Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @mastra/docker (npm) GHSA-vmr3-957g-5w95, MAL-2026-6019 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/docker |
Malicious release: Malicious code in @mastra/turbopuffer (npm) GHSA-jcv4-fvwf-3vg7, MAL-2026-6040 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/turbopuffer |
Malicious release: Malicious code in @mastra/deployer-netlify (npm) GHSA-q697-64gp-6qq7, MAL-2026-6017 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/deployer-netlify |
Malicious release: Malicious code in @mastra/cursor (npm) GHSA-cp3h-358p-m8h2, MAL-2026-6013 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/cursor |
Malicious release: Malicious code in @mastra/claude (npm) GHSA-jp56-69xj-c3rq, MAL-2026-6006 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/claude |
Malicious release: Malicious code in @mastra/deployer-cloudflare (npm) GHSA-c93p-x3xh-cgpj, MAL-2026-6016 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/deployer-cloudflare |
Malicious release: Malicious code in @mastra/cloudflare (npm) GHSA-fx8h-6h58-674x, MAL-2026-6008 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/cloudflare |
Malicious release: Malicious code in @mastra/pinecone (npm) GHSA-f3jx-6rr7-6f5j, MAL-2026-6032 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/pinecone |
Malicious release: Malicious code in @mastra/deployer-vercel (npm) GHSA-phgx-m87g-gqmf, MAL-2026-6018 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/deployer-vercel |
Malicious release: Malicious code in @mastra/upstash (npm) GHSA-grc4-63qq-h897, MAL-2026-6041 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/upstash |
Malicious release: Malicious code in @mastra/s3vectors (npm) GHSA-53fm-gc37-mgvr, MAL-2026-6035 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/s3vectors |
Malicious release: Malicious code in @mastra/convex (npm) GHSA-3g98-f7ww-r9qq, MAL-2026-6010 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/convex |
Malicious release: Malicious code in @mastra/vectorize (npm) GHSA-hhx4-85x4-3g8c, MAL-2026-6042 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/vectorize |
Malicious release: Malicious code in @mastra/qdrant (npm) GHSA-j93j-53rg-7g7g, MAL-2026-6034 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/qdrant |
Malicious release: Malicious code in @mastra/chroma (npm) GHSA-c69w-m5rg-46fw, MAL-2026-6005 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/chroma |
Malicious release: Malicious code in @mastra/couchbase (npm) GHSA-3xgr-445x-7mm6, MAL-2026-6012 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/couchbase |
Malicious release: Malicious code in @mastra/auth-better-auth (npm) GHSA-mg8p-hgv4-7rfp, MAL-2026-6000 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/auth-better-auth |
Malicious release: Malicious code in @mastra/cloudflare-d1 (npm) GHSA-xmx3-r6wm-33p3, MAL-2026-6009 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/cloudflare-d1 |
Malicious release: Malicious code in @mastra/auth-auth0 (npm) GHSA-2j96-v5c4-2p56, MAL-2026-5999 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/auth-auth0 |
Malicious release: Malicious code in @mastra/auth-workos (npm) GHSA-3pr6-37p3-w7g7, MAL-2026-6003 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/auth-workos |
Malicious release: Malicious code in @mastra/dsql (npm) GHSA-7f5h-95hw-fx6x, MAL-2026-6020 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/dsql |
Malicious release: Malicious code in @mastra/mssql (npm) GHSA-mhw2-7gv3-64jj, MAL-2026-6029 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/mssql |
Malicious release: Malicious code in @mastra/auth-supabase (npm) GHSA-3cr8-8w7x-779q, MAL-2026-6002 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/auth-supabase |
Malicious release: Malicious code in @mastra/auth-clerk (npm) GHSA-rgmx-h3wx-g4rj, MAL-2026-6001 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/auth-clerk |
