Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in mdb-vite (npm) GHSA-w572-cxjv-46jc, MAL-2026-10144 | Malicious | Not scored | 10 Jul, 2026 | npm mdb-vite |
Malicious release: Malicious code in polymarket-gamma-apis (npm) GHSA-59wg-mh66-248p, MAL-2026-10149 | Malicious | Not scored | 10 Jul, 2026 | npm polymarket-gamma-apis |
Malicious release: Malicious code in marked-prettier (npm) GHSA-hwmr-cmgq-wr7x, MAL-2026-10143 | Malicious | Not scored | 10 Jul, 2026 | npm marked-prettier |
Malicious release: Malicious code in eslint-jest (npm) GHSA-m3v6-5prj-x7rp, MAL-2026-10142 | Malicious | Not scored | 10 Jul, 2026 | npm eslint-jest |
tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies CVE-2026-49977, GHSA-jxj7-g6gm-49j7 | Medium | 0.4% | 10 Jul, 2026 | npm tarteaucitronjs |
Malicious release: Malicious code in stella-ai-cli (npm) GHSA-v3hh-vj73-4924, MAL-2026-10133 | Malicious | Not scored | 10 Jul, 2026 | npm stella-ai-cli |
Malicious release: Malicious code in stella-coder (npm) MAL-2026-10134 | Malicious | Not scored | 10 Jul, 2026 | npm stella-coder |
Malicious release: Malicious code in uac-package (npm) GHSA-7cmm-649r-p3q2, MAL-2026-10138 | Malicious | Not scored | 10 Jul, 2026 | npm uac-package |
Malicious release: Malicious code in express-session-kit (npm) GHSA-v8j2-pw9x-xx7p, MAL-2026-10131 | Malicious | Not scored | 10 Jul, 2026 | npm express-session-kit |
Malicious release: Malicious code in transform-es2015-sticky-regex (npm) GHSA-2j63-q9jc-966c, MAL-2026-10136 | Malicious | Not scored | 10 Jul, 2026 | npm transform-es2015-sticky-regex |
Malicious release: Malicious code in type-elint (npm) GHSA-v69h-23wr-hjg4, MAL-2026-10137 | Malicious | Not scored | 10 Jul, 2026 | npm type-elint |
Malicious release: Malicious code in ohcm-culture-formatting (npm) MAL-2026-10128 | Malicious | Not scored | 10 Jul, 2026 | npm ohcm-culture-formatting |
Malicious release: Malicious code in eth-react-redirection (npm) MAL-2026-10127 | Malicious | Not scored | 10 Jul, 2026 | npm eth-react-redirection |
Malicious release: Malicious code in rtc-integration-frontend-sdk (npm) MAL-2026-10129 | Malicious | Not scored | 10 Jul, 2026 | npm rtc-integration-frontend-sdk |
Malicious release: Malicious code in type-plint (npm) GHSA-8mhh-r4mc-2293, MAL-2026-10130 | Malicious | Not scored | 10 Jul, 2026 | npm type-plint |
n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads CVE-2026-58661, GHSA-w867-jm58-p9pv | Medium | 0.4% | 10 Jul, 2026 | npm n8n |
Malicious release: Malicious code in dowload_ebok_superior_spider_man_1_marvel_collection_by_dan_slott_tc3wo (npm) GHSA-32gm-qj4x-q887, MAL-2026-10125 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_superior_spider_man_1_marvel_collection_by_dan_slott_tc3wo |
Malicious release: Malicious code in dowload_ebok_programming_in_haskell_second_edition_by_graham_hutton_c19wm (npm) GHSA-7cqx-w44w-2w4m, MAL-2026-10123 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_programming_in_haskell_second_edition_by_graham_hutton_c19wm |
Malicious release: Malicious code in dowload_ebok_river_of_time_by_naomi_judd_marcia_wilkie_i1ze3 (npm) GHSA-gmw4-2r8x-wcrh, MAL-2026-10124 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_river_of_time_by_naomi_judd_marcia_wilkie_i1ze3 |
Malicious release: Malicious code in dowload_ebok_leila_a_filha_de_charles_by_denise_correa_de_macedo_arnold_de_numiers_o103j (npm) GHSA-jf9x-crpq-qr4p, MAL-2026-10121 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_leila_a_filha_de_charles_by_denise_correa_de_macedo_arnold_de_numiers_o103j |
Malicious release: Malicious code in dowload_ebok_wrath_of_the_gods_by_j_robert_kennedy_61o88 (npm) GHSA-g57p-g83q-gcxh, MAL-2026-10126 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_wrath_of_the_gods_by_j_robert_kennedy_61o88 |
Malicious release: Malicious code in dowload_ebok_murder_in_plain_english_by_michael_arntfield_marcel_danesi_uleto (npm) GHSA-j3fj-g64g-f923, MAL-2026-10122 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_murder_in_plain_english_by_michael_arntfield_marcel_danesi_uleto |
