Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in native-runner (npm) GHSA-jxw5-69p3-hpm4, MAL-2026-17218 | Malicious | Not scored | 28 Sep, 2026 | npm native-runner |
Malicious release: Malicious code in nebulajs-api (npm) GHSA-2gr6-gxvx-3594, MAL-2026-17220 | Malicious | Not scored | 28 Sep, 2026 | npm nebulajs-api |
Malicious release: Malicious code in nebula-sdk (npm) GHSA-fm5g-6rr8-p9vq, MAL-2026-17219 | Malicious | Not scored | 28 Sep, 2026 | npm nebula-sdk |
Malicious release: Malicious code in vite-plugin-crypto (npm) GHSA-mh9w-qr45-6wrq, MAL-2026-17222 | Malicious | Not scored | 28 Sep, 2026 | npm vite-plugin-crypto |
Malicious release: Malicious code in tailwindcss-form-kit (npm) GHSA-cxrh-669r-w2g9, MAL-2026-17221 | Malicious | Not scored | 28 Sep, 2026 | npm tailwindcss-form-kit |
Malicious release: Malicious code in my-skibidi (npm) GHSA-w4g6-rgx4-2wjf, MAL-2026-17217 | Malicious | Not scored | 28 Sep, 2026 | npm my-skibidi |
Malicious release: Malicious code in eslint-plugin-skywagon-web (npm) MAL-2026-17215 | Malicious | Not scored | 28 Sep, 2026 | npm eslint-plugin-skywagon-web |
Malicious release: Malicious code in git-en-boite-logging (npm) MAL-2026-17214 | Malicious | Not scored | 28 Sep, 2026 | npm git-en-boite-logging |
Malicious release: Malicious code in godsplan (npm) MAL-2026-17315 | Malicious | Not scored | 28 Sep, 2026 | npm godsplan |
Malicious release: Malicious code in wbnr-probe-visible-check (npm) GHSA-65gf-jmp3-4wrc, MAL-2026-17212 | Malicious | Not scored | 28 Sep, 2026 | npm wbnr-probe-visible-check |
Malicious release: Malicious code in @wbnr/design-kit (npm) GHSA-865f-pwj5-p2c5, MAL-2026-17204 | Malicious | Not scored | 28 Sep, 2026 | npm @wbnr/design-kit |
Malicious release: Malicious code in @wbnr/lottiefiles-loader (npm) GHSA-94r6-cxjq-fq4r, MAL-2026-17205 | Malicious | Not scored | 28 Sep, 2026 | npm @wbnr/lottiefiles-loader |
Malicious release: Malicious code in kalasnik-npm-simple-test (npm) GHSA-pm4h-xrhq-vh62, MAL-2026-17206 | Malicious | Not scored | 28 Sep, 2026 | npm kalasnik-npm-simple-test |
Malicious release: Malicious code in kjj81 (npm) GHSA-9f7c-6fp7-9g6x, MAL-2026-17207 | Malicious | Not scored | 28 Sep, 2026 | npm kjj81 |
Malicious release: Malicious code in uuid-date (npm) GHSA-pqvc-prrc-mv45, MAL-2026-17210 | Malicious | Not scored | 28 Sep, 2026 | npm uuid-date |
Malicious release: Malicious code in riot-private (npm) GHSA-qgpm-ggcf-4fqm, MAL-2026-17208 | Malicious | Not scored | 28 Sep, 2026 | npm riot-private |
Malicious release: Malicious code in vinzzsync-wacli (npm) GHSA-rmcq-f7vh-v86v, MAL-2026-17211 | Malicious | Not scored | 28 Sep, 2026 | npm vinzzsync-wacli |
Malicious release: Malicious code in tanksync (npm) GHSA-47j4-w95p-wjp7, MAL-2026-17209 | Malicious | Not scored | 28 Sep, 2026 | npm tanksync |
Malicious release: Malicious code in @consts/links (npm) GHSA-5rp9-7r4x-3fqp, MAL-2026-17202 | Malicious | Not scored | 28 Sep, 2026 | npm @consts/links |
Malicious release: Malicious code in @digi-kernel/digi-kernel-constrains (npm) GHSA-h37m-2c3q-82j8, MAL-2026-17203 | Malicious | Not scored | 28 Sep, 2026 | npm @digi-kernel/digi-kernel-constrains |
Malicious release: Malicious code in @bb1ptest23/test-paket (npm) MAL-2026-17201 | Malicious | Not scored | 28 Sep, 2026 | npm @bb1ptest23/test-paket |
Malicious release: Malicious code in chai-as-relay (npm) MAL-2026-17189 | Malicious | Not scored | 26 Sep, 2026 | npm chai-as-relay |
Malicious release: Malicious code in cma-self-hosted-sandbox-cf (npm) MAL-2026-17190 | Malicious | Not scored | 26 Sep, 2026 | npm cma-self-hosted-sandbox-cf |
Malicious release: Malicious code in @digift/cli (npm) GHSA-xp76-38xh-m8wc, MAL-2026-17187 | Malicious | Not scored | 25 Sep, 2026 | npm @digift/cli |
