Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in yessir-node (npm) MAL-2026-4736 | Malicious | Not scored | 20 May, 2026 | npm yessir-node |
Malicious release: Malicious code in svharness (npm) MAL-2026-4676 | Malicious | Not scored | 20 May, 2026 | npm svharness |
Malicious release: Malicious code in gm-kilo (npm) MAL-2026-4574 | Malicious | Not scored | 20 May, 2026 | npm gm-kilo |
Malicious release: Malicious code in nw-demo (npm) GHSA-hmxw-6c9h-v2h2, MAL-2026-4624 | Malicious | Not scored | 20 May, 2026 | npm nw-demo |
Malicious release: Malicious code in nolimit-x (npm) GHSA-cp8c-2xwh-q227, MAL-2026-4621 | Malicious | Not scored | 20 May, 2026 | npm nolimit-x |
Malicious release: Malicious code in pinno-loggers (npm) MAL-2026-4196 | Malicious | Not scored | 20 May, 2026 | npm pinno-loggers |
Malicious release: Malicious code in pretty-logger-utils (npm) MAL-2026-4197 | Malicious | Not scored | 20 May, 2026 | npm pretty-logger-utils |
Malicious release: Malicious code in bricks-builder-mcp (npm) MAL-2026-4500 | Malicious | Not scored | 20 May, 2026 | npm bricks-builder-mcp |
Malicious release: Malicious code in pino-formatter (npm) GHSA-gg8p-hh3f-m2vx, MAL-2026-4640 | Malicious | Not scored | 20 May, 2026 | npm pino-formatter |
Malicious release: Malicious code in idlidosa (npm) MAL-2026-4581 | Malicious | Not scored | 20 May, 2026 | npm idlidosa |
Malicious release: Malicious code in @weirdorg/config (npm) GHSA-qj44-mw8g-p27p, MAL-2026-4466 | Malicious | Not scored | 20 May, 2026 | npm @weirdorg/config |
Malicious release: Malicious code in arc-diag-util (npm) GHSA-wx2g-gmxq-vvqv, MAL-2026-4481 | Malicious | Not scored | 20 May, 2026 | npm arc-diag-util |
Malicious release: Malicious code in @weirdorg/dotenv (npm) GHSA-p44j-chjm-p4wj, MAL-2026-4467 | Malicious | Not scored | 20 May, 2026 | npm @weirdorg/dotenv |
Malicious release: Malicious code in seekcode (npm) MAL-2026-4667 | Malicious | Not scored | 20 May, 2026 | npm seekcode |
Malicious release: Malicious code in @qwedqwed/axios (npm) GHSA-3gw3-hvvw-mp2h, MAL-2026-4422 | Malicious | Not scored | 20 May, 2026 | npm @qwedqwed/axios |
Malicious release: Malicious code in ts-logger-pack (npm) GHSA-8w97-mwv3-cwx3, MAL-2026-4199 | Malicious | Not scored | 20 May, 2026 | npm ts-logger-pack |
Malicious release: Malicious code in terminal-logger-utils (npm) GHSA-h9jr-prgp-c322, MAL-2026-4198 | Malicious | Not scored | 20 May, 2026 | npm terminal-logger-utils |
Malicious release: Malicious code in @sec-loans-ui/utils (npm) GHSA-vw7r-pxm7-p56f, MAL-2026-4432 | Malicious | Not scored | 20 May, 2026 | npm @sec-loans-ui/utils |
Malicious release: Malicious code in @riskine-frontend/design-elements (npm) GHSA-4576-fp54-qqfc, MAL-2026-4425 | Malicious | Not scored | 20 May, 2026 | npm @riskine-frontend/design-elements |
Malicious release: Malicious code in react-tracked-tony (npm) GHSA-6734-623v-3p4r, MAL-2026-4661 | Malicious | Not scored | 20 May, 2026 | npm react-tracked-tony |
Malicious release: Malicious code in qazaq-cli (npm) MAL-2026-4654 | Malicious | Not scored | 20 May, 2026 | npm qazaq-cli |
Malicious release: Malicious code in security-env-loader (npm) GHSA-rv4w-rvp6-p6rg, MAL-2026-4665 | Malicious | Not scored | 20 May, 2026 | npm security-env-loader |
Malicious release: Malicious code in fulcrum-sessions (npm) MAL-2026-4568 | Malicious | Not scored | 20 May, 2026 | npm fulcrum-sessions |
Malicious release: Malicious code in axiosqqq (npm) MAL-2026-4493 | Malicious | Not scored | 20 May, 2026 | npm axiosqqq |
Malicious release: Malicious code in bucket-protocol-sdk-v2 (npm) GHSA-23pf-2cqf-xh64, MAL-2026-4502 | Malicious | Not scored | 20 May, 2026 | npm bucket-protocol-sdk-v2 |
Malicious release: Malicious code in @pluxee-connect/api-client (npm) GHSA-wpmr-hxhp-4h27, MAL-2026-4418 | Malicious | Not scored | 20 May, 2026 | npm @pluxee-connect/api-client |
