Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in shizukyu (npm) MAL-2026-4806 | Malicious | Not scored | 26 May, 2026 | npm shizukyu |
Malicious release: Malicious code in wm-idp-sdk (npm) GHSA-hq9q-4jgc-997v, MAL-2026-4808 | Malicious | Not scored | 26 May, 2026 | npm wm-idp-sdk |
Malicious release: Malicious code in react-json-chalk (npm) GHSA-x796-gxxr-pvcr, MAL-2026-4792 | Malicious | Not scored | 26 May, 2026 | npm react-json-chalk |
Malicious release: Malicious code in react-cleaner (npm) MAL-2026-4791 | Malicious | Not scored | 26 May, 2026 | npm react-cleaner |
Malicious release: Malicious code in vxui-react (npm) GHSA-783r-3958-xf8p, MAL-2026-4793 | Malicious | Not scored | 26 May, 2026 | npm vxui-react |
Malicious release: Malicious code in react-ui-polyfills (npm) GHSA-v7mj-pmr3-7x4p, MAL-2026-4784 | Malicious | Not scored | 26 May, 2026 | npm react-ui-polyfills |
pacote is vulnerable to Denial of Service (DoS) via the addGitSha function CVE-2026-9496, GHSA-w4pp-8pjf-rmxw | High | 0.3% | 26 May, 2026 | npm pacote |
@koa/router has an Access Control Bypass CVE-2026-9495, GHSA-47p6-69vm-vw6v | Medium | 0.4% | 26 May, 2026 | npm @koa/router |
Malicious release: Malicious code in test-nonmal-pkg-5 (npm) GHSA-gqhv-x4hg-wqv4, MAL-2026-4785 | Malicious | Not scored | 26 May, 2026 | npm test-nonmal-pkg-5 |
Malicious release: Malicious code in ether-bn.js (npm) GHSA-v3j8-x82x-chvr, MAL-2026-4779 | Malicious | Not scored | 26 May, 2026 | npm ether-bn.js |
Malicious release: Malicious code in reasonix-plugmem (npm) MAL-2026-4780 | Malicious | Not scored | 26 May, 2026 | npm reasonix-plugmem |
Malicious release: Malicious code in unique-id-64 (npm) GHSA-wp6h-8x7v-865g, MAL-2026-4781 | Malicious | Not scored | 26 May, 2026 | npm unique-id-64 |
Malicious release: Malicious code in 1cat-tunnel-client-zx (npm) MAL-2026-4778 | Malicious | Not scored | 26 May, 2026 | npm 1cat-tunnel-client-zx |
Malicious release: Malicious code in testing-on-npmjs (npm) GHSA-4847-p5f9-4366, MAL-2026-4356 | Malicious | Not scored | 26 May, 2026 | npm testing-on-npmjs |
Blitz has a Cross-site Scripting issue CVE-2026-9520, GHSA-h2p9-cr4h-px24 | Low | 0.3% | 26 May, 2026 | npm blitz |
Malicious release: Malicious code in wao (npm) GHSA-hr8w-cxp4-33p7, MAL-2026-4711 | Malicious | Not scored | 26 May, 2026 | npm wao |
Malicious release: Malicious code in weavedb-lite (npm) MAL-2026-4720 | Malicious | Not scored | 26 May, 2026 | npm weavedb-lite |
Malicious release: Malicious code in weavedb-warp-contracts-plugin-deploy (npm) MAL-2026-4727 | Malicious | Not scored | 26 May, 2026 | npm weavedb-warp-contracts-plugin-deploy |
Malicious release: Malicious code in weavedb-console (npm) MAL-2026-4717 | Malicious | Not scored | 26 May, 2026 | npm weavedb-console |
Malicious release: Malicious code in weavedb-sdk-base (npm) MAL-2026-4724 | Malicious | Not scored | 26 May, 2026 | npm weavedb-sdk-base |
Malicious release: Malicious code in weavedb-exm-sdk (npm) MAL-2026-4718 | Malicious | Not scored | 26 May, 2026 | npm weavedb-exm-sdk |
Malicious release: Malicious code in arnext-arkb (npm) MAL-2026-4483 | Malicious | Not scored | 26 May, 2026 | npm arnext-arkb |
Malicious release: Malicious code in create-arnext-app (npm) MAL-2026-4538 | Malicious | Not scored | 26 May, 2026 | npm create-arnext-app |
Malicious release: Malicious code in roidjs (npm) MAL-2026-4663 | Malicious | Not scored | 26 May, 2026 | npm roidjs |
