Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in flexbox-oauth-machinelearning (npm) MAL-2026-6161 | Malicious | Not scored | 17 Jun, 2026 | npm flexbox-oauth-machinelearning |
Malicious release: Malicious code in font-picker-responsive (npm) MAL-2026-6162 | Malicious | Not scored | 17 Jun, 2026 | npm font-picker-responsive |
Malicious release: Malicious code in framerate-interaction-permissions (npm) MAL-2026-6163 | Malicious | Not scored | 17 Jun, 2026 | npm framerate-interaction-permissions |
Malicious release: Malicious code in interaction-photos-infinitescroll (npm) MAL-2026-6164 | Malicious | Not scored | 17 Jun, 2026 | npm interaction-photos-infinitescroll |
Malicious release: Malicious code in ios-save-area-custom (npm) MAL-2026-6165 | Malicious | Not scored | 17 Jun, 2026 | npm ios-save-area-custom |
Malicious release: Malicious code in jest-macos (npm) MAL-2026-6166 | Malicious | Not scored | 17 Jun, 2026 | npm jest-macos |
Malicious release: Malicious code in lazyloading-haptics (npm) MAL-2026-6167 | Malicious | Not scored | 17 Jun, 2026 | npm lazyloading-haptics |
Malicious release: Malicious code in macos-contentprovider-optimizingassets (npm) MAL-2026-6168 | Malicious | Not scored | 17 Jun, 2026 | npm macos-contentprovider-optimizingassets |
Malicious release: Malicious code in notificationcenter-enzyme-jest (npm) MAL-2026-6169 | Malicious | Not scored | 17 Jun, 2026 | npm notificationcenter-enzyme-jest |
Malicious release: Malicious code in onesignal-hooks (npm) MAL-2026-6170 | Malicious | Not scored | 17 Jun, 2026 | npm onesignal-hooks |
Malicious release: Malicious code in personal-custom-button (npm) MAL-2026-6171 | Malicious | Not scored | 17 Jun, 2026 | npm personal-custom-button |
Malicious release: Malicious code in platformspecific-webgl (npm) MAL-2026-6172 | Malicious | Not scored | 17 Jun, 2026 | npm platformspecific-webgl |
Malicious release: Malicious code in profiling-keychain (npm) MAL-2026-6173 | Malicious | Not scored | 17 Jun, 2026 | npm profiling-keychain |
Malicious release: Malicious code in pushnotifications-gesturerecognition (npm) MAL-2026-6174 | Malicious | Not scored | 17 Jun, 2026 | npm pushnotifications-gesturerecognition |
Malicious release: Malicious code in request-performance (npm) MAL-2026-6175 | Malicious | Not scored | 17 Jun, 2026 | npm request-performance |
Malicious release: Malicious code in request-tracking-sqlite (npm) MAL-2026-6176 | Malicious | Not scored | 17 Jun, 2026 | npm request-tracking-sqlite |
Malicious release: Malicious code in socket-network (npm) MAL-2026-6177 | Malicious | Not scored | 17 Jun, 2026 | npm socket-network |
Malicious release: Malicious code in streaming-downloads (npm) MAL-2026-6178 | Malicious | Not scored | 17 Jun, 2026 | npm streaming-downloads |
Malicious release: Malicious code in touchid-images (npm) MAL-2026-6179 | Malicious | Not scored | 17 Jun, 2026 | npm touchid-images |
Malicious release: Malicious code in userinterface-machinelearning (npm) MAL-2026-6180 | Malicious | Not scored | 17 Jun, 2026 | npm userinterface-machinelearning |
Malicious release: Malicious code in virtualization-compression-collapse (npm) MAL-2026-6181 | Malicious | Not scored | 17 Jun, 2026 | npm virtualization-compression-collapse |
Malicious release: Malicious code in @mastra/node-speaker (npm) GHSA-3j53-vxv9-cpcf, MAL-2026-6055 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/node-speaker |
Malicious release: Malicious code in @mastra/voice-playai (npm) GHSA-qpv6-xmpr-rwx5, MAL-2026-6057 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-playai |
Malicious release: Malicious code in @mastra/github-signals (npm) GHSA-8xrc-83hr-5q5m, MAL-2026-6052 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/github-signals |
Malicious release: Malicious code in @mastra/mem0 (npm) GHSA-7725-4rfp-c7fr, MAL-2026-6053 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/mem0 |
Malicious release: Malicious code in @mastra/node-audio (npm) GHSA-g8vm-qr66-jrrc, MAL-2026-6054 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/node-audio |
