Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in screenpipe-mcp-http (npm) MAL-2026-5402 | Malicious | Not scored | 09 Jun, 2026 | npm screenpipe-mcp-http |
Malicious release: Malicious code in multica (npm) MAL-2026-5400 | Malicious | Not scored | 09 Jun, 2026 | npm multica |
Malicious release: Malicious code in create-docs-mcp (npm) MAL-2026-5397 | Malicious | Not scored | 09 Jun, 2026 | npm create-docs-mcp |
Malicious release: Malicious code in t-invest-mcp-server (npm) MAL-2026-5403 | Malicious | Not scored | 09 Jun, 2026 | npm t-invest-mcp-server |
Malicious release: Malicious code in @sqlite-node/createsql (npm) GHSA-9w2p-6gjc-vrqv, MAL-2026-5396 | Malicious | Not scored | 09 Jun, 2026 | npm @sqlite-node/createsql |
Malicious release: Malicious code in @sql-access/nodesql (npm) GHSA-qpx3-6fx4-259q, MAL-2026-5394 | Malicious | Not scored | 09 Jun, 2026 | npm @sql-access/nodesql |
Malicious release: Malicious code in hey-base32 (npm) MAL-2026-5398 | Malicious | Not scored | 09 Jun, 2026 | npm hey-base32 |
Malicious release: Malicious code in @sql-trigger/nodesql (npm) GHSA-9f9w-wg5j-m53j, MAL-2026-5395 | Malicious | Not scored | 09 Jun, 2026 | npm @sql-trigger/nodesql |
Malicious release: Malicious code in kecak256 (npm) GHSA-4vrf-wcrh-g5j5, MAL-2026-5342 | Malicious | Not scored | 09 Jun, 2026 | npm kecak256 |
Malicious release: Malicious code in enquriers (npm) GHSA-c8vc-qqjp-wg87, MAL-2026-5384 | Malicious | Not scored | 09 Jun, 2026 | npm enquriers |
Malicious release: Malicious code in progerss-cli (npm) GHSA-pr99-g8pf-f3rr, MAL-2026-5343 | Malicious | Not scored | 09 Jun, 2026 | npm progerss-cli |
Malicious release: Malicious code in @doaction/wasm-loader (npm) GHSA-54mr-v524-rmw6, MAL-2026-5383 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/wasm-loader |
Malicious release: Malicious code in @doaction/types (npm) GHSA-m5q9-qwgm-wvqx, MAL-2026-5382 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/types |
Malicious release: Malicious code in @doaction/examples (npm) GHSA-3hg6-5qgp-v676, MAL-2026-5372 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/examples |
Malicious release: Malicious code in @doaction/pay (npm) GHSA-55rv-c39c-944m, MAL-2026-5375 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/pay |
Malicious release: Malicious code in @doaction/mapstore (npm) GHSA-6mxf-8m2v-f345, MAL-2026-5374 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/mapstore |
Malicious release: Malicious code in @doaction/http (npm) GHSA-cpf3-vrxh-mv98, MAL-2026-5373 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/http |
Malicious release: Malicious code in @doaction/sudo-prompt (npm) GHSA-f9qh-hqgp-pgvc, MAL-2026-5380 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/sudo-prompt |
Malicious release: Malicious code in @doaction/signalhub (npm) GHSA-gq53-mvg2-fxjf, MAL-2026-5378 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/signalhub |
Malicious release: Malicious code in @doaction/rrweb-sdk (npm) GHSA-j6f2-qf2j-5mh5, MAL-2026-5376 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/rrweb-sdk |
Malicious release: Malicious code in @doaction/storage (npm) GHSA-v89r-6g3x-gjjv, MAL-2026-5379 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/storage |
Malicious release: Malicious code in @doaction/systeminformation (npm) GHSA-xj3m-q8rc-3f5j, MAL-2026-5381 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/systeminformation |
Malicious release: Malicious code in @doaction/shared (npm) GHSA-5784-q7wq-ch43, MAL-2026-5377 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/shared |
Malicious release: Malicious code in @doaction/auth (npm) GHSA-5cwj-c46v-mpmf, MAL-2026-5369 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/auth |
