Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in easy-day-js (npm) MAL-2026-5979 | Malicious | Not scored | 17 Jun, 2026 | npm easy-day-js |
Malicious release: Malicious code in @public-for-cdao/hooks (npm) MAL-2026-5971 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/hooks |
Malicious release: Malicious code in cryptodao-contracts (npm) MAL-2026-5975 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-contracts |
Malicious release: Malicious code in cryptodao-core (npm) MAL-2026-5976 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-core |
Malicious release: Malicious code in cryptodao-bot (npm) MAL-2026-5974 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-bot |
Malicious release: Malicious code in cryptodao-utils (npm) MAL-2026-5978 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-utils |
Malicious release: Malicious code in cryptodao-signer (npm) MAL-2026-5977 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-signer |
Malicious release: Malicious code in @public-for-cdao/abi (npm) GHSA-584q-5354-mhmc, MAL-2026-10599 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/abi |
Malicious release: Malicious code in @public-for-cdao/api (npm) GHSA-hhwx-gm2f-gh2w, MAL-2026-10600 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/api |
Malicious release: Malicious code in @public-for-cdao/token (npm) GHSA-cvjj-96jr-345h, MAL-2026-10603 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/token |
Malicious release: Malicious code in @public-for-cdao/common (npm) GHSA-rhm5-mc66-328f, MAL-2026-10601 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/common |
Malicious release: Malicious code in @public-for-cdao/config (npm) GHSA-387h-gmrw-37qg, MAL-2026-10602 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/config |
Malicious release: Malicious code in @public-for-cdao/types (npm) GHSA-7c85-hxv2-75rg, MAL-2026-10604 | Malicious | Not scored | 17 Jun, 2026 | npm @public-for-cdao/types |
Malicious release: Malicious code in cryptodao-deploy (npm) MAL-2026-5968 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-deploy |
Malicious release: Malicious code in cryptodao-config (npm) MAL-2026-5967 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-config |
Malicious release: Malicious code in cryptodao-types (npm) MAL-2026-5970 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-types |
Malicious release: Malicious code in cryptodao-backend (npm) MAL-2026-5966 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-backend |
Malicious release: Malicious code in cryptodao-sdk (npm) MAL-2026-5969 | Malicious | Not scored | 17 Jun, 2026 | npm cryptodao-sdk |
Malicious release: Malicious code in @mastra/posthog (npm) GHSA-p3jv-r79x-4jvw, MAL-2026-5960 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/posthog |
Malicious release: Malicious code in @mastra/clickhouse (npm) GHSA-6327-2cw4-7cv9, MAL-2026-5942 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/clickhouse |
Malicious release: Malicious code in @mastra/inngest (npm) GHSA-cgr7-8rxj-9vgx, MAL-2026-5951 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/inngest |
Malicious release: Malicious code in @mastra/braintrust (npm) GHSA-64qh-859p-w8cf, MAL-2026-5941 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/braintrust |
Malicious release: Malicious code in @mastra/rag (npm) GHSA-442j-fj4w-jhpw, MAL-2026-5961 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/rag |
Malicious release: Malicious code in @mastra/mongodb (npm) GHSA-prf3-w8mj-rf6j, MAL-2026-5957 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/mongodb |
Malicious release: Malicious code in @mastra/fastify (npm) GHSA-q2q2-qp24-85vj, MAL-2026-5949 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/fastify |
Malicious release: Malicious code in @mastra/mcp-docs-server (npm) GHSA-wxp6-9hmr-928g, MAL-2026-5956 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/mcp-docs-server |
Malicious release: Malicious code in @mastra/langsmith (npm) GHSA-xqqc-fpmf-95cg, MAL-2026-5953 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/langsmith |
Malicious release: Malicious code in @mastra/s3 (npm) GHSA-6fx7-6whr-32rx, MAL-2026-5962 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/s3 |
Malicious release: Malicious code in @mastra/fastembed (npm) GHSA-7wrg-5c4f-2ph2, MAL-2026-5948 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/fastembed |
Malicious release: Malicious code in @mastra/sentry (npm) GHSA-r8mf-3854-wvmf, MAL-2026-5964 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/sentry |
Malicious release: Malicious code in @mastra/auth (npm) GHSA-957m-hm9p-jqrv, MAL-2026-5940 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/auth |
Malicious release: Malicious code in @mastra/hono (npm) GHSA-89jf-vg4p-9vmj, MAL-2026-5950 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/hono |
Malicious release: Malicious code in @mastra/datadog (npm) GHSA-h6wr-wm4g-qfpg, MAL-2026-5943 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/datadog |
Malicious release: Malicious code in @mastra/editor (npm) GHSA-69r2-rp52-252g, MAL-2026-5946 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/editor |
Malicious release: Malicious code in @mastra/otel-bridge (npm) GHSA-xww8-gf7m-2fhh, MAL-2026-5958 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/otel-bridge |
Malicious release: Malicious code in @mastra/dynamodb (npm) GHSA-g53g-3w8w-pqfr, MAL-2026-5945 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/dynamodb |
Malicious release: Malicious code in @mastra/duckdb (npm) GHSA-8fh9-h5vv-j2h4, MAL-2026-5944 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/duckdb |
Malicious release: Malicious code in @mastra/evals (npm) GHSA-c9hm-w6m5-hwcj, MAL-2026-5947 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/evals |
Malicious release: Malicious code in @mastra/schema-compat (npm) GHSA-jf5v-9r8r-vf3m, MAL-2026-5963 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/schema-compat |
Malicious release: Malicious code in @mastra/langfuse (npm) GHSA-5v2f-vg69-mmhv, MAL-2026-5952 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/langfuse |
Malicious release: Malicious code in @mastra/ai-sdk (npm) GHSA-qg4v-49f4-6r89, MAL-2026-5939 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/ai-sdk |
Malicious release: Malicious code in @mastra/pg (npm) GHSA-v5r7-mvp4-8qv6, MAL-2026-5959 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/pg |
Malicious release: Malicious code in @mastra/mcp (npm) GHSA-wfr8-6x4q-hpr3, MAL-2026-5955 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/mcp |
Malicious release: Malicious code in @mastra/libsql (npm) GHSA-4755-6mgh-pjpw, MAL-2026-5954 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/libsql |
Malicious release: Malicious code in mastra (npm) GHSA-mvf4-vg87-q9vm, MAL-2026-5965 | Malicious | Not scored | 17 Jun, 2026 | npm mastra |
Malicious release: Malicious code in abuden21 (npm) GHSA-5wr3-rjvv-cgfj, MAL-2026-5937 | Malicious | Not scored | 16 Jun, 2026 | npm abuden21 |
Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass CVE-2026-54326, GHSA-7v5m-pr3q-6453 | Low | 0.2% | 16 Jun, 2026 | npm @earendil-works/pi-coding-agent npm @mariozechner/pi-coding-agent |
Malicious release: Malicious code in speed4 (npm) GHSA-85hr-6fm5-49fj, MAL-2026-5938 | Malicious | Not scored | 16 Jun, 2026 | npm speed4 |
Cross-site scripting via <NoScript> slot content in Nuxt's head components CVE-2026-56317, GHSA-m3q2-p4fw-w38m | Low | 0.3% | 16 Jun, 2026 | npm nuxt |
n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host CVE-2026-54304, GHSA-rm2v-h48j-895m | High | 0.4% | 16 Jun, 2026 | npm n8n |