Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in howdybase32 (npm) MAL-2026-6449 | Malicious | Not scored | 25 Jun, 2026 | npm howdybase32 |
Malicious release: Malicious code in nizzybase32 (npm) MAL-2026-6450 | Malicious | Not scored | 25 Jun, 2026 | npm nizzybase32 |
Malicious release: Malicious code in base58-core (npm) GHSA-3439-q8cv-mg5v, MAL-2026-6445 | Malicious | Not scored | 25 Jun, 2026 | npm base58-core |
Malicious release: Malicious code in bs58-86 (npm) GHSA-9gvv-wfph-q6rj, MAL-2026-6448 | Malicious | Not scored | 25 Jun, 2026 | npm bs58-86 |
Malicious release: Malicious code in base62-86x (npm) GHSA-239r-cp8p-5gfj, MAL-2026-6446 | Malicious | Not scored | 25 Jun, 2026 | npm base62-86x |
Malicious release: Malicious code in agentsync-tool (npm) MAL-2026-6444 | Malicious | Not scored | 25 Jun, 2026 | npm agentsync-tool |
Malicious release: Malicious code in agentsync-pkg (npm) GHSA-6h7h-cf78-vgc2, MAL-2026-6443 | Malicious | Not scored | 25 Jun, 2026 | npm agentsync-pkg |
Malicious release: Malicious code in logfmt-core (npm) GHSA-q37m-wc54-rhg8, MAL-2026-6437 | Malicious | Not scored | 25 Jun, 2026 | npm logfmt-core |
Malicious release: Malicious code in polymarket-stake-math (npm) GHSA-f2m3-4xrc-vfxg, MAL-2026-6438 | Malicious | Not scored | 25 Jun, 2026 | npm polymarket-stake-math |
Malicious release: Malicious code in polymarket-stake-maths (npm) GHSA-x384-v7hw-q48x, MAL-2026-6439 | Malicious | Not scored | 25 Jun, 2026 | npm polymarket-stake-maths |
Malicious release: Malicious code in easy-time-format (npm) GHSA-g6fx-78q6-3hqv, MAL-2026-6442 | Malicious | Not scored | 25 Jun, 2026 | npm easy-time-format |
Malicious release: Malicious code in tokenization-util (npm) GHSA-wp9r-fqrq-cg5h, MAL-2026-6440 | Malicious | Not scored | 25 Jun, 2026 | npm tokenization-util |
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407) CVE-2026-13311, GHSA-395f-4hp3-45gv | High | 0.4% | 25 Jun, 2026 | npm shell-quote |
Malicious release: Malicious code in unifydata (npm) MAL-2026-6441 | Malicious | Not scored | 25 Jun, 2026 | npm unifydata |
Malicious release: Malicious code in anthropic-claude-latest (npm) GHSA-j588-p757-86r9, MAL-2026-6415 | Malicious | Not scored | 25 Jun, 2026 | npm anthropic-claude-latest |
Malicious release: Malicious code in block-slot (npm) GHSA-pg29-x97h-gfr6, MAL-2026-6416 | Malicious | Not scored | 25 Jun, 2026 | npm block-slot |
Malicious release: Malicious code in @su-doughnym/react-dlb (npm) GHSA-3g2q-cw4h-3g67, MAL-2026-6410 | Malicious | Not scored | 25 Jun, 2026 | npm @su-doughnym/react-dlb |
Malicious release: Malicious code in @su-doughnym/loginui (npm) GHSA-3rvq-gwcv-295m, MAL-2026-6408 | Malicious | Not scored | 25 Jun, 2026 | npm @su-doughnym/loginui |
Malicious release: Malicious code in poc-publish-test-su-doughnym (npm) GHSA-fg75-hmqx-qfw9, MAL-2026-6413 | Malicious | Not scored | 25 Jun, 2026 | npm poc-publish-test-su-doughnym |
Malicious release: Malicious code in nabisco (npm) GHSA-m97m-v5gv-jm47, MAL-2026-6412 | Malicious | Not scored | 25 Jun, 2026 | npm nabisco |
Malicious release: Malicious code in @su-doughnym/metrics-js (npm) GHSA-wj6x-p526-mv2w, MAL-2026-6409 | Malicious | Not scored | 25 Jun, 2026 | npm @su-doughnym/metrics-js |
Malicious release: Malicious code in two-factor-prompt-lib (npm) GHSA-94jg-r3hx-4v8v, MAL-2026-6414 | Malicious | Not scored | 25 Jun, 2026 | npm two-factor-prompt-lib |
Malicious release: Malicious code in data-fetching-client (npm) GHSA-j99m-jc5r-9w58, MAL-2026-6411 | Malicious | Not scored | 25 Jun, 2026 | npm data-fetching-client |
Malicious release: Malicious code in @su-doughnym/hubspot-loginui-poc (npm) GHSA-jgj9-pm28-4m94, MAL-2026-6407 | Malicious | Not scored | 25 Jun, 2026 | npm @su-doughnym/hubspot-loginui-poc |
