Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @w3m-app/switch_network (npm) GHSA-f39p-99x4-7fwv, MAL-2026-3274 | Malicious | Not scored | 04 May, 2026 | npm @w3m-app/switch_network |
Malicious release: Malicious code in @w3m-app/is_connected (npm) GHSA-fc7c-vh37-8m3q, MAL-2026-3273 | Malicious | Not scored | 04 May, 2026 | npm @w3m-app/is_connected |
Malicious release: Malicious code in @w3m-app/get_chain_id (npm) GHSA-ww67-vcwg-gjgm, MAL-2026-3272 | Malicious | Not scored | 04 May, 2026 | npm @w3m-app/get_chain_id |
Malicious release: Malicious code in @bcs-ui/theme (npm) GHSA-8x45-chjj-3fxx, MAL-2026-3271 | Malicious | Not scored | 04 May, 2026 | npm @bcs-ui/theme |
Malicious release: Malicious code in @bcs-react-ui/select (npm) GHSA-xqh5-v77f-g2w5, MAL-2026-3270 | Malicious | Not scored | 04 May, 2026 | npm @bcs-react-ui/select |
Malicious release: Malicious code in @bcs-bank/init (npm) GHSA-25g7-hch5-h5fr, MAL-2026-3266 | Malicious | Not scored | 04 May, 2026 | npm @bcs-bank/init |
Malicious release: Malicious code in @bcs-bank/common-constants (npm) GHSA-2vjv-p4jc-hmm6, MAL-2026-3265 | Malicious | Not scored | 04 May, 2026 | npm @bcs-bank/common-constants |
Malicious release: Malicious code in @bcs-react-ui/context-menu (npm) GHSA-9jqj-3jch-6xg4, MAL-2026-3269 | Malicious | Not scored | 04 May, 2026 | npm @bcs-react-ui/context-menu |
Malicious release: Malicious code in @bcs-bank-react-ui/swiper-slider (npm) GHSA-f96m-p93j-fxrm, MAL-2026-3267 | Malicious | Not scored | 04 May, 2026 | npm @bcs-bank-react-ui/swiper-slider |
Malicious release: Malicious code in @bcs-mi/store (npm) GHSA-q5fm-gcgr-2rjj, MAL-2026-3268 | Malicious | Not scored | 04 May, 2026 | npm @bcs-mi/store |
Malicious release: Malicious code in @bcs-adapters/keycloak-api-adapter (npm) GHSA-6w89-ghw9-qmhr, MAL-2026-3264 | Malicious | Not scored | 04 May, 2026 | npm @bcs-adapters/keycloak-api-adapter |
Malicious release: Malicious code in @bcs-adapters/core-adapter (npm) GHSA-9243-mwpj-5j2h, MAL-2026-3263 | Malicious | Not scored | 04 May, 2026 | npm @bcs-adapters/core-adapter |
Malicious release: Malicious code in paypal-payouts-bridge (npm) GHSA-fpch-j6rr-8r63, MAL-2026-3323 | Malicious | Not scored | 04 May, 2026 | npm paypal-payouts-bridge |
Malicious release: Malicious code in microsoft-agents-auth-service (npm) MAL-2026-3322 | Malicious | Not scored | 04 May, 2026 | npm microsoft-agents-auth-service |
Malicious release: Malicious code in feature-flag-service (npm) MAL-2026-3253 | Malicious | Not scored | 03 May, 2026 | npm feature-flag-service |
Malicious release: Malicious code in google-cloud-secret-manager-config-poc (npm) GHSA-g6v5-9xpp-6hpx, MAL-2026-3309 | Malicious | Not scored | 03 May, 2026 | npm google-cloud-secret-manager-config-poc |
Malicious release: Malicious code in internal-company-module-test-1337 (npm) MAL-2026-3249 | Malicious | Not scored | 03 May, 2026 | npm internal-company-module-test-1337 |
Malicious release: Malicious code in ally-call-wait-time (npm) MAL-2026-3297 | Malicious | Not scored | 03 May, 2026 | npm ally-call-wait-time |
Malicious release: Malicious code in @allybank/ally-sdk (npm) GHSA-2892-cpv4-xqr4, MAL-2026-3289 | Malicious | Not scored | 03 May, 2026 | npm @allybank/ally-sdk |
Malicious release: Malicious code in ally-allowlist (npm) MAL-2026-3294 | Malicious | Not scored | 03 May, 2026 | npm ally-allowlist |
Malicious release: Malicious code in @athena-portal/themes (npm) MAL-2026-3291 | Malicious | Not scored | 03 May, 2026 | npm @athena-portal/themes |
Malicious release: Malicious code in ally-eagw-identity (npm) GHSA-8323-qr4w-h7gg, MAL-2026-3299 | Malicious | Not scored | 03 May, 2026 | npm ally-eagw-identity |
Malicious release: Malicious code in ally-antivirus (npm) GHSA-fxqc-33g9-rh7j, MAL-2026-3295 | Malicious | Not scored | 03 May, 2026 | npm ally-antivirus |
Malicious release: Malicious code in @breeze-ai/ui-library (npm) GHSA-vrcf-mcq9-rpcp, MAL-2026-3292 | Malicious | Not scored | 03 May, 2026 | npm @breeze-ai/ui-library |
