in @bcs-mi-ui/message-block (npm) GHSA-j6mx-7p76-j3h7, MAL-2026-10646 | Malicious | Not scored | 15 Jul, 2026 | npm @bcs-mi-ui/message-block |
Malicious release: Malicious code in leviosa86-test (npm) MAL-2026-10636 | Malicious | Not scored | 15 Jul, 2026 | npm leviosa86-test |
Malicious release: Malicious code in ai-explain (npm) MAL-2026-10628 | Malicious | Not scored | 15 Jul, 2026 | npm ai-explain |
Malicious release: Malicious code in ai-pro-sdk (npm) GHSA-pw5v-v543-v4mp, MAL-2026-10629 | Malicious | Not scored | 15 Jul, 2026 | npm ai-pro-sdk |
Malicious release: Malicious code in @hkyyy/portal-widget-helper-0601 (npm) GHSA-wgx8-6mv9-p6jm, MAL-2026-10648 | Malicious | Not scored | 15 Jul, 2026 | npm @hkyyy/portal-widget-helper-0601 |
Malicious release: Malicious code in @saladin0x1/js-shared-modules (npm) GHSA-7xh4-j295-69xm, MAL-2026-10649 | Malicious | Not scored | 15 Jul, 2026 | npm @saladin0x1/js-shared-modules |
Malicious release: Malicious code in @leviosa86com/leviosa86-test (npm) MAL-2026-10625 | Malicious | Not scored | 15 Jul, 2026 | npm @leviosa86com/leviosa86-test |
Malicious release: Malicious code in chai-as-byte (npm) MAL-2026-10630 | Malicious | Not scored | 15 Jul, 2026 | npm chai-as-byte |
Malicious release: Malicious code in @sqlite-frame/nodesql (npm) GHSA-r9rm-52xp-prf4, MAL-2026-10627 | Malicious | Not scored | 15 Jul, 2026 | npm @sqlite-frame/nodesql |
Malicious release: Malicious code in @react-case/option (npm) MAL-2026-10626 | Malicious | Not scored | 15 Jul, 2026 | npm @react-case/option |
Malicious release: Malicious code in mc-reg (npm) GHSA-hvhc-6qpw-v5r9, MAL-2026-10637 | Malicious | Not scored | 15 Jul, 2026 | npm mc-reg |
Malicious release: Malicious code in iwsdk (npm) GHSA-35fw-734c-r8xf, MAL-2026-10651 | Malicious | Not scored | 14 Jul, 2026 | npm iwsdk |
Malicious release: Malicious code in install-skia (npm) GHSA-r9fr-8w7j-4vj6, MAL-2026-10650 | Malicious | Not scored | 14 Jul, 2026 | npm install-skia |
Malicious release: Malicious code in cppt-common (npm) MAL-2026-10632 | Malicious | Not scored | 14 Jul, 2026 | npm cppt-common |
Malicious release: Malicious code in json-bigint-extend (npm) GHSA-h8r4-9vf9-jp96, MAL-2026-10652 | Malicious | Not scored | 14 Jul, 2026 | npm json-bigint-extend |
Malicious release: Malicious code in @vite-js/vui (npm) GHSA-6x4h-wrvq-m68h, MAL-2026-10619 | Malicious | Not scored | 14 Jul, 2026 | npm @vite-js/vui |
Malicious release: Malicious code in chai-as-structured (npm) GHSA-wf75-6wm5-v349, MAL-2026-10622 | Malicious | Not scored | 14 Jul, 2026 | npm chai-as-structured |
Malicious release: Malicious code in chai-as-hardened (npm) MAL-2026-10621 | Malicious | Not scored | 14 Jul, 2026 | npm chai-as-hardened |
Malicious release: Malicious code in http-ws-listener (npm) MAL-2026-10623 | Malicious | Not scored | 14 Jul, 2026 | npm http-ws-listener |
Malicious release: Malicious code in ahooks-3.7.8 (npm) MAL-2026-10620 | Malicious | Not scored | 14 Jul, 2026 | npm ahooks-3.7.8 |
n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode CVE-2026-55608, GHSA-2cf7-hpwf-47h9 | Medium | 0.3% | 14 Jul, 2026 | npm n8n-mcp |
Malicious release: Malicious code in postcss-selector-minify (npm) GHSA-pjfj-gp2h-5692, MAL-2026-10614 | Malicious | Not scored | 14 Jul, 2026 | npm postcss-selector-minify |
Malicious release: Malicious code in ethereum-lib-utils (npm) GHSA-p99f-7355-gvr8, MAL-2026-10613 | Malicious | Not scored | 14 Jul, 2026 | npm ethereum-lib-utils |
Malicious release: Malicious code in assertion-utils-js (npm) GHSA-q727-8h63-fm25, MAL-2026-10612 | Malicious | Not scored | 14 Jul, 2026 | npm assertion-utils-js |
Malicious release: Malicious code in smb-common-uikit (npm) MAL-2026-10615 | Malicious | Not scored | 14 Jul, 2026 | npm smb-common-uikit |
Malicious release: Malicious code in smb-portal-uikit (npm) MAL-2026-10616 | Malicious | Not scored | 14 Jul, 2026 | npm smb-portal-uikit |
Malicious release: Malicious code in @web3-helpers/core (npm) MAL-2026-10611 | Malicious | Not scored | 14 Jul, 2026 | npm @web3-helpers/core |
Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ CVE-2026-54335, GHSA-28xv-ph75-77wh | Low | 0.4% | 14 Jul, 2026 | npm @feathersjs/commons |
n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments CVE-2026-54052, GHSA-j6r7-6fhx-77wx | Critical | 0.4% | 14 Jul, 2026 | npm n8n-mcp |
Malicious release: Malicious code in utils-style-engine (npm) MAL-2026-10609 | Malicious | Not scored | 14 Jul, 2026 | npm utils-style-engine |
Malicious release: Malicious code in @radivi-ui/react-dialog (npm) MAL-2026-10605 | Malicious | Not scored | 14 Jul, 2026 | npm @radivi-ui/react-dialog |