Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in secrets-manager-wrapper (npm) GHSA-fmm2-56pg-g4g7, MAL-2026-3195 | Malicious | Not scored | 29 Apr, 2026 | npm secrets-manager-wrapper |
Malicious release: Malicious code in @omni-corp-infra/sso-bridge-core (npm) GHSA-pfh5-gh42-c5ff, MAL-2026-3257 | Malicious | Not scored | 29 Apr, 2026 | npm @omni-corp-infra/sso-bridge-core |
Malicious release: Malicious code in @saif777/codemirror5 (npm) GHSA-pm5r-8qx2-2m4r, MAL-2026-3185 | Malicious | Not scored | 29 Apr, 2026 | npm @saif777/codemirror5 |
Malicious release: Malicious code in react-video-canvas (npm) GHSA-pqv4-74gv-v429, MAL-2026-3189 | Malicious | Not scored | 29 Apr, 2026 | npm react-video-canvas |
Malicious release: Malicious code in google-storage-cloud (npm) GHSA-qpwh-x85m-v7j9, MAL-2026-3260 | Malicious | Not scored | 29 Apr, 2026 | npm google-storage-cloud |
Malicious release: Malicious code in internal-auth-provider (npm) GHSA-w76m-ffcr-5rfm, MAL-2026-3261 | Malicious | Not scored | 29 Apr, 2026 | npm internal-auth-provider |
Malicious release: Malicious code in chai-as-char (npm) GHSA-jhr8-c8fj-ccwc, MAL-2026-3164 | Malicious | Not scored | 29 Apr, 2026 | npm chai-as-char |
Malicious release: Malicious code in chai-as-redeployed (npm) GHSA-4cp9-q8r9-2227, MAL-2026-3165 | Malicious | Not scored | 29 Apr, 2026 | npm chai-as-redeployed |
Malicious release: Malicious code in nicegui (npm) MAL-2026-3180 | Malicious | Not scored | 29 Apr, 2026 | npm nicegui |
Malicious release: Malicious code in period-newline (npm) MAL-2026-3181 | Malicious | Not scored | 29 Apr, 2026 | npm period-newline |
Malicious release: Malicious code in redeem-onchain-sdk (npm) MAL-2026-3182 | Malicious | Not scored | 29 Apr, 2026 | npm redeem-onchain-sdk |
Malicious release: Malicious code in @cap-js/sqlite (npm) GHSA-2h7r-x9v2-q52f, MAL-2026-3178 | Malicious | Not scored | 29 Apr, 2026 | npm @cap-js/sqlite |
Malicious release: Malicious code in @cap-js/db-service (npm) GHSA-72vc-j35j-p28h, MAL-2026-3176 | Malicious | Not scored | 29 Apr, 2026 | npm @cap-js/db-service |
Malicious release: Malicious code in @cap-js/postgres (npm) GHSA-7vv3-r527-wvjr, MAL-2026-3177 | Malicious | Not scored | 29 Apr, 2026 | npm @cap-js/postgres |
Malicious release: Malicious code in mbt (npm) MAL-2026-3179 | Malicious | Not scored | 29 Apr, 2026 | npm mbt |
Malicious release: Malicious code in apple-infra-network-v2 (npm) GHSA-4mpf-c2vv-xfj5, MAL-2026-3155 | Malicious | Not scored | 29 Apr, 2026 | npm apple-infra-network-v2 |
Malicious release: Malicious code in npm-global-util (npm) GHSA-56m6-68r8-r7p4, MAL-2026-3163 | Malicious | Not scored | 29 Apr, 2026 | npm npm-global-util |
Malicious release: Malicious code in agents-a365-runtime (npm) GHSA-98v9-9pjp-6p9m, MAL-2026-3149 | Malicious | Not scored | 29 Apr, 2026 | npm agents-a365-runtime |
Malicious release: Malicious code in apple-pki-cert-validator (npm) GHSA-9rmm-mp3q-456f, MAL-2026-3162 | Malicious | Not scored | 29 Apr, 2026 | npm apple-pki-cert-validator |
Malicious release: Malicious code in apple-internal-pki-trust-v5 (npm) GHSA-cgj9-rq56-vc54, MAL-2026-3159 | Malicious | Not scored | 29 Apr, 2026 | npm apple-internal-pki-trust-v5 |
Malicious release: Malicious code in apple-cktool-api-v2 (npm) GHSA-ff63-6wjc-q735, MAL-2026-3150 | Malicious | Not scored | 29 Apr, 2026 | npm apple-cktool-api-v2 |
Malicious release: Malicious code in apple-internal-telemetry-service (npm) GHSA-g2w3-7m75-fpwv, MAL-2026-3161 | Malicious | Not scored | 29 Apr, 2026 | npm apple-internal-telemetry-service |
Malicious release: Malicious code in apple-cloud-infrastructure-monitor (npm) GHSA-gr3q-f7jp-gr5c, MAL-2026-3151 | Malicious | Not scored | 29 Apr, 2026 | npm apple-cloud-infrastructure-monitor |
Malicious release: Malicious code in apple-coredata-internal-service (npm) GHSA-h7g3-2m9j-5r36, MAL-2026-3152 | Malicious | Not scored | 29 Apr, 2026 | npm apple-coredata-internal-service |
Malicious release: Malicious code in apple-internal-pki-trust (npm) GHSA-mc4h-h4q5-8hw9, MAL-2026-3158 | Malicious | Not scored | 29 Apr, 2026 | npm apple-internal-pki-trust |
Malicious release: Malicious code in apple-internal-auth-v3 (npm) GHSA-r59g-3q6c-f5v6, MAL-2026-3157 | Malicious | Not scored | 29 Apr, 2026 | npm apple-internal-auth-v3 |