Malicious release: Malicious code in @mastra/react (npm) GHSA-v5vm-xv73-6x64, MAL-2026-6056 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/react |
Malicious release: Malicious code in redis-type-xyz (npm) MAL-2026-11205 | Malicious | Not scored | 17 Jun, 2026 | npm redis-type-xyz |
Malicious release: Malicious code in @mastra/arize (npm) GHSA-629j-g5wx-hmr8, MAL-2026-5998 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/arize |
Malicious release: Malicious code in @mastra/voice-elevenlabs (npm) GHSA-fg73-2f9p-wvpv, MAL-2026-6045 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-elevenlabs |
Malicious release: Malicious code in @mastra/gcs (npm) GHSA-7crh-g7x3-q72f, MAL-2026-6023 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/gcs |
Malicious release: Malicious code in @mastra/voice-deepgram (npm) GHSA-858r-w468-45r4, MAL-2026-6044 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-deepgram |
Malicious release: Malicious code in @mastra/voice-aws-nova-sonic (npm) GHSA-xvgq-p2rf-7qv6, MAL-2026-6043 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-aws-nova-sonic |
Malicious release: Malicious code in @mastra/voice-openai (npm) GHSA-8p42-82r4-mf65, MAL-2026-6048 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-openai |
Malicious release: Malicious code in @mastra/voice-google (npm) GHSA-p75c-5cq4-mjmg, MAL-2026-6046 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-google |
Malicious release: Malicious code in @mastra/voice-google-gemini-live (npm) GHSA-q952-4f7p-5rf3, MAL-2026-6047 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-google-gemini-live |
Malicious release: Malicious code in @mastra/voice-openai-realtime (npm) GHSA-4rfq-w3x8-rrx3, MAL-2026-6049 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/voice-openai-realtime |
Malicious release: Malicious code in @mastra/e2b (npm) GHSA-jg9x-69gr-j4hh, MAL-2026-6021 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/e2b |
Malicious release: Malicious code in @mastra/google-cloud-pubsub (npm) GHSA-wv5r-22mx-vfr8, MAL-2026-6024 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/google-cloud-pubsub |
Malicious release: Malicious code in @mastra/daytona (npm) GHSA-8rq6-5x45-6j98, MAL-2026-6014 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/daytona |
Malicious release: Malicious code in @mastra/blaxel (npm) GHSA-jr4h-q66m-r9c7, MAL-2026-6004 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/blaxel |
Malicious release: Malicious code in @mastra/mcp-registry-registry (npm) GHSA-5w62-p653-57mf, MAL-2026-6027 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/mcp-registry-registry |
Malicious release: Malicious code in @mastra/longmemeval (npm) GHSA-7x3v-wg29-8m8v, MAL-2026-6026 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/longmemeval |
Malicious release: Malicious code in @mastra/agent-builder (npm) GHSA-hj75-mc88-g6xc, MAL-2026-5997 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/agent-builder |
Malicious release: Malicious code in @mastra/temporal (npm) GHSA-m6rq-qx37-q2jv, MAL-2026-6039 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/temporal |
Malicious release: Malicious code in @mastra/tavily (npm) GHSA-ph9m-rfv2-m2h6, MAL-2026-6038 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/tavily |
Malicious release: Malicious code in @mastra/stagehand (npm) GHSA-x59w-qg4x-cmrx, MAL-2026-6037 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/stagehand |
Malicious release: Malicious code in @mastra/agent-browser (npm) GHSA-ph9v-3f5h-hg6p, MAL-2026-5996 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/agent-browser |
Malicious release: Malicious code in @mastra/otel-exporter (npm) GHSA-2579-m2q3-5whx, MAL-2026-6031 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/otel-exporter |
Malicious release: Malicious code in @mastra/playground-ui (npm) GHSA-25cg-799c-2gpr, MAL-2026-6033 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/playground-ui |