Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in chai-as-built (npm) MAL-2026-6465 | Malicious | Not scored | 25 Jun, 2026 | npm chai-as-built |
Malicious release: Malicious code in gx-npm-feature-flags (npm) GHSA-hhw7-23r7-qwj7, MAL-2026-6466 | Malicious | Not scored | 25 Jun, 2026 | npm gx-npm-feature-flags |
Malicious release: Malicious code in @colibri-event-types/megamarket-ru-web (npm) MAL-2026-6464 | Malicious | Not scored | 25 Jun, 2026 | npm @colibri-event-types/megamarket-ru-web |
Malicious release: Malicious code in abu-common-components (npm) MAL-2026-6463 | Malicious | Not scored | 25 Jun, 2026 | npm abu-common-components |
Malicious release: Malicious code in dttsdee (npm) MAL-2026-6462 | Malicious | Not scored | 25 Jun, 2026 | npm dttsdee |
Malicious release: Malicious code in easy-string-kit232 (npm) MAL-2026-6461 | Malicious | Not scored | 25 Jun, 2026 | npm easy-string-kit232 |
Malicious release: Malicious code in dddooo (npm) MAL-2026-6460 | Malicious | Not scored | 25 Jun, 2026 | npm dddooo |
Malicious release: Malicious code in easy-string-kit (npm) MAL-2026-6459 | Malicious | Not scored | 25 Jun, 2026 | npm easy-string-kit |
Malicious release: Malicious code in wp-codebox-workspace (npm) MAL-2026-6458 | Malicious | Not scored | 25 Jun, 2026 | npm wp-codebox-workspace |
Malicious release: Malicious code in simple-node-calc-c (npm) MAL-2026-6454 | Malicious | Not scored | 25 Jun, 2026 | npm simple-node-calc-c |
Malicious release: Malicious code in simple-node-calc-a (npm) MAL-2026-6451 | Malicious | Not scored | 25 Jun, 2026 | npm simple-node-calc-a |
Malicious release: Malicious code in simple-node-calc-b (npm) MAL-2026-6453 | Malicious | Not scored | 25 Jun, 2026 | npm simple-node-calc-b |
Malicious release: Malicious code in simple-node-calc-aa (npm) MAL-2026-6452 | Malicious | Not scored | 25 Jun, 2026 | npm simple-node-calc-aa |
Malicious release: Malicious code in simple-node-calc-ccc (npm) MAL-2026-6455 | Malicious | Not scored | 25 Jun, 2026 | npm simple-node-calc-ccc |
Malicious release: Malicious code in subsearch (npm) GHSA-45mm-476v-v2pf, MAL-2026-6457 | Malicious | Not scored | 25 Jun, 2026 | npm subsearch |
Malicious release: Malicious code in stitch-design (npm) MAL-2026-6456 | Malicious | Not scored | 25 Jun, 2026 | npm stitch-design |
Malicious release: Malicious code in based-32 (npm) MAL-2026-6447 | Malicious | Not scored | 25 Jun, 2026 | npm based-32 |
Malicious release: Malicious code in howdybase32 (npm) MAL-2026-6449 | Malicious | Not scored | 25 Jun, 2026 | npm howdybase32 |
Malicious release: Malicious code in nizzybase32 (npm) MAL-2026-6450 | Malicious | Not scored | 25 Jun, 2026 | npm nizzybase32 |
Malicious release: Malicious code in base58-core (npm) GHSA-3439-q8cv-mg5v, MAL-2026-6445 | Malicious | Not scored | 25 Jun, 2026 | npm base58-core |
Malicious release: Malicious code in bs58-86 (npm) GHSA-9gvv-wfph-q6rj, MAL-2026-6448 | Malicious | Not scored | 25 Jun, 2026 | npm bs58-86 |
Malicious release: Malicious code in base62-86x (npm) GHSA-239r-cp8p-5gfj, MAL-2026-6446 | Malicious | Not scored | 25 Jun, 2026 | npm base62-86x |
Malicious release: Malicious code in agentsync-tool (npm) MAL-2026-6444 | Malicious | Not scored | 25 Jun, 2026 | npm agentsync-tool |
Malicious release: Malicious code in agentsync-pkg (npm) GHSA-6h7h-cf78-vgc2, MAL-2026-6443 | Malicious | Not scored | 25 Jun, 2026 | npm agentsync-pkg |
Malicious release: Malicious code in logfmt-core (npm) GHSA-q37m-wc54-rhg8, MAL-2026-6437 | Malicious | Not scored | 25 Jun, 2026 | npm logfmt-core |
Malicious release: Malicious code in polymarket-stake-math (npm) GHSA-f2m3-4xrc-vfxg, MAL-2026-6438 | Malicious | Not scored | 25 Jun, 2026 | npm polymarket-stake-math |
