Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in intl-ads (npm) MAL-2026-4587 | Malicious | Not scored | 25 May, 2026 | npm intl-ads |
Malicious release: Malicious code in tempo-shared-modules (npm) MAL-2026-4688 | Malicious | Not scored | 25 May, 2026 | npm tempo-shared-modules |
Malicious release: Malicious code in intl-ad-routing (npm) MAL-2026-4586 | Malicious | Not scored | 25 May, 2026 | npm intl-ad-routing |
Malicious release: Malicious code in tempo-layout (npm) MAL-2026-4686 | Malicious | Not scored | 25 May, 2026 | npm tempo-layout |
Malicious release: Malicious code in itc-actors-api (npm) GHSA-w2fv-53fr-6qwg, MAL-2026-4589 | Malicious | Not scored | 25 May, 2026 | npm itc-actors-api |
Malicious release: Malicious code in claude-channel-imessage (npm) GHSA-6v88-cxrw-54h7, MAL-2026-4523 | Malicious | Not scored | 25 May, 2026 | npm claude-channel-imessage |
Malicious release: Malicious code in emojifancy-print (npm) GHSA-46c9-x7v7-2g5h, MAL-2026-4550 | Malicious | Not scored | 25 May, 2026 | npm emojifancy-print |
Malicious release: Malicious code in clobprice.api (npm) MAL-2026-4350 | Malicious | Not scored | 25 May, 2026 | npm clobprice.api |
Malicious release: Malicious code in clob.api (npm) MAL-2026-4349 | Malicious | Not scored | 25 May, 2026 | npm clob.api |
Malicious release: Malicious code in @devcarron/clob (npm) MAL-2026-4347 | Malicious | Not scored | 25 May, 2026 | npm @devcarron/clob |
Malicious release: Malicious code in muaddib-scanner (npm) MAL-2026-4616 | Malicious | Not scored | 25 May, 2026 | npm muaddib-scanner |
Malicious release: Malicious code in auth-basic-vault (npm) GHSA-mw3r-368h-vrgv, MAL-2026-4488 | Malicious | Not scored | 25 May, 2026 | npm auth-basic-vault |
Malicious release: Malicious code in msc-terminal (npm) MAL-2026-4823 | Malicious | Not scored | 25 May, 2026 | npm msc-terminal |
Malicious release: Malicious code in authcascade (npm) GHSA-fx94-j779-7c6j, MAL-2026-4491 | Malicious | Not scored | 25 May, 2026 | npm authcascade |
Malicious release: Malicious code in raise-common-lib (npm) MAL-2026-4656 | Malicious | Not scored | 25 May, 2026 | npm raise-common-lib |
Malicious release: Malicious code in chai-as-patch (npm) MAL-2026-4511 | Malicious | Not scored | 25 May, 2026 | npm chai-as-patch |
Malicious release: Malicious code in jules-standard (npm) GHSA-6pxr-857g-mr97, MAL-2026-4317 | Malicious | Not scored | 25 May, 2026 | npm jules-standard |
Malicious release: Malicious code in ts-stream-compose (npm) GHSA-jp5r-76w9-2rvh, MAL-2026-4330 | Malicious | Not scored | 25 May, 2026 | npm ts-stream-compose |
Malicious release: Malicious code in @gbrlxvii/ts-env-validator (npm) GHSA-59j3-wvx3-w9hx, MAL-2026-4297 | Malicious | Not scored | 25 May, 2026 | npm @gbrlxvii/ts-env-validator |
Malicious release: Malicious code in ts-result-pipe (npm) GHSA-66j8-7w8q-vvf5, MAL-2026-4328 | Malicious | Not scored | 25 May, 2026 | npm ts-result-pipe |
Malicious release: Malicious code in ts-iter-utils (npm) GHSA-f6hr-rvf9-ch6p, MAL-2026-4326 | Malicious | Not scored | 25 May, 2026 | npm ts-iter-utils |
Malicious release: Malicious code in ts-config-mapper (npm) GHSA-qgfv-9wmq-m4f7, MAL-2026-4325 | Malicious | Not scored | 25 May, 2026 | npm ts-config-mapper |
Malicious release: Malicious code in ts-schema-config (npm) GHSA-vxrv-934h-xj6q, MAL-2026-4329 | Malicious | Not scored | 25 May, 2026 | npm ts-schema-config |
Malicious release: Malicious code in ts-typeguard-utils (npm) GHSA-xqpr-hv2v-6pfj, MAL-2026-4331 | Malicious | Not scored | 25 May, 2026 | npm ts-typeguard-utils |
Malicious release: Malicious code in internallib_v95 (npm) GHSA-qcrh-87jf-mm39, MAL-2026-4316 | Malicious | Not scored | 25 May, 2026 | npm internallib_v95 |
Malicious release: Malicious code in auth0-aspnetcore-utils (npm) GHSA-4xqv-4874-rxx6, MAL-2026-4302 | Malicious | Not scored | 25 May, 2026 | npm auth0-aspnetcore-utils |