Malicious release: Malicious code in rstreams-shard-util (npm) GHSA-29q5-mm45-3xm3, MAL-2026-6433 | Malicious | Not scored | 24 Jun, 2026 | npm rstreams-shard-util |
Malicious release: Malicious code in leo-connector-mysql (npm) GHSA-474v-72pf-x6q5, MAL-2026-6425 | Malicious | Not scored | 24 Jun, 2026 | npm leo-connector-mysql |
Malicious release: Malicious code in serverless-leo (npm) GHSA-5cg2-34x6-pjgv, MAL-2026-6435 | Malicious | Not scored | 24 Jun, 2026 | npm serverless-leo |
Malicious release: Malicious code in leo-logger (npm) GHSA-5ggh-qwv4-wpwg, MAL-2026-6429 | Malicious | Not scored | 24 Jun, 2026 | npm leo-logger |
Malicious release: Malicious code in serverless-convention (npm) GHSA-7j3q-2rph-cwf8, MAL-2026-6434 | Malicious | Not scored | 24 Jun, 2026 | npm serverless-convention |
Malicious release: Malicious code in leo-connector-mongo (npm) GHSA-gwx3-mrcv-2c26, MAL-2026-6424 | Malicious | Not scored | 24 Jun, 2026 | npm leo-connector-mongo |
Malicious release: Malicious code in leo-streams (npm) GHSA-h98v-2hwg-56fx, MAL-2026-6431 | Malicious | Not scored | 24 Jun, 2026 | npm leo-streams |
Malicious release: Malicious code in leo-cli (npm) GHSA-hmx8-mh72-wj54, MAL-2026-6421 | Malicious | Not scored | 24 Jun, 2026 | npm leo-cli |
Malicious release: Malicious code in rstreams-metrics (npm) GHSA-hqcj-4r96-9wj6, MAL-2026-6432 | Malicious | Not scored | 24 Jun, 2026 | npm rstreams-metrics |
Malicious release: Malicious code in leo-connector-oracle (npm) GHSA-j4v3-8cw4-pg32, MAL-2026-6426 | Malicious | Not scored | 24 Jun, 2026 | npm leo-connector-oracle |
Malicious release: Malicious code in leo-sdk (npm) GHSA-m9cg-qm5p-9pvq, MAL-2026-6430 | Malicious | Not scored | 24 Jun, 2026 | npm leo-sdk |
Malicious release: Malicious code in leo-connector-elasticsearch (npm) GHSA-p5fw-hxvx-jq85, MAL-2026-6423 | Malicious | Not scored | 24 Jun, 2026 | npm leo-connector-elasticsearch |
Malicious release: Malicious code in leo-cache (npm) GHSA-r5pg-rp25-j3m3, MAL-2026-6419 | Malicious | Not scored | 24 Jun, 2026 | npm leo-cache |
Malicious release: Malicious code in leo-cron (npm) GHSA-v66r-c2h4-w9qw, MAL-2026-6428 | Malicious | Not scored | 24 Jun, 2026 | npm leo-cron |
Malicious release: Malicious code in solo-nav (npm) GHSA-v76j-hc7w-m3f5, MAL-2026-6436 | Malicious | Not scored | 24 Jun, 2026 | npm solo-nav |
Malicious release: Malicious code in leo-auth (npm) GHSA-x8r4-xjr9-2hhm, MAL-2026-6417 | Malicious | Not scored | 24 Jun, 2026 | npm leo-auth |
Malicious release: Malicious code in leo-aws (npm) MAL-2026-6418 | Malicious | Not scored | 24 Jun, 2026 | npm leo-aws |
Malicious release: Malicious code in leo-cdk-lib (npm) MAL-2026-6420 | Malicious | Not scored | 24 Jun, 2026 | npm leo-cdk-lib |
Malicious release: Malicious code in leo-config (npm) MAL-2026-6422 | Malicious | Not scored | 24 Jun, 2026 | npm leo-config |
Malicious release: Malicious code in leo-connector-redshift (npm) MAL-2026-6427 | Malicious | Not scored | 24 Jun, 2026 | npm leo-connector-redshift |
Malicious release: Malicious code in syco1 (npm) GHSA-9mh8-xw8w-jh9g, MAL-2026-6404 | Malicious | Not scored | 24 Jun, 2026 | npm syco1 |
Malicious release: Malicious code in syspo (npm) MAL-2026-6406 | Malicious | Not scored | 24 Jun, 2026 | npm syspo |
Malicious release: Malicious code in sypoi1 (npm) GHSA-25vm-7gph-35p5, MAL-2026-6405 | Malicious | Not scored | 24 Jun, 2026 | npm sypoi1 |
chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots CVE-2026-53766, GHSA-8qf9-62x2-82pp | Medium | 0.1% | 24 Jun, 2026 | npm chrome-devtools-mcp |
Malicious release: Malicious code in @kl-dolphin/jump (npm) GHSA-wfwr-cf4w-fpj5, MAL-2026-6403 | Malicious | Not scored | 24 Jun, 2026 | npm @kl-dolphin/jump |
Angular's deprecated package has a Cross-Site Scripting issue CVE-2026-11998, GHSA-7x27-g8rg-x87w | High | 0.4% | 24 Jun, 2026 | npm angular |