Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in transform-regenerator (npm) GHSA-gc7v-2qjx-vwwp, MAL-2026-561 | Malicious | Not scored | 28 Jan, 2026 | npm transform-regenerator |
Malicious release: Malicious code in syntax-async-functions (npm) GHSA-vw4x-22x4-cvmw, MAL-2026-559 | Malicious | Not scored | 28 Jan, 2026 | npm syntax-async-functions |
Malicious release: Malicious code in express-lists-routes (npm) GHSA-qg82-jrgh-rv25, MAL-2026-551 | Malicious | Not scored | 28 Jan, 2026 | npm express-lists-routes |
Malicious release: Malicious code in json-mapping-web (npm) GHSA-m3jp-4w2p-gm5f, MAL-2026-552 | Malicious | Not scored | 28 Jan, 2026 | npm json-mapping-web |
Malicious release: Malicious code in cdnhost (npm) GHSA-wh7m-vhx9-f4qq, MAL-2026-550 | Malicious | Not scored | 28 Jan, 2026 | npm cdnhost |
Malicious release: Malicious code in blockchain-helper-lib (npm) GHSA-3rcr-854m-q7w4, MAL-2026-549 | Malicious | Not scored | 28 Jan, 2026 | npm blockchain-helper-lib |
Malicious release: Malicious code in @santandergroup-uk/edgehome-components (npm) GHSA-7w89-3478-9838, MAL-2026-527 | Malicious | Not scored | 27 Jan, 2026 | npm @santandergroup-uk/edgehome-components |
Malicious release: Malicious code in internallib_v828 (npm) GHSA-4r5c-58jj-47rr, MAL-2026-534 | Malicious | Not scored | 27 Jan, 2026 | npm internallib_v828 |
Malicious release: Malicious code in stylus.js (npm) GHSA-7hw4-xjm9-2fr7, MAL-2026-542 | Malicious | Not scored | 27 Jan, 2026 | npm stylus.js |
Malicious release: Malicious code in morgan.js (npm) GHSA-8j6f-2j2w-q8hc, MAL-2026-536 | Malicious | Not scored | 27 Jan, 2026 | npm morgan.js |
Malicious release: Malicious code in mysql2.js (npm) GHSA-mv7j-pqp4-p8p3, MAL-2026-537 | Malicious | Not scored | 27 Jan, 2026 | npm mysql2.js |
Malicious release: Malicious code in knex.js (npm) GHSA-v532-mx4j-wq5x, MAL-2026-535 | Malicious | Not scored | 27 Jan, 2026 | npm knex.js |
Malicious release: Malicious code in pump.js (npm) GHSA-vg7v-pm3q-r4f5, MAL-2026-541 | Malicious | Not scored | 27 Jan, 2026 | npm pump.js |
Malicious release: Malicious code in grepleaks (npm) GHSA-576v-xg3m-rpj7, MAL-2026-530 | Malicious | Not scored | 27 Jan, 2026 | npm grepleaks |
Malicious release: Malicious code in hackerxhj (npm) GHSA-893h-38p9-2g7m, MAL-2026-531 | Malicious | Not scored | 27 Jan, 2026 | npm hackerxhj |
Malicious release: Malicious code in testxhjhka (npm) GHSA-pqc3-frfj-85cg, MAL-2026-545 | Malicious | Not scored | 27 Jan, 2026 | npm testxhjhka |
Malicious release: Malicious code in xhjxhjhiagent (npm) GHSA-rx7h-wg9p-mhmq, MAL-2026-546 | Malicious | Not scored | 27 Jan, 2026 | npm xhjxhjhiagent |
Malicious release: Malicious code in testxhjhk (npm) GHSA-v3hr-6cj2-6w2v, MAL-2026-544 | Malicious | Not scored | 27 Jan, 2026 | npm testxhjhk |
Malicious release: Malicious code in hiagentxhjrceme (npm) GHSA-7rwj-7qq6-w6vx, MAL-2026-533 | Malicious | Not scored | 27 Jan, 2026 | npm hiagentxhjrceme |
Malicious release: Malicious code in hiagentxhjrce (npm) GHSA-rq46-v367-269c, MAL-2026-532 | Malicious | Not scored | 27 Jan, 2026 | npm hiagentxhjrce |
Malicious release: Malicious code in @row-components/pricing-embedded-sui (npm) GHSA-22mf-gpfv-j3x3, MAL-2026-526 | Malicious | Not scored | 27 Jan, 2026 | npm @row-components/pricing-embedded-sui |
Malicious release: Malicious code in tailwind-components-cli (npm) GHSA-r7r7-fg7f-727f, MAL-2026-543 | Malicious | Not scored | 27 Jan, 2026 | npm tailwind-components-cli |
Malicious release: Malicious code in n8n-nodes-xkwqpzrt-jmflhvbn-dsyocgxwmkelpt (npm) GHSA-4h38-mjmr-prfx, MAL-2026-540 | Malicious | Not scored | 27 Jan, 2026 | npm n8n-nodes-xkwqpzrt-jmflhvbn-dsyocgxwmkelpt |
Malicious release: Malicious code in n8n-nodes-gasdhgfuy-rejerw-ytjsadx (npm) GHSA-7jcc-gjp4-f9w4, MAL-2026-538 | Malicious | Not scored | 27 Jan, 2026 | npm n8n-nodes-gasdhgfuy-rejerw-ytjsadx |
Malicious release: Malicious code in n8n-nodes-gg-udhasudsh-hgjkhg-official (npm) GHSA-9gwp-x3p2-fchf, MAL-2026-539 | Malicious | Not scored | 27 Jan, 2026 | npm n8n-nodes-gg-udhasudsh-hgjkhg-official |