Malicious release: Malicious code in @mastra/koa (npm) GHSA-w9wg-f3pj-cf4v, MAL-2026-6025 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/koa |
Malicious release: Malicious code in @mastra/express (npm) GHSA-r6w3-xpw9-p9g6, MAL-2026-6022 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/express |
Malicious release: Malicious code in @mastra/nestjs (npm) GHSA-9qg4-j8r6-rjc9, MAL-2026-6030 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/nestjs |
Malicious release: Malicious code in @mastra/client-js (npm) GHSA-4jmq-h62h-xhgh, MAL-2026-6007 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/client-js |
Malicious release: Malicious code in @mastra/memory (npm) GHSA-69g6-344c-3qpm, MAL-2026-6028 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/memory |
Malicious release: Malicious code in @mastra/server (npm) GHSA-wm6j-68jc-4x58, MAL-2026-6036 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/server |
Malicious release: Malicious code in create-mastra (npm) GHSA-jgwq-x2m5-mxhm, MAL-2026-6050 | Malicious | Not scored | 17 Jun, 2026 | npm create-mastra |
Malicious release: Malicious code in @mastra/core (npm) GHSA-pp62-grrw-hvfp, MAL-2026-6011 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/core |
Malicious release: Malicious code in @mastra/deployer (npm) GHSA-rjjh-j9jr-wg46, MAL-2026-6015 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/deployer |
Malicious release: Malicious code in metrics-probe-64b2 (npm) GHSA-7jwq-33cp-frr8, MAL-2026-5981 | Malicious | Not scored | 17 Jun, 2026 | npm metrics-probe-64b2 |
Malicious release: Malicious code in metrics-probe-77d4 (npm) GHSA-94g9-7rch-xv9j, MAL-2026-5982 | Malicious | Not scored | 17 Jun, 2026 | npm metrics-probe-77d4 |
Malicious release: Malicious code in metrics-probe-dc85 (npm) GHSA-49m3-wjc7-7pxw, MAL-2026-5983 | Malicious | Not scored | 17 Jun, 2026 | npm metrics-probe-dc85 |
Malicious release: Malicious code in pkg-telemetry-r4f9 (npm) GHSA-755p-5wm7-4qg5, MAL-2026-5990 | Malicious | Not scored | 17 Jun, 2026 | npm pkg-telemetry-r4f9 |
Malicious release: Malicious code in runtime-metrics-w7k2 (npm) GHSA-65h4-xcqj-p428, MAL-2026-5992 | Malicious | Not scored | 17 Jun, 2026 | npm runtime-metrics-w7k2 |
Malicious release: Malicious code in npm-sandbox-ping-r9t2 (npm) GHSA-p3jc-qrj7-hj68, MAL-2026-5986 | Malicious | Not scored | 17 Jun, 2026 | npm npm-sandbox-ping-r9t2 |
Malicious release: Malicious code in gpu-accelerator (npm) GHSA-qc67-wjjh-qpcv, MAL-2026-5980 | Malicious | Not scored | 17 Jun, 2026 | npm gpu-accelerator |
Malicious release: Malicious code in canary-ci-test (npm) GHSA-6p9p-wp4g-8546, MAL-2026-5972 | Malicious | Not scored | 17 Jun, 2026 | npm canary-ci-test |
Malicious release: Malicious code in nepublisher (npm) MAL-2026-5984 | Malicious | Not scored | 17 Jun, 2026 | npm nepublisher |
Malicious release: Malicious code in ts-webplug (npm) GHSA-m637-4v9j-499p, MAL-2026-5994 | Malicious | Not scored | 17 Jun, 2026 | npm ts-webplug |
Malicious release: Malicious code in params-valid-js (npm) GHSA-4mh2-8f67-ph3q, MAL-2026-5988 | Malicious | Not scored | 17 Jun, 2026 | npm params-valid-js |
Malicious release: Malicious code in node-path-utils (npm) GHSA-7qr8-pqwp-95p9, MAL-2026-5985 | Malicious | Not scored | 17 Jun, 2026 | npm node-path-utils |
Malicious release: Malicious code in req-parmas-valid (npm) GHSA-3pgv-795j-3ggc, MAL-2026-5991 | Malicious | Not scored | 17 Jun, 2026 | npm req-parmas-valid |
Malicious release: Malicious code in sheratan_test_p (npm) MAL-2026-5993 | Malicious | Not scored | 17 Jun, 2026 | npm sheratan_test_p |
Malicious release: Malicious code in pathfix (npm) GHSA-623x-x2wh-q9xq, MAL-2026-5989 | Malicious | Not scored | 17 Jun, 2026 | npm pathfix |
Malicious release: Malicious code in ogd-analytics (npm) MAL-2026-5987 | Malicious | Not scored | 17 Jun, 2026 | npm ogd-analytics |
Malicious release: Malicious code in classbreeze-utils (npm) GHSA-gj7f-m4cx-vmx3, MAL-2026-5973 | Malicious | Not scored | 17 Jun, 2026 | npm classbreeze-utils |