Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @gt-test-exp/profiler-exp-00000005 (npm) GHSA-h3w8-853x-jh37, MAL-2026-10242 | Malicious | Not scored | 13 Jul, 2026 | npm @gt-test-exp/profiler-exp-00000005 |
Malicious release: Malicious code in @gt-test-exp/profiler-exp-00000001 (npm) GHSA-vj45-v39j-8wrg, MAL-2026-10238 | Malicious | Not scored | 13 Jul, 2026 | npm @gt-test-exp/profiler-exp-00000001 |
Malicious release: Malicious code in @gt-test-exp/profiler-exp-00000003 (npm) GHSA-xh9v-9556-25xw, MAL-2026-10240 | Malicious | Not scored | 13 Jul, 2026 | npm @gt-test-exp/profiler-exp-00000003 |
Malicious release: Malicious code in openai-apps (npm) GHSA-6p8x-rqq9-f5hm, MAL-2026-10363 | Malicious | Not scored | 13 Jul, 2026 | npm openai-apps |
Malicious release: Malicious code in dogfood-search (npm) GHSA-rj7x-4vm3-g5qh, MAL-2026-10300 | Malicious | Not scored | 13 Jul, 2026 | npm dogfood-search |
Malicious release: Malicious code in vibewise (npm) GHSA-5w28-c486-hwhp, MAL-2026-10394 | Malicious | Not scored | 13 Jul, 2026 | npm vibewise |
Malicious release: Malicious code in vibewise-cli (npm) GHSA-c576-6fr6-958p, MAL-2026-10395 | Malicious | Not scored | 13 Jul, 2026 | npm vibewise-cli |
Malicious release: Malicious code in gpapp (npm) GHSA-jqmp-phjr-8wgf, MAL-2026-10302 | Malicious | Not scored | 13 Jul, 2026 | npm gpapp |
Malicious release: Malicious code in gpapps (npm) GHSA-q3m9-9f7f-9rjp, MAL-2026-10303 | Malicious | Not scored | 13 Jul, 2026 | npm gpapps |
Malicious release: Malicious code in apps-gpt (npm) GHSA-w8x5-m86w-956v, MAL-2026-10284 | Malicious | Not scored | 13 Jul, 2026 | npm apps-gpt |
Malicious release: Malicious code in @gleamkit/ws (npm) MAL-2026-10402 | Malicious | Not scored | 13 Jul, 2026 | npm @gleamkit/ws |
Malicious release: Malicious code in @iana-rzms/bff-sdk (npm) MAL-2026-10403 | Malicious | Not scored | 13 Jul, 2026 | npm @iana-rzms/bff-sdk |
Malicious release: Malicious code in @espn-ping/react-dmed-oauth (npm) GHSA-c99m-x4q9-727p, MAL-2026-10401 | Malicious | Not scored | 13 Jul, 2026 | npm @espn-ping/react-dmed-oauth |
Malicious release: Malicious code in @db-tools/main-app (npm) MAL-2026-10398 | Malicious | Not scored | 13 Jul, 2026 | npm @db-tools/main-app |
Malicious release: Malicious code in @equansservices/tool (npm) GHSA-5v77-3vqq-cv88, MAL-2026-10400 | Malicious | Not scored | 13 Jul, 2026 | npm @equansservices/tool |
Malicious release: Malicious code in @equansservices/codex (npm) MAL-2026-10399 | Malicious | Not scored | 13 Jul, 2026 | npm @equansservices/codex |
Malicious release: Malicious code in @car_loans/dealerships-approval (npm) GHSA-p8xg-5qpp-p289, MAL-2026-10397 | Malicious | Not scored | 13 Jul, 2026 | npm @car_loans/dealerships-approval |
Malicious release: Malicious code in @jplopezy/connectivity-test-do-not-install (npm) GHSA-gc65-4rgh-4rc3, MAL-2026-10220 | Malicious | Not scored | 13 Jul, 2026 | npm @jplopezy/connectivity-test-do-not-install |
Malicious release: Malicious code in chai-as-precision (npm) MAL-2026-10219 | Malicious | Not scored | 13 Jul, 2026 | npm chai-as-precision |
Malicious release: Malicious code in pure-folder-three (npm) GHSA-9w58-3cgj-jw7v, MAL-2026-10218 | Malicious | Not scored | 13 Jul, 2026 | npm pure-folder-three |
Malicious release: Malicious code in dotnet-runtime-base (npm) GHSA-9gr8-wg29-9wvv, MAL-2026-10217 | Malicious | Not scored | 13 Jul, 2026 | npm dotnet-runtime-base |
Malicious release: Malicious code in node-sysmetrics (npm) GHSA-w2wx-f2m6-332m, MAL-2026-10216 | Malicious | Not scored | 13 Jul, 2026 | npm node-sysmetrics |
Malicious release: Malicious code in slds-lsp-client (npm) GHSA-63pr-5274-mfh7, MAL-2026-10234 | Malicious | Not scored | 13 Jul, 2026 | npm slds-lsp-client |
Malicious release: Malicious code in salesforce-vscode-slds (npm) GHSA-9cp8-cmrv-qrg9, MAL-2026-10232 | Malicious | Not scored | 13 Jul, 2026 | npm salesforce-vscode-slds |
