Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in mastraqqq (npm) GHSA-7vj9-63m9-3x7f, MAL-2026-5913 | Malicious | Not scored | 16 Jun, 2026 | npm mastraqqq |
Malicious release: Malicious code in proto-bin (npm) MAL-2026-5921 | Malicious | Not scored | 16 Jun, 2026 | npm proto-bin |
Malicious release: Malicious code in utils-common-helpers (npm) GHSA-fq4g-5xjj-r935, MAL-2026-5911 | Malicious | Not scored | 16 Jun, 2026 | npm utils-common-helpers |
Malicious release: Malicious code in react-hook-use-debounce-throttle-12 (npm) GHSA-2x4w-64xc-78fv, MAL-2026-5909 | Malicious | Not scored | 16 Jun, 2026 | npm react-hook-use-debounce-throttle-12 |
Malicious release: Malicious code in chai-plugin-helper (npm) MAL-2026-5905 | Malicious | Not scored | 16 Jun, 2026 | npm chai-plugin-helper |
Malicious release: Malicious code in chain-chai-test (npm) GHSA-6626-c428-r9qf, MAL-2026-5908 | Malicious | Not scored | 16 Jun, 2026 | npm chain-chai-test |
Malicious release: Malicious code in chai-as-polished (npm) GHSA-jpr9-h23w-g7gg, MAL-2026-5901 | Malicious | Not scored | 16 Jun, 2026 | npm chai-as-polished |
Malicious release: Malicious code in chai-as-tokenized (npm) GHSA-4hvx-q2w4-f48v, MAL-2026-5902 | Malicious | Not scored | 16 Jun, 2026 | npm chai-as-tokenized |
Malicious release: Malicious code in chai-guid (npm) GHSA-g8gv-g8mr-x8pc, MAL-2026-5903 | Malicious | Not scored | 16 Jun, 2026 | npm chai-guid |
Malicious release: Malicious code in chai-plugin-kit (npm) MAL-2026-5906 | Malicious | Not scored | 16 Jun, 2026 | npm chai-plugin-kit |
Malicious release: Malicious code in chai-plugin (npm) MAL-2026-5904 | Malicious | Not scored | 16 Jun, 2026 | npm chai-plugin |
Malicious release: Malicious code in chai-solidity-testkit (npm) MAL-2026-5907 | Malicious | Not scored | 16 Jun, 2026 | npm chai-solidity-testkit |
Malicious release: Malicious code in chai-as-decrypted (npm) GHSA-w7rc-qq2w-vqhg, MAL-2026-5900 | Malicious | Not scored | 16 Jun, 2026 | npm chai-as-decrypted |
Malicious release: Malicious code in uidai_reusable_components (npm) GHSA-8gm2-m96j-547g, MAL-2026-5910 | Malicious | Not scored | 16 Jun, 2026 | npm uidai_reusable_components |
Malicious release: Malicious code in easyllmai (npm) MAL-2026-5895 | Malicious | Not scored | 16 Jun, 2026 | npm easyllmai |
Malicious release: Malicious code in caspian-day-js (npm) MAL-2026-5892 | Malicious | Not scored | 16 Jun, 2026 | npm caspian-day-js |
Malicious release: Malicious code in strict-engine-peer (npm) MAL-2026-5898 | Malicious | Not scored | 16 Jun, 2026 | npm strict-engine-peer |
Malicious release: Malicious code in jest-test-plugin-utils (npm) GHSA-7969-jc8h-fp32, MAL-2026-5896 | Malicious | Not scored | 16 Jun, 2026 | npm jest-test-plugin-utils |
Malicious release: Malicious code in noderzero (npm) MAL-2026-5897 | Malicious | Not scored | 16 Jun, 2026 | npm noderzero |
Malicious release: Malicious code in create-vercel-integration (npm) MAL-2026-5894 | Malicious | Not scored | 16 Jun, 2026 | npm create-vercel-integration |
Malicious release: Malicious code in @dsft/ft-utils (npm) GHSA-2578-g4v9-hc4p, MAL-2026-5890 | Malicious | Not scored | 16 Jun, 2026 | npm @dsft/ft-utils |
Malicious release: Malicious code in @dsft/ft-element (npm) GHSA-5g88-35hm-8xr7, MAL-2026-5889 | Malicious | Not scored | 16 Jun, 2026 | npm @dsft/ft-element |
Malicious release: Malicious code in stripe-cli-init-plugin (npm) MAL-2026-5899 | Malicious | Not scored | 16 Jun, 2026 | npm stripe-cli-init-plugin |
Malicious release: Malicious code in conducts (npm) GHSA-93mx-rvh8-rm26, MAL-2026-5887 | Malicious | Not scored | 16 Jun, 2026 | npm conducts |
Malicious release: Malicious code in atlassian-forge-skills (npm) GHSA-7gj4-qpcp-64p2, MAL-2026-5891 | Malicious | Not scored | 16 Jun, 2026 | npm atlassian-forge-skills |
