Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @mastra/dsql (npm) GHSA-7f5h-95hw-fx6x, MAL-2026-6020 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/dsql |
Malicious release: Malicious code in @mastra/mssql (npm) GHSA-mhw2-7gv3-64jj, MAL-2026-6029 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/mssql |
Malicious release: Malicious code in @mastra/auth-supabase (npm) GHSA-3cr8-8w7x-779q, MAL-2026-6002 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/auth-supabase |
Malicious release: Malicious code in @mastra/auth-clerk (npm) GHSA-rgmx-h3wx-g4rj, MAL-2026-6001 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/auth-clerk |
Malicious release: Malicious code in @mastra/koa (npm) GHSA-w9wg-f3pj-cf4v, MAL-2026-6025 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/koa |
Malicious release: Malicious code in @mastra/express (npm) GHSA-r6w3-xpw9-p9g6, MAL-2026-6022 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/express |
Malicious release: Malicious code in @mastra/nestjs (npm) GHSA-9qg4-j8r6-rjc9, MAL-2026-6030 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/nestjs |
Malicious release: Malicious code in @mastra/client-js (npm) GHSA-4jmq-h62h-xhgh, MAL-2026-6007 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/client-js |
Malicious release: Malicious code in @mastra/memory (npm) GHSA-69g6-344c-3qpm, MAL-2026-6028 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/memory |
Malicious release: Malicious code in @mastra/server (npm) GHSA-wm6j-68jc-4x58, MAL-2026-6036 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/server |
Malicious release: Malicious code in create-mastra (npm) GHSA-jgwq-x2m5-mxhm, MAL-2026-6050 | Malicious | Not scored | 17 Jun, 2026 | npm create-mastra |
Malicious release: Malicious code in @mastra/core (npm) GHSA-pp62-grrw-hvfp, MAL-2026-6011 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/core |
Malicious release: Malicious code in @mastra/deployer (npm) GHSA-rjjh-j9jr-wg46, MAL-2026-6015 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/deployer |
Malicious release: Malicious code in metrics-probe-64b2 (npm) GHSA-7jwq-33cp-frr8, MAL-2026-5981 | Malicious | Not scored | 17 Jun, 2026 | npm metrics-probe-64b2 |
Malicious release: Malicious code in metrics-probe-77d4 (npm) GHSA-94g9-7rch-xv9j, MAL-2026-5982 | Malicious | Not scored | 17 Jun, 2026 | npm metrics-probe-77d4 |
Malicious release: Malicious code in metrics-probe-dc85 (npm) GHSA-49m3-wjc7-7pxw, MAL-2026-5983 | Malicious | Not scored | 17 Jun, 2026 | npm metrics-probe-dc85 |
Malicious release: Malicious code in pkg-telemetry-r4f9 (npm) GHSA-755p-5wm7-4qg5, MAL-2026-5990 | Malicious | Not scored | 17 Jun, 2026 | npm pkg-telemetry-r4f9 |
Malicious release: Malicious code in runtime-metrics-w7k2 (npm) GHSA-65h4-xcqj-p428, MAL-2026-5992 | Malicious | Not scored | 17 Jun, 2026 | npm runtime-metrics-w7k2 |
Malicious release: Malicious code in npm-sandbox-ping-r9t2 (npm) GHSA-p3jc-qrj7-hj68, MAL-2026-5986 | Malicious | Not scored | 17 Jun, 2026 | npm npm-sandbox-ping-r9t2 |
Malicious release: Malicious code in gpu-accelerator (npm) GHSA-qc67-wjjh-qpcv, MAL-2026-5980 | Malicious | Not scored | 17 Jun, 2026 | npm gpu-accelerator |
Malicious release: Malicious code in canary-ci-test (npm) GHSA-6p9p-wp4g-8546, MAL-2026-5972 | Malicious | Not scored | 17 Jun, 2026 | npm canary-ci-test |
Malicious release: Malicious code in nepublisher (npm) MAL-2026-5984 | Malicious | Not scored | 17 Jun, 2026 | npm nepublisher |
Malicious release: Malicious code in ts-webplug (npm) GHSA-m637-4v9j-499p, MAL-2026-5994 | Malicious | Not scored | 17 Jun, 2026 | npm ts-webplug |
Malicious release: Malicious code in params-valid-js (npm) GHSA-4mh2-8f67-ph3q, MAL-2026-5988 | Malicious | Not scored | 17 Jun, 2026 | npm params-valid-js |
