Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @tanstack/zod-adapter (npm) GHSA-xj4p-7xwr-q9jj, MAL-2026-3501 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/zod-adapter |
Malicious release: Malicious code in @tanstack/router-devtools-core (npm) GHSA-8jwm-h66c-fj6r, MAL-2026-3475 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/router-devtools-core |
Malicious release: Malicious code in @tanstack/router-core (npm) GHSA-r8f9-7pfq-w872, MAL-2026-3473 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/router-core |
Malicious release: Malicious code in @tanstack/router-cli (npm) GHSA-7xj7-65hc-69fc, MAL-2026-3472 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/router-cli |
Malicious release: Malicious code in @tanstack/react-start (npm) GHSA-7cm2-482j-9rxq, MAL-2026-3468 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-start |
Malicious release: Malicious code in @tanstack/react-start-server (npm) GHSA-xf53-jqmx-h45h, MAL-2026-3471 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-start-server |
Malicious release: Malicious code in @tanstack/react-start-rsc (npm) GHSA-hv5h-gqr4-76v3, MAL-2026-3470 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-start-rsc |
Malicious release: Malicious code in @tanstack/react-start-client (npm) GHSA-8j42-6cpx-3c7g, MAL-2026-3469 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-start-client |
Malicious release: Malicious code in @tanstack/react-router (npm) GHSA-5q7g-gw3w-r3rh, MAL-2026-3465 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-router |
Malicious release: Malicious code in @tanstack/react-router-ssr-query (npm) GHSA-q9q3-jp8x-cq8h, MAL-2026-3467 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-router-ssr-query |
Malicious release: Malicious code in @tanstack/react-router-devtools (npm) GHSA-qqw3-95q8-m7g4, MAL-2026-3466 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-router-devtools |
Malicious release: Malicious code in @tanstack/nitro-v2-vite-plugin (npm) GHSA-qj9f-x9rw-w5v3, MAL-2026-3464 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/nitro-v2-vite-plugin |
Malicious release: Malicious code in @tanstack/history (npm) GHSA-rmmr-r34h-pfm5, MAL-2026-3463 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/history |
Malicious release: Malicious code in @tanstack/eslint-plugin-start (npm) GHSA-8hwj-wqhq-3xw2, MAL-2026-3462 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/eslint-plugin-start |
Malicious release: Malicious code in @tanstack/eslint-plugin-router (npm) GHSA-4q7x-8jvq-jpfv, MAL-2026-3461 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/eslint-plugin-router |
Malicious release: Malicious code in @tanstack/arktype-adapter (npm) GHSA-5v49-5jh3-j7wg, MAL-2026-3460 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/arktype-adapter |
Malicious release: Malicious code in @mistralai/mistralai (npm) GHSA-3q49-cfcf-g5fm, MAL-2026-3432 | Malicious | Not scored | 11 May, 2026 | npm @mistralai/mistralai |
Malicious release: Malicious code in cplace-bmw-emt-mvp (npm) MAL-2026-3430 | Malicious | Not scored | 11 May, 2026 | npm cplace-bmw-emt-mvp |
Malicious release: Malicious code in crypto-javascri (npm) MAL-2026-3508 | Malicious | Not scored | 11 May, 2026 | npm crypto-javascri |
Malicious release: Malicious code in @mimecast-ui/charts (npm) MAL-2026-3506 | Malicious | Not scored | 11 May, 2026 | npm @mimecast-ui/charts |
Malicious release: Malicious code in @mimecast-ui/components (npm) MAL-2026-3507 | Malicious | Not scored | 11 May, 2026 | npm @mimecast-ui/components |
Malicious release: Malicious code in @cplace-workflow-fe/cf-workflow (npm) GHSA-fmm7-x566-j93x, MAL-2026-3427 | Malicious | Not scored | 11 May, 2026 | npm @cplace-workflow-fe/cf-workflow |
Malicious release: Malicious code in byvendors (npm) MAL-2026-3423 | Malicious | Not scored | 11 May, 2026 | npm byvendors |