Malicious release: Malicious code in polymarket-stake-maths (npm) GHSA-x384-v7hw-q48x, MAL-2026-6439 | Malicious | Not scored | 25 Jun, 2026 | npm polymarket-stake-maths |
Malicious release: Malicious code in easy-time-format (npm) GHSA-g6fx-78q6-3hqv, MAL-2026-6442 | Malicious | Not scored | 25 Jun, 2026 | npm easy-time-format |
Malicious release: Malicious code in tokenization-util (npm) GHSA-wp9r-fqrq-cg5h, MAL-2026-6440 | Malicious | Not scored | 25 Jun, 2026 | npm tokenization-util |
Malicious release: Malicious code in unifydata (npm) MAL-2026-6441 | Malicious | Not scored | 25 Jun, 2026 | npm unifydata |
Malicious release: Malicious code in anthropic-claude-latest (npm) GHSA-j588-p757-86r9, MAL-2026-6415 | Malicious | Not scored | 25 Jun, 2026 | npm anthropic-claude-latest |
Malicious release: Malicious code in block-slot (npm) GHSA-pg29-x97h-gfr6, MAL-2026-6416 | Malicious | Not scored | 25 Jun, 2026 | npm block-slot |
Malicious release: Malicious code in @su-doughnym/react-dlb (npm) GHSA-3g2q-cw4h-3g67, MAL-2026-6410 | Malicious | Not scored | 25 Jun, 2026 | npm @su-doughnym/react-dlb |
Malicious release: Malicious code in @su-doughnym/loginui (npm) GHSA-3rvq-gwcv-295m, MAL-2026-6408 | Malicious | Not scored | 25 Jun, 2026 | npm @su-doughnym/loginui |
Malicious release: Malicious code in poc-publish-test-su-doughnym (npm) GHSA-fg75-hmqx-qfw9, MAL-2026-6413 | Malicious | Not scored | 25 Jun, 2026 | npm poc-publish-test-su-doughnym |
Malicious release: Malicious code in nabisco (npm) GHSA-m97m-v5gv-jm47, MAL-2026-6412 | Malicious | Not scored | 25 Jun, 2026 | npm nabisco |
Malicious release: Malicious code in @su-doughnym/metrics-js (npm) GHSA-wj6x-p526-mv2w, MAL-2026-6409 | Malicious | Not scored | 25 Jun, 2026 | npm @su-doughnym/metrics-js |
Malicious release: Malicious code in two-factor-prompt-lib (npm) GHSA-94jg-r3hx-4v8v, MAL-2026-6414 | Malicious | Not scored | 25 Jun, 2026 | npm two-factor-prompt-lib |
Malicious release: Malicious code in data-fetching-client (npm) GHSA-j99m-jc5r-9w58, MAL-2026-6411 | Malicious | Not scored | 25 Jun, 2026 | npm data-fetching-client |
Malicious release: Malicious code in @su-doughnym/hubspot-loginui-poc (npm) GHSA-jgj9-pm28-4m94, MAL-2026-6407 | Malicious | Not scored | 25 Jun, 2026 | npm @su-doughnym/hubspot-loginui-poc |
Malicious release: Malicious code in rstreams-shard-util (npm) GHSA-29q5-mm45-3xm3, MAL-2026-6433 | Malicious | Not scored | 24 Jun, 2026 | npm rstreams-shard-util |
Malicious release: Malicious code in leo-connector-mysql (npm) GHSA-474v-72pf-x6q5, MAL-2026-6425 | Malicious | Not scored | 24 Jun, 2026 | npm leo-connector-mysql |
Malicious release: Malicious code in serverless-leo (npm) GHSA-5cg2-34x6-pjgv, MAL-2026-6435 | Malicious | Not scored | 24 Jun, 2026 | npm serverless-leo |
Malicious release: Malicious code in leo-logger (npm) GHSA-5ggh-qwv4-wpwg, MAL-2026-6429 | Malicious | Not scored | 24 Jun, 2026 | npm leo-logger |
Malicious release: Malicious code in serverless-convention (npm) GHSA-7j3q-2rph-cwf8, MAL-2026-6434 | Malicious | Not scored | 24 Jun, 2026 | npm serverless-convention |
Malicious release: Malicious code in leo-connector-mongo (npm) GHSA-gwx3-mrcv-2c26, MAL-2026-6424 | Malicious | Not scored | 24 Jun, 2026 | npm leo-connector-mongo |
Malicious release: Malicious code in leo-streams (npm) GHSA-h98v-2hwg-56fx, MAL-2026-6431 | Malicious | Not scored | 24 Jun, 2026 | npm leo-streams |
Malicious release: Malicious code in leo-cli (npm) GHSA-hmx8-mh72-wj54, MAL-2026-6421 | Malicious | Not scored | 24 Jun, 2026 | npm leo-cli |
Malicious release: Malicious code in rstreams-metrics (npm) GHSA-hqcj-4r96-9wj6, MAL-2026-6432 | Malicious | Not scored | 24 Jun, 2026 | npm rstreams-metrics |
Malicious release: Malicious code in leo-connector-oracle (npm) GHSA-j4v3-8cw4-pg32, MAL-2026-6426 | Malicious | Not scored | 24 Jun, 2026 | npm leo-connector-oracle |