Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in sparkling-sdk (npm) GHSA-hw2r-2jh6-9mqr, MAL-2026-2996 | Malicious | Not scored | 22 Apr, 2026 | npm sparkling-sdk |
Malicious release: Malicious code in color-studio (npm) GHSA-qcph-mvf5-hgf2, MAL-2026-2995 | Malicious | Not scored | 22 Apr, 2026 | npm color-studio |
Malicious release: Malicious code in @openwebconcept/design-tokens (npm) GHSA-gj25-264w-qww3, MAL-2026-2993 | Malicious | Not scored | 22 Apr, 2026 | npm @openwebconcept/design-tokens |
Malicious release: Malicious code in @openwebconcept/theme-owc (npm) GHSA-wqjr-fc46-m68m, MAL-2026-2994 | Malicious | Not scored | 22 Apr, 2026 | npm @openwebconcept/theme-owc |
Malicious release: Malicious code in @automagik/genie (npm) GHSA-ppw4-42v6-538v, MAL-2026-2992 | Malicious | Not scored | 22 Apr, 2026 | npm @automagik/genie |
Malicious release: Malicious code in pgserve (npm) GHSA-v892-cmx2-hjq8, MAL-2026-2991 | Malicious | Not scored | 22 Apr, 2026 | npm pgserve |
Malicious release: Malicious code in @bmg-web/bmg-dialog (npm) MAL-2026-2985 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-dialog |
Malicious release: Malicious code in @bmg-web/bmg-checkbox (npm) MAL-2026-2983 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-checkbox |
Malicious release: Malicious code in etsyapp (npm) MAL-2026-2990 | Malicious | Not scored | 22 Apr, 2026 | npm etsyapp |
Malicious release: Malicious code in @bmg-web/bmg-collapse (npm) MAL-2026-2984 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-collapse |
Malicious release: Malicious code in @bmg-web/bmg-grid (npm) MAL-2026-2988 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-grid |
Malicious release: Malicious code in @bmg-web/bmg-button (npm) MAL-2026-2981 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-button |
Malicious release: Malicious code in @bmg-web/bmg-dropdown (npm) MAL-2026-2986 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-dropdown |
Malicious release: Malicious code in @bmg-web/bmg-ajax (npm) MAL-2026-2980 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-ajax |
Malicious release: Malicious code in @bmg-web-features/bmg-user-interaction-tracker (npm) MAL-2026-2989 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web-features/bmg-user-interaction-tracker |
Malicious release: Malicious code in @bmg-web/bmg-card (npm) MAL-2026-2982 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-card |
Malicious release: Malicious code in @bmg-web/bmg-external-link (npm) MAL-2026-2987 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-external-link |
Malicious release: Malicious code in tsdoc-build-rig (npm) MAL-2026-2979 | Malicious | Not scored | 22 Apr, 2026 | npm tsdoc-build-rig |
Malicious release: Malicious code in @oec-settlement/react-router (npm) GHSA-qqc6-xp57-98h7, MAL-2026-2978 | Malicious | Not scored | 22 Apr, 2026 | npm @oec-settlement/react-router |
Malicious release: Malicious code in crypto-keccak-js (npm) GHSA-gqj4-7gpv-6w6w, MAL-2026-2975 | Malicious | Not scored | 22 Apr, 2026 | npm crypto-keccak-js |
Malicious release: Malicious code in gleb-js (npm) GHSA-gxf7-922p-wp6q, MAL-2026-2976 | Malicious | Not scored | 22 Apr, 2026 | npm gleb-js |
Malicious release: Malicious code in ts-utils-dev (npm) GHSA-p95c-73jf-8362, MAL-2026-2977 | Malicious | Not scored | 22 Apr, 2026 | npm ts-utils-dev |
Malicious release: Malicious code in claudcode-mcp (npm) GHSA-5v3x-g9r5-vvhg, MAL-2026-2974 | Malicious | Not scored | 22 Apr, 2026 | npm claudcode-mcp |
Malicious release: Malicious code in claudcode-cli (npm) GHSA-65j6-qgfm-6486, MAL-2026-2973 | Malicious | Not scored | 22 Apr, 2026 | npm claudcode-cli |
Malicious release: Malicious code in @usealloy/component-library (npm) GHSA-4g37-2m9h-2w95, MAL-2026-2970 | Malicious | Not scored | 22 Apr, 2026 | npm @usealloy/component-library |
