Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in env-embed (npm) MAL-2026-2359 | Malicious | Not scored | 24 Mar, 2026 | npm env-embed |
Malicious release: Malicious code in env-cli-express (npm) MAL-2026-2358 | Malicious | Not scored | 24 Mar, 2026 | npm env-cli-express |
Malicious release: Malicious code in ectoplast-spirit (npm) MAL-2026-2357 | Malicious | Not scored | 24 Mar, 2026 | npm ectoplast-spirit |
Malicious release: Malicious code in ecto-spirit (npm) MAL-2026-2355 | Malicious | Not scored | 24 Mar, 2026 | npm ecto-spirit |
Malicious release: Malicious code in ecto-spirit-core (npm) MAL-2026-2356 | Malicious | Not scored | 24 Mar, 2026 | npm ecto-spirit-core |
Malicious release: Malicious code in ecto-registry (npm) MAL-2026-2354 | Malicious | Not scored | 24 Mar, 2026 | npm ecto-registry |
Malicious release: Malicious code in ecto-corsair-lwirz (npm) MAL-2026-2352 | Malicious | Not scored | 24 Mar, 2026 | npm ecto-corsair-lwirz |
Malicious release: Malicious code in ecto-engine (npm) MAL-2026-2353 | Malicious | Not scored | 24 Mar, 2026 | npm ecto-engine |
Malicious release: Malicious code in dotenv-xtend (npm) MAL-2026-2351 | Malicious | Not scored | 24 Mar, 2026 | npm dotenv-xtend |
Malicious release: Malicious code in dotenv-express (npm) GHSA-hmr7-9h9c-5m6q, MAL-2026-2350 | Malicious | Not scored | 24 Mar, 2026 | npm dotenv-express |
Malicious release: Malicious code in deriv_ppetest (npm) MAL-2026-2349 | Malicious | Not scored | 24 Mar, 2026 | npm deriv_ppetest |
Malicious release: Malicious code in cursed-module (npm) MAL-2026-2348 | Malicious | Not scored | 24 Mar, 2026 | npm cursed-module |
Malicious release: Malicious code in ctf-package-onetimeuseforctf (npm) MAL-2026-2347 | Malicious | Not scored | 24 Mar, 2026 | npm ctf-package-onetimeuseforctf |
Malicious release: Malicious code in corsair-module (npm) MAL-2026-2346 | Malicious | Not scored | 24 Mar, 2026 | npm corsair-module |
Malicious release: Malicious code in codecoverage-tools (npm) MAL-2026-2345 | Malicious | Not scored | 24 Mar, 2026 | npm codecoverage-tools |
Malicious release: Malicious code in codeanalysis-common (npm) MAL-2026-2344 | Malicious | Not scored | 24 Mar, 2026 | npm codeanalysis-common |
Malicious release: Malicious code in chain-multer (npm) MAL-2026-2343 | Malicious | Not scored | 24 Mar, 2026 | npm chain-multer |
Malicious release: Malicious code in chai-set (npm) MAL-2026-2342 | Malicious | Not scored | 24 Mar, 2026 | npm chai-set |
Malicious release: Malicious code in chai-chain-cognivault (npm) MAL-2026-2341 | Malicious | Not scored | 24 Mar, 2026 | npm chai-chain-cognivault |
Malicious release: Malicious code in chai-chain-argon (npm) MAL-2026-2340 | Malicious | Not scored | 24 Mar, 2026 | npm chai-chain-argon |
Malicious release: Malicious code in chai-as-chains (npm) GHSA-8f77-86rh-3hvj, MAL-2026-2339 | Malicious | Not scored | 24 Mar, 2026 | npm chai-as-chains |
Malicious release: Malicious code in chai-as-attached (npm) MAL-2026-2338 | Malicious | Not scored | 24 Mar, 2026 | npm chai-as-attached |
Malicious release: Malicious code in chai-as-aligned (npm) MAL-2026-2337 | Malicious | Not scored | 24 Mar, 2026 | npm chai-as-aligned |
Malicious release: Malicious code in cdnjavacss (npm) MAL-2026-2336 | Malicious | Not scored | 24 Mar, 2026 | npm cdnjavacss |
Malicious release: Malicious code in azurestack-common (npm) MAL-2026-2335 | Malicious | Not scored | 24 Mar, 2026 | npm azurestack-common |
Malicious release: Malicious code in argon-node (npm) MAL-2026-2334 | Malicious | Not scored | 24 Mar, 2026 | npm argon-node |
Malicious release: Malicious code in @pansycareful/github-helper (npm) MAL-2026-2333 | Malicious | Not scored | 24 Mar, 2026 | npm @pansycareful/github-helper |
