Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @thone33/core-utils (npm) GHSA-w2wf-8vp4-86mq, MAL-2026-6564 | Malicious | Not scored | 29 Jun, 2026 | npm @thone33/core-utils |
Malicious release: Malicious code in longzy-basic-ui (npm) MAL-2026-6569 | Malicious | Not scored | 29 Jun, 2026 | npm longzy-basic-ui |
Malicious release: Malicious code in pkg-fallback (npm) MAL-2026-6570 | Malicious | Not scored | 29 Jun, 2026 | npm pkg-fallback |
Malicious release: Malicious code in express-mocha-test (npm) GHSA-7jq4-grp7-9wq3, MAL-2026-6568 | Malicious | Not scored | 29 Jun, 2026 | npm express-mocha-test |
Malicious release: Malicious code in @epic-common/observability-node (npm) MAL-2026-6562 | Malicious | Not scored | 29 Jun, 2026 | npm @epic-common/observability-node |
Malicious release: Malicious code in yandex-geobase (npm) GHSA-86q5-cfp8-j54g, MAL-2026-6574 | Malicious | Not scored | 29 Jun, 2026 | npm yandex-geobase |
Malicious release: Malicious code in react-wp-viewer (npm) GHSA-566x-g457-qg8g, MAL-2026-6571 | Malicious | Not scored | 29 Jun, 2026 | npm react-wp-viewer |
Malicious release: Malicious code in date-uuid (npm) MAL-2026-6566 | Malicious | Not scored | 29 Jun, 2026 | npm date-uuid |
Malicious release: Malicious code in eslint-commit-parser (npm) GHSA-qmq6-r6mp-r586, MAL-2026-6567 | Malicious | Not scored | 29 Jun, 2026 | npm eslint-commit-parser |
Malicious release: Malicious code in @uisp/utils (npm) GHSA-8gmj-7w3h-39fx, MAL-2026-6565 | Malicious | Not scored | 29 Jun, 2026 | npm @uisp/utils |
Malicious release: Malicious code in rebrandly-domains-digger (npm) GHSA-44wx-4683-p2h3, MAL-2026-6572 | Malicious | Not scored | 29 Jun, 2026 | npm rebrandly-domains-digger |
Malicious release: Malicious code in rebrandly-domains-search-client (npm) GHSA-6q7q-73w8-xvcf, MAL-2026-6573 | Malicious | Not scored | 29 Jun, 2026 | npm rebrandly-domains-search-client |
Malicious release: Malicious code in ulid-xyz (npm) GHSA-56hj-rr4f-w39g, MAL-2026-6672 | Malicious | Not scored | 29 Jun, 2026 | npm ulid-xyz |
Malicious release: Malicious code in @digitalcnzz/commonmodule (npm) MAL-2026-6595 | Malicious | Not scored | 29 Jun, 2026 | npm @digitalcnzz/commonmodule |
Malicious release: Malicious code in @digitalcnzz/embedded-sdk (npm) MAL-2026-6596 | Malicious | Not scored | 29 Jun, 2026 | npm @digitalcnzz/embedded-sdk |
Malicious release: Malicious code in @longzy/react-native-polyfill (npm) MAL-2026-6597 | Malicious | Not scored | 29 Jun, 2026 | npm @longzy/react-native-polyfill |
Malicious release: Malicious code in @sailing-package/core (npm) MAL-2026-6598 | Malicious | Not scored | 29 Jun, 2026 | npm @sailing-package/core |
Malicious release: Malicious code in lc-chatbot (npm) MAL-2026-6559 | Malicious | Not scored | 28 Jun, 2026 | npm lc-chatbot |
Malicious release: Malicious code in polymarket-clob-math (npm) GHSA-3q5w-m6wr-5jp2, MAL-2026-6556 | Malicious | Not scored | 28 Jun, 2026 | npm polymarket-clob-math |
Malicious release: Malicious code in livekit-agents (npm) GHSA-gf82-j362-r5f6, MAL-2026-6555 | Malicious | Not scored | 28 Jun, 2026 | npm livekit-agents |
Malicious release: Malicious code in @k18n/creatormarketplace-admin-language (npm) MAL-2026-6550 | Malicious | Not scored | 28 Jun, 2026 | npm @k18n/creatormarketplace-admin-language |
Malicious release: Malicious code in insomnia-test-util-m4gester (npm) MAL-2026-6554 | Malicious | Not scored | 28 Jun, 2026 | npm insomnia-test-util-m4gester |
Malicious release: Malicious code in insomnia-plugin-poc-m4gester (npm) MAL-2026-6552 | Malicious | Not scored | 28 Jun, 2026 | npm insomnia-plugin-poc-m4gester |
Malicious release: Malicious code in insomnia-plugin-poc-m4gester2 (npm) MAL-2026-6553 | Malicious | Not scored | 28 Jun, 2026 | npm insomnia-plugin-poc-m4gester2 |
Malicious release: Malicious code in anthropic-internal-tools (npm) MAL-2026-6551 | Malicious | Not scored | 28 Jun, 2026 | npm anthropic-internal-tools |
