Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @mastra/loggers (npm) GHSA-f2m2-jq59-rvfm, MAL-2026-6072 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/loggers |
Malicious release: Malicious code in @mastra/redis (npm) GHSA-wg7r-3q89-x9q4, MAL-2026-6074 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/redis |
Malicious release: Malicious code in n8n-nodes-security-test-poc (npm) MAL-2026-6071 | Malicious | Not scored | 17 Jun, 2026 | npm n8n-nodes-security-test-poc |
Malicious release: Malicious code in lab-services (npm) MAL-2026-6065 | Malicious | Not scored | 17 Jun, 2026 | npm lab-services |
Malicious release: Malicious code in scan-only (npm) GHSA-72g3-g9xj-wxp6, MAL-2026-6067 | Malicious | Not scored | 17 Jun, 2026 | npm scan-only |
Malicious release: Malicious code in swift-parse-stream (npm) GHSA-qcr2-hwcg-gf9g, MAL-2026-6068 | Malicious | Not scored | 17 Jun, 2026 | npm swift-parse-stream |
Malicious release: Malicious code in quirky-token (npm) GHSA-8p89-7m4q-45qm, MAL-2026-6066 | Malicious | Not scored | 17 Jun, 2026 | npm quirky-token |
Malicious release: Malicious code in sodel-pych (npm) GHSA-4cgm-w872-8q5g, MAL-2026-6062 | Malicious | Not scored | 17 Jun, 2026 | npm sodel-pych |
Malicious release: Malicious code in @ignacionunez91/keccak24 (npm) GHSA-c9fj-mvvf-834r, MAL-2026-6058 | Malicious | Not scored | 17 Jun, 2026 | npm @ignacionunez91/keccak24 |
Malicious release: Malicious code in sort-btree (npm) GHSA-wwvg-mj5j-mqx8, MAL-2026-6063 | Malicious | Not scored | 17 Jun, 2026 | npm sort-btree |
Malicious release: Malicious code in qrcode-express (npm) GHSA-684f-7c48-5hhq, MAL-2026-6060 | Malicious | Not scored | 17 Jun, 2026 | npm qrcode-express |
Malicious release: Malicious code in qrcode-generator-node (npm) GHSA-8856-m673-rcwx, MAL-2026-6061 | Malicious | Not scored | 17 Jun, 2026 | npm qrcode-generator-node |
Malicious release: Malicious code in express-validates (npm) GHSA-qxgr-xx42-5g6p, MAL-2026-6059 | Malicious | Not scored | 17 Jun, 2026 | npm express-validates |
Malicious release: Malicious code in tailwindcss-animates-css (npm) GHSA-xwr3-cg53-gqv5, MAL-2026-6064 | Malicious | Not scored | 17 Jun, 2026 | npm tailwindcss-animates-css |
Malicious release: Malicious code in accordion-animationtiming-authorization (npm) MAL-2026-6145 | Malicious | Not scored | 17 Jun, 2026 | npm accordion-animationtiming-authorization |
Malicious release: Malicious code in actionbars-infinitescroll-searchbar (npm) MAL-2026-6146 | Malicious | Not scored | 17 Jun, 2026 | npm actionbars-infinitescroll-searchbar |
Malicious release: Malicious code in analytics-readability-gestures (npm) MAL-2026-6147 | Malicious | Not scored | 17 Jun, 2026 | npm analytics-readability-gestures |
Malicious release: Malicious code in async-protobuf-av (npm) MAL-2026-6148 | Malicious | Not scored | 17 Jun, 2026 | npm async-protobuf-av |
Malicious release: Malicious code in backgroundprocessing-contextmenus (npm) MAL-2026-6149 | Malicious | Not scored | 17 Jun, 2026 | npm backgroundprocessing-contextmenus |
Malicious release: Malicious code in barcodescanner-reconnect (npm) MAL-2026-6150 | Malicious | Not scored | 17 Jun, 2026 | npm barcodescanner-reconnect |
Malicious release: Malicious code in buildautomation-touch (npm) MAL-2026-6151 | Malicious | Not scored | 17 Jun, 2026 | npm buildautomation-touch |
Malicious release: Malicious code in custom-save-area-block (npm) MAL-2026-6152 | Malicious | Not scored | 17 Jun, 2026 | npm custom-save-area-block |
Malicious release: Malicious code in datapersistence-profiling (npm) MAL-2026-6153 | Malicious | Not scored | 17 Jun, 2026 | npm datapersistence-profiling |
Malicious release: Malicious code in datapersistence-steppers-ai (npm) MAL-2026-6154 | Malicious | Not scored | 17 Jun, 2026 | npm datapersistence-steppers-ai |
Malicious release: Malicious code in designsystem-vector (npm) MAL-2026-6155 | Malicious | Not scored | 17 Jun, 2026 | npm designsystem-vector |
