Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @serviceshub/x-web-core (npm) GHSA-xjvj-r6v9-q99q, MAL-2026-4440 | Malicious | Not scored | 20 May, 2026 | npm @serviceshub/x-web-core |
Malicious release: Malicious code in ethers-wallet-packages (npm) GHSA-gm49-5q33-vf6f, MAL-2026-4554 | Malicious | Not scored | 20 May, 2026 | npm ethers-wallet-packages |
Malicious release: Malicious code in python-utils (npm) GHSA-3c8h-wfcm-wpw5, MAL-2026-4652 | Malicious | Not scored | 20 May, 2026 | npm python-utils |
Malicious release: Malicious code in cb-wallet-data (npm) GHSA-7w56-x3g2-57fg, MAL-2026-4506 | Malicious | Not scored | 20 May, 2026 | npm cb-wallet-data |
Malicious release: Malicious code in @trackking/core (npm) GHSA-2qqx-q4v2-495g, MAL-2026-4460 | Malicious | Not scored | 20 May, 2026 | npm @trackking/core |
Malicious release: Malicious code in @ikyyofc/gemini-cli (npm) MAL-2026-4394 | Malicious | Not scored | 20 May, 2026 | npm @ikyyofc/gemini-cli |
Malicious release: Malicious code in @vtmn-play/react (npm) GHSA-vpcv-xpqm-w228, MAL-2026-4464 | Malicious | Not scored | 20 May, 2026 | npm @vtmn-play/react |
Malicious release: Malicious code in wallet-agent-ai-radix (npm) MAL-2026-4709 | Malicious | Not scored | 20 May, 2026 | npm wallet-agent-ai-radix |
Malicious release: Malicious code in color-style-utils (npm) GHSA-2hm6-8j47-2qg7, MAL-2026-4534 | Malicious | Not scored | 20 May, 2026 | npm color-style-utils |
Malicious release: Malicious code in @flipbit2-bb/test-auth-state (npm) GHSA-jrpc-qv6v-wmr6, MAL-2026-4389 | Malicious | Not scored | 20 May, 2026 | npm @flipbit2-bb/test-auth-state |
Malicious release: Malicious code in @deadcode09284814/axios-util (npm) MAL-2026-4379 | Malicious | Not scored | 20 May, 2026 | npm @deadcode09284814/axios-util |
Malicious release: Malicious code in chalk-tempalte (npm) GHSA-hvjp-xq9w-c33f, MAL-2026-4517 | Malicious | Not scored | 20 May, 2026 | npm chalk-tempalte |
Malicious release: Malicious code in cloud-pc-templates (npm) MAL-2026-4528 | Malicious | Not scored | 20 May, 2026 | npm cloud-pc-templates |
Malicious release: Malicious code in ezymail (npm) MAL-2026-4557 | Malicious | Not scored | 20 May, 2026 | npm ezymail |
Malicious release: Malicious code in pulse-axios (npm) MAL-2026-4651 | Malicious | Not scored | 20 May, 2026 | npm pulse-axios |
Malicious release: Malicious code in foundy-toolkit (npm) GHSA-48f2-rw49-vgx3, MAL-2026-4242 | Malicious | Not scored | 20 May, 2026 | npm foundy-toolkit |
Malicious release: Malicious code in axois-utils (npm) GHSA-pvvv-cmc6-c323, MAL-2026-4494 | Malicious | Not scored | 20 May, 2026 | npm axois-utils |
Malicious release: Malicious code in carvus-lens (npm) MAL-2026-4505 | Malicious | Not scored | 20 May, 2026 | npm carvus-lens |
Malicious release: Malicious code in polymarket-clob-client (npm) MAL-2026-4643 | Malicious | Not scored | 20 May, 2026 | npm polymarket-clob-client |
Malicious release: Malicious code in @solarcraft/observix (npm) MAL-2026-4446 | Malicious | Not scored | 20 May, 2026 | npm @solarcraft/observix |
Malicious release: Malicious code in get-deps-path (npm) GHSA-c852-72hm-gxvf, MAL-2026-4571 | Malicious | Not scored | 20 May, 2026 | npm get-deps-path |
Malicious release: Malicious code in truffle-config-helper (npm) GHSA-q8c8-9p2m-f4v7, MAL-2026-4249 | Malicious | Not scored | 20 May, 2026 | npm truffle-config-helper |
Malicious release: Malicious code in customerdigital-ui-containers-lib (npm) GHSA-fpwv-wv7c-h2mw, MAL-2026-4543 | Malicious | Not scored | 20 May, 2026 | npm customerdigital-ui-containers-lib |
Malicious release: Malicious code in code-tool-langfuse (npm) MAL-2026-4532 | Malicious | Not scored | 20 May, 2026 | npm code-tool-langfuse |
Malicious release: Malicious code in hpsetup (npm) MAL-2026-4579 | Malicious | Not scored | 20 May, 2026 | npm hpsetup |
