Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @tallyui/components (npm) GHSA-fc57-xv4v-8cp7, MAL-2026-3514 | Malicious | Not scored | 12 May, 2026 | npm @tallyui/components |
Malicious release: Malicious code in @supersurkhet/sdk (npm) GHSA-j2fh-hxx6-vqqr, MAL-2026-3513 | Malicious | Not scored | 12 May, 2026 | npm @supersurkhet/sdk |
Malicious release: Malicious code in @mistralai/mistralai-gcp (npm) GHSA-rccm-wwph-vgxc, MAL-2026-3512 | Malicious | Not scored | 12 May, 2026 | npm @mistralai/mistralai-gcp |
Malicious release: Malicious code in @mistralai/mistralai-azure (npm) GHSA-2rm2-c4pc-xxr9, MAL-2026-3511 | Malicious | Not scored | 12 May, 2026 | npm @mistralai/mistralai-azure |
Malicious release: Malicious code in @mesadev/rest (npm) GHSA-x77w-4f56-pcvp, MAL-2026-3510 | Malicious | Not scored | 12 May, 2026 | npm @mesadev/rest |
Malicious release: Malicious code in @supersurkhet/cli (npm) GHSA-5fx3-327x-w6m7, MAL-2026-3457 | Malicious | Not scored | 12 May, 2026 | npm @supersurkhet/cli |
Malicious release: Malicious code in @tallyui/connector-vendure (npm) GHSA-gp5v-3cpv-vqh6, MAL-2026-3458 | Malicious | Not scored | 12 May, 2026 | npm @tallyui/connector-vendure |
Malicious release: Malicious code in @tallyui/pos (npm) GHSA-9phw-7rx9-6ccq, MAL-2026-3459 | Malicious | Not scored | 12 May, 2026 | npm @tallyui/pos |
Malicious release: Malicious code in git-branch-selector (npm) GHSA-h5h4-xpf8-g55c, MAL-2026-3503 | Malicious | Not scored | 12 May, 2026 | npm git-branch-selector |
Malicious release: Malicious code in git-git-git (npm) GHSA-w8x9-9886-9m73, MAL-2026-3504 | Malicious | Not scored | 12 May, 2026 | npm git-git-git |
Malicious release: Malicious code in @opensearch-project/opensearch (npm) GHSA-298w-vvm4-ww55, MAL-2026-3434 | Malicious | Not scored | 12 May, 2026 | npm @opensearch-project/opensearch |
Malicious release: Malicious code in @tanstack/vue-start-client (npm) GHSA-p5mj-5p7c-22jr, MAL-2026-3499 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/vue-start-client |
Malicious release: Malicious code in @beproduct/nestjs-auth (npm) GHSA-cqpw-mfqj-f2j7, MAL-2026-3433 | Malicious | Not scored | 12 May, 2026 | npm @beproduct/nestjs-auth |
Malicious release: Malicious code in @squawk/airway-data (npm) GHSA-qwgj-2vrg-5q3h, MAL-2026-3439 | Malicious | Not scored | 12 May, 2026 | npm @squawk/airway-data |
Malicious release: Malicious code in @squawk/navaid-data (npm) GHSA-rrwc-wg79-pr28, MAL-2026-3449 | Malicious | Not scored | 12 May, 2026 | npm @squawk/navaid-data |
Malicious release: Malicious code in @squawk/geo (npm) GHSA-vr5r-pmj9-g7m9, MAL-2026-3445 | Malicious | Not scored | 12 May, 2026 | npm @squawk/geo |
Malicious release: Malicious code in @squawk/airspace (npm) GHSA-9g47-9g93-8mx7, MAL-2026-3437 | Malicious | Not scored | 12 May, 2026 | npm @squawk/airspace |
Malicious release: Malicious code in @squawk/icao-registry (npm) GHSA-mpc4-8622-ww9c, MAL-2026-3446 | Malicious | Not scored | 12 May, 2026 | npm @squawk/icao-registry |
Malicious release: Malicious code in @squawk/types (npm) GHSA-mf83-f42r-h5hm, MAL-2026-3454 | Malicious | Not scored | 12 May, 2026 | npm @squawk/types |
Malicious release: Malicious code in ts-dna (npm) GHSA-w2mh-w7hh-f235, MAL-2026-3505 | Malicious | Not scored | 12 May, 2026 | npm ts-dna |
Malicious release: Malicious code in @squawk/airports (npm) GHSA-r594-chgw-g4p9, MAL-2026-3436 | Malicious | Not scored | 12 May, 2026 | npm @squawk/airports |
Malicious release: Malicious code in @squawk/airways (npm) GHSA-3c23-5qp4-r5mv, MAL-2026-3440 | Malicious | Not scored | 12 May, 2026 | npm @squawk/airways |
Malicious release: Malicious code in @squawk/notams (npm) GHSA-4qm3-vxjm-3wfp, MAL-2026-3451 | Malicious | Not scored | 12 May, 2026 | npm @squawk/notams |
Malicious release: Malicious code in @squawk/procedures (npm) GHSA-gv3v-f444-2w4h, MAL-2026-3453 | Malicious | Not scored | 12 May, 2026 | npm @squawk/procedures |
Malicious release: Malicious code in @squawk/navaids (npm) GHSA-635g-g6vm-h5m3, MAL-2026-3450 | Malicious | Not scored | 12 May, 2026 | npm @squawk/navaids |
Malicious release: Malicious code in @tanstack/router-vite-plugin (npm) GHSA-p6hw-732x-2qw7, MAL-2026-3480 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/router-vite-plugin |
