Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in hops-preset-jest (npm) GHSA-hgp2-cp4x-f69q, MAL-2026-908 | Malicious | Not scored | 15 Feb, 2026 | npm hops-preset-jest |
Malicious release: Malicious code in sinon-web3-chain (npm) GHSA-r5gp-3j8c-8rpr, MAL-2026-896 | Malicious | Not scored | 13 Feb, 2026 | npm sinon-web3-chain |
Malicious release: Malicious code in json-mapping-src (npm) GHSA-vc3m-m5cg-4h7m, MAL-2026-895 | Malicious | Not scored | 13 Feb, 2026 | npm json-mapping-src |
Malicious release: Malicious code in contosoapp (npm) GHSA-67mx-f364-8rpr, MAL-2026-881 | Malicious | Not scored | 13 Feb, 2026 | npm contosoapp |
Malicious release: Malicious code in responsible-ai (npm) GHSA-6rqj-6g7j-8mgh, MAL-2026-890 | Malicious | Not scored | 13 Feb, 2026 | npm responsible-ai |
Malicious release: Malicious code in codexworld (npm) GHSA-fpff-jvx6-7wxw, MAL-2026-879 | Malicious | Not scored | 13 Feb, 2026 | npm codexworld |
Malicious release: Malicious code in responses-starter-app (npm) GHSA-2gw2-3gjc-c357, MAL-2026-889 | Malicious | Not scored | 13 Feb, 2026 | npm responses-starter-app |
Malicious release: Malicious code in pyrefly (npm) GHSA-2mj4-8c65-f5p4, MAL-2026-887 | Malicious | Not scored | 13 Feb, 2026 | npm pyrefly |
Malicious release: Malicious code in pyright-root (npm) GHSA-j4q3-7f72-hm94, MAL-2026-888 | Malicious | Not scored | 13 Feb, 2026 | npm pyright-root |
Malicious release: Malicious code in ecosystem_ui (npm) GHSA-rfm3-w7v3-89mx, MAL-2026-883 | Malicious | Not scored | 13 Feb, 2026 | npm ecosystem_ui |
Malicious release: Malicious code in open-answer-engine-frontend (npm) GHSA-vwq3-gg4r-gq8g, MAL-2026-886 | Malicious | Not scored | 13 Feb, 2026 | npm open-answer-engine-frontend |
Malicious release: Malicious code in hxz-protection (npm) GHSA-r49f-jwqc-c4pr, MAL-2026-884 | Malicious | Not scored | 13 Feb, 2026 | npm hxz-protection |
Malicious release: Malicious code in wropz-6module (npm) GHSA-m2hg-26pv-w27r, MAL-2026-891 | Malicious | Not scored | 13 Feb, 2026 | npm wropz-6module |
Malicious release: Malicious code in wropz-module (npm) GHSA-8vvw-57pj-xxfv, MAL-2026-892 | Malicious | Not scored | 13 Feb, 2026 | npm wropz-module |
Malicious release: Malicious code in metadata-stripper (npm) GHSA-8r3c-vhmx-vmwr, MAL-2026-885 | Malicious | Not scored | 13 Feb, 2026 | npm metadata-stripper |
Malicious release: Malicious code in xsstesting (npm) GHSA-f2r4-9pvw-jg83, MAL-2026-893 | Malicious | Not scored | 13 Feb, 2026 | npm xsstesting |
Malicious release: Malicious code in console-style-pro0o0o0o (npm) GHSA-r4v3-x2p5-xc5v, MAL-2026-880 | Malicious | Not scored | 13 Feb, 2026 | npm console-style-pro0o0o0o |
Malicious release: Malicious code in despicable-me (npm) GHSA-w8vg-4rq2-wh29, MAL-2026-882 | Malicious | Not scored | 13 Feb, 2026 | npm despicable-me |
Malicious release: Malicious code in @depro0x/despicable-me (npm) MAL-2026-873 | Malicious | Not scored | 12 Feb, 2026 | npm @depro0x/despicable-me |
Malicious release: Malicious code in stylelint-recommended (npm) GHSA-prwr-p62p-3qr2, MAL-2026-872 | Malicious | Not scored | 12 Feb, 2026 | npm stylelint-recommended |
Malicious release: Malicious code in envoy1 (npm) GHSA-f4fg-xj6v-j6r8, MAL-2026-871 | Malicious | Not scored | 12 Feb, 2026 | npm envoy1 |
Malicious release: Malicious code in ether-lint (npm) GHSA-9p23-x4p4-m392, MAL-2026-941 | Malicious | Not scored | 12 Feb, 2026 | npm ether-lint |
Malicious release: Malicious code in express-gueues (npm) GHSA-x2xw-8qjm-mcvr, MAL-2026-861 | Malicious | Not scored | 11 Feb, 2026 | npm express-gueues |
Malicious release: Malicious code in systemtest-network (npm) GHSA-2cmj-2pj3-9369, MAL-2026-859 | Malicious | Not scored | 11 Feb, 2026 | npm systemtest-network |
Malicious release: Malicious code in osopackage (npm) GHSA-hc86-54fq-c4mf, MAL-2026-857 | Malicious | Not scored | 11 Feb, 2026 | npm osopackage |
