Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in moneykit-cardano-demo (npm) MAL-2026-4614 | Malicious | Not scored | 21 May, 2026 | npm moneykit-cardano-demo |
Malicious release: Malicious code in chai-as-vite (npm) MAL-2026-4514 | Malicious | Not scored | 21 May, 2026 | npm chai-as-vite |
Malicious release: Malicious code in @jaggle/resizeobserves (npm) GHSA-qc6p-vxcj-7r4h, MAL-2026-4288 | Malicious | Not scored | 21 May, 2026 | npm @jaggle/resizeobserves |
Malicious release: Malicious code in maxixy-cli (npm) MAL-2026-4607 | Malicious | Not scored | 21 May, 2026 | npm maxixy-cli |
Malicious release: Malicious code in chai-as-tuned (npm) GHSA-2f37-mh3q-7394, MAL-2026-4513 | Malicious | Not scored | 21 May, 2026 | npm chai-as-tuned |
@sveltejs/kit: `query.batch` cross-talk CVE-2026-82258, GHSA-hgv7-v322-mmgr | Medium | 0.2% | 21 May, 2026 | npm @sveltejs/kit |
md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed) CVE-2026-46492, GHSA-32q2-hhr5-6qvv | High | 0.2% | 21 May, 2026 | npm md-fileserver |
samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions CVE-2026-46490, GHSA-34r5-q4jw-r36m | High | 0.5% | 21 May, 2026 | npm samlify |
Malicious release: Malicious code in @pulse-web-platform-core/scripts-loader (npm) GHSA-f75f-hrx6-f8qh, MAL-2026-4421 | Malicious | Not scored | 21 May, 2026 | npm @pulse-web-platform-core/scripts-loader |
Malicious release: Malicious code in veteran (npm) MAL-2026-4703 | Malicious | Not scored | 21 May, 2026 | npm veteran |
Malicious release: Malicious code in tailwindcss-themers (npm) GHSA-6677-qmcf-whxp, MAL-2026-4226 | Malicious | Not scored | 21 May, 2026 | npm tailwindcss-themers |
Malicious release: Malicious code in tailwindcss-theme-custom (npm) GHSA-79mj-3g96-g96c, MAL-2026-4225 | Malicious | Not scored | 21 May, 2026 | npm tailwindcss-theme-custom |
Malicious release: Malicious code in celonix-otp-react (npm) GHSA-873w-7879-qpxv, MAL-2026-4509 | Malicious | Not scored | 21 May, 2026 | npm celonix-otp-react |
Malicious release: Malicious code in json-spectaculation (npm) GHSA-7fg9-5rgv-4rvq, MAL-2026-4224 | Malicious | Not scored | 21 May, 2026 | npm json-spectaculation |
Malicious release: Malicious code in veteran-proxy (npm) MAL-2026-4704 | Malicious | Not scored | 21 May, 2026 | npm veteran-proxy |
Malicious release: Malicious code in utils-mf (npm) GHSA-4c54-hwv9-c5xm, MAL-2026-4699 | Malicious | Not scored | 21 May, 2026 | npm utils-mf |
Malicious release: Malicious code in ihubinternal (npm) MAL-2026-4584 | Malicious | Not scored | 21 May, 2026 | npm ihubinternal |
Malicious release: Malicious code in @luke-101141/nobody (npm) MAL-2026-4229 | Malicious | Not scored | 21 May, 2026 | npm @luke-101141/nobody |
Malicious release: Malicious code in chai-as-afforded (npm) GHSA-55pm-4fm6-3x9v, MAL-2026-4222 | Malicious | Not scored | 21 May, 2026 | npm chai-as-afforded |
Malicious release: Malicious code in zest-product (npm) GHSA-qm6m-33hv-fvwv, MAL-2026-4738 | Malicious | Not scored | 21 May, 2026 | npm zest-product |
Malicious release: Malicious code in autoheal-dev-cli (npm) MAL-2026-4492 | Malicious | Not scored | 21 May, 2026 | npm autoheal-dev-cli |
Malicious release: Malicious code in nikou-node (npm) MAL-2026-4620 | Malicious | Not scored | 21 May, 2026 | npm nikou-node |
Malicious release: Malicious code in chai-val (npm) MAL-2026-4515 | Malicious | Not scored | 21 May, 2026 | npm chai-val |
Malicious release: Malicious code in finup-mongo-library (npm) MAL-2026-4564 | Malicious | Not scored | 21 May, 2026 | npm finup-mongo-library |
Malicious release: Malicious code in payment-account-input-selector (npm) MAL-2026-4635 | Malicious | Not scored | 21 May, 2026 | npm payment-account-input-selector |
Malicious release: Malicious code in http-uploader-dev (npm) GHSA-4cmw-88qw-qcpr, MAL-2026-4580 | Malicious | Not scored | 21 May, 2026 | npm http-uploader-dev |