Malicious release: Malicious code in ts-ankle (npm) GHSA-992p-988h-h55j, MAL-2026-6548 | Malicious | Not scored | 27 Jun, 2026 | npm ts-ankle |
Malicious release: Malicious code in ryan-pdf-js (npm) GHSA-7qr7-hcw4-9826, MAL-2026-6546 | Malicious | Not scored | 27 Jun, 2026 | npm ryan-pdf-js |
Malicious release: Malicious code in react-editable-calendar (npm) MAL-2026-6547 | Malicious | Not scored | 27 Jun, 2026 | npm react-editable-calendar |
Malicious release: Malicious code in crossmint-wallets-sdk (npm) GHSA-7rfm-v32j-2583, MAL-2026-6545 | Malicious | Not scored | 27 Jun, 2026 | npm crossmint-wallets-sdk |
Malicious release: Malicious code in chai-as-persisted (npm) GHSA-4wm6-vmww-2544, MAL-2026-6544 | Malicious | Not scored | 27 Jun, 2026 | npm chai-as-persisted |
Malicious release: Malicious code in @osmura/treeify (npm) MAL-2026-6542 | Malicious | Not scored | 26 Jun, 2026 | npm @osmura/treeify |
Malicious release: Malicious code in express-initial (npm) GHSA-fh43-48vc-c9r9, MAL-2026-6543 | Malicious | Not scored | 26 Jun, 2026 | npm express-initial |
Malicious release: Malicious code in db-query-log (npm) GHSA-5p8x-c32p-h2jc, MAL-2026-6539 | Malicious | Not scored | 26 Jun, 2026 | npm db-query-log |
Malicious release: Malicious code in db-rake (npm) GHSA-prxc-r4q3-q88m, MAL-2026-6540 | Malicious | Not scored | 26 Jun, 2026 | npm db-rake |
Malicious release: Malicious code in db-plog (npm) GHSA-j49r-84jx-vq3m, MAL-2026-6538 | Malicious | Not scored | 26 Jun, 2026 | npm db-plog |
Malicious release: Malicious code in @krentzen/buffer-reverse (npm) MAL-2026-6536 | Malicious | Not scored | 26 Jun, 2026 | npm @krentzen/buffer-reverse |
Malicious release: Malicious code in gptmini (npm) MAL-2026-6537 | Malicious | Not scored | 26 Jun, 2026 | npm gptmini |
Malicious release: Malicious code in disksweep (npm) GHSA-257r-h9h2-65xg, MAL-2026-6535 | Malicious | Not scored | 26 Jun, 2026 | npm disksweep |
Malicious release: Malicious code in @appupdate/cdn-sync (npm) MAL-2026-6531 | Malicious | Not scored | 26 Jun, 2026 | npm @appupdate/cdn-sync |
Malicious release: Malicious code in react-dynamic-table-compenent (npm) GHSA-gv99-2c4m-pr2c, MAL-2026-6533 | Malicious | Not scored | 26 Jun, 2026 | npm react-dynamic-table-compenent |
Malicious release: Malicious code in chai-as-assured (npm) GHSA-m282-3m8c-qjwj, MAL-2026-6532 | Malicious | Not scored | 26 Jun, 2026 | npm chai-as-assured |
Malicious release: Malicious code in xrblocks-remote-control (npm) GHSA-24xr-qqmw-jvvf, MAL-2026-6530 | Malicious | Not scored | 26 Jun, 2026 | npm xrblocks-remote-control |
Malicious release: Malicious code in react-dynammic-table-component (npm) GHSA-rghg-wjq8-jq2g, MAL-2026-6534 | Malicious | Not scored | 26 Jun, 2026 | npm react-dynammic-table-component |
Malicious release: Malicious code in @immobiliarelabs/backstage-plugin-gitlab-backend (npm) MAL-2026-6527 | Malicious | Not scored | 26 Jun, 2026 | npm @immobiliarelabs/backstage-plugin-gitlab-backend |
Malicious release: Malicious code in @immobiliarelabs/backstage-plugin-ldap-auth-backend (npm) MAL-2026-6529 | Malicious | Not scored | 26 Jun, 2026 | npm @immobiliarelabs/backstage-plugin-ldap-auth-backend |
Malicious release: Malicious code in @immobiliarelabs/backstage-plugin-ldap-auth (npm) MAL-2026-6528 | Malicious | Not scored | 26 Jun, 2026 | npm @immobiliarelabs/backstage-plugin-ldap-auth |
Malicious release: Malicious code in @immobiliarelabs/backstage-plugin-gitlab (npm) GHSA-r4r5-rj2h-xfvg, MAL-2026-6526 | Malicious | Not scored | 26 Jun, 2026 | npm @immobiliarelabs/backstage-plugin-gitlab |
Malicious release: Malicious code in @carvana.authentication-flows/shared (npm) MAL-2026-6521 | Malicious | Not scored | 26 Jun, 2026 | npm @carvana.authentication-flows/shared |
Malicious release: Malicious code in express-plugin (npm) MAL-2026-6523 | Malicious | Not scored | 26 Jun, 2026 | npm express-plugin |
Malicious release: Malicious code in ts-einkle (npm) GHSA-mjcv-m7fg-mg8j, MAL-2026-6524 | Malicious | Not scored | 26 Jun, 2026 | npm ts-einkle |