Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @mastra/inngest (npm) GHSA-cgr7-8rxj-9vgx, MAL-2026-5951 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/inngest |
Malicious release: Malicious code in @mastra/braintrust (npm) GHSA-64qh-859p-w8cf, MAL-2026-5941 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/braintrust |
Malicious release: Malicious code in @mastra/rag (npm) GHSA-442j-fj4w-jhpw, MAL-2026-5961 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/rag |
Malicious release: Malicious code in @mastra/mongodb (npm) GHSA-prf3-w8mj-rf6j, MAL-2026-5957 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/mongodb |
Malicious release: Malicious code in @mastra/fastify (npm) GHSA-q2q2-qp24-85vj, MAL-2026-5949 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/fastify |
Malicious release: Malicious code in @mastra/mcp-docs-server (npm) GHSA-wxp6-9hmr-928g, MAL-2026-5956 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/mcp-docs-server |
Malicious release: Malicious code in @mastra/langsmith (npm) GHSA-xqqc-fpmf-95cg, MAL-2026-5953 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/langsmith |
Malicious release: Malicious code in @mastra/s3 (npm) GHSA-6fx7-6whr-32rx, MAL-2026-5962 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/s3 |
Malicious release: Malicious code in @mastra/fastembed (npm) GHSA-7wrg-5c4f-2ph2, MAL-2026-5948 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/fastembed |
Malicious release: Malicious code in @mastra/sentry (npm) GHSA-r8mf-3854-wvmf, MAL-2026-5964 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/sentry |
Malicious release: Malicious code in @mastra/auth (npm) GHSA-957m-hm9p-jqrv, MAL-2026-5940 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/auth |
Malicious release: Malicious code in @mastra/hono (npm) GHSA-89jf-vg4p-9vmj, MAL-2026-5950 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/hono |
Malicious release: Malicious code in @mastra/datadog (npm) GHSA-h6wr-wm4g-qfpg, MAL-2026-5943 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/datadog |
Malicious release: Malicious code in @mastra/editor (npm) GHSA-69r2-rp52-252g, MAL-2026-5946 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/editor |
Malicious release: Malicious code in @mastra/otel-bridge (npm) GHSA-xww8-gf7m-2fhh, MAL-2026-5958 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/otel-bridge |
Malicious release: Malicious code in @mastra/dynamodb (npm) GHSA-g53g-3w8w-pqfr, MAL-2026-5945 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/dynamodb |
Malicious release: Malicious code in @mastra/duckdb (npm) GHSA-8fh9-h5vv-j2h4, MAL-2026-5944 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/duckdb |
Malicious release: Malicious code in @mastra/evals (npm) GHSA-c9hm-w6m5-hwcj, MAL-2026-5947 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/evals |
Malicious release: Malicious code in @mastra/schema-compat (npm) GHSA-jf5v-9r8r-vf3m, MAL-2026-5963 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/schema-compat |
Malicious release: Malicious code in @mastra/langfuse (npm) GHSA-5v2f-vg69-mmhv, MAL-2026-5952 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/langfuse |
Malicious release: Malicious code in @mastra/ai-sdk (npm) GHSA-qg4v-49f4-6r89, MAL-2026-5939 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/ai-sdk |
Malicious release: Malicious code in @mastra/pg (npm) GHSA-v5r7-mvp4-8qv6, MAL-2026-5959 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/pg |
Malicious release: Malicious code in @mastra/mcp (npm) GHSA-wfr8-6x4q-hpr3, MAL-2026-5955 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/mcp |
Malicious release: Malicious code in @mastra/libsql (npm) GHSA-4755-6mgh-pjpw, MAL-2026-5954 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/libsql |