Malicious release: Malicious code in pp-react-v5 (npm) MAL-2026-3509 | Malicious | Not scored | 11 May, 2026 | npm pp-react-v5 |
Malicious release: Malicious code in briantreehttp (npm) MAL-2026-3639 | Malicious | Not scored | 11 May, 2026 | npm briantreehttp |
Malicious release: Malicious code in ac-sasskit (npm) MAL-2026-3415 | Malicious | Not scored | 10 May, 2026 | npm ac-sasskit |
Malicious release: Malicious code in rsflows-pexml (npm) GHSA-m2qp-j4c5-7m6m, MAL-2026-3422 | Malicious | Not scored | 10 May, 2026 | npm rsflows-pexml |
Malicious release: Malicious code in noon-contracts (npm) GHSA-qj9j-8fcr-pjq2, MAL-2026-3420 | Malicious | Not scored | 10 May, 2026 | npm noon-contracts |
Malicious release: Malicious code in post-purchase-bundler (npm) MAL-2026-3412 | Malicious | Not scored | 10 May, 2026 | npm post-purchase-bundler |
Malicious release: Malicious code in @miurba/alcazaba (npm) MAL-2026-3410 | Malicious | Not scored | 10 May, 2026 | npm @miurba/alcazaba |
Malicious release: Malicious code in mw-filesystem-events-nodream (npm) MAL-2026-3409 | Malicious | Not scored | 10 May, 2026 | npm mw-filesystem-events-nodream |
Malicious release: Malicious code in dit-envv (npm) GHSA-m6q4-79qp-v6vp, MAL-2026-3645 | Malicious | Not scored | 10 May, 2026 | npm dit-envv |
Malicious release: Malicious code in erslove (npm) GHSA-r4pq-fh5v-934h, MAL-2026-3646 | Malicious | Not scored | 10 May, 2026 | npm erslove |
Malicious release: Malicious code in @rsi-community/hub-schema (npm) GHSA-j83r-w4f8-v7m9, MAL-2026-3414 | Malicious | Not scored | 09 May, 2026 | npm @rsi-community/hub-schema |
Malicious release: Malicious code in @matjp/dvi-decode (npm) MAL-2026-3404 | Malicious | Not scored | 09 May, 2026 | npm @matjp/dvi-decode |
Malicious release: Malicious code in apple-mycelium-fix (npm) GHSA-fjcr-w74v-m2qw, MAL-2026-3416 | Malicious | Not scored | 09 May, 2026 | npm apple-mycelium-fix |
Malicious release: Malicious code in haswons (npm) MAL-2026-3647 | Malicious | Not scored | 09 May, 2026 | npm haswons |
Malicious release: Malicious code in oneblk-design-system (npm) MAL-2026-3421 | Malicious | Not scored | 08 May, 2026 | npm oneblk-design-system |
Malicious release: Malicious code in devsite-youtube (npm) MAL-2026-3418 | Malicious | Not scored | 08 May, 2026 | npm devsite-youtube |
Malicious release: Malicious code in typo-crypto (npm) MAL-2026-3400 | Malicious | Not scored | 08 May, 2026 | npm typo-crypto |
Malicious release: Malicious code in money-badger-open-rpc-test-bugbount (npm) MAL-2026-3399 | Malicious | Not scored | 08 May, 2026 | npm money-badger-open-rpc-test-bugbount |
Malicious release: Malicious code in tecken (npm) GHSA-4gxg-7rff-vvmx, MAL-2026-3397 | Malicious | Not scored | 08 May, 2026 | npm tecken |
Malicious release: Malicious code in coral-dev-proxy (npm) MAL-2026-3395 | Malicious | Not scored | 08 May, 2026 | npm coral-dev-proxy |
Malicious release: Malicious code in @gaia-codesearch/gaia-api-typescript (npm) MAL-2026-3394 | Malicious | Not scored | 08 May, 2026 | npm @gaia-codesearch/gaia-api-typescript |
Malicious release: Malicious code in @gaia-codesearch/gaia-api-python (npm) MAL-2026-3387 | Malicious | Not scored | 08 May, 2026 | npm @gaia-codesearch/gaia-api-python |
Malicious release: Malicious code in connect-perspectives-admintool (npm) MAL-2026-3417 | Malicious | Not scored | 08 May, 2026 | npm connect-perspectives-admintool |
Malicious release: Malicious code in msal-browser-1p (npm) MAL-2026-3419 | Malicious | Not scored | 08 May, 2026 | npm msal-browser-1p |
Malicious release: Malicious code in playgod (npm) MAL-2026-3374 | Malicious | Not scored | 08 May, 2026 | npm playgod |
Malicious release: Malicious code in owa-analytics-utils (npm) MAL-2026-3373 | Malicious | Not scored | 07 May, 2026 | npm owa-analytics-utils |
Malicious release: Malicious code in @b2bneo-rest/api-csf (npm) MAL-2026-3365 | Malicious | Not scored | 07 May, 2026 | npm @b2bneo-rest/api-csf |