Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in chai-as-sharpened (npm) GHSA-wm45-4mwq-2pg6, MAL-2026-10045 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-sharpened |
Malicious release: Malicious code in chai-secure (npm) MAL-2026-10053 | Malicious | Not scored | 09 Jul, 2026 | npm chai-secure |
Malicious release: Malicious code in chai-smart (npm) GHSA-22f3-fmp6-x5c8, MAL-2026-10054 | Malicious | Not scored | 09 Jul, 2026 | npm chai-smart |
Malicious release: Malicious code in chai-as-disarmed (npm) MAL-2026-10042 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-disarmed |
Malicious release: Malicious code in chai-defender (npm) GHSA-hqh4-jccw-jxg6, MAL-2026-10050 | Malicious | Not scored | 09 Jul, 2026 | npm chai-defender |
Malicious release: Malicious code in tailwind-animate-v4 (npm) GHSA-rh36-94jf-9566, MAL-2026-10073 | Malicious | Not scored | 09 Jul, 2026 | npm tailwind-animate-v4 |
Malicious release: Malicious code in chai-as-smart (npm) MAL-2026-10046 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-smart |
Malicious release: Malicious code in txs-builder-lib (npm) GHSA-r4hr-3frr-jgjv, MAL-2026-10021 | Malicious | Not scored | 09 Jul, 2026 | npm txs-builder-lib |
Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data GHSA-382c-vx95-w3p5 | Medium | Not scored | 09 Jul, 2026 | npm @jsonbored/gittensory-mcp |
Malicious release: Malicious code in client-cookies-agent (npm) MAL-2026-10019 | Malicious | Not scored | 09 Jul, 2026 | npm client-cookies-agent |
Malicious release: Malicious code in n8n-nodes-mcputils (npm) GHSA-rxc8-p2w2-g5jg, MAL-2026-10013 | Malicious | Not scored | 09 Jul, 2026 | npm n8n-nodes-mcputils |
Malicious release: Malicious code in chain-api-sdk (npm) GHSA-6vrp-3g92-phhf, MAL-2026-10009 | Malicious | Not scored | 09 Jul, 2026 | npm chain-api-sdk |
Malicious release: Malicious code in mchain-sdk (npm) GHSA-frcx-7v83-jfwx, MAL-2026-10012 | Malicious | Not scored | 09 Jul, 2026 | npm mchain-sdk |
Malicious release: Malicious code in testing-d3do (npm) MAL-2026-10006 | Malicious | Not scored | 09 Jul, 2026 | npm testing-d3do |
Malicious release: Malicious code in feedback-api (npm) GHSA-48f9-4ww2-87xr, MAL-2026-10010 | Malicious | Not scored | 09 Jul, 2026 | npm feedback-api |
Malicious release: Malicious code in breeze-feature-flag-poc (npm) GHSA-549f-jwr2-69q2, MAL-2026-10008 | Malicious | Not scored | 09 Jul, 2026 | npm breeze-feature-flag-poc |
Malicious release: Malicious code in poc-node-npm (npm) GHSA-72cg-2g98-8fcp, MAL-2026-10015 | Malicious | Not scored | 09 Jul, 2026 | npm poc-node-npm |
Malicious release: Malicious code in rabi-snooze-api (npm) GHSA-cpfq-7jvh-rc7w, MAL-2026-10017 | Malicious | Not scored | 09 Jul, 2026 | npm rabi-snooze-api |
Malicious release: Malicious code in fusion-client (npm) GHSA-j6qf-7f37-jfrh, MAL-2026-10011 | Malicious | Not scored | 09 Jul, 2026 | npm fusion-client |
Malicious release: Malicious code in security-console-ui (npm) GHSA-jxmh-936f-pxv7, MAL-2026-10018 | Malicious | Not scored | 09 Jul, 2026 | npm security-console-ui |
Malicious release: Malicious code in bizapi-portal (npm) GHSA-w3w9-8p53-87h5, MAL-2026-10007 | Malicious | Not scored | 09 Jul, 2026 | npm bizapi-portal |
Malicious release: Malicious code in qlkube (npm) GHSA-w88p-pj99-p5g3, MAL-2026-10016 | Malicious | Not scored | 09 Jul, 2026 | npm qlkube |
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement CVE-2026-12590, GHSA-v422-hmwv-36x6 | Medium | 0.4% | 09 Jul, 2026 | npm body-parser |
Malicious release: Malicious code in clavue (npm) GHSA-3qpf-99hh-7hp4, MAL-2026-7029 | Malicious | Not scored | 09 Jul, 2026 | npm clavue |
Malicious release: Malicious code in clavuepro (npm) GHSA-7m5m-ch5w-5q7v, MAL-2026-7031 | Malicious | Not scored | 09 Jul, 2026 | npm clavuepro |