Malicious release: Malicious code in test-weavedb-sdk (npm) MAL-2026-4690 | Malicious | Not scored | 26 May, 2026 | npm test-weavedb-sdk |
Malicious release: Malicious code in arnext (npm) MAL-2026-4482 | Malicious | Not scored | 26 May, 2026 | npm arnext |
Malicious release: Malicious code in weavedb-client (npm) GHSA-6fj3-894w-h3x9, MAL-2026-4716 | Malicious | Not scored | 26 May, 2026 | npm weavedb-client |
Malicious release: Malicious code in atomic-notes (npm) MAL-2026-4486 | Malicious | Not scored | 26 May, 2026 | npm atomic-notes |
Malicious release: Malicious code in weavedb-offchain (npm) GHSA-pxrc-4fpx-c74r, MAL-2026-4722 | Malicious | Not scored | 26 May, 2026 | npm weavedb-offchain |
Malicious release: Malicious code in ai3 (npm) MAL-2026-4476 | Malicious | Not scored | 26 May, 2026 | npm ai3 |
Malicious release: Malicious code in cwao-units (npm) GHSA-36rh-p4hx-qrr8, MAL-2026-4546 | Malicious | Not scored | 26 May, 2026 | npm cwao-units |
Malicious release: Malicious code in weavedb-exm-sdk-web (npm) MAL-2026-4719 | Malicious | Not scored | 26 May, 2026 | npm weavedb-exm-sdk-web |
Malicious release: Malicious code in weavedb-tools (npm) MAL-2026-4726 | Malicious | Not scored | 26 May, 2026 | npm weavedb-tools |
Malicious release: Malicious code in fpjson-lang (npm) GHSA-vhjh-rmpr-mcqm, MAL-2026-4566 | Malicious | Not scored | 26 May, 2026 | npm fpjson-lang |
Malicious release: Malicious code in wdb-sdk (npm) MAL-2026-4714 | Malicious | Not scored | 26 May, 2026 | npm wdb-sdk |
Malicious release: Malicious code in monade (npm) MAL-2026-4613 | Malicious | Not scored | 26 May, 2026 | npm monade |
Malicious release: Malicious code in wdb-cli (npm) MAL-2026-4713 | Malicious | Not scored | 26 May, 2026 | npm wdb-cli |
Malicious release: Malicious code in cwao-tools (npm) MAL-2026-4545 | Malicious | Not scored | 26 May, 2026 | npm cwao-tools |
Malicious release: Malicious code in warp-contracts-plugin-deploy-test (npm) MAL-2026-4712 | Malicious | Not scored | 26 May, 2026 | npm warp-contracts-plugin-deploy-test |
Malicious release: Malicious code in testnpmnmp (npm) MAL-2026-4691 | Malicious | Not scored | 26 May, 2026 | npm testnpmnmp |
Malicious release: Malicious code in cwao (npm) MAL-2026-4544 | Malicious | Not scored | 26 May, 2026 | npm cwao |
Malicious release: Malicious code in test-ajs (npm) MAL-2026-4689 | Malicious | Not scored | 26 May, 2026 | npm test-ajs |
Malicious release: Malicious code in zkjson (npm) MAL-2026-4739 | Malicious | Not scored | 26 May, 2026 | npm zkjson |
Malicious release: Malicious code in aonote (npm) MAL-2026-4480 | Malicious | Not scored | 26 May, 2026 | npm aonote |
Malicious release: Malicious code in weavedb-sdk (npm) MAL-2026-4723 | Malicious | Not scored | 26 May, 2026 | npm weavedb-sdk |
Malicious release: Malicious code in weavedb-base (npm) GHSA-xj9g-9ff6-g755, MAL-2026-4715 | Malicious | Not scored | 26 May, 2026 | npm weavedb-base |
Malicious release: Malicious code in weavedb-node-client (npm) GHSA-94x8-wq6v-6gwp, MAL-2026-4721 | Malicious | Not scored | 26 May, 2026 | npm weavedb-node-client |
Malicious release: Malicious code in weavedb-sdk-node (npm) MAL-2026-4725 | Malicious | Not scored | 26 May, 2026 | npm weavedb-sdk-node |
Malicious release: Malicious code in fe-utils-core (npm) GHSA-8xf7-7m4f-fgrv, MAL-2026-4561 | Malicious | Not scored | 26 May, 2026 | npm fe-utils-core |
Malicious release: Malicious code in bandkit (npm) GHSA-v69f-q3vh-9qcf, MAL-2026-4496 | Malicious | Not scored | 25 May, 2026 | npm bandkit |