Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in mailcraftjs (npm) GHSA-vq82-2629-gfqq, MAL-2026-2940 | Malicious | Not scored | 20 Apr, 2026 | npm mailcraftjs |
Malicious release: Malicious code in turbo-leven (npm) GHSA-w2j4-whh4-rr63, MAL-2026-2944 | Malicious | Not scored | 20 Apr, 2026 | npm turbo-leven |
Malicious release: Malicious code in @kjma/mailcraft (npm) GHSA-xf6v-jvfc-m994, MAL-2026-2933 | Malicious | Not scored | 20 Apr, 2026 | npm @kjma/mailcraft |
Malicious release: Malicious code in chandan-module-test (npm) MAL-2026-2921 | Malicious | Not scored | 19 Apr, 2026 | npm chandan-module-test |
Malicious release: Malicious code in pa-marked-internal (npm) MAL-2026-2928 | Malicious | Not scored | 19 Apr, 2026 | npm pa-marked-internal |
Malicious release: Malicious code in react-spa-shadcn (npm) GHSA-c6cr-p8wf-qmjh, MAL-2026-2931 | Malicious | Not scored | 19 Apr, 2026 | npm react-spa-shadcn |
Malicious release: Malicious code in pa-marked (npm) MAL-2026-2927 | Malicious | Not scored | 19 Apr, 2026 | npm pa-marked |
Malicious release: Malicious code in rtms-manager (npm) GHSA-5cq2-xfqr-cmvg, MAL-2026-2862 | Malicious | Not scored | 19 Apr, 2026 | npm rtms-manager |
Malicious release: Malicious code in vinext-monorepo (npm) MAL-2026-2861 | Malicious | Not scored | 19 Apr, 2026 | npm vinext-monorepo |
Malicious release: Malicious code in sy-editor-v3 (npm) MAL-2026-2932 | Malicious | Not scored | 19 Apr, 2026 | npm sy-editor-v3 |
Malicious release: Malicious code in @shoobx/types (npm) GHSA-9jhq-mjgj-698m, MAL-2026-2857 | Malicious | Not scored | 18 Apr, 2026 | npm @shoobx/types |
Malicious release: Malicious code in @source-row/source-container (npm) GHSA-x8p5-jmxq-hp52, MAL-2026-2858 | Malicious | Not scored | 18 Apr, 2026 | npm @source-row/source-container |
Malicious release: Malicious code in @ataslkit/profilecard (npm) GHSA-3m34-94wv-xw5q, MAL-2026-2856 | Malicious | Not scored | 18 Apr, 2026 | npm @ataslkit/profilecard |
Malicious release: Malicious code in react-resource-router-next (npm) GHSA-7hgr-34h5-w2m5, MAL-2026-2855 | Malicious | Not scored | 18 Apr, 2026 | npm react-resource-router-next |
Malicious release: Malicious code in cktool.core.internal (npm) GHSA-52g9-vwwf-5wm4, MAL-2026-2924 | Malicious | Not scored | 18 Apr, 2026 | npm cktool.core.internal |
Malicious release: Malicious code in cktool.config (npm) GHSA-2rgm-r9mf-qcvf, MAL-2026-2923 | Malicious | Not scored | 18 Apr, 2026 | npm cktool.config |
Malicious release: Malicious code in cktool.api (npm) GHSA-82v9-v4pr-3fv5, MAL-2026-2922 | Malicious | Not scored | 18 Apr, 2026 | npm cktool.api |
Malicious release: Malicious code in cktool.internal (npm) GHSA-49vv-fr4f-qphw, MAL-2026-2925 | Malicious | Not scored | 18 Apr, 2026 | npm cktool.internal |
Malicious release: Malicious code in apple-idms-internal (npm) GHSA-x7r7-7xmr-4v2x, MAL-2026-2919 | Malicious | Not scored | 18 Apr, 2026 | npm apple-idms-internal |
Malicious release: Malicious code in apple-cloudkit-internal (npm) GHSA-phc7-xwvq-32mh, MAL-2026-2918 | Malicious | Not scored | 18 Apr, 2026 | npm apple-cloudkit-internal |
Malicious release: Malicious code in react-hook-form (npm) GHSA-w8j3-qvc3-h56f, MAL-2026-2853 | Malicious | Not scored | 18 Apr, 2026 | npm react-hook-form |
Malicious release: Malicious code in ac-sasskit-internal (npm) GHSA-cxqq-9fj8-v9x8, MAL-2026-2917 | Malicious | Not scored | 18 Apr, 2026 | npm ac-sasskit-internal |
Malicious release: Malicious code in material-ui-plugin-cache-endpoint (npm) GHSA-gcvj-xqr7-rc54, MAL-2026-2926 | Malicious | Not scored | 17 Apr, 2026 | npm material-ui-plugin-cache-endpoint |
Malicious release: Malicious code in @indriver-poc/whisperwind (npm) MAL-2026-2851 | Malicious | Not scored | 17 Apr, 2026 | npm @indriver-poc/whisperwind |
Malicious release: Malicious code in value-slider (npm) GHSA-h8m3-pcfp-2jpw, MAL-2026-2850 | Malicious | Not scored | 17 Apr, 2026 | npm value-slider |
