Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in virtualization-compression-collapse (npm) MAL-2026-6181 | Malicious | Not scored | 17 Jun, 2026 | npm virtualization-compression-collapse |
Malicious release: Malicious code in @mastra/node-speaker (npm) GHSA-3j53-vxv9-cpcf, MAL-2026-6055 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/node-speaker |
Malicious release: Malicious code in @mastra/voice-playai (npm) GHSA-qpv6-xmpr-rwx5, MAL-2026-6057 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-playai |
Malicious release: Malicious code in @mastra/github-signals (npm) GHSA-8xrc-83hr-5q5m, MAL-2026-6052 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/github-signals |
Malicious release: Malicious code in @mastra/mem0 (npm) GHSA-7725-4rfp-c7fr, MAL-2026-6053 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/mem0 |
Malicious release: Malicious code in @mastra/node-audio (npm) GHSA-g8vm-qr66-jrrc, MAL-2026-6054 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/node-audio |
Malicious release: Malicious code in @mastra/react (npm) GHSA-v5vm-xv73-6x64, MAL-2026-6056 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/react |
Malicious release: Malicious code in redis-type-xyz (npm) MAL-2026-11205 | Malicious | Not scored | 17 Jun, 2026 | npm redis-type-xyz |
Malicious release: Malicious code in @mastra/arize (npm) GHSA-629j-g5wx-hmr8, MAL-2026-5998 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/arize |
Malicious release: Malicious code in @mastra/voice-elevenlabs (npm) GHSA-fg73-2f9p-wvpv, MAL-2026-6045 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-elevenlabs |
Malicious release: Malicious code in @mastra/gcs (npm) GHSA-7crh-g7x3-q72f, MAL-2026-6023 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/gcs |
Malicious release: Malicious code in @mastra/voice-deepgram (npm) GHSA-858r-w468-45r4, MAL-2026-6044 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-deepgram |
Malicious release: Malicious code in @mastra/voice-aws-nova-sonic (npm) GHSA-xvgq-p2rf-7qv6, MAL-2026-6043 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-aws-nova-sonic |
Malicious release: Malicious code in @mastra/voice-openai (npm) GHSA-8p42-82r4-mf65, MAL-2026-6048 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-openai |
Malicious release: Malicious code in @mastra/voice-google (npm) GHSA-p75c-5cq4-mjmg, MAL-2026-6046 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-google |
Malicious release: Malicious code in @mastra/voice-google-gemini-live (npm) GHSA-q952-4f7p-5rf3, MAL-2026-6047 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-google-gemini-live |
Malicious release: Malicious code in @mastra/voice-openai-realtime (npm) GHSA-4rfq-w3x8-rrx3, MAL-2026-6049 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-openai-realtime |
Malicious release: Malicious code in @mastra/e2b (npm) GHSA-jg9x-69gr-j4hh, MAL-2026-6021 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/e2b |
Malicious release: Malicious code in @mastra/google-cloud-pubsub (npm) GHSA-wv5r-22mx-vfr8, MAL-2026-6024 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/google-cloud-pubsub |
Malicious release: Malicious code in @mastra/daytona (npm) GHSA-8rq6-5x45-6j98, MAL-2026-6014 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/daytona |
Malicious release: Malicious code in @mastra/blaxel (npm) GHSA-jr4h-q66m-r9c7, MAL-2026-6004 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/blaxel |
Malicious release: Malicious code in @mastra/mcp-registry-registry (npm) GHSA-5w62-p653-57mf, MAL-2026-6027 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/mcp-registry-registry |
Malicious release: Malicious code in @mastra/longmemeval (npm) GHSA-7x3v-wg29-8m8v, MAL-2026-6026 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/longmemeval |
Malicious release: Malicious code in @mastra/agent-builder (npm) GHSA-hj75-mc88-g6xc, MAL-2026-5997 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/agent-builder |
Malicious release: Malicious code in @mastra/temporal (npm) GHSA-m6rq-qx37-q2jv, MAL-2026-6039 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/temporal |
