Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @apple-pay-trust/validate-merchant (npm) GHSA-wqf2-mrc2-r8j3, MAL-2026-3055 | Malicious | Not scored | 25 Apr, 2026 | npm @apple-pay-trust/validate-merchant |
Malicious release: Malicious code in apollo-vertex (npm) GHSA-ch5h-3gj9-4r8q, MAL-2026-3040 | Malicious | Not scored | 25 Apr, 2026 | npm apollo-vertex |
Malicious release: Malicious code in apollo-landing (npm) GHSA-9qp9-qwfr-p72c, MAL-2026-3038 | Malicious | Not scored | 25 Apr, 2026 | npm apollo-landing |
Malicious release: Malicious code in process-app-task (npm) GHSA-388h-jcvw-5634, MAL-2026-3039 | Malicious | Not scored | 25 Apr, 2026 | npm process-app-task |
Malicious release: Malicious code in @tw-models/storage (npm) GHSA-qr4v-hj88-g7j6, MAL-2026-3072 | Malicious | Not scored | 25 Apr, 2026 | npm @tw-models/storage |
Malicious release: Malicious code in @tw-marionette/input (npm) GHSA-584r-4qf7-jqf3, MAL-2026-3071 | Malicious | Not scored | 25 Apr, 2026 | npm @tw-marionette/input |
Malicious release: Malicious code in @tw-utils/static (npm) GHSA-v3mw-r645-qc2r, MAL-2026-3073 | Malicious | Not scored | 25 Apr, 2026 | npm @tw-utils/static |
Malicious release: Malicious code in standalone-apps (npm) GHSA-9whf-2j26-8mhh, MAL-2026-3037 | Malicious | Not scored | 25 Apr, 2026 | npm standalone-apps |
Malicious release: Malicious code in uipath-ui-widgets (npm) GHSA-x45w-938v-6p65, MAL-2026-3036 | Malicious | Not scored | 25 Apr, 2026 | npm uipath-ui-widgets |
Malicious release: Malicious code in kl-b2c-ui-kit (npm) GHSA-jwhp-97gv-chg5, MAL-2026-3082 | Malicious | Not scored | 25 Apr, 2026 | npm kl-b2c-ui-kit |
Malicious release: Malicious code in @sbt_gitverse/analytics-client (npm) GHSA-q9xj-mpqj-qpcc, MAL-2026-3068 | Malicious | Not scored | 25 Apr, 2026 | npm @sbt_gitverse/analytics-client |
Malicious release: Malicious code in tether-base (npm) GHSA-gwg8-p6mg-cp7g, MAL-2026-3033 | Malicious | Not scored | 25 Apr, 2026 | npm tether-base |
Malicious release: Malicious code in axis-ui-generator (npm) MAL-2026-3079 | Malicious | Not scored | 25 Apr, 2026 | npm axis-ui-generator |
Malicious release: Malicious code in axis-abc-search-address (npm) GHSA-r78p-pprh-8hvp, MAL-2026-3076 | Malicious | Not scored | 25 Apr, 2026 | npm axis-abc-search-address |
Malicious release: Malicious code in axis-abc-portal-menu (npm) MAL-2026-3074 | Malicious | Not scored | 25 Apr, 2026 | npm axis-abc-portal-menu |
Malicious release: Malicious code in axis-abc-search-account (npm) GHSA-q53f-j5w8-x7vh, MAL-2026-3075 | Malicious | Not scored | 25 Apr, 2026 | npm axis-abc-search-account |
Malicious release: Malicious code in axis-notification (npm) GHSA-2fp7-j74x-chvv, MAL-2026-3078 | Malicious | Not scored | 25 Apr, 2026 | npm axis-notification |
Malicious release: Malicious code in axis-charts (npm) MAL-2026-3077 | Malicious | Not scored | 25 Apr, 2026 | npm axis-charts |
Malicious release: Malicious code in js-component-explorer (npm) MAL-2026-3032 | Malicious | Not scored | 25 Apr, 2026 | npm js-component-explorer |
Malicious release: Malicious code in @tochka-ui/foundation (npm) GHSA-hf3j-mx5g-jc8r, MAL-2026-3069 | Malicious | Not scored | 24 Apr, 2026 | npm @tochka-ui/foundation |
Malicious release: Malicious code in @frengki0707/google-cloud-clone (npm) MAL-2026-3060 | Malicious | Not scored | 24 Apr, 2026 | npm @frengki0707/google-cloud-clone |
Malicious release: Malicious code in @alfa.life.mapp/app.web (npm) GHSA-68cm-x784-c9gw, MAL-2026-3052 | Malicious | Not scored | 24 Apr, 2026 | npm @alfa.life.mapp/app.web |
Malicious release: Malicious code in @m0ntana/app.web (npm) GHSA-m6jr-4x3f-2ph2, MAL-2026-3065 | Malicious | Not scored | 24 Apr, 2026 | npm @m0ntana/app.web |
Malicious release: Malicious code in model-poc-suhail (npm) GHSA-cpqg-wgv2-g29r, MAL-2026-3030 | Malicious | Not scored | 24 Apr, 2026 | npm model-poc-suhail |
Malicious release: Malicious code in auth0-ui-components-docs (npm) GHSA-78cj-64p5-2wh5, MAL-2026-3024 | Malicious | Not scored | 24 Apr, 2026 | npm auth0-ui-components-docs |