Malicious release: Malicious code in @than-xs/libsignal-node (npm) GHSA-5gf4-hf7c-gxxp, MAL-2026-2848 | Malicious | Not scored | 17 Apr, 2026 | npm @than-xs/libsignal-node |
Malicious release: Malicious code in @than1st/baileys (npm) GHSA-hcw6-3v33-4gw3, MAL-2026-2849 | Malicious | Not scored | 17 Apr, 2026 | npm @than1st/baileys |
Malicious release: Malicious code in eslint-plugin-totara (npm) GHSA-gvr8-64fv-6p2h, MAL-2026-2846 | Malicious | Not scored | 17 Apr, 2026 | npm eslint-plugin-totara |
Malicious release: Malicious code in node-red-contrib-yolo-object-detection (npm) GHSA-rxwg-h367-5qgm, MAL-2026-2845 | Malicious | Not scored | 17 Apr, 2026 | npm node-red-contrib-yolo-object-detection |
Malicious release: Malicious code in koa-v3 (npm) GHSA-975w-34c4-77hm, MAL-2026-2838 | Malicious | Not scored | 17 Apr, 2026 | npm koa-v3 |
Malicious release: Malicious code in express-security-policy (npm) GHSA-3hxc-wppf-m25r, MAL-2026-2828 | Malicious | Not scored | 17 Apr, 2026 | npm express-security-policy |
Malicious release: Malicious code in renovate-config-doctolib (npm) GHSA-8327-2h3c-rm8g, MAL-2026-2830 | Malicious | Not scored | 17 Apr, 2026 | npm renovate-config-doctolib |
Malicious release: Malicious code in paddle-internal-scripts (npm) MAL-2026-2829 | Malicious | Not scored | 17 Apr, 2026 | npm paddle-internal-scripts |
Malicious release: Malicious code in ing-web-v5 (npm) GHSA-5c9h-x827-2v9f, MAL-2026-2822 | Malicious | Not scored | 17 Apr, 2026 | npm ing-web-v5 |
Malicious release: Malicious code in chai-as-ide (npm) GHSA-53p3-r84h-8pj3, MAL-2026-2890 | Malicious | Not scored | 16 Apr, 2026 | npm chai-as-ide |
Malicious release: Malicious code in chai-as-init (npm) GHSA-7cq2-px9f-cq3g, MAL-2026-2891 | Malicious | Not scored | 16 Apr, 2026 | npm chai-as-init |
Malicious release: Malicious code in chai-as-optimized (npm) GHSA-g99c-rjxw-f6jg, MAL-2026-2895 | Malicious | Not scored | 16 Apr, 2026 | npm chai-as-optimized |
Malicious release: Malicious code in lightweight-charts-4.1 (npm) MAL-2026-2817 | Malicious | Not scored | 16 Apr, 2026 | npm lightweight-charts-4.1 |
Malicious release: Malicious code in modern-events (npm) GHSA-wwr2-883g-52c2, MAL-2026-2914 | Malicious | Not scored | 16 Apr, 2026 | npm modern-events |
Malicious release: Malicious code in sanitize-url (npm) MAL-2026-2701 | Malicious | Not scored | 16 Apr, 2026 | npm sanitize-url |
Malicious release: Malicious code in conventional-changelog-dash (npm) MAL-2026-2700 | Malicious | Not scored | 16 Apr, 2026 | npm conventional-changelog-dash |
Malicious release: Malicious code in youpin (npm) MAL-2026-2806 | Malicious | Not scored | 16 Apr, 2026 | npm youpin |
Malicious release: Malicious code in winston-prisma (npm) MAL-2026-2805 | Malicious | Not scored | 16 Apr, 2026 | npm winston-prisma |
Malicious release: Malicious code in transcript-viewer-ui-demo (npm) MAL-2026-2804 | Malicious | Not scored | 16 Apr, 2026 | npm transcript-viewer-ui-demo |
Malicious release: Malicious code in tailwind-configuration (npm) MAL-2026-2803 | Malicious | Not scored | 16 Apr, 2026 | npm tailwind-configuration |
Malicious release: Malicious code in synthetics-sdk-node (npm) MAL-2026-2802 | Malicious | Not scored | 16 Apr, 2026 | npm synthetics-sdk-node |
Malicious release: Malicious code in sfx-data (npm) MAL-2026-2801 | Malicious | Not scored | 16 Apr, 2026 | npm sfx-data |
Malicious release: Malicious code in separadordeinfo (npm) MAL-2026-2800 | Malicious | Not scored | 16 Apr, 2026 | npm separadordeinfo |
Malicious release: Malicious code in rtxaspnet (npm) MAL-2026-2799 | Malicious | Not scored | 16 Apr, 2026 | npm rtxaspnet |
Malicious release: Malicious code in request-easy-validator (npm) GHSA-6h5g-9vvm-x5jj, MAL-2026-2798 | Malicious | Not scored | 16 Apr, 2026 | npm request-easy-validator |