Malicious release: Malicious code in @doaction/eventemitter (npm) GHSA-926j-qqmq-889c, MAL-2026-5370 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/eventemitter |
Malicious release: Malicious code in @doaction/example (npm) GHSA-w4g4-r5qj-rj58, MAL-2026-5371 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/example |
Malicious release: Malicious code in transacts (npm) GHSA-r8v2-q2r3-ghm6, MAL-2026-5368 | Malicious | Not scored | 09 Jun, 2026 | npm transacts |
Malicious release: Malicious code in moustick (npm) GHSA-979m-vm48-369f, MAL-2026-5347 | Malicious | Not scored | 09 Jun, 2026 | npm moustick |
Malicious release: Malicious code in cookie-parser-legacy (npm) GHSA-xv3p-wcmf-6hp8, MAL-2026-5346 | Malicious | Not scored | 09 Jun, 2026 | npm cookie-parser-legacy |
Malicious release: Malicious code in os-ulid-void (npm) GHSA-7fhf-p3wv-2xrc, MAL-2026-5348 | Malicious | Not scored | 09 Jun, 2026 | npm os-ulid-void |
Malicious release: Malicious code in @bancolonbia/menu-filter-widget-web (npm) MAL-2026-5344 | Malicious | Not scored | 09 Jun, 2026 | npm @bancolonbia/menu-filter-widget-web |
Malicious release: Malicious code in farming-tools-12 (npm) MAL-2026-5357 | Malicious | Not scored | 09 Jun, 2026 | npm farming-tools-12 |
Malicious release: Malicious code in defi-tools-39 (npm) MAL-2026-5354 | Malicious | Not scored | 09 Jun, 2026 | npm defi-tools-39 |
Malicious release: Malicious code in swap-sdk-87 (npm) MAL-2026-5359 | Malicious | Not scored | 09 Jun, 2026 | npm swap-sdk-87 |
Malicious release: Malicious code in wallet-sdk-9 (npm) MAL-2026-5360 | Malicious | Not scored | 09 Jun, 2026 | npm wallet-sdk-9 |
Malicious release: Malicious code in ethereum-kit-9 (npm) MAL-2026-5356 | Malicious | Not scored | 09 Jun, 2026 | npm ethereum-kit-9 |
Malicious release: Malicious code in crypto-utils-7 (npm) MAL-2026-5353 | Malicious | Not scored | 09 Jun, 2026 | npm crypto-utils-7 |
Malicious release: Malicious code in ethereum-kit-1 (npm) MAL-2026-5355 | Malicious | Not scored | 09 Jun, 2026 | npm ethereum-kit-1 |
Malicious release: Malicious code in blockchain-helper-0 (npm) MAL-2026-5352 | Malicious | Not scored | 09 Jun, 2026 | npm blockchain-helper-0 |
Malicious release: Malicious code in @demica/shared (npm) GHSA-h89w-h537-fmq5, MAL-2026-5351 | Malicious | Not scored | 09 Jun, 2026 | npm @demica/shared |
Malicious release: Malicious code in @demica/resources (npm) GHSA-jpwc-w79c-8p63, MAL-2026-5350 | Malicious | Not scored | 09 Jun, 2026 | npm @demica/resources |
Malicious release: Malicious code in @demica/core (npm) GHSA-5ffq-j26h-5mr4, MAL-2026-5349 | Malicious | Not scored | 09 Jun, 2026 | npm @demica/core |
degit has a Command Injection issue CVE-2026-11572, GHSA-77c7-pq4r-6mcq | High | 1.0% | 09 Jun, 2026 | npm degit |
Malicious release: Malicious code in solana-core-4 (npm) MAL-2026-5358 | Malicious | Not scored | 09 Jun, 2026 | npm solana-core-4 |
Malicious release: Malicious code in web3-tools-9 (npm) MAL-2026-5361 | Malicious | Not scored | 09 Jun, 2026 | npm web3-tools-9 |
Malicious release: Malicious code in void-ulid (npm) GHSA-3697-j84m-hx3g, MAL-2026-5341 | Malicious | Not scored | 09 Jun, 2026 | npm void-ulid |
FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions CVE-2026-47721, GHSA-8ghr-w65f-j3qr | Medium | 0.4% | 08 Jun, 2026 | npm fuxa-server |
FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString CVE-2026-47720, GHSA-h9fj-c2qr-76g2 | Medium | 0.6% | 08 Jun, 2026 | npm fuxa-server |
FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading CVE-2026-47719, GHSA-w86f-rf9w-h3x6 | High | 0.6% | 08 Jun, 2026 | npm fuxa-server |
AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping CVE-2026-11393, GHSA-m4x6-gwgp-4pm7 | High | 0.3% | 08 Jun, 2026 | npm @aws/agentcore |