Malicious release: Malicious code in mastra (npm) GHSA-mvf4-vg87-q9vm, MAL-2026-5965 | Malicious | Not scored | 17 Jun, 2026 | npm mastra |
Malicious release: Malicious code in abuden21 (npm) GHSA-5wr3-rjvv-cgfj, MAL-2026-5937 | Malicious | Not scored | 16 Jun, 2026 | npm abuden21 |
Malicious release: Malicious code in speed4 (npm) GHSA-85hr-6fm5-49fj, MAL-2026-5938 | Malicious | Not scored | 16 Jun, 2026 | npm speed4 |
Malicious release: Malicious code in backoffice-charges-module (npm) GHSA-mmhq-hrgp-xjhx, MAL-2026-5929 | Malicious | Not scored | 16 Jun, 2026 | npm backoffice-charges-module |
Malicious release: Malicious code in bubblestr (npm) GHSA-9p79-38q4-f6wc, MAL-2026-5930 | Malicious | Not scored | 16 Jun, 2026 | npm bubblestr |
Malicious release: Malicious code in tw-theme-kit (npm) GHSA-g2wq-vjqj-xc3h, MAL-2026-5935 | Malicious | Not scored | 16 Jun, 2026 | npm tw-theme-kit |
Malicious release: Malicious code in vite-config-field (npm) GHSA-w8vm-43w2-4xqf, MAL-2026-5936 | Malicious | Not scored | 16 Jun, 2026 | npm vite-config-field |
Malicious release: Malicious code in react-vite-assert (npm) MAL-2026-5933 | Malicious | Not scored | 16 Jun, 2026 | npm react-vite-assert |
Malicious release: Malicious code in ssr-auth-sync (npm) GHSA-5xwj-q4j9-v44q, MAL-2026-5934 | Malicious | Not scored | 16 Jun, 2026 | npm ssr-auth-sync |
Malicious release: Malicious code in package-uploader (npm) GHSA-q8q6-p47p-ppp3, MAL-2026-5932 | Malicious | Not scored | 16 Jun, 2026 | npm package-uploader |
Malicious release: Malicious code in mci-sdk (npm) GHSA-7cjh-m5vf-hp3r, MAL-2026-5931 | Malicious | Not scored | 16 Jun, 2026 | npm mci-sdk |
Malicious release: Malicious code in chai-test-mocks (npm) MAL-2026-5928 | Malicious | Not scored | 16 Jun, 2026 | npm chai-test-mocks |
Malicious release: Malicious code in aillmgen (npm) GHSA-cqfc-w7g9-4c7p, MAL-2026-5927 | Malicious | Not scored | 16 Jun, 2026 | npm aillmgen |
Malicious release: Malicious code in @kalipto/local (npm) GHSA-653g-2cfx-6gpc, MAL-2026-5922 | Malicious | Not scored | 16 Jun, 2026 | npm @kalipto/local |
Malicious release: Malicious code in test-copppss (npm) MAL-2026-5926 | Malicious | Not scored | 16 Jun, 2026 | npm test-copppss |
Malicious release: Malicious code in @welcome-onboarding-web/mobile-focus-account-beta-merging (npm) MAL-2026-5923 | Malicious | Not scored | 16 Jun, 2026 | npm @welcome-onboarding-web/mobile-focus-account-beta-merging |
Malicious release: Malicious code in binproto (npm) MAL-2026-5924 | Malicious | Not scored | 16 Jun, 2026 | npm binproto |
Malicious release: Malicious code in motion-lib (npm) GHSA-4qw9-xmhp-hc7v, MAL-2026-5925 | Malicious | Not scored | 16 Jun, 2026 | npm motion-lib |
Malicious release: Malicious code in js-digest (npm) MAL-2026-5912 | Malicious | Not scored | 16 Jun, 2026 | npm js-digest |
Malicious release: Malicious code in pretie_x2 (npm) GHSA-wqxw-wj7c-pv2x, MAL-2026-5920 | Malicious | Not scored | 16 Jun, 2026 | npm pretie_x2 |
Malicious release: Malicious code in pretie_x1 (npm) GHSA-m9g3-3j2m-gf65, MAL-2026-5919 | Malicious | Not scored | 16 Jun, 2026 | npm pretie_x1 |
Malicious release: Malicious code in nottuff7 (npm) GHSA-f4m6-gffx-m3mq, MAL-2026-5918 | Malicious | Not scored | 16 Jun, 2026 | npm nottuff7 |
Malicious release: Malicious code in nottuff23 (npm) GHSA-w6gq-6584-67xq, MAL-2026-5915 | Malicious | Not scored | 16 Jun, 2026 | npm nottuff23 |
Malicious release: Malicious code in nottuff25 (npm) GHSA-2gj2-9868-32pf, MAL-2026-5916 | Malicious | Not scored | 16 Jun, 2026 | npm nottuff25 |
Malicious release: Malicious code in nottuff4 (npm) GHSA-r54f-vpj7-r35g, MAL-2026-5917 | Malicious | Not scored | 16 Jun, 2026 | npm nottuff4 |
Malicious release: Malicious code in nottuff15 (npm) GHSA-pvm5-2r8w-jpqq, MAL-2026-5914 | Malicious | Not scored | 16 Jun, 2026 | npm nottuff15 |