Malicious release: Malicious code in auth0-sample-dus-utils (npm) GHSA-c8ph-73mc-f5p8, MAL-2026-4306 | Malicious | Not scored | 25 May, 2026 | npm auth0-sample-dus-utils |
Malicious release: Malicious code in auth0-android-helper-utils (npm) GHSA-cwjp-2mq2-6xp6, MAL-2026-4301 | Malicious | Not scored | 25 May, 2026 | npm auth0-android-helper-utils |
Malicious release: Malicious code in auth0-internal-collector (npm) GHSA-g8jx-g4j9-hh3w, MAL-2026-4304 | Malicious | Not scored | 25 May, 2026 | npm auth0-internal-collector |
Malicious release: Malicious code in auth0-common-telemetry (npm) GHSA-jfp3-8vwj-7g9v, MAL-2026-4303 | Malicious | Not scored | 25 May, 2026 | npm auth0-common-telemetry |
Malicious release: Malicious code in auth0-net-sdk-utils (npm) GHSA-xm89-4mqj-hfrq, MAL-2026-4305 | Malicious | Not scored | 25 May, 2026 | npm auth0-net-sdk-utils |
Malicious release: Malicious code in chai-as-redeploy (npm) GHSA-w6gc-fhv9-53hq, MAL-2026-4307 | Malicious | Not scored | 25 May, 2026 | npm chai-as-redeploy |
Malicious release: Malicious code in vite-plugin-env-compat-plus (npm) GHSA-2rh6-x7fc-2fr4, MAL-2026-4334 | Malicious | Not scored | 25 May, 2026 | npm vite-plugin-env-compat-plus |
Malicious release: Malicious code in vite-plugin-env-compat-1.5 (npm) GHSA-7v58-43rg-wjwq, MAL-2026-4333 | Malicious | Not scored | 25 May, 2026 | npm vite-plugin-env-compat-1.5 |
Malicious release: Malicious code in expo-config-plugin-typescript (npm) GHSA-rj44-v8w3-c5q5, MAL-2026-4314 | Malicious | Not scored | 25 May, 2026 | npm expo-config-plugin-typescript |
Malicious release: Malicious code in unique-string-64 (npm) GHSA-gqvh-j8hx-425w, MAL-2026-4332 | Malicious | Not scored | 25 May, 2026 | npm unique-string-64 |
Malicious release: Malicious code in motion-ui-tool (npm) GHSA-9pqq-3hxc-rg53, MAL-2026-4321 | Malicious | Not scored | 25 May, 2026 | npm motion-ui-tool |
Malicious release: Malicious code in explorhub-mcp-server (npm) GHSA-2qjx-pmc9-2jrj, MAL-2026-4312 | Malicious | Not scored | 25 May, 2026 | npm explorhub-mcp-server |
Malicious release: Malicious code in explorhub-ai-agent (npm) GHSA-fvhq-6j9p-rggx, MAL-2026-4310 | Malicious | Not scored | 25 May, 2026 | npm explorhub-ai-agent |
Malicious release: Malicious code in explorhub-sdk (npm) GHSA-g5w6-hgj6-4j2c, MAL-2026-4313 | Malicious | Not scored | 25 May, 2026 | npm explorhub-sdk |
Malicious release: Malicious code in explorhub-claude-bridge (npm) GHSA-hgw4-f8mg-vgwf, MAL-2026-4311 | Malicious | Not scored | 25 May, 2026 | npm explorhub-claude-bridge |
Malicious release: Malicious code in eh-bridge-utils (npm) GHSA-xjvq-4jq6-f8vq, MAL-2026-4309 | Malicious | Not scored | 25 May, 2026 | npm eh-bridge-utils |
Apache ECharts has a cross-site scripting (XSS) vulnerability CVE-2026-45249, GHSA-fgmj-fm8m-jvvx | Medium | 0.7% | 25 May, 2026 | npm echarts |
Malicious release: Malicious code in core-utility-tools (npm) GHSA-c4gp-gx6v-65jq, MAL-2026-4308 | Malicious | Not scored | 25 May, 2026 | npm core-utility-tools |
Malicious release: Malicious code in apple-app-store-server-library-v3 (npm) GHSA-j79j-hjwj-vx88, MAL-2026-4300 | Malicious | Not scored | 25 May, 2026 | npm apple-app-store-server-library-v3 |
Malicious release: Malicious code in flownodelp5 (npm) GHSA-48cg-4f3j-48fq, MAL-2026-4315 | Malicious | Not scored | 25 May, 2026 | npm flownodelp5 |
Malicious release: Malicious code in nba-cdn-plugin (npm) GHSA-27fg-m46w-x83r, MAL-2026-4323 | Malicious | Not scored | 25 May, 2026 | npm nba-cdn-plugin |
Malicious release: Malicious code in nba-blocker-plugin (npm) GHSA-82vw-6f3x-f942, MAL-2026-4322 | Malicious | Not scored | 25 May, 2026 | npm nba-blocker-plugin |
Malicious release: Malicious code in mobile-international (npm) GHSA-f4h6-f7mh-jhjh, MAL-2026-4320 | Malicious | Not scored | 25 May, 2026 | npm mobile-international |
Malicious release: Malicious code in wnba-parent (npm) GHSA-rrv6-6f8p-p2xq, MAL-2026-4343 | Malicious | Not scored | 25 May, 2026 | npm wnba-parent |