Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in test_adminet (npm) MAL-2026-10509 | Malicious | Not scored | 13 Jul, 2026 | npm test_adminet |
Malicious release: Malicious code in express-ini (npm) GHSA-w3p6-c3cm-r253, MAL-2026-10505 | Malicious | Not scored | 13 Jul, 2026 | npm express-ini |
Malicious release: Malicious code in filewisee (npm) GHSA-wp6h-28pg-v4j5, MAL-2026-10501 | Malicious | Not scored | 13 Jul, 2026 | npm filewisee |
Malicious release: Malicious code in bubblestring (npm) MAL-2026-10496 | Malicious | Not scored | 13 Jul, 2026 | npm bubblestring |
Malicious release: Malicious code in ddok-modal (npm) GHSA-5xvp-j6m9-rwr6, MAL-2026-10497 | Malicious | Not scored | 13 Jul, 2026 | npm ddok-modal |
Malicious release: Malicious code in n8n-nodes-rce-poc (npm) GHSA-f4f3-9g54-864m, MAL-2026-10503 | Malicious | Not scored | 13 Jul, 2026 | npm n8n-nodes-rce-poc |
Malicious release: Malicious code in gamified-trading-system (npm) GHSA-h8fc-h568-wwr9, GHSA-hh4c-9fqx-2vc5, MAL-2026-10502 | Malicious | Not scored | 13 Jul, 2026 | npm gamified-trading-system |
Malicious release: Malicious code in eslint-angular-react (npm) GHSA-jp3x-3mrw-3vwf, MAL-2026-10498 | Malicious | Not scored | 13 Jul, 2026 | npm eslint-angular-react |
Malicious release: Malicious code in express-bunker (npm) GHSA-mrw6-p6x7-7jj3, GHSA-w7r5-8cmj-m893, MAL-2026-10500, SNYK-JS-EXPRESSBUNKER-19161375 | Malicious | Not scored | 13 Jul, 2026 | npm express-bunker |
Malicious release: Malicious code in @quukk/opencode-clawmessenger (npm) MAL-2026-10495 | Malicious | Not scored | 13 Jul, 2026 | npm @quukk/opencode-clawmessenger |
Malicious release: Malicious code in @quickcall/krew (npm) MAL-2026-10494 | Malicious | Not scored | 13 Jul, 2026 | npm @quickcall/krew |
Malicious release: Malicious code in eth-lib-utils (npm) GHSA-q57p-j3v9-q767, MAL-2026-10499 | Malicious | Not scored | 13 Jul, 2026 | npm eth-lib-utils |
Malicious release: Malicious code in insomnia-plugin-poc-m4gester-run (npm) MAL-2026-10493 | Malicious | Not scored | 13 Jul, 2026 | npm insomnia-plugin-poc-m4gester-run |
Malicious release: Malicious code in assertcoreutils (npm) GHSA-22qr-5q9r-7v6x, MAL-2026-10491 | Malicious | Not scored | 13 Jul, 2026 | npm assertcoreutils |
Malicious release: Malicious code in font-huge (npm) GHSA-x8f8-q6m3-g4pq, MAL-2026-10492 | Malicious | Not scored | 13 Jul, 2026 | npm font-huge |
Malicious release: Malicious code in @sqlite-panel/createsql (npm) GHSA-mq68-3vc3-ch3q, MAL-2026-10490 | Malicious | Not scored | 13 Jul, 2026 | npm @sqlite-panel/createsql |
Malicious release: Malicious code in permcarmserver (npm) GHSA-9499-pgrg-v7w7, MAL-2026-10488 | Malicious | Not scored | 13 Jul, 2026 | npm permcarmserver |
Malicious release: Malicious code in permcserver (npm) GHSA-vjr2-cx8x-3q2x, MAL-2026-10489 | Malicious | Not scored | 13 Jul, 2026 | npm permcserver |
Malicious release: Malicious code in @omniwatch-wick/cli (npm) GHSA-x4cm-7r6h-pjg3, MAL-2026-10486 | Malicious | Not scored | 13 Jul, 2026 | npm @omniwatch-wick/cli |
Malicious release: Malicious code in @outsmartly/metaobjects (npm) MAL-2026-10487 | Malicious | Not scored | 13 Jul, 2026 | npm @outsmartly/metaobjects |
Malicious release: Malicious code in polymarket-stake-kelly-math-check (npm) GHSA-w387-g22r-3pw7, MAL-2026-10485 | Malicious | Not scored | 13 Jul, 2026 | npm polymarket-stake-kelly-math-check |
Malicious release: Malicious code in react-icons-svgo (npm) GHSA-m78v-9w6f-xwf2, MAL-2026-10482 | Malicious | Not scored | 13 Jul, 2026 | npm react-icons-svgo |
Malicious release: Malicious code in node-fsmetrics-data (npm) GHSA-85wr-m3c9-v62j, MAL-2026-10479 | Malicious | Not scored | 13 Jul, 2026 | npm node-fsmetrics-data |
Malicious release: Malicious code in route-processor (npm) GHSA-8mrq-4593-6x5p, MAL-2026-10483 | Malicious | Not scored | 13 Jul, 2026 | npm route-processor |
