Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in chain-sdk-js (npm) GHSA-2p8p-vrrr-9f6c, MAL-2026-10608 | Malicious | Not scored | 14 Jul, 2026 | npm chain-sdk-js |
Malicious release: Malicious code in chai-as-act (npm) MAL-2026-10607 | Malicious | Not scored | 14 Jul, 2026 | npm chai-as-act |
Malicious release: Malicious code in base58-utils (npm) MAL-2026-10606 | Malicious | Not scored | 14 Jul, 2026 | npm base58-utils |
Malicious release: Malicious code in monitoring-service (npm) GHSA-538g-pxj3-w58h, MAL-2026-10597 | Malicious | Not scored | 14 Jul, 2026 | npm monitoring-service |
Malicious release: Malicious code in monitoring-service-util (npm) GHSA-mc6r-4967-53wm, MAL-2026-10598 | Malicious | Not scored | 14 Jul, 2026 | npm monitoring-service-util |
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry CVE-2026-59891, GHSA-pf56-329r-95rw | Critical | 0.5% | 14 Jul, 2026 | npm @sigstore/oci |
Malicious release: Malicious code in @ayunlove/bails (npm) GHSA-qv85-w97v-vpp2, MAL-2026-10596 | Malicious | Not scored | 14 Jul, 2026 | npm @ayunlove/bails |
Malicious release: Malicious code in nodemon-plint (npm) GHSA-3pf8-vmwm-g7gv, MAL-2026-10595 | Malicious | Not scored | 14 Jul, 2026 | npm nodemon-plint |
Malicious release: Malicious code in async-mutex-v2 (npm) GHSA-f829-g84r-2fq7, MAL-2026-10582 | Malicious | Not scored | 14 Jul, 2026 | npm async-mutex-v2 |
Malicious release: Malicious code in nodeaxois (npm) MAL-2026-10589 | Malicious | Not scored | 14 Jul, 2026 | npm nodeaxois |
Malicious release: Malicious code in dayjscore (npm) MAL-2026-10587 | Malicious | Not scored | 14 Jul, 2026 | npm dayjscore |
Malicious release: Malicious code in chalkdevx (npm) MAL-2026-10584 | Malicious | Not scored | 14 Jul, 2026 | npm chalkdevx |
Malicious release: Malicious code in chalkdev (npm) MAL-2026-10583 | Malicious | Not scored | 14 Jul, 2026 | npm chalkdev |
Malicious release: Malicious code in momenntjs (npm) MAL-2026-10588 | Malicious | Not scored | 14 Jul, 2026 | npm momenntjs |
Malicious release: Malicious code in yargsplus (npm) MAL-2026-10594 | Malicious | Not scored | 14 Jul, 2026 | npm yargsplus |
Malicious release: Malicious code in cheeriobox (npm) MAL-2026-10585 | Malicious | Not scored | 14 Jul, 2026 | npm cheeriobox |
Malicious release: Malicious code in twiliobox (npm) MAL-2026-10593 | Malicious | Not scored | 14 Jul, 2026 | npm twiliobox |
Malicious release: Malicious code in openaiwrapper (npm) MAL-2026-10590 | Malicious | Not scored | 14 Jul, 2026 | npm openaiwrapper |
Malicious release: Malicious code in stripedev (npm) MAL-2026-10592 | Malicious | Not scored | 14 Jul, 2026 | npm stripedev |
Malicious release: Malicious code in crypto-validate-lib (npm) MAL-2026-10586 | Malicious | Not scored | 14 Jul, 2026 | npm crypto-validate-lib |
Malicious release: Malicious code in solana-key-utils (npm) MAL-2026-10591 | Malicious | Not scored | 14 Jul, 2026 | npm solana-key-utils |
Malicious release: Malicious code in bimi-maker (npm) MAL-2026-10579 | Malicious | Not scored | 14 Jul, 2026 | npm bimi-maker |
Malicious release: Malicious code in ethers-core (npm) MAL-2026-10580 | Malicious | Not scored | 14 Jul, 2026 | npm ethers-core |
Malicious release: Malicious code in process-status-widget (npm) GHSA-rvcg-4hj7-jmv2, MAL-2026-10581 | Malicious | Not scored | 14 Jul, 2026 | npm process-status-widget |
Malicious release: Malicious code in @sqlite-group/sql-creator (npm) GHSA-pgxx-98xj-2gvg, MAL-2026-10578 | Malicious | Not scored | 14 Jul, 2026 | npm @sqlite-group/sql-creator |
Malicious release: Malicious code in @sqlite-clone/nodesql (npm) GHSA-x8m3-m829-mhc4, MAL-2026-10577 | Malicious | Not scored | 14 Jul, 2026 | npm @sqlite-clone/nodesql |