Malicious release: Malicious code in documents-widgets (npm) MAL-2026-6156 | Malicious | Not scored | 17 Jun, 2026 | npm documents-widgets |
Malicious release: Malicious code in dropdown-thread (npm) MAL-2026-6157 | Malicious | Not scored | 17 Jun, 2026 | npm dropdown-thread |
Malicious release: Malicious code in enzyme-optimization-bluetooth (npm) MAL-2026-6158 | Malicious | Not scored | 17 Jun, 2026 | npm enzyme-optimization-bluetooth |
Malicious release: Malicious code in expandingcards-socket-virtualization (npm) MAL-2026-6159 | Malicious | Not scored | 17 Jun, 2026 | npm expandingcards-socket-virtualization |
Malicious release: Malicious code in firebase-readability (npm) MAL-2026-6160 | Malicious | Not scored | 17 Jun, 2026 | npm firebase-readability |
Malicious release: Malicious code in flexbox-oauth-machinelearning (npm) MAL-2026-6161 | Malicious | Not scored | 17 Jun, 2026 | npm flexbox-oauth-machinelearning |
Malicious release: Malicious code in font-picker-responsive (npm) MAL-2026-6162 | Malicious | Not scored | 17 Jun, 2026 | npm font-picker-responsive |
Malicious release: Malicious code in framerate-interaction-permissions (npm) MAL-2026-6163 | Malicious | Not scored | 17 Jun, 2026 | npm framerate-interaction-permissions |
Malicious release: Malicious code in interaction-photos-infinitescroll (npm) MAL-2026-6164 | Malicious | Not scored | 17 Jun, 2026 | npm interaction-photos-infinitescroll |
Malicious release: Malicious code in ios-save-area-custom (npm) MAL-2026-6165 | Malicious | Not scored | 17 Jun, 2026 | npm ios-save-area-custom |
Malicious release: Malicious code in jest-macos (npm) MAL-2026-6166 | Malicious | Not scored | 17 Jun, 2026 | npm jest-macos |
Malicious release: Malicious code in lazyloading-haptics (npm) MAL-2026-6167 | Malicious | Not scored | 17 Jun, 2026 | npm lazyloading-haptics |
Malicious release: Malicious code in macos-contentprovider-optimizingassets (npm) MAL-2026-6168 | Malicious | Not scored | 17 Jun, 2026 | npm macos-contentprovider-optimizingassets |
Malicious release: Malicious code in notificationcenter-enzyme-jest (npm) MAL-2026-6169 | Malicious | Not scored | 17 Jun, 2026 | npm notificationcenter-enzyme-jest |
Malicious release: Malicious code in onesignal-hooks (npm) MAL-2026-6170 | Malicious | Not scored | 17 Jun, 2026 | npm onesignal-hooks |
Malicious release: Malicious code in personal-custom-button (npm) MAL-2026-6171 | Malicious | Not scored | 17 Jun, 2026 | npm personal-custom-button |
Malicious release: Malicious code in platformspecific-webgl (npm) MAL-2026-6172 | Malicious | Not scored | 17 Jun, 2026 | npm platformspecific-webgl |
Malicious release: Malicious code in profiling-keychain (npm) MAL-2026-6173 | Malicious | Not scored | 17 Jun, 2026 | npm profiling-keychain |
Malicious release: Malicious code in pushnotifications-gesturerecognition (npm) MAL-2026-6174 | Malicious | Not scored | 17 Jun, 2026 | npm pushnotifications-gesturerecognition |
Malicious release: Malicious code in request-performance (npm) MAL-2026-6175 | Malicious | Not scored | 17 Jun, 2026 | npm request-performance |
Malicious release: Malicious code in request-tracking-sqlite (npm) MAL-2026-6176 | Malicious | Not scored | 17 Jun, 2026 | npm request-tracking-sqlite |
Malicious release: Malicious code in socket-network (npm) MAL-2026-6177 | Malicious | Not scored | 17 Jun, 2026 | npm socket-network |
Malicious release: Malicious code in streaming-downloads (npm) MAL-2026-6178 | Malicious | Not scored | 17 Jun, 2026 | npm streaming-downloads |
Malicious release: Malicious code in touchid-images (npm) MAL-2026-6179 | Malicious | Not scored | 17 Jun, 2026 | npm touchid-images |
Malicious release: Malicious code in userinterface-machinelearning (npm) MAL-2026-6180 | Malicious | Not scored | 17 Jun, 2026 | npm userinterface-machinelearning |