Malicious release: Malicious code in @hsbc-mfe/host (npm) MAL-2026-2332 | Malicious | Not scored | 24 Mar, 2026 | npm @hsbc-mfe/host |
Malicious release: Malicious code in @girirajravichandran/corp-build-utils-poc (npm) MAL-2026-2331 | Malicious | Not scored | 24 Mar, 2026 | npm @girirajravichandran/corp-build-utils-poc |
Malicious release: Malicious code in @fyxer-ai/shared (npm) MAL-2026-2330 | Malicious | Not scored | 24 Mar, 2026 | npm @fyxer-ai/shared |
Malicious release: Malicious code in @abi-labs-frontend/standards (npm) GHSA-hqxv-wmmr-v5h3, MAL-2026-2329 | Malicious | Not scored | 24 Mar, 2026 | npm @abi-labs-frontend/standards |
Malicious release: Malicious code in @one-site/europcar (npm) MAL-2026-2137 | Malicious | Not scored | 24 Mar, 2026 | npm @one-site/europcar |
Malicious release: Malicious code in express-session-validator (npm) GHSA-52hw-wvx9-x8pq, MAL-2026-2129 | Malicious | Not scored | 24 Mar, 2026 | npm express-session-validator |
Malicious release: Malicious code in express-session-vailidator (npm) GHSA-hqj8-x2vp-mrp9, MAL-2026-2128 | Malicious | Not scored | 24 Mar, 2026 | npm express-session-vailidator |
Malicious release: Malicious code in sbx-mask (npm) GHSA-r934-qgg3-v7fg, MAL-2026-2132 | Malicious | Not scored | 24 Mar, 2026 | npm sbx-mask |
Malicious release: Malicious code in fancode-web-app (npm) GHSA-f6pq-884h-rjxq, MAL-2026-2130 | Malicious | Not scored | 24 Mar, 2026 | npm fancode-web-app |
Malicious release: Malicious code in agoda-test-poc (npm) GHSA-hfhc-gmgj-9v7v, MAL-2026-2127 | Malicious | Not scored | 24 Mar, 2026 | npm agoda-test-poc |
Malicious release: Malicious code in agoda-dep-confusion (npm) GHSA-px82-m72x-rpj7, MAL-2026-2126 | Malicious | Not scored | 24 Mar, 2026 | npm agoda-dep-confusion |
Malicious release: Malicious code in yelp-react-component-rating (npm) GHSA-xqxf-c9jr-8wx6, MAL-2026-2136 | Malicious | Not scored | 24 Mar, 2026 | npm yelp-react-component-rating |
Malicious release: Malicious code in yelp-react-component-photo-upload (npm) GHSA-7v3c-wxfg-x5fg, MAL-2026-2135 | Malicious | Not scored | 24 Mar, 2026 | npm yelp-react-component-photo-upload |
Malicious release: Malicious code in yelp-biz-action-constants-js-generated (npm) GHSA-mg5x-ww4x-j322, MAL-2026-2134 | Malicious | Not scored | 24 Mar, 2026 | npm yelp-biz-action-constants-js-generated |
Malicious release: Malicious code in server-fpti (npm) GHSA-8w5j-p4jv-8rmq, MAL-2026-2133 | Malicious | Not scored | 24 Mar, 2026 | npm server-fpti |
Malicious release: Malicious code in nemo-fpti (npm) GHSA-hmv2-22ff-cxh8, MAL-2026-2131 | Malicious | Not scored | 24 Mar, 2026 | npm nemo-fpti |
Malicious release: Malicious code in customerdigital-ui-components-lib (npm) GHSA-3m3c-wc3h-m5mr, MAL-2026-2125 | Malicious | Not scored | 24 Mar, 2026 | npm customerdigital-ui-components-lib |
Malicious release: Malicious code in @wame/ngx-frf-utilities (npm) MAL-2026-2412 | Malicious | Not scored | 24 Mar, 2026 | npm @wame/ngx-frf-utilities |
Malicious release: Malicious code in @wame/ngx-adfs (npm) MAL-2026-2411 | Malicious | Not scored | 24 Mar, 2026 | npm @wame/ngx-adfs |
Malicious release: Malicious code in tombac-chronos (npm) MAL-2026-2418 | Malicious | Not scored | 24 Mar, 2026 | npm tombac-chronos |
Malicious release: Malicious code in @the-coca-cola-company/ngps-global-common-utils (npm) MAL-2026-2410 | Malicious | Not scored | 24 Mar, 2026 | npm @the-coca-cola-company/ngps-global-common-utils |
Malicious release: Malicious code in @phonos/types (npm) MAL-2026-2409 | Malicious | Not scored | 24 Mar, 2026 | npm @phonos/types |
Malicious release: Malicious code in oc-navbar-module-client (npm) MAL-2026-2417 | Malicious | Not scored | 24 Mar, 2026 | npm oc-navbar-module-client |