Malicious release: Malicious code in @hanssoft/libsignal-node (npm) GHSA-v265-vv2m-9pgf, MAL-2026-4393 | Malicious | Not scored | 21 May, 2026 | npm @hanssoft/libsignal-node |
Malicious release: Malicious code in ionic-insta-api-wrapper (npm) GHSA-65qr-q8w8-4q7r, MAL-2026-4588 | Malicious | Not scored | 21 May, 2026 | npm ionic-insta-api-wrapper |
Malicious release: Malicious code in oh-langfuse (npm) MAL-2026-4625 | Malicious | Not scored | 21 May, 2026 | npm oh-langfuse |
Malicious release: Malicious code in webservices.rest (npm) GHSA-2qjx-pgq9-vx24, MAL-2026-4335 | Malicious | Not scored | 21 May, 2026 | npm webservices.rest |
Malicious release: Malicious code in webservices.rest-utils (npm) GHSA-v62r-4vqp-f32g, MAL-2026-4336 | Malicious | Not scored | 21 May, 2026 | npm webservices.rest-utils |
Malicious release: Malicious code in @tiledesk/tiledesk-server (npm) GHSA-5vfv-hpg7-77hj, MAL-2026-4228 | Malicious | Not scored | 21 May, 2026 | npm @tiledesk/tiledesk-server |
Malicious release: Malicious code in turing-sdk (npm) MAL-2026-4696 | Malicious | Not scored | 21 May, 2026 | npm turing-sdk |
Malicious release: Malicious code in auth0-templates-scripts-utils (npm) GHSA-ff45-fchw-3969, MAL-2026-4490 | Malicious | Not scored | 21 May, 2026 | npm auth0-templates-scripts-utils |
Malicious release: Malicious code in auth0-templates-scripts (npm) GHSA-748c-3f9q-294w, MAL-2026-4489 | Malicious | Not scored | 21 May, 2026 | npm auth0-templates-scripts |
Malicious release: Malicious code in sparkecoder (npm) MAL-2026-4673 | Malicious | Not scored | 21 May, 2026 | npm sparkecoder |
Malicious release: Malicious code in @zhengshuo888/huoke (npm) MAL-2026-4472 | Malicious | Not scored | 21 May, 2026 | npm @zhengshuo888/huoke |
Malicious release: Malicious code in git-userhub (npm) MAL-2026-4573 | Malicious | Not scored | 21 May, 2026 | npm git-userhub |
Malicious release: Malicious code in claw_messenger (npm) MAL-2026-4526 | Malicious | Not scored | 21 May, 2026 | npm claw_messenger |
Malicious release: Malicious code in dot-utils-plus (npm) MAL-2026-4549 | Malicious | Not scored | 21 May, 2026 | npm dot-utils-plus |
Malicious release: Malicious code in fastgrc-openclaw (npm) MAL-2026-4558 | Malicious | Not scored | 21 May, 2026 | npm fastgrc-openclaw |
Malicious release: Malicious code in polygon-toolkit-validate (npm) GHSA-w4vh-7827-g474, MAL-2026-4642 | Malicious | Not scored | 21 May, 2026 | npm polygon-toolkit-validate |
Malicious release: Malicious code in cerebrum-core (npm) GHSA-7886-2x59-rg2h, MAL-2026-4510 | Malicious | Not scored | 21 May, 2026 | npm cerebrum-core |
Malicious release: Malicious code in @djessicatony/folk-mcp-canary (npm) MAL-2026-4382 | Malicious | Not scored | 21 May, 2026 | npm @djessicatony/folk-mcp-canary |
Malicious release: Malicious code in @gad360/apothem (npm) MAL-2026-4391 | Malicious | Not scored | 21 May, 2026 | npm @gad360/apothem |
Malicious release: Malicious code in n8n-nodes-pentest-rce (npm) GHSA-hrxx-vwgp-4xff, MAL-2026-4617 | Malicious | Not scored | 21 May, 2026 | npm n8n-nodes-pentest-rce |
Malicious release: Malicious code in anthropic-shared-logger (npm) GHSA-4vj8-cm74-gcx3, MAL-2026-4479 | Malicious | Not scored | 21 May, 2026 | npm anthropic-shared-logger |
Malicious release: Malicious code in wallet-security-checker (npm) GHSA-2j9x-hxgf-42vh, MAL-2026-4219 | Malicious | Not scored | 21 May, 2026 | npm wallet-security-checker |
Malicious release: Malicious code in polymarket-auto-trade (npm) GHSA-3j8p-hfj4-j6w6, MAL-2026-4210 | Malicious | Not scored | 21 May, 2026 | npm polymarket-auto-trade |
Malicious release: Malicious code in polymarket-trade (npm) GHSA-5qjv-f5g4-jx7w, MAL-2026-4215 | Malicious | Not scored | 21 May, 2026 | npm polymarket-trade |