Malicious release: Malicious code in etherjs-utils (npm) GHSA-3c7w-4xp2-7963, MAL-2026-4239 | Malicious | Not scored | 20 May, 2026 | npm etherjs-utils |
Malicious release: Malicious code in jsonbson (npm) GHSA-44rg-m26f-r36f, MAL-2026-4591 | Malicious | Not scored | 20 May, 2026 | npm jsonbson |
Malicious release: Malicious code in hardhat-gas-profiler-plugin (npm) GHSA-w4rg-p3x5-fv42, MAL-2026-4244 | Malicious | Not scored | 20 May, 2026 | npm hardhat-gas-profiler-plugin |
Malicious release: Malicious code in chainlink-price-feed-aggregator (npm) GHSA-88p4-x24p-x2j9, MAL-2026-4233 | Malicious | Not scored | 20 May, 2026 | npm chainlink-price-feed-aggregator |
Malicious release: Malicious code in @rocketreach/rr-components (npm) GHSA-7v8q-r297-95jx, MAL-2026-4427 | Malicious | Not scored | 20 May, 2026 | npm @rocketreach/rr-components |
Malicious release: Malicious code in crypto-javascript (npm) GHSA-v8fq-265h-rcw5, MAL-2026-4542 | Malicious | Not scored | 20 May, 2026 | npm crypto-javascript |
Malicious release: Malicious code in ganache-cli-provider (npm) GHSA-hfp4-5fx7-5mwm, MAL-2026-4243 | Malicious | Not scored | 20 May, 2026 | npm ganache-cli-provider |
Malicious release: Malicious code in solna-web3 (npm) GHSA-39j5-93x5-73hc, MAL-2026-4248 | Malicious | Not scored | 20 May, 2026 | npm solna-web3 |
Malicious release: Malicious code in solana-pda-helper (npm) GHSA-jrx8-mvj8-9gq2, MAL-2026-4247 | Malicious | Not scored | 20 May, 2026 | npm solana-pda-helper |
Malicious release: Malicious code in foundry-deploy-helper (npm) GHSA-xhp8-r3hh-j47p, MAL-2026-4241 | Malicious | Not scored | 20 May, 2026 | npm foundry-deploy-helper |
Malicious release: Malicious code in ethers-multicall-utils (npm) GHSA-r83q-qx5h-cjqm, MAL-2026-4240 | Malicious | Not scored | 20 May, 2026 | npm ethers-multicall-utils |
Malicious release: Malicious code in to-cms (npm) GHSA-789x-j439-qx3f, MAL-2026-4693 | Malicious | Not scored | 19 May, 2026 | npm to-cms |
Malicious release: Malicious code in martinez-polygon-clipping-tony (npm) GHSA-64jc-f3r5-gp74, MAL-2026-4606 | Malicious | Not scored | 19 May, 2026 | npm martinez-polygon-clipping-tony |
Malicious release: Malicious code in did-0091 (npm) MAL-2026-4177 | Malicious | Not scored | 19 May, 2026 | npm did-0091 |
Malicious release: Malicious code in zod-to-js (npm) GHSA-8cm2-vv7w-4c27, MAL-2026-4740 | Malicious | Not scored | 19 May, 2026 | npm zod-to-js |
Malicious release: Malicious code in collected-forms-embed-js (npm) GHSA-9j37-8wjm-pcxq, MAL-2026-4175 | Malicious | Not scored | 19 May, 2026 | npm collected-forms-embed-js |
Malicious release: Malicious code in clsx-js (npm) GHSA-8jmh-pvvx-wjrf, MAL-2026-4531 | Malicious | Not scored | 19 May, 2026 | npm clsx-js |
Malicious release: Malicious code in btd-smart (npm) GHSA-m4m6-q4p8-3vjv, MAL-2026-4501 | Malicious | Not scored | 19 May, 2026 | npm btd-smart |
Malicious release: Malicious code in crypto-hash-sdk (npm) GHSA-hr6r-2xx8-mrh9, MAL-2026-4541 | Malicious | Not scored | 19 May, 2026 | npm crypto-hash-sdk |
Malicious release: Malicious code in xorma-js (npm) GHSA-h7mc-23rp-vpj6, MAL-2026-4734 | Malicious | Not scored | 19 May, 2026 | npm xorma-js |
Malicious release: Malicious code in qr-code-styling-temp (npm) GHSA-m7q2-jqhj-4f3q, GHSA-pp2c-4x5r-7h8j, MAL-2026-4655, SNYK-JS-QRCODESTYLINGTEMP-19161484 | Malicious | Not scored | 19 May, 2026 | npm qr-code-styling-temp |
Malicious release: Malicious code in whiteboard-agent (npm) MAL-2026-4729 | Malicious | Not scored | 19 May, 2026 | npm whiteboard-agent |
Malicious release: Malicious code in claude-all-config (npm) MAL-2026-4522 | Malicious | Not scored | 19 May, 2026 | npm claude-all-config |
Malicious release: Malicious code in corelia (npm) GHSA-fg63-2vqh-93xf, MAL-2026-4536 | Malicious | Not scored | 19 May, 2026 | npm corelia |
Malicious release: Malicious code in superacli (npm) MAL-2026-4674 | Malicious | Not scored | 19 May, 2026 | npm superacli |