Malicious release: Malicious code in chat-adapter-zoom (npm) GHSA-vw6g-629w-6hgx, MAL-2026-10228 | Malicious | Not scored | 13 Jul, 2026 | npm chat-adapter-zoom |
Malicious release: Malicious code in babel-preset-lib-client (npm) GHSA-wxh7-fh8g-5j3m, MAL-2026-10214 | Malicious | Not scored | 12 Jul, 2026 | npm babel-preset-lib-client |
Malicious release: Malicious code in auto-debug-tool (npm) GHSA-j6r6-q63r-r4qx, MAL-2026-10209 | Malicious | Not scored | 12 Jul, 2026 | npm auto-debug-tool |
Malicious release: Malicious code in vuln-package (npm) MAL-2026-10212 | Malicious | Not scored | 12 Jul, 2026 | npm vuln-package |
Malicious release: Malicious code in mcp-notes-server-poc-praetorian (npm) GHSA-rfhm-2wfr-r9p2, MAL-2026-10210 | Malicious | Not scored | 12 Jul, 2026 | npm mcp-notes-server-poc-praetorian |
Malicious release: Malicious code in @meziizana/frontend-logger (npm) MAL-2026-10208 | Malicious | Not scored | 12 Jul, 2026 | npm @meziizana/frontend-logger |
Malicious release: Malicious code in react-next-vite (npm) MAL-2026-10211 | Malicious | Not scored | 12 Jul, 2026 | npm react-next-vite |
Malicious release: Malicious code in nullrift (npm) MAL-2026-10206 | Malicious | Not scored | 12 Jul, 2026 | npm nullrift |
Malicious release: Malicious code in chain-await-dom (npm) MAL-2026-10202 | Malicious | Not scored | 12 Jul, 2026 | npm chain-await-dom |
Malicious release: Malicious code in react-dom-v17 (npm) MAL-2026-10207 | Malicious | Not scored | 12 Jul, 2026 | npm react-dom-v17 |
Malicious release: Malicious code in library-explorer (npm) GHSA-rgpm-2hw4-8725, MAL-2026-10205 | Malicious | Not scored | 12 Jul, 2026 | npm library-explorer |
Malicious release: Malicious code in giantswarm (npm) MAL-2026-10203 | Malicious | Not scored | 12 Jul, 2026 | npm giantswarm |
Malicious release: Malicious code in api-changelly (npm) GHSA-3835-mjjv-wqw8, MAL-2026-10200 | Malicious | Not scored | 12 Jul, 2026 | npm api-changelly |
Malicious release: Malicious code in gptcore (npm) MAL-2026-10204 | Malicious | Not scored | 12 Jul, 2026 | npm gptcore |
Malicious release: Malicious code in bugexploit (npm) MAL-2026-10201 | Malicious | Not scored | 12 Jul, 2026 | npm bugexploit |
Malicious release: Malicious code in polylabel-web-lib (npm) GHSA-4x59-mhxh-4ghc, MAL-2026-10198 | Malicious | Not scored | 12 Jul, 2026 | npm polylabel-web-lib |
Malicious release: Malicious code in polymarket-kelly-math-stake (npm) GHSA-394f-8988-57rp, MAL-2026-10199 | Malicious | Not scored | 12 Jul, 2026 | npm polymarket-kelly-math-stake |
Malicious release: Malicious code in tinymask-js (npm) GHSA-993g-jhvm-h79j, MAL-2026-10189 | Malicious | Not scored | 11 Jul, 2026 | npm tinymask-js |
Malicious release: Malicious code in awesome-ts-jest (npm) GHSA-7xr4-v32m-4h8x, MAL-2026-10188 | Malicious | Not scored | 11 Jul, 2026 | npm awesome-ts-jest |
Malicious release: Malicious code in tinyparrot (npm) GHSA-447m-j3q4-m529, MAL-2026-10190 | Malicious | Not scored | 11 Jul, 2026 | npm tinyparrot |
Malicious release: Malicious code in google-caja-bower (npm) GHSA-qq75-mfwc-v6gx, MAL-2026-10186 | Malicious | Not scored | 11 Jul, 2026 | npm google-caja-bower |
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist BIT-parse-2026-61448, CVE-2026-61448, GHSA-r899-h629-j84r | Low | 0.4% | 11 Jul, 2026 | npm parse-server |
PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure CVE-2026-61426, GHSA-6wjp-v33h-5cvq | High | 0.4% | 11 Jul, 2026 | npm praisonai |
Malicious release: Malicious code in authvaultx (npm) GHSA-frr6-2jc6-6fhr, MAL-2026-10185 | Malicious | Not scored | 11 Jul, 2026 | npm authvaultx |
Malicious release: Malicious code in jscrambler (npm) GHSA-v3g3-4x77-rw68, MAL-2026-10187 | Malicious | Not scored | 11 Jul, 2026 | npm jscrambler |
Malicious release: Malicious code in polymarket-mcp-v2 (npm) MAL-2026-10481 | Malicious | Not scored | 11 Jul, 2026 | npm polymarket-mcp-v2 |