Malicious release: Malicious code in systemtest-information (npm) GHSA-j464-mvwq-jr58, MAL-2026-858 | Malicious | Not scored | 11 Feb, 2026 | npm systemtest-information |
Malicious release: Malicious code in chai-prop (npm) GHSA-4p6w-3gcj-crr5, MAL-2026-856 | Malicious | Not scored | 11 Feb, 2026 | npm chai-prop |
Malicious release: Malicious code in node-dotenv-cli (npm) GHSA-46v6-58g3-h5qh, MAL-2026-853 | Malicious | Not scored | 11 Feb, 2026 | npm node-dotenv-cli |
Malicious release: Malicious code in sinon-node (npm) GHSA-777h-658h-v2g3, MAL-2026-854 | Malicious | Not scored | 11 Feb, 2026 | npm sinon-node |
Malicious release: Malicious code in chai-await (npm) GHSA-cg22-2f58-35xj, MAL-2026-852 | Malicious | Not scored | 11 Feb, 2026 | npm chai-await |
Malicious release: Malicious code in npm_cimetadata (npm) MAL-2026-848 | Malicious | Not scored | 11 Feb, 2026 | npm npm_cimetadata |
Malicious release: Malicious code in search-newfrontier-podlet (npm) MAL-2026-839 | Malicious | Not scored | 10 Feb, 2026 | npm search-newfrontier-podlet |
Malicious release: Malicious code in notification-saved-search-settings-podlet (npm) MAL-2026-837 | Malicious | Not scored | 10 Feb, 2026 | npm notification-saved-search-settings-podlet |
Malicious release: Malicious code in search-savedsearch-podlet (npm) MAL-2026-840 | Malicious | Not scored | 10 Feb, 2026 | npm search-savedsearch-podlet |
Malicious release: Malicious code in myads-layout (npm) MAL-2026-836 | Malicious | Not scored | 10 Feb, 2026 | npm myads-layout |
Malicious release: Malicious code in realestate-atlas (npm) MAL-2026-838 | Malicious | Not scored | 10 Feb, 2026 | npm realestate-atlas |
Malicious release: Malicious code in @reimorg/config (npm) GHSA-3x6g-grxh-c84v, MAL-2026-828 | Malicious | Not scored | 10 Feb, 2026 | npm @reimorg/config |
Malicious release: Malicious code in @uniconvex/dotenv (npm) GHSA-5hc6-4g5j-c3q2, MAL-2026-829 | Malicious | Not scored | 10 Feb, 2026 | npm @uniconvex/dotenv |
Malicious release: Malicious code in express-configer (npm) GHSA-69cq-35c9-qwg9, MAL-2026-833 | Malicious | Not scored | 10 Feb, 2026 | npm express-configer |
Malicious release: Malicious code in aligners (npm) GHSA-fmr8-mpjc-h8rg, MAL-2026-830 | Malicious | Not scored | 10 Feb, 2026 | npm aligners |
Malicious release: Malicious code in sap-code-style-guides (npm) GHSA-6pjr-w5hp-m7pj, MAL-2026-835 | Malicious | Not scored | 10 Feb, 2026 | npm sap-code-style-guides |
Malicious release: Malicious code in chai-as-approved (npm) GHSA-8j3c-w8c2-jpfr, MAL-2026-832 | Malicious | Not scored | 10 Feb, 2026 | npm chai-as-approved |
Malicious release: Malicious code in bigmathix (npm) GHSA-fvcx-rrjg-gr82, MAL-2026-831 | Malicious | Not scored | 10 Feb, 2026 | npm bigmathix |
Malicious release: Malicious code in graphflowx (npm) GHSA-8jpg-855v-mh37, MAL-2026-834 | Malicious | Not scored | 10 Feb, 2026 | npm graphflowx |
Malicious release: Malicious code in narrow-array (npm) GHSA-6cq7-pjjx-42h3, MAL-2026-827 | Malicious | Not scored | 10 Feb, 2026 | npm narrow-array |
Malicious release: Malicious code in jwtdotenv (npm) GHSA-8mjx-w3ff-mv8m, MAL-2026-821 | Malicious | Not scored | 09 Feb, 2026 | npm jwtdotenv |
Malicious release: Malicious code in json-web-sources (npm) GHSA-7r6g-f9q3-q5fg, MAL-2026-820 | Malicious | Not scored | 09 Feb, 2026 | npm json-web-sources |
Malicious release: Malicious code in json-mapping-sources (npm) GHSA-vphr-h9xh-66ff, MAL-2026-819 | Malicious | Not scored | 09 Feb, 2026 | npm json-mapping-sources |
Malicious release: Malicious code in react-svg-handler (npm) GHSA-qjpf-p69c-m582, MAL-2026-822 | Malicious | Not scored | 09 Feb, 2026 | npm react-svg-handler |
Malicious release: Malicious code in @skyeng/libs (npm) GHSA-97cm-4mhj-hmf7, MAL-2026-816 | Malicious | Not scored | 09 Feb, 2026 | npm @skyeng/libs |