Malicious release: Malicious code in calvuepro (npm) GHSA-82qq-fgw6-6hf8, MAL-2026-7028 | Malicious | Not scored | 09 Jul, 2026 | npm calvuepro |
Malicious release: Malicious code in myclaude-code (npm) GHSA-f5r3-gf4p-pf67, MAL-2026-7032 | Malicious | Not scored | 09 Jul, 2026 | npm myclaude-code |
Malicious release: Malicious code in @calm2026/imux (npm) GHSA-vwgj-9938-7p8q, MAL-2026-7027 | Malicious | Not scored | 09 Jul, 2026 | npm @calm2026/imux |
Malicious release: Malicious code in clavue-agent-sdk (npm) GHSA-vxh6-2g6j-qrrc, MAL-2026-7030 | Malicious | Not scored | 09 Jul, 2026 | npm clavue-agent-sdk |
Malicious release: Malicious code in tailwind-core (npm) GHSA-m6r5-49q4-pv25, MAL-2026-7026 | Malicious | Not scored | 09 Jul, 2026 | npm tailwind-core |
Malicious release: Malicious code in nodemon-sudo (npm) GHSA-8228-4gjp-c339, MAL-2026-10014 | Malicious | Not scored | 09 Jul, 2026 | npm nodemon-sudo |
Malicious release: Malicious code in @wagni_bot/eth-agent (npm) GHSA-h4p6-fwxp-9h2p, MAL-2026-10024 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/eth-agent |
Malicious release: Malicious code in @wagni_bot/binance-sdk (npm) MAL-2026-10022 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/binance-sdk |
Malicious release: Malicious code in @wagni_bot/bsc-sdk (npm) MAL-2026-10023 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/bsc-sdk |
Malicious release: Malicious code in @wagni_bot/ethereum-wallet (npm) MAL-2026-10025 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/ethereum-wallet |
Malicious release: Malicious code in @wagni_bot/hyperliquid-sdk (npm) MAL-2026-10026 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/hyperliquid-sdk |
Malicious release: Malicious code in @wagni_bot/jupiter-sdk (npm) MAL-2026-10027 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/jupiter-sdk |
Malicious release: Malicious code in @wagni_bot/metemask-sdk (npm) MAL-2026-10028 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/metemask-sdk |
Malicious release: Malicious code in @wagni_bot/meteora-sdk (npm) MAL-2026-10029 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/meteora-sdk |
Malicious release: Malicious code in @wagni_bot/opensea-sdk (npm) MAL-2026-10030 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/opensea-sdk |
Malicious release: Malicious code in @wagni_bot/orca-sdk (npm) MAL-2026-10031 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/orca-sdk |
Malicious release: Malicious code in @wagni_bot/polygon-sdk (npm) MAL-2026-10032 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/polygon-sdk |
Malicious release: Malicious code in @wagni_bot/polymarket-sdk (npm) MAL-2026-10033 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/polymarket-sdk |
Malicious release: Malicious code in @wagni_bot/pumpfun-sdk (npm) MAL-2026-10034 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/pumpfun-sdk |
Malicious release: Malicious code in @wagni_bot/solana-sdk (npm) MAL-2026-10035 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/solana-sdk |
Malicious release: Malicious code in @wagni_bot/web3-agent (npm) MAL-2026-10036 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/web3-agent |
Malicious release: Malicious code in @wagni_bot/web3-toolkit (npm) MAL-2026-10037 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/web3-toolkit |
Malicious release: Malicious code in antsrcsrctest (npm) MAL-2026-10038 | Malicious | Not scored | 09 Jul, 2026 | npm antsrcsrctest |
Malicious release: Malicious code in testis-pack (npm) MAL-2026-10074 | Malicious | Not scored | 09 Jul, 2026 | npm testis-pack |
Malicious release: Malicious code in testudo-pack (npm) MAL-2026-10075 | Malicious | Not scored | 09 Jul, 2026 | npm testudo-pack |