Malicious release: Malicious code in next-rwa (npm) GHSA-qr67-r552-v99q, MAL-2026-3025 | Malicious | Not scored | 24 Apr, 2026 | npm next-rwa |
Malicious release: Malicious code in wrapped-logger-utils (npm) GHSA-wm52-75j2-vmr3, MAL-2026-3027 | Malicious | Not scored | 24 Apr, 2026 | npm wrapped-logger-utils |
Malicious release: Malicious code in sagat-core (npm) GHSA-53hj-4c4g-2wqq, MAL-2026-3026 | Malicious | Not scored | 24 Apr, 2026 | npm sagat-core |
Malicious release: Malicious code in amplitude-ma-ts (npm) GHSA-987f-7782-4mjj, MAL-2026-3028 | Malicious | Not scored | 24 Apr, 2026 | npm amplitude-ma-ts |
Malicious release: Malicious code in lightspark-js (npm) MAL-2026-3021 | Malicious | Not scored | 23 Apr, 2026 | npm lightspark-js |
Malicious release: Malicious code in @bitwarden/cli (npm) GHSA-g98r-qjhg-4fmr, MAL-2026-3020 | Malicious | Not scored | 23 Apr, 2026 | npm @bitwarden/cli |
Malicious release: Malicious code in microsoft-employee-experience (npm) MAL-2026-3018 | Malicious | Not scored | 23 Apr, 2026 | npm microsoft-employee-experience |
Malicious release: Malicious code in hls.js (npm) GHSA-pq9g-f2rr-m4hw, MAL-2026-3019 | Malicious | Not scored | 23 Apr, 2026 | npm hls.js |
Malicious release: Malicious code in react-spa-npm (npm) GHSA-5w76-h44f-4xfp, MAL-2026-3017 | Malicious | Not scored | 23 Apr, 2026 | npm react-spa-npm |
Malicious release: Malicious code in amazon-q-developer-streaming-client (npm) MAL-2026-3016 | Malicious | Not scored | 23 Apr, 2026 | npm amazon-q-developer-streaming-client |
Malicious release: Malicious code in eth-logger (npm) GHSA-fxxj-hw8x-wvvh, MAL-2026-3029 | Malicious | Not scored | 23 Apr, 2026 | npm eth-logger |
Malicious release: Malicious code in json-dec (npm) GHSA-3wh6-59mv-jpvw, MAL-2026-3007 | Malicious | Not scored | 23 Apr, 2026 | npm json-dec |
Malicious release: Malicious code in json-spacer (npm) GHSA-hp4j-fxr5-4x88, MAL-2026-3008 | Malicious | Not scored | 23 Apr, 2026 | npm json-spacer |
Malicious release: Malicious code in changelog-cli-logger (npm) GHSA-43cm-q339-rpw7, MAL-2026-3005 | Malicious | Not scored | 23 Apr, 2026 | npm changelog-cli-logger |
Malicious release: Malicious code in changelog-utils-structured-logger (npm) GHSA-668m-2g35-3g72, MAL-2026-3006 | Malicious | Not scored | 23 Apr, 2026 | npm changelog-utils-structured-logger |
Malicious release: Malicious code in @nklkas/hyperliquid (npm) GHSA-p9qm-9r6f-v25r, MAL-2026-3004 | Malicious | Not scored | 23 Apr, 2026 | npm @nklkas/hyperliquid |
Malicious release: Malicious code in undicy-http (npm) GHSA-26cf-6cvr-mv4x, MAL-2026-3013 | Malicious | Not scored | 23 Apr, 2026 | npm undicy-http |
Malicious release: Malicious code in separadordeinfocc (npm) GHSA-8p9h-5jx3-gx7v, MAL-2026-3010 | Malicious | Not scored | 23 Apr, 2026 | npm separadordeinfocc |
Malicious release: Malicious code in vime-azl (npm) GHSA-3r8p-pjjh-h967, MAL-2026-3014 | Malicious | Not scored | 23 Apr, 2026 | npm vime-azl |
Malicious release: Malicious code in ts-bing (npm) GHSA-8fcp-g97g-6pwj, MAL-2026-3011 | Malicious | Not scored | 23 Apr, 2026 | npm ts-bing |
Malicious release: Malicious code in rollup-plugin-polyfill-route (npm) GHSA-9f4f-7957-69m9, MAL-2026-3009 | Malicious | Not scored | 23 Apr, 2026 | npm rollup-plugin-polyfill-route |
Malicious release: Malicious code in @amsterdam-local/forms-component-library (npm) GHSA-7w6c-9hfw-6385, MAL-2026-3003 | Malicious | Not scored | 23 Apr, 2026 | npm @amsterdam-local/forms-component-library |
Malicious release: Malicious code in ts-moduler (npm) GHSA-mq2j-jgm4-q5vv, MAL-2026-3012 | Malicious | Not scored | 23 Apr, 2026 | npm ts-moduler |
Malicious release: Malicious code in @spinstorm/shared (npm) MAL-2026-2998 | Malicious | Not scored | 22 Apr, 2026 | npm @spinstorm/shared |
Malicious release: Malicious code in @stlm/common-ui (npm) GHSA-694m-qj2w-cp8j, MAL-2026-2997 | Malicious | Not scored | 22 Apr, 2026 | npm @stlm/common-ui |