Malicious release: Malicious code in node-path-utils (npm) GHSA-7qr8-pqwp-95p9, MAL-2026-5985 | Malicious | Not scored | 17 Jun, 2026 | npm node-path-utils |
Malicious release: Malicious code in req-parmas-valid (npm) GHSA-3pgv-795j-3ggc, MAL-2026-5991 | Malicious | Not scored | 17 Jun, 2026 | npm req-parmas-valid |
Malicious release: Malicious code in sheratan_test_p (npm) MAL-2026-5993 | Malicious | Not scored | 17 Jun, 2026 | npm sheratan_test_p |
Malicious release: Malicious code in pathfix (npm) GHSA-623x-x2wh-q9xq, MAL-2026-5989 | Malicious | Not scored | 17 Jun, 2026 | npm pathfix |
Malicious release: Malicious code in ogd-analytics (npm) MAL-2026-5987 | Malicious | Not scored | 17 Jun, 2026 | npm ogd-analytics |
Malicious release: Malicious code in classbreeze-utils (npm) GHSA-gj7f-m4cx-vmx3, MAL-2026-5973 | Malicious | Not scored | 17 Jun, 2026 | npm classbreeze-utils |
Malicious release: Malicious code in easy-day-js (npm) MAL-2026-5979 | Malicious | Not scored | 17 Jun, 2026 | npm easy-day-js |
Malicious release: Malicious code in @public-for-cdao/hooks (npm) MAL-2026-5971 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/hooks |
Malicious release: Malicious code in cryptodao-contracts (npm) MAL-2026-5975 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-contracts |
Malicious release: Malicious code in cryptodao-core (npm) MAL-2026-5976 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-core |
Malicious release: Malicious code in cryptodao-bot (npm) MAL-2026-5974 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-bot |
Malicious release: Malicious code in cryptodao-utils (npm) MAL-2026-5978 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-utils |
Malicious release: Malicious code in cryptodao-signer (npm) MAL-2026-5977 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-signer |
Malicious release: Malicious code in @public-for-cdao/abi (npm) GHSA-584q-5354-mhmc, MAL-2026-10599 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/abi |
Malicious release: Malicious code in @public-for-cdao/api (npm) GHSA-hhwx-gm2f-gh2w, MAL-2026-10600 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/api |
Malicious release: Malicious code in @public-for-cdao/token (npm) GHSA-cvjj-96jr-345h, MAL-2026-10603 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/token |
Malicious release: Malicious code in @public-for-cdao/common (npm) GHSA-rhm5-mc66-328f, MAL-2026-10601 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/common |
Malicious release: Malicious code in @public-for-cdao/config (npm) GHSA-387h-gmrw-37qg, MAL-2026-10602 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/config |
Malicious release: Malicious code in @public-for-cdao/types (npm) GHSA-7c85-hxv2-75rg, MAL-2026-10604 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/types |
Malicious release: Malicious code in cryptodao-deploy (npm) MAL-2026-5968 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-deploy |
Malicious release: Malicious code in cryptodao-config (npm) MAL-2026-5967 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-config |
Malicious release: Malicious code in cryptodao-types (npm) MAL-2026-5970 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-types |
Malicious release: Malicious code in cryptodao-backend (npm) MAL-2026-5966 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-backend |
Malicious release: Malicious code in cryptodao-sdk (npm) MAL-2026-5969 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-sdk |
Malicious release: Malicious code in @mastra/posthog (npm) GHSA-p3jv-r79x-4jvw, MAL-2026-5960 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/posthog |
Malicious release: Malicious code in @mastra/clickhouse (npm) GHSA-6327-2cw4-7cv9, MAL-2026-5942 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/clickhouse |