Malicious release: Malicious code in @squawk/procedure-data (npm) GHSA-fjg7-hqrf-v48w, MAL-2026-3452 | Malicious | Not scored | 12 May, 2026 | npm @squawk/procedure-data |
Malicious release: Malicious code in @tanstack/solid-start-client (npm) GHSA-jh9w-85vm-vgm4, MAL-2026-3485 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/solid-start-client |
Malicious release: Malicious code in @tanstack/solid-router-ssr-query (npm) GHSA-qjr3-33qv-w5rq, MAL-2026-3483 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/solid-router-ssr-query |
Malicious release: Malicious code in @tanstack/solid-router (npm) GHSA-34qr-xpfg-5g3g, MAL-2026-3481 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/solid-router |
Malicious release: Malicious code in @tanstack/solid-router-devtools (npm) GHSA-gvq3-5frr-qqmp, MAL-2026-3482 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/solid-router-devtools |
Malicious release: Malicious code in @squawk/airspace-data (npm) GHSA-j5w5-5fj6-mwvv, MAL-2026-3438 | Malicious | Not scored | 12 May, 2026 | npm @squawk/airspace-data |
Malicious release: Malicious code in @tanstack/router-utils (npm) GHSA-3rg6-f8mh-5pvp, MAL-2026-3479 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/router-utils |
Malicious release: Malicious code in @tanstack/router-ssr-query-core (npm) GHSA-943h-v9jx-69h5, MAL-2026-3478 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/router-ssr-query-core |
Malicious release: Malicious code in @squawk/fixes (npm) GHSA-rjx4-mpv7-fwq9, MAL-2026-3442 | Malicious | Not scored | 12 May, 2026 | npm @squawk/fixes |
Malicious release: Malicious code in @squawk/mcp (npm) GHSA-vcpv-j6jh-qcc2, MAL-2026-3448 | Malicious | Not scored | 12 May, 2026 | npm @squawk/mcp |
Malicious release: Malicious code in @squawk/flight-math (npm) GHSA-g2v5-h9gp-qwjx, MAL-2026-3443 | Malicious | Not scored | 12 May, 2026 | npm @squawk/flight-math |
Malicious release: Malicious code in @squawk/units (npm) GHSA-v9qg-v8xv-qjpc, MAL-2026-3455 | Malicious | Not scored | 12 May, 2026 | npm @squawk/units |
Malicious release: Malicious code in @squawk/flightplan (npm) GHSA-2mgf-6xw7-hjgh, MAL-2026-3444 | Malicious | Not scored | 12 May, 2026 | npm @squawk/flightplan |
Malicious release: Malicious code in @squawk/airport-data (npm) GHSA-4q5g-g93p-w23v, MAL-2026-3435 | Malicious | Not scored | 12 May, 2026 | npm @squawk/airport-data |
Malicious release: Malicious code in @squawk/icao-registry-data (npm) GHSA-r72q-f5pp-8556, MAL-2026-3447 | Malicious | Not scored | 12 May, 2026 | npm @squawk/icao-registry-data |
Malicious release: Malicious code in @squawk/weather (npm) GHSA-p6w9-58xc-257f, MAL-2026-3456 | Malicious | Not scored | 12 May, 2026 | npm @squawk/weather |
Malicious release: Malicious code in @squawk/fix-data (npm) GHSA-w75r-vq2j-vpmf, MAL-2026-3441 | Malicious | Not scored | 12 May, 2026 | npm @squawk/fix-data |
Malicious release: Malicious code in cross-stitch (npm) GHSA-9ffp-9935-xjqq, MAL-2026-3502 | Malicious | Not scored | 12 May, 2026 | npm cross-stitch |
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys CVE-2026-45321, GHSA-g7cv-rxg3-hmpx | CriticalExploited | 3.3% | 12 May, 2026 | npm @tanstack/arktype-adapter npm @tanstack/eslint-plugin-router npm @tanstack/eslint-plugin-start npm @tanstack/history +38 more |
Malicious release: Malicious code in @tanstack/solid-start-server (npm) GHSA-2gqf-jmq8-m7qw, MAL-2026-3486 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/solid-start-server |
Malicious release: Malicious code in @tanstack/solid-start (npm) GHSA-8hxh-jf75-8g4x, MAL-2026-3484 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/solid-start |
Malicious release: Malicious code in @tanstack/start-client-core (npm) GHSA-68cm-p79h-wv3p, MAL-2026-3487 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/start-client-core |
Malicious release: Malicious code in @tanstack/start-fn-stubs (npm) GHSA-phm9-h72q-2rv5, MAL-2026-3488 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/start-fn-stubs |
Malicious release: Malicious code in @tanstack/start-plugin-core (npm) GHSA-q8qg-3r28-j492, MAL-2026-3489 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/start-plugin-core |