Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @ci-lifecycle-test/postinstall-ping (npm) GHSA-q86v-7cxj-6979, MAL-2026-5723 | Malicious | Not scored | 13 Jun, 2026 | npm @ci-lifecycle-test/postinstall-ping |
Malicious release: Malicious code in warp-dependency (npm) GHSA-gxc9-xrxm-w788, MAL-2026-5724 | Malicious | Not scored | 13 Jun, 2026 | npm warp-dependency |
Malicious release: Malicious code in ect-472839-ctf (npm) GHSA-9j3j-4vjh-6h88, MAL-2026-5718 | Malicious | Not scored | 12 Jun, 2026 | npm ect-472839-ctf |
Malicious release: Malicious code in ect-654321 (npm) GHSA-q226-9qx7-fxmj, MAL-2026-5719 | Malicious | Not scored | 12 Jun, 2026 | npm ect-654321 |
Malicious release: Malicious code in ect-839201 (npm) GHSA-v786-gqcj-q437, MAL-2026-5720 | Malicious | Not scored | 12 Jun, 2026 | npm ect-839201 |
Malicious release: Malicious code in ect-839201-ctf (npm) GHSA-g7vq-rhjq-x8rw, MAL-2026-5721 | Malicious | Not scored | 12 Jun, 2026 | npm ect-839201-ctf |
Malicious release: Malicious code in claudechor (npm) GHSA-w7p9-gpj5-p2pw, MAL-2026-5717 | Malicious | Not scored | 12 Jun, 2026 | npm claudechor |
Malicious release: Malicious code in beamz (npm) MAL-2026-5716 | Malicious | Not scored | 12 Jun, 2026 | npm beamz |
Malicious release: Malicious code in chalk-plus-js (npm) MAL-2026-5709 | Malicious | Not scored | 12 Jun, 2026 | npm chalk-plus-js |
Malicious release: Malicious code in chalk-pro (npm) MAL-2026-5711 | Malicious | Not scored | 12 Jun, 2026 | npm chalk-pro |
Malicious release: Malicious code in jextic-eclib (npm) GHSA-fvh5-fhfx-3whm, MAL-2026-5712 | Malicious | Not scored | 12 Jun, 2026 | npm jextic-eclib |
Malicious release: Malicious code in chalk-plus-ts (npm) GHSA-247v-x9qw-cc59, MAL-2026-5710 | Malicious | Not scored | 12 Jun, 2026 | npm chalk-plus-ts |
Malicious release: Malicious code in vite-plugin-logo (npm) GHSA-cw37-h4jm-63xh, MAL-2026-5714 | Malicious | Not scored | 12 Jun, 2026 | npm vite-plugin-logo |
Malicious release: Malicious code in workflow-postgres-setup (npm) MAL-2026-5715 | Malicious | Not scored | 12 Jun, 2026 | npm workflow-postgres-setup |
Malicious release: Malicious code in vite-plugin-compress-js (npm) GHSA-jc9j-qfjm-7m7f, MAL-2026-5713 | Malicious | Not scored | 12 Jun, 2026 | npm vite-plugin-compress-js |
Malicious release: Malicious code in vite-svgr (npm) MAL-2026-5708 | Malicious | Not scored | 12 Jun, 2026 | npm vite-svgr |
Malicious release: Malicious code in friendly-greeter-demo (npm) GHSA-47h6-x596-wmmx, MAL-2026-5704 | Malicious | Not scored | 12 Jun, 2026 | npm friendly-greeter-demo |
Malicious release: Malicious code in theta-connector (npm) GHSA-9vfq-xv95-fh28, MAL-2026-5705 | Malicious | Not scored | 12 Jun, 2026 | npm theta-connector |
Malicious release: Malicious code in theta-kit (npm) GHSA-ccpw-cfwc-qgw4, MAL-2026-5706 | Malicious | Not scored | 12 Jun, 2026 | npm theta-kit |
Malicious release: Malicious code in ttspc-server-sample (npm) GHSA-55wh-p7q3-vh4p, MAL-2026-5707 | Malicious | Not scored | 12 Jun, 2026 | npm ttspc-server-sample |
Malicious release: Malicious code in eslint-plugin-mistica-local-rules (npm) MAL-2026-5703 | Malicious | Not scored | 12 Jun, 2026 | npm eslint-plugin-mistica-local-rules |
Malicious release: Malicious code in vite-react-toolkit (npm) GHSA-4vwq-cp5w-hx5g, MAL-2026-5701 | Malicious | Not scored | 12 Jun, 2026 | npm vite-react-toolkit |
Malicious release: Malicious code in transportator (npm) GHSA-6wwm-jx4f-p4xq, MAL-2026-5700 | Malicious | Not scored | 12 Jun, 2026 | npm transportator |
Malicious release: Malicious code in chai-web3-testkit (npm) GHSA-j8qr-4p5h-mwqj, MAL-2026-5699 | Malicious | Not scored | 12 Jun, 2026 | npm chai-web3-testkit |
Malicious release: Malicious code in internallib_v856 (npm) GHSA-9jj2-f2qc-pm2j, MAL-2026-5694 | Malicious | Not scored | 12 Jun, 2026 | npm internallib_v856 |
Malicious release: Malicious code in internallib_v984 (npm) GHSA-24jp-936m-6fg4, MAL-2026-5695 | Malicious | Not scored | 12 Jun, 2026 | npm internallib_v984 |