Malicious release: Malicious code in @breezeai-frontend/i18n-config (npm) GHSA-3274-6pmj-53c3, MAL-2026-3293 | Malicious | Not scored | 03 May, 2026 | npm @breezeai-frontend/i18n-config |
Malicious release: Malicious code in apcyber-test-package (npm) GHSA-xr6f-x85p-m7ff, MAL-2026-3304 | Malicious | Not scored | 03 May, 2026 | npm apcyber-test-package |
Malicious release: Malicious code in ally-whitelist (npm) MAL-2026-3303 | Malicious | Not scored | 03 May, 2026 | npm ally-whitelist |
Malicious release: Malicious code in @allyfinancial/allyfinancial-api (npm) GHSA-g584-r3m7-mrrm, MAL-2026-3290 | Malicious | Not scored | 03 May, 2026 | npm @allyfinancial/allyfinancial-api |
Malicious release: Malicious code in ally-json-threat-protect (npm) GHSA-9vx9-c8j6-h9p4, MAL-2026-3301 | Malicious | Not scored | 03 May, 2026 | npm ally-json-threat-protect |
Malicious release: Malicious code in ally-starter-api (npm) MAL-2026-3302 | Malicious | Not scored | 03 May, 2026 | npm ally-starter-api |
Malicious release: Malicious code in ally-forms (npm) MAL-2026-3300 | Malicious | Not scored | 03 May, 2026 | npm ally-forms |
Malicious release: Malicious code in ally-ccapi (npm) GHSA-29c6-x862-p526, MAL-2026-3298 | Malicious | Not scored | 03 May, 2026 | npm ally-ccapi |
Malicious release: Malicious code in ally-badges (npm) GHSA-9pfp-jfc9-q69j, MAL-2026-3296 | Malicious | Not scored | 03 May, 2026 | npm ally-badges |
Malicious release: Malicious code in nextjs-chat-with-ai-service (npm) GHSA-88fc-46q8-6h4p, MAL-2026-3241 | Malicious | Not scored | 03 May, 2026 | npm nextjs-chat-with-ai-service |
sublinear-time-solver has a Path Traversal Issue CVE-2026-7645, GHSA-gc2j-wpjv-jhrw | Medium | 0.5% | 02 May, 2026 | npm sublinear-time-solver |
Malicious release: Malicious code in apexpro (npm) GHSA-4jwh-w2xx-p5rq, MAL-2026-3234 | Malicious | Not scored | 02 May, 2026 | npm apexpro |
Malicious release: Malicious code in apexomni (npm) GHSA-m6v2-w5cf-f85x, MAL-2026-3233 | Malicious | Not scored | 02 May, 2026 | npm apexomni |
Malicious release: Malicious code in ams-ssk (npm) GHSA-827p-whjw-xp3w, MAL-2026-3287 | Malicious | Not scored | 02 May, 2026 | npm ams-ssk |
Malicious release: Malicious code in common-tg-service (npm) GHSA-wvhv-cgwm-v2hv, MAL-2026-3288 | Malicious | Not scored | 02 May, 2026 | npm common-tg-service |
Malicious release: Malicious code in codewhisperer-streaming (npm) MAL-2026-3232 | Malicious | Not scored | 02 May, 2026 | npm codewhisperer-streaming |
yii2-mcp-server has a Command Injection Issue CVE-2026-7600, GHSA-gc8w-x73w-p4rh | Low | 1.2% | 02 May, 2026 | npm yii2-mcp-server |
Malicious release: Malicious code in bpmn-studio (npm) GHSA-j2xc-x6gx-xqq8, MAL-2026-3306 | Malicious | Not scored | 01 May, 2026 | npm bpmn-studio |
Malicious release: Malicious code in archetype-style (npm) GHSA-m9f5-cp7r-48pm, MAL-2026-3215 | Malicious | Not scored | 01 May, 2026 | npm archetype-style |
Malicious release: Malicious code in update-db (npm) MAL-2026-3315 | Malicious | Not scored | 01 May, 2026 | npm update-db |
Malicious release: Malicious code in update-browserslist (npm) MAL-2026-3314 | Malicious | Not scored | 01 May, 2026 | npm update-browserslist |
Malicious release: Malicious code in browserslist-db (npm) MAL-2026-3307 | Malicious | Not scored | 01 May, 2026 | npm browserslist-db |
Malicious release: Malicious code in common-roles (npm) MAL-2026-3308 | Malicious | Not scored | 01 May, 2026 | npm common-roles |
Malicious release: Malicious code in apple-internal-security-library-v99 (npm) GHSA-6gr9-g52h-226p, MAL-2026-3209 | Malicious | Not scored | 01 May, 2026 | npm apple-internal-security-library-v99 |
@diplodoc/search-extension allows stored XSS via Markdown file title CVE-2026-40201, GHSA-rjmp-rwj4-mv82 | Medium | 0.2% | 01 May, 2026 | npm @diplodoc/search-extension |
Malicious release: Malicious code in path-internal-util (npm) GHSA-c267-q765-387r, MAL-2026-3312 | Malicious | Not scored | 01 May, 2026 | npm path-internal-util |