Malicious release: Malicious code in dowload_ebok_goodbye_things_by_fumio_sasaki_ptu02 (npm) GHSA-rffj-cpwp-q65h, MAL-2026-10120 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_goodbye_things_by_fumio_sasaki_ptu02 |
Malicious release: Malicious code in execfences (npm) GHSA-34gj-pgfv-8qgf, MAL-2026-10118 | Malicious | Not scored | 10 Jul, 2026 | npm execfences |
Malicious release: Malicious code in nodemon-slint (npm) GHSA-wr24-8cj8-p627, MAL-2026-10117 | Malicious | Not scored | 10 Jul, 2026 | npm nodemon-slint |
Malicious release: Malicious code in driftpin (npm) MAL-2026-10114 | Malicious | Not scored | 10 Jul, 2026 | npm driftpin |
Malicious release: Malicious code in jwtmethod (npm) MAL-2026-10116 | Malicious | Not scored | 10 Jul, 2026 | npm jwtmethod |
Malicious release: Malicious code in workspace-lint (npm) GHSA-2667-2whh-v3mf, MAL-2026-10112 | Malicious | Not scored | 10 Jul, 2026 | npm workspace-lint |
Malicious release: Malicious code in workspace-scripts (npm) GHSA-pcrx-c762-59jm, MAL-2026-10113 | Malicious | Not scored | 10 Jul, 2026 | npm workspace-scripts |
Malicious release: Malicious code in nodemon-patch (npm) GHSA-5v8m-v9mp-gf8h, MAL-2026-10110 | Malicious | Not scored | 10 Jul, 2026 | npm nodemon-patch |
Malicious release: Malicious code in nodepack-daemon (npm) GHSA-v7fc-qvp5-6qx3, MAL-2026-10111 | Malicious | Not scored | 10 Jul, 2026 | npm nodepack-daemon |
Malicious release: Malicious code in dc-repro (npm) MAL-2026-10102 | Malicious | Not scored | 09 Jul, 2026 | npm dc-repro |
Malicious release: Malicious code in date-kit-lite (npm) MAL-2026-10101 | Malicious | Not scored | 09 Jul, 2026 | npm date-kit-lite |
Malicious release: Malicious code in pxpure8 (npm) MAL-2026-10105 | Malicious | Not scored | 09 Jul, 2026 | npm pxpure8 |
Malicious release: Malicious code in px8my (npm) GHSA-9869-r2r5-fff6, MAL-2026-10104 | Malicious | Not scored | 09 Jul, 2026 | npm px8my |
Malicious release: Malicious code in validator-string (npm) MAL-2026-10109 | Malicious | Not scored | 09 Jul, 2026 | npm validator-string |
Malicious release: Malicious code in url-func-registry (npm) MAL-2026-10108 | Malicious | Not scored | 09 Jul, 2026 | npm url-func-registry |
Malicious release: Malicious code in security-node (npm) GHSA-h82v-g9rg-f32j, MAL-2026-10107 | Malicious | Not scored | 09 Jul, 2026 | npm security-node |
Malicious release: Malicious code in optimize-regex (npm) GHSA-vrj5-6f7q-fx9g, MAL-2026-10103 | Malicious | Not scored | 09 Jul, 2026 | npm optimize-regex |
Malicious release: Malicious code in rallycoding (npm) GHSA-xh99-h4gh-gcv6, MAL-2026-10106 | Malicious | Not scored | 09 Jul, 2026 | npm rallycoding |
Malicious release: Malicious code in polipoli-pak (npm) GHSA-9rgw-9wxh-3pp2, MAL-2026-10099 | Malicious | Not scored | 09 Jul, 2026 | npm polipoli-pak |
Malicious release: Malicious code in @kl-starfish/test-01 (npm) GHSA-q8q2-g7r6-wg9x, MAL-2026-10097 | Malicious | Not scored | 09 Jul, 2026 | npm @kl-starfish/test-01 |
@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint CVE-2026-55605, GHSA-72f3-6w86-7rv3 | Medium | 0.5% | 09 Jul, 2026 | npm @arikusi/deepseek-mcp-server |
@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key CVE-2026-55604, GHSA-fh3r-g96v-f578 | High | 0.4% | 09 Jul, 2026 | npm @arikusi/deepseek-mcp-server |
decompress allows arbitrary hardlink creation during archive extraction CVE-2026-39243, GHSA-jwp9-9v96-94mx | Medium | 0.3% | 09 Jul, 2026 | npm decompress |
Malicious release: Malicious code in fastify-addone (npm) MAL-2026-10098 | Malicious | Not scored | 09 Jul, 2026 | npm fastify-addone |
Malicious release: Malicious code in guest-app-ui (npm) MAL-2026-10096 | Malicious | Not scored | 09 Jul, 2026 | npm guest-app-ui |
Malicious release: Malicious code in fury_frontend-andes-ui (npm) MAL-2026-10095 | Malicious | Not scored | 09 Jul, 2026 | npm fury_frontend-andes-ui |
Malicious release: Malicious code in @equansservices/setup (npm) MAL-2026-10094 | Malicious | Not scored | 09 Jul, 2026 | npm @equansservices/setup |
Malicious release: Malicious code in @andrewstory18/is-real-odd (npm) MAL-2026-10093 | Malicious | Not scored | 09 Jul, 2026 | npm @andrewstory18/is-real-odd |