Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in mrdaa-frontend (npm) GHSA-r3r7-xhf7-xf87, MAL-2026-3363 | Malicious | Not scored | 07 May, 2026 | npm mrdaa-frontend |
Malicious release: Malicious code in 24712-pl5006 (npm) MAL-2026-3362 | Malicious | Not scored | 07 May, 2026 | npm 24712-pl5006 |
Malicious release: Malicious code in camelotlabs-config (npm) GHSA-7972-958m-rqjg, MAL-2026-3640 | Malicious | Not scored | 07 May, 2026 | npm camelotlabs-config |
Malicious release: Malicious code in camelotlabs-core (npm) GHSA-pf82-f9wr-54vx, MAL-2026-3641 | Malicious | Not scored | 07 May, 2026 | npm camelotlabs-core |
Malicious release: Malicious code in camelotlabs-sdk (npm) GHSA-wx8x-c4rg-8rg7, MAL-2026-3642 | Malicious | Not scored | 07 May, 2026 | npm camelotlabs-sdk |
Malicious release: Malicious code in camelotlabs-utils (npm) GHSA-2j2p-88v8-7xrm, MAL-2026-3643 | Malicious | Not scored | 07 May, 2026 | npm camelotlabs-utils |
Malicious release: Malicious code in camelotlabs-worker (npm) GHSA-4mgg-vrvh-32xg, MAL-2026-3644 | Malicious | Not scored | 07 May, 2026 | npm camelotlabs-worker |
Malicious release: Malicious code in 24712-pl5004 (npm) MAL-2026-3361 | Malicious | Not scored | 06 May, 2026 | npm 24712-pl5004 |
Malicious release: Malicious code in @paysafe-tracking/error-monitoring (npm) MAL-2026-3360 | Malicious | Not scored | 06 May, 2026 | npm @paysafe-tracking/error-monitoring |
Malicious release: Malicious code in 24712-pl4712 (npm) MAL-2026-3358 | Malicious | Not scored | 06 May, 2026 | npm 24712-pl4712 |
Malicious release: Malicious code in b2bneo-rest (npm) MAL-2026-3359 | Malicious | Not scored | 06 May, 2026 | npm b2bneo-rest |
Malicious release: Malicious code in 24712-plv2 (npm) MAL-2026-3357 | Malicious | Not scored | 06 May, 2026 | npm 24712-plv2 |
Malicious release: Malicious code in money-badger-open-rpc (npm) GHSA-g6gf-368m-9pvf, MAL-2026-3353 | Malicious | Not scored | 06 May, 2026 | npm money-badger-open-rpc |
Malicious release: Malicious code in carbonite-internal (npm) MAL-2026-3352 | Malicious | Not scored | 06 May, 2026 | npm carbonite-internal |
Malicious release: Malicious code in forge-jsxy (npm) GHSA-hm2h-78wx-fpxp, MAL-2026-3609 | Malicious | Not scored | 06 May, 2026 | npm forge-jsxy |
Malicious release: Malicious code in @rivianlabs/bedrock (npm) MAL-2026-3348 | Malicious | Not scored | 05 May, 2026 | npm @rivianlabs/bedrock |
Malicious release: Malicious code in @rivianlabs/dc-fe-app-web-rivian-com (npm) MAL-2026-3349 | Malicious | Not scored | 05 May, 2026 | npm @rivianlabs/dc-fe-app-web-rivian-com |
Malicious release: Malicious code in @rivianlabs/dt-shop-bag-v0 (npm) MAL-2026-3351 | Malicious | Not scored | 05 May, 2026 | npm @rivianlabs/dt-shop-bag-v0 |
Malicious release: Malicious code in @rivianlabs/dt-lib-lumberjack (npm) MAL-2026-3350 | Malicious | Not scored | 05 May, 2026 | npm @rivianlabs/dt-lib-lumberjack |
Malicious release: Malicious code in deployment-core (npm) GHSA-gjhw-qg2j-wrvm, MAL-2026-3345 | Malicious | Not scored | 05 May, 2026 | npm deployment-core |
Malicious release: Malicious code in generator-go-circleci (npm) GHSA-xw4p-ff39-hmj4, MAL-2026-3346 | Malicious | Not scored | 05 May, 2026 | npm generator-go-circleci |
Malicious release: Malicious code in @bold-commerce/stacks-ui (npm) GHSA-mgm6-933c-v7m5, MAL-2026-3344 | Malicious | Not scored | 05 May, 2026 | npm @bold-commerce/stacks-ui |
Malicious release: Malicious code in @atlan/connectors (npm) GHSA-q5p9-629j-qg9g, MAL-2026-3343 | Malicious | Not scored | 05 May, 2026 | npm @atlan/connectors |
Malicious release: Malicious code in trevlo (npm) GHSA-64f2-864w-556j, MAL-2026-3340 | Malicious | Not scored | 05 May, 2026 | npm trevlo |
Malicious release: Malicious code in nf-ui-components (npm) GHSA-9vr2-f57v-r6r2, MAL-2026-3339 | Malicious | Not scored | 05 May, 2026 | npm nf-ui-components |
Malicious release: Malicious code in fanduel (npm) GHSA-mjhc-2rfg-vh93, MAL-2026-3334 | Malicious | Not scored | 04 May, 2026 | npm fanduel |