Malicious release: Malicious code in fileupload-core (npm) GHSA-jmrw-v7rp-6m4v, MAL-2026-529 | Malicious | Not scored | 27 Jan, 2026 | npm fileupload-core |
Malicious release: Malicious code in @shije/new-qs (npm) GHSA-mp8v-x9wp-v423, MAL-2026-528 | Malicious | Not scored | 27 Jan, 2026 | npm @shije/new-qs |
Malicious release: Malicious code in ftm-noderpc (npm) GHSA-m2jq-q4v9-276f, MAL-2026-520 | Malicious | Not scored | 27 Jan, 2026 | npm ftm-noderpc |
Malicious release: Malicious code in sandbox-hooks (npm) GHSA-58gm-9gr2-v55v, MAL-2026-525 | Malicious | Not scored | 27 Jan, 2026 | npm sandbox-hooks |
Malicious release: Malicious code in magento-coding-standard-eslint-plugin (npm) GHSA-673x-qfjx-j475, MAL-2026-522 | Malicious | Not scored | 27 Jan, 2026 | npm magento-coding-standard-eslint-plugin |
Malicious release: Malicious code in hammer-jquery (npm) GHSA-732r-c6r2-x55r, MAL-2026-521 | Malicious | Not scored | 27 Jan, 2026 | npm hammer-jquery |
Malicious release: Malicious code in mapkit-example-svelte (npm) GHSA-978q-52r4-529f, MAL-2026-523 | Malicious | Not scored | 27 Jan, 2026 | npm mapkit-example-svelte |
Malicious release: Malicious code in mapkit-example-vue (npm) GHSA-mvxj-fpqx-qhph, MAL-2026-524 | Malicious | Not scored | 27 Jan, 2026 | npm mapkit-example-vue |
Malicious release: Malicious code in @afg-ikea/ikea-modals (npm) GHSA-9f47-ffh4-6h4f, MAL-2026-519 | Malicious | Not scored | 27 Jan, 2026 | npm @afg-ikea/ikea-modals |
Malicious release: Malicious code in @afg-ikea/ikea-kiosk-related-components (npm) GHSA-27vw-p6h7-3c24, MAL-2026-518 | Malicious | Not scored | 27 Jan, 2026 | npm @afg-ikea/ikea-kiosk-related-components |
Malicious release: Malicious code in @afg-ikea/ikea-family-registration-module (npm) GHSA-wx5g-qvrw-cmg9, MAL-2026-517 | Malicious | Not scored | 27 Jan, 2026 | npm @afg-ikea/ikea-family-registration-module |
Malicious release: Malicious code in @sommos/create-program-template-form-data (npm) MAL-2026-509 | Malicious | Not scored | 26 Jan, 2026 | npm @sommos/create-program-template-form-data |
Malicious release: Malicious code in cartos-dds-ui (npm) MAL-2026-508 | Malicious | Not scored | 26 Jan, 2026 | npm cartos-dds-ui |
Malicious release: Malicious code in @snazah/davey (npm) GHSA-64jj-9746-r33x, MAL-2026-553 | Malicious | Not scored | 26 Jan, 2026 | npm @snazah/davey |
Malicious release: Malicious code in tripica-library (npm) MAL-2026-507 | Malicious | Not scored | 26 Jan, 2026 | npm tripica-library |
Malicious release: Malicious code in braintree-web-latest (npm) GHSA-97xw-rj6v-j7xc, MAL-2026-554 | Malicious | Not scored | 25 Jan, 2026 | npm braintree-web-latest |
Malicious release: Malicious code in overstock-component-library (npm) GHSA-7jpx-8c37-86g4, MAL-2026-512 | Malicious | Not scored | 25 Jan, 2026 | npm overstock-component-library |
Malicious release: Malicious code in overstock-login-layer (npm) GHSA-mwfv-m2qw-57w9, MAL-2026-516 | Malicious | Not scored | 25 Jan, 2026 | npm overstock-login-layer |
Malicious release: Malicious code in ostk-otel-autoconfig (npm) GHSA-wcfp-f27x-6p4p, MAL-2026-511 | Malicious | Not scored | 25 Jan, 2026 | npm ostk-otel-autoconfig |
Malicious release: Malicious code in overstock-component-library-v3 (npm) GHSA-9wh8-6mc2-6396, MAL-2026-513 | Malicious | Not scored | 25 Jan, 2026 | npm overstock-component-library-v3 |
Malicious release: Malicious code in zabittest11 (npm) MAL-2026-500 | Malicious | Not scored | 25 Jan, 2026 | npm zabittest11 |
Malicious release: Malicious code in overstock-jenkins (npm) GHSA-wg22-7286-wgvx, MAL-2026-515 | Malicious | Not scored | 23 Jan, 2026 | npm overstock-jenkins |
Malicious release: Malicious code in overstock-health-express (npm) GHSA-8689-38pm-xg5f, MAL-2026-514 | Malicious | Not scored | 23 Jan, 2026 | npm overstock-health-express |
Malicious release: Malicious code in h-jsencrypt (npm) GHSA-5cc8-j5c8-6wrc, MAL-2026-495 | Malicious | Not scored | 23 Jan, 2026 | npm h-jsencrypt |
Malicious release: Malicious code in eits (npm) GHSA-6pm6-xfgg-f722, MAL-2026-494 | Malicious | Not scored | 23 Jan, 2026 | npm eits |