Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in eh-bridge-utils (npm) GHSA-xjvq-4jq6-f8vq, MAL-2026-4309 | Malicious | Not scored | 25 May, 2026 | npm eh-bridge-utils |
Malicious release: Malicious code in core-utility-tools (npm) GHSA-c4gp-gx6v-65jq, MAL-2026-4308 | Malicious | Not scored | 25 May, 2026 | npm core-utility-tools |
Malicious release: Malicious code in apple-app-store-server-library-v3 (npm) GHSA-j79j-hjwj-vx88, MAL-2026-4300 | Malicious | Not scored | 25 May, 2026 | npm apple-app-store-server-library-v3 |
Malicious release: Malicious code in flownodelp5 (npm) GHSA-48cg-4f3j-48fq, MAL-2026-4315 | Malicious | Not scored | 25 May, 2026 | npm flownodelp5 |
Malicious release: Malicious code in nba-cdn-plugin (npm) GHSA-27fg-m46w-x83r, MAL-2026-4323 | Malicious | Not scored | 25 May, 2026 | npm nba-cdn-plugin |
Malicious release: Malicious code in nba-blocker-plugin (npm) GHSA-82vw-6f3x-f942, MAL-2026-4322 | Malicious | Not scored | 25 May, 2026 | npm nba-blocker-plugin |
Malicious release: Malicious code in mobile-international (npm) GHSA-f4h6-f7mh-jhjh, MAL-2026-4320 | Malicious | Not scored | 25 May, 2026 | npm mobile-international |
Malicious release: Malicious code in wnba-parent (npm) GHSA-rrv6-6f8p-p2xq, MAL-2026-4343 | Malicious | Not scored | 25 May, 2026 | npm wnba-parent |
Malicious release: Malicious code in wm-plugin-create-iframe-capturing (npm) GHSA-7rv7-253c-f494, MAL-2026-4337 | Malicious | Not scored | 25 May, 2026 | npm wm-plugin-create-iframe-capturing |
Malicious release: Malicious code in wm-plugin-native-functions-restorer (npm) GHSA-99f6-4956-77rc, MAL-2026-4339 | Malicious | Not scored | 25 May, 2026 | npm wm-plugin-native-functions-restorer |
Malicious release: Malicious code in wm-plugin-json-conditions (npm) GHSA-9gg4-xfch-pg34, MAL-2026-4338 | Malicious | Not scored | 25 May, 2026 | npm wm-plugin-json-conditions |
Malicious release: Malicious code in wm-plugin-open-teach-me-after-deployable-played (npm) GHSA-3hgv-jw6w-5mp9, MAL-2026-4340 | Malicious | Not scored | 25 May, 2026 | npm wm-plugin-open-teach-me-after-deployable-played |
Malicious release: Malicious code in wm-w5g-preview (npm) GHSA-m3mm-mrf3-4jrg, MAL-2026-4342 | Malicious | Not scored | 25 May, 2026 | npm wm-w5g-preview |
Malicious release: Malicious code in wm-plugin-set-walkme-language (npm) GHSA-pqjf-2x7v-f9r6, MAL-2026-4341 | Malicious | Not scored | 25 May, 2026 | npm wm-plugin-set-walkme-language |
Malicious release: Malicious code in ts-relayer-client (npm) GHSA-cvwx-2464-h9x6, MAL-2026-4327 | Malicious | Not scored | 25 May, 2026 | npm ts-relayer-client |
Malicious release: Malicious code in lint-builder-logger (npm) GHSA-fhq7-9r8g-8x92, MAL-2026-4319 | Malicious | Not scored | 25 May, 2026 | npm lint-builder-logger |
Malicious release: Malicious code in ts-big-lib (npm) GHSA-qpq5-8fmq-vjwh, MAL-2026-4324 | Malicious | Not scored | 25 May, 2026 | npm ts-big-lib |
Malicious release: Malicious code in levex-press (npm) GHSA-r47x-77f8-x86j, MAL-2026-4318 | Malicious | Not scored | 25 May, 2026 | npm levex-press |
Malicious release: Malicious code in git-en-boite-inventory (npm) GHSA-8745-6fr8-pwjr, MAL-2026-4295 | Malicious | Not scored | 25 May, 2026 | npm git-en-boite-inventory |
Malicious release: Malicious code in mcp-dashboards-shared (npm) GHSA-h2q9-x96j-55m7, MAL-2026-4296 | Malicious | Not scored | 25 May, 2026 | npm mcp-dashboards-shared |
Malicious release: Malicious code in flow-parser-oxidized (npm) GHSA-vhfh-fm2f-jp72, MAL-2026-4294 | Malicious | Not scored | 25 May, 2026 | npm flow-parser-oxidized |
Malicious release: Malicious code in chai-as-buffer (npm) GHSA-fj6h-gjf9-hpm9, MAL-2026-4292 | Malicious | Not scored | 25 May, 2026 | npm chai-as-buffer |
Malicious release: Malicious code in chai-as-float (npm) GHSA-vwjq-h2wg-2r2f, MAL-2026-4293 | Malicious | Not scored | 25 May, 2026 | npm chai-as-float |
Malicious release: Malicious code in system-user-identifier-cli (npm) MAL-2026-4679 | Malicious | Not scored | 25 May, 2026 | npm system-user-identifier-cli |