Malicious release: Malicious code in lazyhtml-scripts (npm) MAL-2026-3331 | Malicious | Not scored | 04 May, 2026 | npm lazyhtml-scripts |
Malicious release: Malicious code in ms.analytics-web (npm) MAL-2026-3338 | Malicious | Not scored | 04 May, 2026 | npm ms.analytics-web |
Malicious release: Malicious code in api-typings (npm) GHSA-gjx9-hrcc-f6qj, MAL-2026-3329 | Malicious | Not scored | 04 May, 2026 | npm api-typings |
Malicious release: Malicious code in seek-pass (npm) GHSA-q39g-5xh5-89h3, MAL-2026-3330 | Malicious | Not scored | 04 May, 2026 | npm seek-pass |
Malicious release: Malicious code in pocpoc2626 (npm) MAL-2026-3328 | Malicious | Not scored | 04 May, 2026 | npm pocpoc2626 |
Malicious release: Malicious code in capacitor-plugin-service-worker (npm) GHSA-qg5c-9jmq-fpmf, MAL-2026-3327 | Malicious | Not scored | 04 May, 2026 | npm capacitor-plugin-service-worker |
Malicious release: Malicious code in @channel_bot/xa0 (npm) MAL-2026-3336 | Malicious | Not scored | 04 May, 2026 | npm @channel_bot/xa0 |
Malicious release: Malicious code in paychex-common-vendor-lib (npm) GHSA-64fr-896g-cjfw, MAL-2026-3326 | Malicious | Not scored | 04 May, 2026 | npm paychex-common-vendor-lib |
Malicious release: Malicious code in @t-in-one/save_application_hid_to_storage (npm) GHSA-99m3-vc85-ccc3, MAL-2026-3337 | Malicious | Not scored | 04 May, 2026 | npm @t-in-one/save_application_hid_to_storage |
Malicious release: Malicious code in @bank-widgets/whats-new (npm) MAL-2026-3335 | Malicious | Not scored | 04 May, 2026 | npm @bank-widgets/whats-new |
Malicious release: Malicious code in @b2b_blocker/hide_activation_error (npm) GHSA-97mp-8qgq-v82w, MAL-2026-3318 | Malicious | Not scored | 04 May, 2026 | npm @b2b_blocker/hide_activation_error |
Malicious release: Malicious code in @apple-pay-trust/check-apple-pay (npm) GHSA-c3f2-55m6-q284, MAL-2026-3316 | Malicious | Not scored | 04 May, 2026 | npm @apple-pay-trust/check-apple-pay |
Malicious release: Malicious code in @montanatonytest/app.web (npm) GHSA-g938-5928-2j43, MAL-2026-3321 | Malicious | Not scored | 04 May, 2026 | npm @montanatonytest/app.web |
Malicious release: Malicious code in @google-pay-trust/init-google-pay-result (npm) GHSA-mcg4-68w5-qh5p, MAL-2026-3319 | Malicious | Not scored | 04 May, 2026 | npm @google-pay-trust/init-google-pay-result |
Malicious release: Malicious code in @google-pay-trust/start (npm) GHSA-p2m3-4r92-xj4f, MAL-2026-3320 | Malicious | Not scored | 04 May, 2026 | npm @google-pay-trust/start |
Malicious release: Malicious code in @apple-pay-trust/destroy (npm) GHSA-r239-hc6j-wmm8, MAL-2026-3317 | Malicious | Not scored | 04 May, 2026 | npm @apple-pay-trust/destroy |
Malicious release: Malicious code in accesso-angular-cache-buster (npm) GHSA-66qr-2394-v3r3, MAL-2026-3276 | Malicious | Not scored | 04 May, 2026 | npm accesso-angular-cache-buster |
Malicious release: Malicious code in shopify-draggable (npm) GHSA-223c-5fg7-gqmv, MAL-2026-3282 | Malicious | Not scored | 04 May, 2026 | npm shopify-draggable |
Malicious release: Malicious code in tinfoil-shops (npm) GHSA-7p2r-cm6w-w768, MAL-2026-3284 | Malicious | Not scored | 04 May, 2026 | npm tinfoil-shops |
Malicious release: Malicious code in pos-next-react-native (npm) GHSA-9x65-cvfj-9vmq, MAL-2026-3281 | Malicious | Not scored | 04 May, 2026 | npm pos-next-react-native |
Malicious release: Malicious code in temhe-dev (npm) GHSA-f9jj-rhcp-rhf6, MAL-2026-3283 | Malicious | Not scored | 04 May, 2026 | npm temhe-dev |
Malicious release: Malicious code in pi-exa-mcp (npm) GHSA-fpc5-w8c8-3mhv, MAL-2026-3280 | Malicious | Not scored | 04 May, 2026 | npm pi-exa-mcp |
Malicious release: Malicious code in honcho-theme (npm) GHSA-gmrq-2vx2-vm67, MAL-2026-3278 | Malicious | Not scored | 04 May, 2026 | npm honcho-theme |
Malicious release: Malicious code in @kills_sh/bootstrap (npm) GHSA-gxfc-h756-8jpg, MAL-2026-3275 | Malicious | Not scored | 04 May, 2026 | npm @kills_sh/bootstrap |