Malicious release: Malicious code in claude-jar (npm) MAL-2026-5893 | Malicious | Not scored | 16 Jun, 2026 | npm claude-jar |
Malicious release: Malicious code in @vantuz/sdk-core (npm) GHSA-pxhh-8x7x-7g7j, MAL-2026-5886 | Malicious | Not scored | 16 Jun, 2026 | npm @vantuz/sdk-core |
Malicious release: Malicious code in middleware-jwt (npm) GHSA-g9mr-rvmw-fg9c, MAL-2026-5888 | Malicious | Not scored | 16 Jun, 2026 | npm middleware-jwt |
Malicious release: Malicious code in vortnode (npm) GHSA-c3fw-fh7f-9h58, MAL-2026-5884 | Malicious | Not scored | 16 Jun, 2026 | npm vortnode |
Malicious release: Malicious code in wordpad-text-ui (npm) GHSA-83j8-j97r-9p9h, MAL-2026-5885 | Malicious | Not scored | 16 Jun, 2026 | npm wordpad-text-ui |
Malicious release: Malicious code in claude-token-tracker-mcp (npm) GHSA-w56m-5ch4-5xjw, MAL-2026-10693 | Malicious | Not scored | 16 Jun, 2026 | npm claude-token-tracker-mcp |
Malicious release: Malicious code in obfus-jsxy (npm) GHSA-9xh7-qcrr-h88h, MAL-2026-5881 | Malicious | Not scored | 16 Jun, 2026 | npm obfus-jsxy |
Malicious release: Malicious code in redis-xyz (npm) GHSA-mc4w-cxr6-qw8r, MAL-2026-5883 | Malicious | Not scored | 16 Jun, 2026 | npm redis-xyz |
Malicious release: Malicious code in ioredis-os (npm) GHSA-68r3-8wgf-pv9g, MAL-2026-5879 | Malicious | Not scored | 16 Jun, 2026 | npm ioredis-os |
Malicious release: Malicious code in redis-type-os (npm) GHSA-w3ww-qq48-r4j9, MAL-2026-5882 | Malicious | Not scored | 16 Jun, 2026 | npm redis-type-os |
Malicious release: Malicious code in nat-ulid (npm) GHSA-wgqj-fphq-9x3q, MAL-2026-5880 | Malicious | Not scored | 16 Jun, 2026 | npm nat-ulid |
Malicious release: Malicious code in check-ulid (npm) GHSA-266v-958f-g596, MAL-2026-5877 | Malicious | Not scored | 16 Jun, 2026 | npm check-ulid |
Malicious release: Malicious code in hot-validation-sdk (npm) GHSA-86rx-hcgg-q42r, MAL-2026-5870 | Malicious | Not scored | 16 Jun, 2026 | npm hot-validation-sdk |
Malicious release: Malicious code in lucide-next (npm) GHSA-gqhv-66pr-h35f, MAL-2026-5871 | Malicious | Not scored | 16 Jun, 2026 | npm lucide-next |
Malicious release: Malicious code in pampipes (npm) GHSA-j43p-473c-2jjx, MAL-2026-5872 | Malicious | Not scored | 16 Jun, 2026 | npm pampipes |
Malicious release: Malicious code in fabric-graphics (npm) GHSA-p7vq-w45x-hmmj, MAL-2026-5869 | Malicious | Not scored | 16 Jun, 2026 | npm fabric-graphics |
Malicious release: Malicious code in rbac-auth (npm) GHSA-vhxh-pphh-cjmr, MAL-2026-5873 | Malicious | Not scored | 16 Jun, 2026 | npm rbac-auth |
Malicious release: Malicious code in terminal-pretty-logger (npm) GHSA-2266-qhvj-h8r5, MAL-2026-5866 | Malicious | Not scored | 16 Jun, 2026 | npm terminal-pretty-logger |
Malicious release: Malicious code in terminal-structured-logger (npm) GHSA-9ggp-5rq8-jmff, MAL-2026-5867 | Malicious | Not scored | 16 Jun, 2026 | npm terminal-structured-logger |
Malicious release: Malicious code in npmjs-doc-builder (npm) GHSA-jhx4-8pjp-h27w, MAL-2026-5865 | Malicious | Not scored | 16 Jun, 2026 | npm npmjs-doc-builder |
Malicious release: Malicious code in bign.tsm (npm) GHSA-pwrg-56mj-pq64, MAL-2026-5864 | Malicious | Not scored | 16 Jun, 2026 | npm bign.tsm |
Malicious release: Malicious code in @ts-internal/shared-lib (npm) MAL-2026-5863 | Malicious | Not scored | 16 Jun, 2026 | npm @ts-internal/shared-lib |
Malicious release: Malicious code in vitest-pro (npm) MAL-2026-5862 | Malicious | Not scored | 16 Jun, 2026 | npm vitest-pro |
Malicious release: Malicious code in solana-js-client (npm) GHSA-w6xx-m24v-5674, MAL-2026-5860 | Malicious | Not scored | 16 Jun, 2026 | npm solana-js-client |
Malicious release: Malicious code in solana-mev-bot (npm) GHSA-8gg8-q73f-wv82, MAL-2026-5861 | Malicious | Not scored | 16 Jun, 2026 | npm solana-mev-bot |