Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in zomato-espresso (npm) MAL-2026-6269 | Malicious | Not scored | 22 Jun, 2026 | npm zomato-espresso |
Malicious release: Malicious code in zomato-mcp (npm) MAL-2026-6270 | Malicious | Not scored | 22 Jun, 2026 | npm zomato-mcp |
Malicious release: Malicious code in zomato-core (npm) MAL-2026-6268 | Malicious | Not scored | 22 Jun, 2026 | npm zomato-core |
Malicious release: Malicious code in sn-internal-testjgsakjdkjadkjah (npm) MAL-2026-6265 | Malicious | Not scored | 22 Jun, 2026 | npm sn-internal-testjgsakjdkjadkjah |
Malicious release: Malicious code in test-package-sajsdkashdj (npm) MAL-2026-6266 | Malicious | Not scored | 22 Jun, 2026 | npm test-package-sajsdkashdj |
Malicious release: Malicious code in search-from-feed (npm) MAL-2026-6264 | Malicious | Not scored | 22 Jun, 2026 | npm search-from-feed |
Malicious release: Malicious code in gd-auth-client (npm) MAL-2026-6263 | Malicious | Not scored | 22 Jun, 2026 | npm gd-auth-client |
Malicious release: Malicious code in crud-respect (npm) GHSA-4p36-4jp8-8rx5, MAL-2026-6257 | Malicious | Not scored | 22 Jun, 2026 | npm crud-respect |
Malicious release: Malicious code in respects-switch (npm) GHSA-4xcj-2v9f-vmqv, MAL-2026-6259 | Malicious | Not scored | 22 Jun, 2026 | npm respects-switch |
Malicious release: Malicious code in onboarding-respects-modal (npm) GHSA-7mh9-j98m-ccvj, MAL-2026-6258 | Malicious | Not scored | 22 Jun, 2026 | npm onboarding-respects-modal |
Malicious release: Malicious code in @tinyfox/shapecheck (npm) GHSA-9q9p-jf58-9fxg, MAL-2026-6312 | Malicious | Not scored | 22 Jun, 2026 | npm @tinyfox/shapecheck |
Malicious release: Malicious code in @lazyutil/dater (npm) GHSA-gjrj-3f9w-gpmr, MAL-2026-6308 | Malicious | Not scored | 22 Jun, 2026 | npm @lazyutil/dater |
Malicious release: Malicious code in @thymelab/logfx (npm) GHSA-j2pw-qr45-rpjm, MAL-2026-6311 | Malicious | Not scored | 22 Jun, 2026 | npm @thymelab/logfx |
Malicious release: Malicious code in @glitchpad/throttler (npm) GHSA-qqf7-vqp4-5rvv, MAL-2026-6307 | Malicious | Not scored | 22 Jun, 2026 | npm @glitchpad/throttler |
Malicious release: Malicious code in @petitcode/eb-retry (npm) GHSA-vfmg-ghq7-3rv3, MAL-2026-6310 | Malicious | Not scored | 22 Jun, 2026 | npm @petitcode/eb-retry |
Malicious release: Malicious code in @frostnode/waitfor (npm) GHSA-w6p8-666c-885f, MAL-2026-6305 | Malicious | Not scored | 22 Jun, 2026 | npm @frostnode/waitfor |
Malicious release: Malicious code in @zynkit/jwtbytes (npm) GHSA-xpqg-89v5-vc7w, MAL-2026-6313 | Malicious | Not scored | 22 Jun, 2026 | npm @zynkit/jwtbytes |
Malicious release: Malicious code in forge-jsx4 (npm) MAL-2026-6279 | Malicious | Not scored | 22 Jun, 2026 | npm forge-jsx4 |
Malicious release: Malicious code in @nullzero/urlcat (npm) MAL-2026-6309 | Malicious | Not scored | 22 Jun, 2026 | npm @nullzero/urlcat |
Malicious release: Malicious code in @dexwilt/node-fetch (npm) MAL-2026-11203 | Malicious | Not scored | 22 Jun, 2026 | npm @dexwilt/node-fetch |
Malicious release: Malicious code in fork-angular-daterangepicker (npm) MAL-2026-6255 | Malicious | Not scored | 21 Jun, 2026 | npm fork-angular-daterangepicker |
Malicious release: Malicious code in blinkit-core (npm) MAL-2026-6249 | Malicious | Not scored | 21 Jun, 2026 | npm blinkit-core |
Malicious release: Malicious code in hyperpure-core (npm) MAL-2026-6250 | Malicious | Not scored | 21 Jun, 2026 | npm hyperpure-core |
Malicious release: Malicious code in zomato-sushi (npm) MAL-2026-6254 | Malicious | Not scored | 21 Jun, 2026 | npm zomato-sushi |