Malicious release: Malicious code in @usealloy/api-contract (npm) GHSA-733p-5g7w-hh7w, MAL-2026-2969 | Malicious | Not scored | 22 Apr, 2026 | npm @usealloy/api-contract |
Malicious release: Malicious code in @bitunix/test (npm) GHSA-mhwj-ggc3-5228, MAL-2026-2968 | Malicious | Not scored | 22 Apr, 2026 | npm @bitunix/test |
Malicious release: Malicious code in @usealloy/typegen (npm) GHSA-qmfv-9964-cvf2, MAL-2026-2971 | Malicious | Not scored | 22 Apr, 2026 | npm @usealloy/typegen |
Malicious release: Malicious code in aven_types (npm) GHSA-r8xm-rx8q-xmr3, MAL-2026-2972 | Malicious | Not scored | 22 Apr, 2026 | npm aven_types |
Malicious release: Malicious code in 6161test1234 (npm) GHSA-r9qx-xcg2-7wcc, MAL-2026-2967 | Malicious | Not scored | 21 Apr, 2026 | npm 6161test1234 |
Malicious release: Malicious code in com.tencent.puerts.agent (npm) GHSA-xjh5-rr2q-3382, MAL-2026-2966 | Malicious | Not scored | 21 Apr, 2026 | npm com.tencent.puerts.agent |
Malicious release: Malicious code in apple-internal-security-poc-frank (npm) GHSA-84p7-7qvg-vhvf, MAL-2026-2961 | Malicious | Not scored | 21 Apr, 2026 | npm apple-internal-security-poc-frank |
Malicious release: Malicious code in apple-auth-internal (npm) GHSA-m39f-fr86-j7f7, MAL-2026-2960 | Malicious | Not scored | 21 Apr, 2026 | npm apple-auth-internal |
Malicious release: Malicious code in @serasa/core (npm) GHSA-w2qv-ff75-53mf, MAL-2026-2956 | Malicious | Not scored | 20 Apr, 2026 | npm @serasa/core |
Malicious release: Malicious code in @settle-sea/supporting-documents (npm) GHSA-f375-927m-428g, MAL-2026-2952 | Malicious | Not scored | 20 Apr, 2026 | npm @settle-sea/supporting-documents |
Malicious release: Malicious code in bmg-web-features (npm) MAL-2026-2954 | Malicious | Not scored | 20 Apr, 2026 | npm bmg-web-features |
Malicious release: Malicious code in bmg-web (npm) MAL-2026-2953 | Malicious | Not scored | 20 Apr, 2026 | npm bmg-web |
Malicious release: Malicious code in megabank-worklist (npm) MAL-2026-2955 | Malicious | Not scored | 20 Apr, 2026 | npm megabank-worklist |
Malicious release: Malicious code in internal_insights_enabled (npm) GHSA-7xx2-cw9j-xjgc, MAL-2026-2959 | Malicious | Not scored | 20 Apr, 2026 | npm internal_insights_enabled |
Malicious release: Malicious code in hifromhere1 (npm) MAL-2026-2951 | Malicious | Not scored | 20 Apr, 2026 | npm hifromhere1 |
Malicious release: Malicious code in tailwind-text-fill (npm) GHSA-xxgm-722g-xhwg, MAL-2026-2950 | Malicious | Not scored | 20 Apr, 2026 | npm tailwind-text-fill |
Malicious release: Malicious code in npm-doc-deploy (npm) GHSA-3h77-7q59-chhp, MAL-2026-2941 | Malicious | Not scored | 20 Apr, 2026 | npm npm-doc-deploy |
Malicious release: Malicious code in bignum-ts-v2 (npm) GHSA-m7pg-7qqx-66f5, MAL-2026-2938 | Malicious | Not scored | 20 Apr, 2026 | npm bignum-ts-v2 |
Malicious release: Malicious code in @tushar-br/editing-pack (npm) GHSA-7wjj-mwx4-cxx5, MAL-2026-2936 | Malicious | Not scored | 20 Apr, 2026 | npm @tushar-br/editing-pack |
Malicious release: Malicious code in @tushar-br/desktop (npm) GHSA-crxh-425q-78hj, MAL-2026-2935 | Malicious | Not scored | 20 Apr, 2026 | npm @tushar-br/desktop |
Malicious release: Malicious code in @tushar-br/file11 (npm) GHSA-mxxq-gg42-8p97, MAL-2026-2937 | Malicious | Not scored | 20 Apr, 2026 | npm @tushar-br/file11 |
Malicious release: Malicious code in krdfonts (npm) GHSA-vj4v-6qjg-33v7, MAL-2026-2939 | Malicious | Not scored | 20 Apr, 2026 | npm krdfonts |
Malicious release: Malicious code in @otaxayuns/baileys (npm) GHSA-4vx6-qhj8-f6cr, MAL-2026-2934 | Malicious | Not scored | 20 Apr, 2026 | npm @otaxayuns/baileys |
Malicious release: Malicious code in turbo-he (npm) GHSA-6xh4-h79w-9w2q, MAL-2026-2943 | Malicious | Not scored | 20 Apr, 2026 | npm turbo-he |
Malicious release: Malicious code in optimized-fastest-levenshtein (npm) GHSA-cwvx-mmxj-v8ww, MAL-2026-2942 | Malicious | Not scored | 20 Apr, 2026 | npm optimized-fastest-levenshtein |