Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @onum-releases/shared-components (npm) MAL-2026-6126 | Malicious | Not scored | 18 Jun, 2026 | npm @onum-releases/shared-components |
Malicious release: Malicious code in @onum-releases/ixel (npm) MAL-2026-6124 | Malicious | Not scored | 18 Jun, 2026 | npm @onum-releases/ixel |
Malicious release: Malicious code in @onum-releases/sdk (npm) MAL-2026-6125 | Malicious | Not scored | 18 Jun, 2026 | npm @onum-releases/sdk |
Malicious release: Malicious code in @onum-releases/auth (npm) MAL-2026-6123 | Malicious | Not scored | 18 Jun, 2026 | npm @onum-releases/auth |
Malicious release: Malicious code in @onum-releases/api-client (npm) MAL-2026-6122 | Malicious | Not scored | 18 Jun, 2026 | npm @onum-releases/api-client |
Malicious release: Malicious code in @caspianph/storyteller (npm) MAL-2026-6120 | Malicious | Not scored | 18 Jun, 2026 | npm @caspianph/storyteller |
Malicious release: Malicious code in computerrock-babel-preset-react-app (npm) MAL-2026-6131 | Malicious | Not scored | 18 Jun, 2026 | npm computerrock-babel-preset-react-app |
Malicious release: Malicious code in metavu (npm) MAL-2026-6132 | Malicious | Not scored | 18 Jun, 2026 | npm metavu |
Malicious release: Malicious code in parket-helper (npm) GHSA-w6cg-2gpv-j66m, MAL-2026-6119 | Malicious | Not scored | 18 Jun, 2026 | npm parket-helper |
Malicious release: Malicious code in @rafaelsene01/agent-flow (npm) GHSA-rhv6-f4px-2cf4, MAL-2026-6111 | Malicious | Not scored | 18 Jun, 2026 | npm @rafaelsene01/agent-flow |
Malicious release: Malicious code in stackus (npm) GHSA-x868-gvwf-qxg6, MAL-2026-6098 | Malicious | Not scored | 18 Jun, 2026 | npm stackus |
Malicious release: Malicious code in jwtmode (npm) MAL-2026-6093 | Malicious | Not scored | 18 Jun, 2026 | npm jwtmode |
Malicious release: Malicious code in requests-middleware (npm) GHSA-mxgq-rcpv-wrm9, MAL-2026-6096 | Malicious | Not scored | 18 Jun, 2026 | npm requests-middleware |
Malicious release: Malicious code in roblox-api-client (npm) GHSA-hmpp-mfgc-mq8p, MAL-2026-6097 | Malicious | Not scored | 18 Jun, 2026 | npm roblox-api-client |
Malicious release: Malicious code in intquery (npm) GHSA-w7f8-x6ww-hf3x, MAL-2026-6113 | Malicious | Not scored | 18 Jun, 2026 | npm intquery |
Malicious release: Malicious code in oem-agentic-shared (npm) GHSA-h957-h3mc-79qr, MAL-2026-6095 | Malicious | Not scored | 18 Jun, 2026 | npm oem-agentic-shared |
Malicious release: Malicious code in datacamp-light (npm) GHSA-j27q-7263-hr46, MAL-2026-6091 | Malicious | Not scored | 18 Jun, 2026 | npm datacamp-light |
Malicious release: Malicious code in data-utils-bcf2 (npm) MAL-2026-6090 | Malicious | Not scored | 18 Jun, 2026 | npm data-utils-bcf2 |
Malicious release: Malicious code in stream-read-35cf (npm) MAL-2026-6099 | Malicious | Not scored | 18 Jun, 2026 | npm stream-read-35cf |
Malicious release: Malicious code in fmt-helpers-794b (npm) GHSA-4wmf-8x9r-34cc, MAL-2026-6092 | Malicious | Not scored | 18 Jun, 2026 | npm fmt-helpers-794b |
Malicious release: Malicious code in data-utils-d703 (npm) GHSA-655h-34jr-cj9x, MAL-2026-6112 | Malicious | Not scored | 18 Jun, 2026 | npm data-utils-d703 |
Malicious release: Malicious code in string-tools-be6c (npm) GHSA-93cp-5ff7-p9m5, MAL-2026-6100 | Malicious | Not scored | 18 Jun, 2026 | npm string-tools-be6c |
Malicious release: Malicious code in color-utils-dee0 (npm) GHSA-f8p9-v2xw-79xc, MAL-2026-6089 | Malicious | Not scored | 18 Jun, 2026 | npm color-utils-dee0 |
Malicious release: Malicious code in type-check-816d (npm) GHSA-q7qm-cfrq-fg6g, MAL-2026-6101 | Malicious | Not scored | 18 Jun, 2026 | npm type-check-816d |
Malicious release: Malicious code in metrics-probe-88ad (npm) GHSA-qh3x-q57r-jq77, MAL-2026-6114 | Malicious | Not scored | 18 Jun, 2026 | npm metrics-probe-88ad |
Malicious release: Malicious code in metrics-probe-f256 (npm) GHSA-wrx9-4534-jwh6, MAL-2026-6094 | Malicious | Not scored | 18 Jun, 2026 | npm metrics-probe-f256 |