Malicious release: Malicious code in apple-infra-final-escape (npm) GHSA-whv7-rqc3-rvhc, MAL-2026-3153 | Malicious | Not scored | 29 Apr, 2026 | npm apple-infra-final-escape |
Malicious release: Malicious code in apple-internal-pki-utils (npm) GHSA-wpjx-fcmm-7p5h, MAL-2026-3160 | Malicious | Not scored | 29 Apr, 2026 | npm apple-internal-pki-utils |
Malicious release: Malicious code in apple-infra-gcp-leak (npm) GHSA-wvgf-2hjr-hcw7, MAL-2026-3154 | Malicious | Not scored | 29 Apr, 2026 | npm apple-infra-gcp-leak |
Malicious release: Malicious code in apple-infra-ultimate-bypass (npm) GHSA-x5g9-r6x2-jpfv, MAL-2026-3156 | Malicious | Not scored | 29 Apr, 2026 | npm apple-infra-ultimate-bypass |
Malicious release: Malicious code in coinmate-typescript-client (npm) MAL-2026-3147 | Malicious | Not scored | 29 Apr, 2026 | npm coinmate-typescript-client |
CyberChef has a Cross-site Scripting issue CVE-2026-42615, GHSA-h4hv-92pp-pcjg | High | 0.3% | 29 Apr, 2026 | npm cyberchef |
Malicious release: Malicious code in fivem-monitor (npm) GHSA-fc78-r45j-m7f5, MAL-2026-3140 | Malicious | Not scored | 28 Apr, 2026 | npm fivem-monitor |
Malicious release: Malicious code in wm-plugin-teach-me-widget (npm) GHSA-qgp5-pp55-46vj, MAL-2026-3128 | Malicious | Not scored | 28 Apr, 2026 | npm wm-plugin-teach-me-widget |
Apache Thrift Node.js bindings vulnerable to Uncontrolled Recursion BIT-thrift-2026-41636, CVE-2026-41636, GHSA-r67j-r569-jrwp | High | 0.5% | 28 Apr, 2026 | npm thrift |
BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue CVE-2026-7223, GHSA-r2jq-4h3x-rfj6 | Medium | 0.3% | 28 Apr, 2026 | npm @dadigua/hyperchat |
Malicious release: Malicious code in apple-app-store-server-library-poc (npm) GHSA-4r99-2267-v7p2, MAL-2026-3123 | Malicious | Not scored | 27 Apr, 2026 | npm apple-app-store-server-library-poc |
Malicious release: Malicious code in @w3m-frame/session_update (npm) GHSA-48cv-82hq-87cc, MAL-2026-3122 | Malicious | Not scored | 27 Apr, 2026 | npm @w3m-frame/session_update |
Malicious release: Malicious code in @pyme-web/web-api (npm) GHSA-q9v2-86j4-4885, MAL-2026-3120 | Malicious | Not scored | 27 Apr, 2026 | npm @pyme-web/web-api |
Malicious release: Malicious code in @pyme-web/ui-widget (npm) GHSA-5x28-2ff3-64cj, MAL-2026-3119 | Malicious | Not scored | 27 Apr, 2026 | npm @pyme-web/ui-widget |
Malicious release: Malicious code in @pyme-web/ui-base (npm) GHSA-8jh8-42h4-gjg5, MAL-2026-3118 | Malicious | Not scored | 27 Apr, 2026 | npm @pyme-web/ui-base |
Malicious release: Malicious code in @taxmoninor/taxmon (npm) GHSA-qpg7-5r8v-6h76, MAL-2026-3121 | Malicious | Not scored | 27 Apr, 2026 | npm @taxmoninor/taxmon |
Malicious release: Malicious code in @apple-pay-trust/authorize-payment (npm) GHSA-3g77-vg2g-7mjv, MAL-2026-3111 | Malicious | Not scored | 27 Apr, 2026 | npm @apple-pay-trust/authorize-payment |
Malicious release: Malicious code in @activation_code/success (npm) GHSA-hq57-73cg-6253, MAL-2026-3108 | Malicious | Not scored | 27 Apr, 2026 | npm @activation_code/success |
Malicious release: Malicious code in @apple-pay-trust/cancelled (npm) GHSA-2v65-5xfv-p42q, MAL-2026-3112 | Malicious | Not scored | 27 Apr, 2026 | npm @apple-pay-trust/cancelled |
Malicious release: Malicious code in @apiary-annex/meta (npm) GHSA-gqjg-5998-3rmq, MAL-2026-3109 | Malicious | Not scored | 27 Apr, 2026 | npm @apiary-annex/meta |
Malicious release: Malicious code in @business_promocode/cancel_promocode (npm) GHSA-5vjv-9xjr-hq87, MAL-2026-3117 | Malicious | Not scored | 27 Apr, 2026 | npm @business_promocode/cancel_promocode |
Malicious release: Malicious code in @activation_code/activate (npm) GHSA-64fm-mh5q-w2rp, MAL-2026-3106 | Malicious | Not scored | 27 Apr, 2026 | npm @activation_code/activate |
Malicious release: Malicious code in @business_promocode/apply_promocode (npm) GHSA-g79w-grhv-qw3m, MAL-2026-3116 | Malicious | Not scored | 27 Apr, 2026 | npm @business_promocode/apply_promocode |
Malicious release: Malicious code in @b2b_blocker/show_activation_error (npm) GHSA-ppx3-ph2c-gqgm, MAL-2026-3115 | Malicious | Not scored | 27 Apr, 2026 | npm @b2b_blocker/show_activation_error |