Malicious release: Malicious code in node-fsmetrics-native (npm) GHSA-hfgq-7j44-m23h, MAL-2026-10480 | Malicious | Not scored | 13 Jul, 2026 | npm node-fsmetrics-native |
Malicious release: Malicious code in @sectest429/hello-npm-world (npm) GHSA-q7w2-749v-c98p, MAL-2026-10478 | Malicious | Not scored | 13 Jul, 2026 | npm @sectest429/hello-npm-world |
Malicious release: Malicious code in @torbeck/priority-queue (npm) GHSA-v2rg-75ch-7cfx, MAL-2026-10472 | Malicious | Not scored | 13 Jul, 2026 | npm @torbeck/priority-queue |
Malicious release: Malicious code in claude-team-tracker (npm) MAL-2026-10473 | Malicious | Not scored | 13 Jul, 2026 | npm claude-team-tracker |
Malicious release: Malicious code in @dervix/socket.io (npm) GHSA-8hwh-fjw2-33qq, MAL-2026-10475 | Malicious | Not scored | 13 Jul, 2026 | npm @dervix/socket.io |
Malicious release: Malicious code in @dervix/engine.io (npm) GHSA-p68q-mqrg-7w4p, MAL-2026-10474 | Malicious | Not scored | 13 Jul, 2026 | npm @dervix/engine.io |
Malicious release: Malicious code in @gleamkit/socket.io (npm) GHSA-666h-5h3g-crf4, MAL-2026-10477 | Malicious | Not scored | 13 Jul, 2026 | npm @gleamkit/socket.io |
Malicious release: Malicious code in @gleamkit/engine.io (npm) GHSA-gvp7-6g9j-r5c6, MAL-2026-10476 | Malicious | Not scored | 13 Jul, 2026 | npm @gleamkit/engine.io |
Malicious release: Malicious code in loading-sessions (npm) GHSA-qrjp-fmwp-2rjq, MAL-2026-10471 | Malicious | Not scored | 13 Jul, 2026 | npm loading-sessions |
Malicious release: Malicious code in @uw010010/vite-tree (npm) GHSA-5q9f-77m9-x7c2, MAL-2026-10470 | Malicious | Not scored | 13 Jul, 2026 | npm @uw010010/vite-tree |
Malicious release: Malicious code in @sheltr_/agent (npm) MAL-2026-10469 | Malicious | Not scored | 13 Jul, 2026 | npm @sheltr_/agent |
Malicious release: Malicious code in @origindev/ethaccount (npm) MAL-2026-10455 | Malicious | Not scored | 13 Jul, 2026 | npm @origindev/ethaccount |
Malicious release: Malicious code in @spzhongwin/skill-logger-plugin (npm) MAL-2026-10456 | Malicious | Not scored | 13 Jul, 2026 | npm @spzhongwin/skill-logger-plugin |
Malicious release: Malicious code in nodemon-sync (npm) GHSA-jj64-x8fg-q524, MAL-2026-10468 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-sync |
Malicious release: Malicious code in hehehee (npm) MAL-2026-10462 | Malicious | Not scored | 13 Jul, 2026 | npm hehehee |
Malicious release: Malicious code in cktool-core (npm) GHSA-qm37-v399-r9m5, MAL-2026-10457 | Malicious | Not scored | 13 Jul, 2026 | npm cktool-core |
Malicious release: Malicious code in polymarket-math-stake-kelly (npm) MAL-2026-10466 | Malicious | Not scored | 13 Jul, 2026 | npm polymarket-math-stake-kelly |
Malicious release: Malicious code in gptlite (npm) MAL-2026-10461 | Malicious | Not scored | 13 Jul, 2026 | npm gptlite |
Malicious release: Malicious code in polymarket-stake-kelly-math (npm) GHSA-2957-xv6c-9vvm, MAL-2026-10467 | Malicious | Not scored | 13 Jul, 2026 | npm polymarket-stake-kelly-math |
Malicious release: Malicious code in compliancepolicyserv (npm) MAL-2026-10458 | Malicious | Not scored | 13 Jul, 2026 | npm compliancepolicyserv |
Malicious release: Malicious code in connectedmerchantsserv (npm) MAL-2026-10459 | Malicious | Not scored | 13 Jul, 2026 | npm connectedmerchantsserv |
Malicious release: Malicious code in datavaultx (npm) MAL-2026-10460 | Malicious | Not scored | 13 Jul, 2026 | npm datavaultx |
Malicious release: Malicious code in node-path-addon (npm) GHSA-87rj-7vj7-vxgg, MAL-2026-10463 | Malicious | Not scored | 13 Jul, 2026 | npm node-path-addon |
Malicious release: Malicious code in node-procmetrics-data (npm) MAL-2026-10464 | Malicious | Not scored | 13 Jul, 2026 | npm node-procmetrics-data |
Malicious release: Malicious code in node-sysmon-native (npm) MAL-2026-10465 | Malicious | Not scored | 13 Jul, 2026 | npm node-sysmon-native |
Malicious release: Malicious code in nodemon-async (npm) GHSA-p75m-7xf4-8cqw, MAL-2026-10454 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-async |