Malicious release: Malicious code in zomato-logger (npm) MAL-2026-6252 | Malicious | Not scored | 21 Jun, 2026 | npm zomato-logger |
Malicious release: Malicious code in zomato-server (npm) MAL-2026-6253 | Malicious | Not scored | 21 Jun, 2026 | npm zomato-server |
Malicious release: Malicious code in zomato-config (npm) MAL-2026-6251 | Malicious | Not scored | 21 Jun, 2026 | npm zomato-config |
Malicious release: Malicious code in sf-storybook (npm) MAL-2026-6261 | Malicious | Not scored | 20 Jun, 2026 | npm sf-storybook |
Malicious release: Malicious code in free-anthropic-claude (npm) GHSA-3h58-8ch3-mgp3, MAL-2026-6260 | Malicious | Not scored | 20 Jun, 2026 | npm free-anthropic-claude |
Malicious release: Malicious code in atlasora-config (npm) MAL-2026-6239 | Malicious | Not scored | 20 Jun, 2026 | npm atlasora-config |
Malicious release: Malicious code in atlasora-shared (npm) MAL-2026-6241 | Malicious | Not scored | 20 Jun, 2026 | npm atlasora-shared |
Malicious release: Malicious code in atlasora-api (npm) MAL-2026-6237 | Malicious | Not scored | 20 Jun, 2026 | npm atlasora-api |
Malicious release: Malicious code in atlasora-types (npm) MAL-2026-6242 | Malicious | Not scored | 20 Jun, 2026 | npm atlasora-types |
Malicious release: Malicious code in atlasora-sdk (npm) MAL-2026-6240 | Malicious | Not scored | 20 Jun, 2026 | npm atlasora-sdk |
Malicious release: Malicious code in atlasora-utils (npm) MAL-2026-6243 | Malicious | Not scored | 20 Jun, 2026 | npm atlasora-utils |
Malicious release: Malicious code in atlasora-client (npm) MAL-2026-6238 | Malicious | Not scored | 20 Jun, 2026 | npm atlasora-client |
Malicious release: Malicious code in @withgoogle/stitch-sdk (npm) GHSA-c9hc-fqm6-wjj7, MAL-2026-6256 | Malicious | Not scored | 20 Jun, 2026 | npm @withgoogle/stitch-sdk |
Malicious release: Malicious code in yian666aikf (npm) MAL-2026-6234 | Malicious | Not scored | 20 Jun, 2026 | npm yian666aikf |
Malicious release: Malicious code in yianzzkf6687 (npm) MAL-2026-6235 | Malicious | Not scored | 20 Jun, 2026 | npm yianzzkf6687 |
Malicious release: Malicious code in free-claude (npm) GHSA-7qpf-5pm7-57rh, MAL-2026-6232 | Malicious | Not scored | 19 Jun, 2026 | npm free-claude |
Malicious release: Malicious code in base_parts_ai (npm) MAL-2026-6228 | Malicious | Not scored | 19 Jun, 2026 | npm base_parts_ai |
Malicious release: Malicious code in routecraft (npm) GHSA-mw8m-x3ph-h3x7, MAL-2026-6229 | Malicious | Not scored | 19 Jun, 2026 | npm routecraft |
Malicious release: Malicious code in aikaf668897 (npm) MAL-2026-6216 | Malicious | Not scored | 19 Jun, 2026 | npm aikaf668897 |
Malicious release: Malicious code in aikaf6688812 (npm) MAL-2026-6215 | Malicious | Not scored | 19 Jun, 2026 | npm aikaf6688812 |
Malicious release: Malicious code in aikaf788812 (npm) MAL-2026-6217 | Malicious | Not scored | 19 Jun, 2026 | npm aikaf788812 |
Malicious release: Malicious code in create-mono-package (npm) MAL-2026-6222 | Malicious | Not scored | 19 Jun, 2026 | npm create-mono-package |
Malicious release: Malicious code in @chunklab/hexparse (npm) GHSA-fv23-ggqm-w99j, MAL-2026-6214 | Malicious | Not scored | 19 Jun, 2026 | npm @chunklab/hexparse |
Malicious release: Malicious code in @bytemend/mfebus (npm) GHSA-hfjj-fph3-hp6h, MAL-2026-6213 | Malicious | Not scored | 19 Jun, 2026 | npm @bytemend/mfebus |
Malicious release: Malicious code in @briskforge/envcheck (npm) GHSA-g63v-8g6g-5p76, MAL-2026-6212 | Malicious | Not scored | 19 Jun, 2026 | npm @briskforge/envcheck |
Malicious release: Malicious code in @apexcraft/nano-key (npm) GHSA-8x7w-vjr2-7q4m, MAL-2026-6210 | Malicious | Not scored | 19 Jun, 2026 | npm @apexcraft/nano-key |