Malicious release: Malicious code in @mastra/tavily (npm) GHSA-ph9m-rfv2-m2h6, MAL-2026-6038 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/tavily |
Malicious release: Malicious code in @mastra/stagehand (npm) GHSA-x59w-qg4x-cmrx, MAL-2026-6037 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/stagehand |
Malicious release: Malicious code in @mastra/agent-browser (npm) GHSA-ph9v-3f5h-hg6p, MAL-2026-5996 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/agent-browser |
Malicious release: Malicious code in @mastra/otel-exporter (npm) GHSA-2579-m2q3-5whx, MAL-2026-6031 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/otel-exporter |
Malicious release: Malicious code in @mastra/playground-ui (npm) GHSA-25cg-799c-2gpr, MAL-2026-6033 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/playground-ui |
Malicious release: Malicious code in @mastra/docker (npm) GHSA-vmr3-957g-5w95, MAL-2026-6019 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/docker |
Malicious release: Malicious code in @mastra/turbopuffer (npm) GHSA-jcv4-fvwf-3vg7, MAL-2026-6040 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/turbopuffer |
Malicious release: Malicious code in @mastra/deployer-netlify (npm) GHSA-q697-64gp-6qq7, MAL-2026-6017 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/deployer-netlify |
Malicious release: Malicious code in @mastra/cursor (npm) GHSA-cp3h-358p-m8h2, MAL-2026-6013 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/cursor |
Malicious release: Malicious code in @mastra/claude (npm) GHSA-jp56-69xj-c3rq, MAL-2026-6006 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/claude |
Malicious release: Malicious code in @mastra/deployer-cloudflare (npm) GHSA-c93p-x3xh-cgpj, MAL-2026-6016 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/deployer-cloudflare |
Malicious release: Malicious code in @mastra/cloudflare (npm) GHSA-fx8h-6h58-674x, MAL-2026-6008 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/cloudflare |
Malicious release: Malicious code in @mastra/pinecone (npm) GHSA-f3jx-6rr7-6f5j, MAL-2026-6032 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/pinecone |
Malicious release: Malicious code in @mastra/deployer-vercel (npm) GHSA-phgx-m87g-gqmf, MAL-2026-6018 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/deployer-vercel |
Malicious release: Malicious code in @mastra/upstash (npm) GHSA-grc4-63qq-h897, MAL-2026-6041 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/upstash |
Malicious release: Malicious code in @mastra/s3vectors (npm) GHSA-53fm-gc37-mgvr, MAL-2026-6035 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/s3vectors |
Malicious release: Malicious code in @mastra/convex (npm) GHSA-3g98-f7ww-r9qq, MAL-2026-6010 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/convex |
Malicious release: Malicious code in @mastra/vectorize (npm) GHSA-hhx4-85x4-3g8c, MAL-2026-6042 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/vectorize |
Malicious release: Malicious code in @mastra/qdrant (npm) GHSA-j93j-53rg-7g7g, MAL-2026-6034 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/qdrant |
Malicious release: Malicious code in @mastra/chroma (npm) GHSA-c69w-m5rg-46fw, MAL-2026-6005 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/chroma |
Malicious release: Malicious code in @mastra/couchbase (npm) GHSA-3xgr-445x-7mm6, MAL-2026-6012 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/couchbase |
Malicious release: Malicious code in @mastra/auth-better-auth (npm) GHSA-mg8p-hgv4-7rfp, MAL-2026-6000 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/auth-better-auth |
Malicious release: Malicious code in @mastra/cloudflare-d1 (npm) GHSA-xmx3-r6wm-33p3, MAL-2026-6009 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/cloudflare-d1 |
Malicious release: Malicious code in @mastra/auth-auth0 (npm) GHSA-2j96-v5c4-2p56, MAL-2026-5999 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/auth-auth0 |
Malicious release: Malicious code in @mastra/auth-workos (npm) GHSA-3pr6-37p3-w7g7, MAL-2026-6003 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/auth-workos |