Malicious release: Malicious code in voyager-web (npm) GHSA-3vr9-xc7m-h6qx, MAL-2026-5696 | Malicious | Not scored | 12 Jun, 2026 | npm voyager-web |
Malicious release: Malicious code in web-model-bridge (npm) GHSA-69cw-2vc8-9jm7, MAL-2026-5697 | Malicious | Not scored | 12 Jun, 2026 | npm web-model-bridge |
Malicious release: Malicious code in ecto-win-flag-q2m7 (npm) GHSA-22wq-6mfh-69qv, MAL-2026-5692 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-win-flag-q2m7 |
Malicious release: Malicious code in @malwguy/ecto-corsair-whisper-3d2a7c (npm) GHSA-636m-vpq6-g454, MAL-2026-5685 | Malicious | Not scored | 12 Jun, 2026 | npm @malwguy/ecto-corsair-whisper-3d2a7c |
Malicious release: Malicious code in ecto-rust-read-f3a9c1 (npm) GHSA-9h8h-37p7-873r, MAL-2026-5689 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-rust-read-f3a9c1 |
Malicious release: Malicious code in sea-bound-siren (npm) GHSA-cp5x-35vp-rj7j, MAL-2026-5693 | Malicious | Not scored | 12 Jun, 2026 | npm sea-bound-siren |
Malicious release: Malicious code in ecto-corsair-flag-x9m4 (npm) GHSA-f7w9-m44f-pvf9, MAL-2026-5686 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-corsair-flag-x9m4 |
Malicious release: Malicious code in ecto-flag-read-m7p2 (npm) GHSA-ggf2-rhq7-qqgg, MAL-2026-5687 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-flag-read-m7p2 |
Malicious release: Malicious code in ecto-spirit-win-k4n8 (npm) GHSA-h2hh-hg37-42gq, MAL-2026-5691 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-spirit-win-k4n8 |
Malicious release: Malicious code in ecto-spectral-leak-8d4e2 (npm) GHSA-jmpq-jp85-ggf3, MAL-2026-5690 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-spectral-leak-8d4e2 |
Malicious release: Malicious code in ecto-nightly-spirit (npm) GHSA-qv45-fm3m-pqmr, MAL-2026-5688 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-nightly-spirit |
Malicious release: Malicious code in coral-wraith (npm) GHSA-f2r7-23p9-8jff, MAL-2026-5682 | Malicious | Not scored | 12 Jun, 2026 | npm coral-wraith |
Malicious release: Malicious code in internallib_v557 (npm) GHSA-945p-4458-jg48, MAL-2026-5678 | Malicious | Not scored | 11 Jun, 2026 | npm internallib_v557 |
Malicious release: Malicious code in worker-build (npm) GHSA-7wpx-89q3-rcf4, MAL-2026-5677 | Malicious | Not scored | 11 Jun, 2026 | npm worker-build |
Malicious release: Malicious code in @johntaohunter/forge-jsx (npm) GHSA-v9x2-2qjf-q7qp, MAL-2026-5674 | Malicious | Not scored | 11 Jun, 2026 | npm @johntaohunter/forge-jsx |
Malicious release: Malicious code in ioredis-typed (npm) GHSA-wvg2-6r77-9m78, MAL-2026-5676 | Malicious | Not scored | 11 Jun, 2026 | npm ioredis-typed |
Malicious release: Malicious code in ioredis-orm (npm) GHSA-x3wj-647m-wx5c, MAL-2026-5675 | Malicious | Not scored | 11 Jun, 2026 | npm ioredis-orm |
Malicious release: Malicious code in vqlxjmpr (npm) GHSA-4mx5-f4mw-64v7, MAL-2026-5672 | Malicious | Not scored | 11 Jun, 2026 | npm vqlxjmpr |
Malicious release: Malicious code in zatzdbai (npm) GHSA-c389-4m23-j8gj, MAL-2026-5673 | Malicious | Not scored | 11 Jun, 2026 | npm zatzdbai |
Malicious release: Malicious code in downlynpm (npm) GHSA-vq59-5vfc-9rh5, MAL-2026-5666 | Malicious | Not scored | 11 Jun, 2026 | npm downlynpm |
Malicious release: Malicious code in @hatcha-captcha/core (npm) GHSA-2v2g-hp62-vhwj, MAL-2026-5655 | Malicious | Not scored | 11 Jun, 2026 | npm @hatcha-captcha/core |
Malicious release: Malicious code in @tenforce/toolbox-fontmap (npm) GHSA-4pgr-qgvj-c2wh, MAL-2026-5663 | Malicious | Not scored | 11 Jun, 2026 | npm @tenforce/toolbox-fontmap |
Malicious release: Malicious code in @marketplace-shared/components (npm) GHSA-5cx4-3w47-xm4h, MAL-2026-5658 | Malicious | Not scored | 11 Jun, 2026 | npm @marketplace-shared/components |
Malicious release: Malicious code in @sazka/web (npm) GHSA-5pm3-rqcf-522w, MAL-2026-5661 | Malicious | Not scored | 11 Jun, 2026 | npm @sazka/web |