Malicious release: Malicious code in @wrenfield/viem (npm) GHSA-pm4g-83cj-7858, MAL-2026-10571 | Malicious | Not scored | 14 Jul, 2026 | npm @wrenfield/viem |
Malicious release: Malicious code in vite-plugin-config-paths (npm) MAL-2026-10574 | Malicious | Not scored | 14 Jul, 2026 | npm vite-plugin-config-paths |
Malicious release: Malicious code in harpoon-package (npm) MAL-2026-10573 | Malicious | Not scored | 14 Jul, 2026 | npm harpoon-package |
Malicious release: Malicious code in web-pop (npm) MAL-2026-10575 | Malicious | Not scored | 14 Jul, 2026 | npm web-pop |
Malicious release: Malicious code in eth-wallet-helpers (npm) MAL-2026-10572 | Malicious | Not scored | 14 Jul, 2026 | npm eth-wallet-helpers |
Malicious release: Malicious code in @akshajrawat/plugin-repo-cli (npm) GHSA-4pr3-9qm5-4r6c, MAL-2026-10554 | Malicious | Not scored | 14 Jul, 2026 | npm @akshajrawat/plugin-repo-cli |
Malicious release: Malicious code in akshajrawat.utils (npm) GHSA-68xp-rp76-mhf5, MAL-2026-10558 | Malicious | Not scored | 14 Jul, 2026 | npm akshajrawat.utils |
Malicious release: Malicious code in eth-dev (npm) MAL-2026-10552 | Malicious | Not scored | 14 Jul, 2026 | npm eth-dev |
Malicious release: Malicious code in abi-encode (npm) MAL-2026-10549 | Malicious | Not scored | 14 Jul, 2026 | npm abi-encode |
Malicious release: Malicious code in @cw-ui/asio-neon-themes (npm) GHSA-4966-56x6-595h, MAL-2026-10556 | Malicious | Not scored | 14 Jul, 2026 | npm @cw-ui/asio-neon-themes |
Malicious release: Malicious code in micro-ui-loader (npm) GHSA-cc9r-4374-69qj, MAL-2026-10564 | Malicious | Not scored | 14 Jul, 2026 | npm micro-ui-loader |
Malicious release: Malicious code in @cw-ui/micro-ui-loader (npm) GHSA-fq95-jj7h-pj3w, MAL-2026-10557 | Malicious | Not scored | 14 Jul, 2026 | npm @cw-ui/micro-ui-loader |
Malicious release: Malicious code in elsisi-cli (npm) MAL-2026-10551 | Malicious | Not scored | 14 Jul, 2026 | npm elsisi-cli |
Malicious release: Malicious code in home-mp-commons (npm) MAL-2026-10553 | Malicious | Not scored | 14 Jul, 2026 | npm home-mp-commons |
Malicious release: Malicious code in avatar-forge (npm) GHSA-23h6-jm35-q4x7, MAL-2026-10559 | Malicious | Not scored | 14 Jul, 2026 | npm avatar-forge |
Malicious release: Malicious code in sync-logger (npm) GHSA-3x53-3cq6-9g58, MAL-2026-10568 | Malicious | Not scored | 14 Jul, 2026 | npm sync-logger |
Malicious release: Malicious code in clipboard-drop (npm) GHSA-85m7-f7fw-3h7f, MAL-2026-10560 | Malicious | Not scored | 14 Jul, 2026 | npm clipboard-drop |
Malicious release: Malicious code in duration-kit (npm) GHSA-8853-3cv6-g8q4, MAL-2026-10562 | Malicious | Not scored | 14 Jul, 2026 | npm duration-kit |
Malicious release: Malicious code in valid-scope (npm) GHSA-chfc-f2cm-2wf8, MAL-2026-10570 | Malicious | Not scored | 14 Jul, 2026 | npm valid-scope |
Malicious release: Malicious code in string-morph (npm) GHSA-ggfx-72x6-p884, MAL-2026-10567 | Malicious | Not scored | 14 Jul, 2026 | npm string-morph |
Malicious release: Malicious code in humanize-kit (npm) GHSA-hxh5-f4r5-8m6g, MAL-2026-10563 | Malicious | Not scored | 14 Jul, 2026 | npm humanize-kit |
Malicious release: Malicious code in relative-time-live (npm) GHSA-p7gw-9qj5-3mmw, MAL-2026-10565 | Malicious | Not scored | 14 Jul, 2026 | npm relative-time-live |
Malicious release: Malicious code in temp-cloak (npm) GHSA-rr2q-r4vq-r6cm, MAL-2026-10569 | Malicious | Not scored | 14 Jul, 2026 | npm temp-cloak |
Malicious release: Malicious code in sight-bind (npm) GHSA-v3x8-hfcr-q8p2, MAL-2026-10566 | Malicious | Not scored | 14 Jul, 2026 | npm sight-bind |