Malicious release: Malicious code in @ncurran/dc-selftest-33afb7 (npm) GHSA-42f8-8vgh-57px, MAL-2026-6102 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/dc-selftest-33afb7 |
Malicious release: Malicious code in npm-sandbox-research-f1g2 (npm) GHSA-5786-jcjh-w75f, MAL-2026-6116 | Malicious | Not scored | 18 Jun, 2026 | npm npm-sandbox-research-f1g2 |
Malicious release: Malicious code in @ncurran/sandbox-recon-7c4e1a (npm) GHSA-6h2p-j374-h5qj, MAL-2026-6104 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-7c4e1a |
Malicious release: Malicious code in @ncurran/sandbox-recon-880538 (npm) GHSA-829r-722f-73rg, MAL-2026-6105 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-880538 |
Malicious release: Malicious code in @ncurran/sandbox-recon-uac-4e7c (npm) GHSA-88j8-4jpx-79xj, MAL-2026-6110 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-uac-4e7c |
Malicious release: Malicious code in @ncurran/sandbox-recon-sys-6a3f (npm) GHSA-8xvr-4p7v-395p, MAL-2026-6109 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-sys-6a3f |
Malicious release: Malicious code in @ncurran/sandbox-recon-9b2d4f (npm) GHSA-c462-2ggc-2wj2, MAL-2026-6106 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-9b2d4f |
Malicious release: Malicious code in npm-sandbox-research-a1b2 (npm) GHSA-jw25-p682-fhw6, MAL-2026-6115 | Malicious | Not scored | 18 Jun, 2026 | npm npm-sandbox-research-a1b2 |
Malicious release: Malicious code in @ncurran/sandbox-recon-sys-5b2c (npm) GHSA-qqj4-fh9f-5v33, MAL-2026-6107 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-sys-5b2c |
Malicious release: Malicious code in @ncurran/sandbox-recon-sys-5f1b (npm) GHSA-v27g-px49-r9w8, MAL-2026-6108 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-sys-5f1b |
Malicious release: Malicious code in @ncurran/dc-selftest-ba0ad4 (npm) GHSA-vgm9-c9cx-8cvv, MAL-2026-6103 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/dc-selftest-ba0ad4 |
Malicious release: Malicious code in vite-common-utils (npm) GHSA-6wm7-cff3-322r, MAL-2026-6088 | Malicious | Not scored | 17 Jun, 2026 | npm vite-common-utils |
Malicious release: Malicious code in uol-simple-api-futebol (npm) MAL-2026-6087 | Malicious | Not scored | 17 Jun, 2026 | npm uol-simple-api-futebol |
Malicious release: Malicious code in ai-chat-helper (npm) MAL-2026-6086 | Malicious | Not scored | 17 Jun, 2026 | npm ai-chat-helper |
Malicious release: Malicious code in @hotcappuccino/nodepull (npm) GHSA-r3fv-99xj-m7pw, MAL-2026-6085 | Malicious | Not scored | 17 Jun, 2026 | npm @hotcappuccino/nodepull |
Malicious release: Malicious code in @array-util/nodepull (npm) GHSA-qhxp-5mv2-773f, MAL-2026-6084 | Malicious | Not scored | 17 Jun, 2026 | npm @array-util/nodepull |
Malicious release: Malicious code in pino-slite (npm) GHSA-4m74-rvqg-rg5w, MAL-2026-6078 | Malicious | Not scored | 17 Jun, 2026 | npm pino-slite |
Malicious release: Malicious code in set-proto-chain (npm) GHSA-7p39-r7q7-jcv7, MAL-2026-6079 | Malicious | Not scored | 17 Jun, 2026 | npm set-proto-chain |
Malicious release: Malicious code in ebpf-tracker-action (npm) MAL-2026-6077 | Malicious | Not scored | 17 Jun, 2026 | npm ebpf-tracker-action |
Malicious release: Malicious code in opt-archetype-check (npm) GHSA-fq5h-gc4g-76cp, MAL-2026-6075 | Malicious | Not scored | 17 Jun, 2026 | npm opt-archetype-check |
Malicious release: Malicious code in nano-perf (npm) GHSA-4236-g67q-42fc, MAL-2026-11204 | Malicious | Not scored | 17 Jun, 2026 | npm nano-perf |
Malicious release: Malicious code in @civitatis/bot-ui (npm) MAL-2026-6069 | Malicious | Not scored | 17 Jun, 2026 | npm @civitatis/bot-ui |
Malicious release: Malicious code in libsc-runtime-telemetry (npm) MAL-2026-6070 | Malicious | Not scored | 17 Jun, 2026 | npm libsc-runtime-telemetry |
Malicious release: Malicious code in @mastra/observability (npm) GHSA-cgqj-9hhw-gw7x, MAL-2026-6073 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/observability |