Malicious release: Malicious code in @nubjs/types (npm) GHSA-7qx8-98q7-66p4, MAL-2026-17186 | Malicious | Not scored | 25 Sep, 2026 | npm @nubjs/types |
Malicious release: Malicious code in @zeronexcode/baileys (npm) GHSA-cghr-f3w3-qh2h, MAL-2026-17326 | Malicious | Not scored | 25 Sep, 2026 | npm @zeronexcode/baileys |
Malicious release: Malicious code in @airbnb-extended/typescript-config (npm) GHSA-4jfx-2j46-9rqq, MAL-2026-17184 | Malicious | Not scored | 25 Sep, 2026 | npm @airbnb-extended/typescript-config |
Malicious release: Malicious code in shoplist-app (npm) MAL-2026-17185 | Malicious | Not scored | 25 Sep, 2026 | npm shoplist-app |
Malicious release: Malicious code in app-sca-info-banking (npm) GHSA-v2r2-pcp9-6mxr, MAL-2026-17182 | Malicious | Not scored | 25 Sep, 2026 | npm app-sca-info-banking |
Malicious release: Malicious code in @alphaspace/core (npm) MAL-2026-17169 | Malicious | Not scored | 25 Sep, 2026 | npm @alphaspace/core |
Malicious release: Malicious code in n8n-nodes-moonlet-helpers (npm) MAL-2026-17176 | Malicious | Not scored | 25 Sep, 2026 | npm n8n-nodes-moonlet-helpers |
Malicious release: Malicious code in n8n-nodes-moonlet-utils (npm) MAL-2026-17177 | Malicious | Not scored | 25 Sep, 2026 | npm n8n-nodes-moonlet-utils |
Malicious release: Malicious code in n8n-nodes-flowstats (npm) MAL-2026-17175 | Malicious | Not scored | 25 Sep, 2026 | npm n8n-nodes-flowstats |
Malicious release: Malicious code in wallet-connect-adapter (npm) MAL-2026-17179 | Malicious | Not scored | 25 Sep, 2026 | npm wallet-connect-adapter |
Malicious release: Malicious code in agency-testts (npm) MAL-2026-17171 | Malicious | Not scored | 25 Sep, 2026 | npm agency-testts |
Malicious release: Malicious code in secure-env3 (npm) MAL-2026-17178 | Malicious | Not scored | 25 Sep, 2026 | npm secure-env3 |
Malicious release: Malicious code in agency-test-exercise (npm) MAL-2026-17170 | Malicious | Not scored | 25 Sep, 2026 | npm agency-test-exercise |
Malicious release: Malicious code in better-dotenv3 (npm) MAL-2026-17172 | Malicious | Not scored | 25 Sep, 2026 | npm better-dotenv3 |
Malicious release: Malicious code in chromatitle-js (npm) MAL-2026-17174 | Malicious | Not scored | 25 Sep, 2026 | npm chromatitle-js |
Malicious release: Malicious code in chromatitle (npm) MAL-2026-17173 | Malicious | Not scored | 25 Sep, 2026 | npm chromatitle |
Malicious release: Malicious code in analytics-widget (npm) GHSA-548g-r2c9-6chm, MAL-2026-17163 | Malicious | Not scored | 24 Sep, 2026 | npm analytics-widget |
Malicious release: Malicious code in building-build (npm) GHSA-2fq4-2r26-qr64, MAL-2026-17164 | Malicious | Not scored | 24 Sep, 2026 | npm building-build |
Malicious release: Malicious code in cache-swipper (npm) MAL-2026-17166 | Malicious | Not scored | 24 Sep, 2026 | npm cache-swipper |
Malicious release: Malicious code in c2-client (npm) MAL-2026-17165 | Malicious | Not scored | 24 Sep, 2026 | npm c2-client |
Malicious release: Malicious code in simple-date-formatter-new-16 (npm) MAL-2026-17162 | Malicious | Not scored | 24 Sep, 2026 | npm simple-date-formatter-new-16 |
Malicious release: Malicious code in eslint-config-compact-base (npm) GHSA-gx7g-jjf6-c7jg, MAL-2026-17157 | Malicious | Not scored | 24 Sep, 2026 | npm eslint-config-compact-base |
Malicious release: Malicious code in simple-date-formatter-new-14 (npm) MAL-2026-17160 | Malicious | Not scored | 24 Sep, 2026 | npm simple-date-formatter-new-14 |
Malicious release: Malicious code in simple-date-formatter-new-13 (npm) MAL-2026-17159 | Malicious | Not scored | 24 Sep, 2026 | npm simple-date-formatter-new-13 |
Malicious release: Malicious code in aliftech-ui (npm) MAL-2026-17156 | Malicious | Not scored | 24 Sep, 2026 | npm aliftech-ui |
Malicious release: Malicious code in @osl-design/react (npm) MAL-2026-17155 | Malicious | Not scored | 24 Sep, 2026 | npm @osl-design/react |