Malicious release: Malicious code in @web-3d-tool/sdk (npm) GHSA-qmfq-m796-v557, MAL-2026-4465 | Malicious | Not scored | 20 May, 2026 | npm @web-3d-tool/sdk |
Malicious release: Malicious code in @serviceshub/x-web-core (npm) GHSA-xjvj-r6v9-q99q, MAL-2026-4440 | Malicious | Not scored | 20 May, 2026 | npm @serviceshub/x-web-core |
Malicious release: Malicious code in ethers-wallet-packages (npm) GHSA-gm49-5q33-vf6f, MAL-2026-4554 | Malicious | Not scored | 20 May, 2026 | npm ethers-wallet-packages |
Malicious release: Malicious code in python-utils (npm) GHSA-3c8h-wfcm-wpw5, MAL-2026-4652 | Malicious | Not scored | 20 May, 2026 | npm python-utils |
Malicious release: Malicious code in cb-wallet-data (npm) GHSA-7w56-x3g2-57fg, MAL-2026-4506 | Malicious | Not scored | 20 May, 2026 | npm cb-wallet-data |
Malicious release: Malicious code in @trackking/core (npm) GHSA-2qqx-q4v2-495g, MAL-2026-4460 | Malicious | Not scored | 20 May, 2026 | npm @trackking/core |
Malicious release: Malicious code in @ikyyofc/gemini-cli (npm) MAL-2026-4394 | Malicious | Not scored | 20 May, 2026 | npm @ikyyofc/gemini-cli |
Malicious release: Malicious code in @vtmn-play/react (npm) GHSA-vpcv-xpqm-w228, MAL-2026-4464 | Malicious | Not scored | 20 May, 2026 | npm @vtmn-play/react |
Malicious release: Malicious code in wallet-agent-ai-radix (npm) MAL-2026-4709 | Malicious | Not scored | 20 May, 2026 | npm wallet-agent-ai-radix |
Malicious release: Malicious code in color-style-utils (npm) GHSA-2hm6-8j47-2qg7, MAL-2026-4534 | Malicious | Not scored | 20 May, 2026 | npm color-style-utils |
Malicious release: Malicious code in @flipbit2-bb/test-auth-state (npm) GHSA-jrpc-qv6v-wmr6, MAL-2026-4389 | Malicious | Not scored | 20 May, 2026 | npm @flipbit2-bb/test-auth-state |
Malicious release: Malicious code in @deadcode09284814/axios-util (npm) MAL-2026-4379 | Malicious | Not scored | 20 May, 2026 | npm @deadcode09284814/axios-util |
Malicious release: Malicious code in chalk-tempalte (npm) GHSA-hvjp-xq9w-c33f, MAL-2026-4517 | Malicious | Not scored | 20 May, 2026 | npm chalk-tempalte |
Malicious release: Malicious code in cloud-pc-templates (npm) MAL-2026-4528 | Malicious | Not scored | 20 May, 2026 | npm cloud-pc-templates |
Malicious release: Malicious code in ezymail (npm) MAL-2026-4557 | Malicious | Not scored | 20 May, 2026 | npm ezymail |
Malicious release: Malicious code in pulse-axios (npm) MAL-2026-4651 | Malicious | Not scored | 20 May, 2026 | npm pulse-axios |
Malicious release: Malicious code in foundy-toolkit (npm) GHSA-48f2-rw49-vgx3, MAL-2026-4242 | Malicious | Not scored | 20 May, 2026 | npm foundy-toolkit |
Malicious release: Malicious code in axois-utils (npm) GHSA-pvvv-cmc6-c323, MAL-2026-4494 | Malicious | Not scored | 20 May, 2026 | npm axois-utils |
Malicious release: Malicious code in carvus-lens (npm) MAL-2026-4505 | Malicious | Not scored | 20 May, 2026 | npm carvus-lens |
Malicious release: Malicious code in polymarket-clob-client (npm) MAL-2026-4643 | Malicious | Not scored | 20 May, 2026 | npm polymarket-clob-client |
Malicious release: Malicious code in @solarcraft/observix (npm) MAL-2026-4446 | Malicious | Not scored | 20 May, 2026 | npm @solarcraft/observix |
Malicious release: Malicious code in get-deps-path (npm) GHSA-c852-72hm-gxvf, MAL-2026-4571 | Malicious | Not scored | 20 May, 2026 | npm get-deps-path |
Malicious release: Malicious code in truffle-config-helper (npm) GHSA-q8c8-9p2m-f4v7, MAL-2026-4249 | Malicious | Not scored | 20 May, 2026 | npm truffle-config-helper |
Malicious release: Malicious code in customerdigital-ui-containers-lib (npm) GHSA-fpwv-wv7c-h2mw, MAL-2026-4543 | Malicious | Not scored | 20 May, 2026 | npm customerdigital-ui-containers-lib |