Malicious release: Malicious code in your-unique-package-name1 (npm) MAL-2026-4737 | Malicious | Not scored | 25 May, 2026 | npm your-unique-package-name1 |
Malicious release: Malicious code in npm-builderio-qwik-poc (npm) MAL-2026-4623 | Malicious | Not scored | 25 May, 2026 | npm npm-builderio-qwik-poc |
Malicious release: Malicious code in @zizie071/libsignal-node (npm) GHSA-3425-gc6h-mm9j, MAL-2026-4473 | Malicious | Not scored | 25 May, 2026 | npm @zizie071/libsignal-node |
Malicious release: Malicious code in @stockrepublic/republic-components (npm) GHSA-p923-4q96-mqgq, MAL-2026-4289 | Malicious | Not scored | 24 May, 2026 | npm @stockrepublic/republic-components |
Malicious release: Malicious code in shiroai (npm) MAL-2026-4669 | Malicious | Not scored | 24 May, 2026 | npm shiroai |
Malicious release: Malicious code in cxpher-linux-arm32 (npm) MAL-2026-4547 | Malicious | Not scored | 24 May, 2026 | npm cxpher-linux-arm32 |
Malicious release: Malicious code in clipboard-guardian (npm) MAL-2026-4290 | Malicious | Not scored | 24 May, 2026 | npm clipboard-guardian |
Malicious release: Malicious code in sysnode (npm) MAL-2026-4678 | Malicious | Not scored | 24 May, 2026 | npm sysnode |
Malicious release: Malicious code in class-weaver (npm) GHSA-jx4m-wmh7-wmhr, MAL-2026-4521 | Malicious | Not scored | 24 May, 2026 | npm class-weaver |
Malicious release: Malicious code in vite-plugin-css-blend (npm) MAL-2026-4706 | Malicious | Not scored | 24 May, 2026 | npm vite-plugin-css-blend |
Malicious release: Malicious code in class-blend (npm) MAL-2026-4520 | Malicious | Not scored | 24 May, 2026 | npm class-blend |
Malicious release: Malicious code in power-platform-playwright-toolkit (npm) GHSA-jwfr-3hmj-4r72, MAL-2026-4644 | Malicious | Not scored | 24 May, 2026 | npm power-platform-playwright-toolkit |
Malicious release: Malicious code in cami-design (npm) MAL-2026-4504 | Malicious | Not scored | 24 May, 2026 | npm cami-design |
Malicious release: Malicious code in react-malicious-clone (npm) MAL-2026-4660 | Malicious | Not scored | 24 May, 2026 | npm react-malicious-clone |
Malicious release: Malicious code in power-apps (npm) GHSA-hgc9-p5mp-p8f6, MAL-2026-4274 | Malicious | Not scored | 24 May, 2026 | npm power-apps |
Malicious release: Malicious code in twokey (npm) MAL-2026-4697 | Malicious | Not scored | 24 May, 2026 | npm twokey |
Malicious release: Malicious code in harness-skil (npm) MAL-2026-4577 | Malicious | Not scored | 24 May, 2026 | npm harness-skil |
Malicious release: Malicious code in tailwind-typography-stylecss (npm) GHSA-p258-w6jm-c6ff, MAL-2026-4681 | Malicious | Not scored | 24 May, 2026 | npm tailwind-typography-stylecss |
Malicious release: Malicious code in license-checker-plus (npm) GHSA-73xx-w222-rg6v, MAL-2026-4599 | Malicious | Not scored | 24 May, 2026 | npm license-checker-plus |
Malicious release: Malicious code in solidity-coverage-plus (npm) GHSA-j3fh-3pm4-rw5h, MAL-2026-4672 | Malicious | Not scored | 24 May, 2026 | npm solidity-coverage-plus |
Malicious release: Malicious code in freertc (npm) MAL-2026-4567 | Malicious | Not scored | 24 May, 2026 | npm freertc |
Malicious release: Malicious code in hardhat-gas-analytics (npm) GHSA-7pxc-2jp3-w7c8, MAL-2026-4576 | Malicious | Not scored | 23 May, 2026 | npm hardhat-gas-analytics |
Malicious release: Malicious code in openprompt-lang (npm) MAL-2026-4630 | Malicious | Not scored | 23 May, 2026 | npm openprompt-lang |
Malicious release: Malicious code in @gbrlxvii/ts-project-lint (npm) GHSA-pvrm-mpcj-2mcp, MAL-2026-4299 | Malicious | Not scored | 23 May, 2026 | npm @gbrlxvii/ts-project-lint |
Malicious release: Malicious code in pewter-constantstest (npm) MAL-2026-4638 | Malicious | Not scored | 23 May, 2026 | npm pewter-constantstest |
Malicious release: Malicious code in @audience-common-ui/components (npm) MAL-2026-4287 | Malicious | Not scored | 23 May, 2026 | npm @audience-common-ui/components |