Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in hemi-btc-staking-actions (npm) GHSA-96cq-3x5w-5fr2, MAL-2026-496 | Malicious | Not scored | 23 Jan, 2026 | npm hemi-btc-staking-actions |
Malicious release: Malicious code in test-on-other (npm) MAL-2026-497 | Malicious | Not scored | 23 Jan, 2026 | npm test-on-other |
Malicious release: Malicious code in oxnoxon (npm) GHSA-3qj6-c6x2-w2w6, MAL-2026-493 | Malicious | Not scored | 23 Jan, 2026 | npm oxnoxon |
Malicious release: Malicious code in test-on-other-again (npm) MAL-2026-491 | Malicious | Not scored | 23 Jan, 2026 | npm test-on-other-again |
Malicious release: Malicious code in rank4222wun (npm) GHSA-3phq-qxp9-55pv, MAL-2026-489 | Malicious | Not scored | 23 Jan, 2026 | npm rank4222wun |
Malicious release: Malicious code in a5xm (npm) GHSA-8v27-jw75-7v3c, MAL-2026-486 | Malicious | Not scored | 23 Jan, 2026 | npm a5xm |
Malicious release: Malicious code in ntwsc (npm) GHSA-g39p-gprj-c37g, MAL-2026-487 | Malicious | Not scored | 23 Jan, 2026 | npm ntwsc |
Malicious release: Malicious code in ntwsx (npm) GHSA-qqcc-7qrm-mf75, MAL-2026-488 | Malicious | Not scored | 23 Jan, 2026 | npm ntwsx |
Malicious release: Malicious code in a4wu (npm) GHSA-q3gw-cjjf-gqq5, MAL-2026-485 | Malicious | Not scored | 23 Jan, 2026 | npm a4wu |
Malicious release: Malicious code in kwp-shared-components-production-system (npm) GHSA-5rrx-w333-h86q, MAL-2026-480 | Malicious | Not scored | 23 Jan, 2026 | npm kwp-shared-components-production-system |
Malicious release: Malicious code in translation-note (npm) GHSA-7888-g6c7-rm6g, MAL-2026-484 | Malicious | Not scored | 23 Jan, 2026 | npm translation-note |
Malicious release: Malicious code in @acqui-calm-library/acqui-hero-carousel-section (npm) MAL-2026-471 | Malicious | Not scored | 23 Jan, 2026 | npm @acqui-calm-library/acqui-hero-carousel-section |
Malicious release: Malicious code in @landing-platform/data-bridge (npm) MAL-2026-472 | Malicious | Not scored | 23 Jan, 2026 | npm @landing-platform/data-bridge |
Malicious release: Malicious code in @transaction-list/transaction-list-lg (npm) MAL-2026-473 | Malicious | Not scored | 23 Jan, 2026 | npm @transaction-list/transaction-list-lg |
Malicious release: Malicious code in @transaction-list/transaction-list-md (npm) MAL-2026-474 | Malicious | Not scored | 23 Jan, 2026 | npm @transaction-list/transaction-list-md |
Malicious release: Malicious code in @transaction-list/transaction-list-sm (npm) MAL-2026-475 | Malicious | Not scored | 23 Jan, 2026 | npm @transaction-list/transaction-list-sm |
Malicious release: Malicious code in @transaction-list/transaction-list-xs (npm) MAL-2026-476 | Malicious | Not scored | 23 Jan, 2026 | npm @transaction-list/transaction-list-xs |
Malicious release: Malicious code in bttr-devs (npm) MAL-2026-477 | Malicious | Not scored | 23 Jan, 2026 | npm bttr-devs |
Malicious release: Malicious code in domino-elements (npm) MAL-2026-478 | Malicious | Not scored | 23 Jan, 2026 | npm domino-elements |
Malicious release: Malicious code in integromat-ui (npm) MAL-2026-479 | Malicious | Not scored | 23 Jan, 2026 | npm integromat-ui |
Malicious release: Malicious code in oasis-os-provider-messaging (npm) MAL-2026-481 | Malicious | Not scored | 23 Jan, 2026 | npm oasis-os-provider-messaging |
Malicious release: Malicious code in public-site-boostmoney-ui (npm) MAL-2026-482 | Malicious | Not scored | 23 Jan, 2026 | npm public-site-boostmoney-ui |
Malicious release: Malicious code in public-site-cms-ui (npm) MAL-2026-483 | Malicious | Not scored | 23 Jan, 2026 | npm public-site-cms-ui |
Malicious release: Malicious code in uuu8lgd (npm) MAL-2026-466 | Malicious | Not scored | 22 Jan, 2026 | npm uuu8lgd |
Malicious release: Malicious code in @ikeacn/utils (npm) GHSA-8hww-h75w-hmhr, MAL-2026-465 | Malicious | Not scored | 22 Jan, 2026 | npm @ikeacn/utils |
Malicious release: Malicious code in @ikeacn/icons (npm) GHSA-f867-45wh-g5pw, MAL-2026-464 | Malicious | Not scored | 22 Jan, 2026 | npm @ikeacn/icons |
Malicious release: Malicious code in @corp-front/corporate-filter-company-select (npm) MAL-2026-461 | Malicious | Not scored | 22 Jan, 2026 | npm @corp-front/corporate-filter-company-select |
Malicious release: Malicious code in @ikeacn/ui (npm) GHSA-f6r6-w68v-687q, MAL-2026-462 | Malicious | Not scored | 22 Jan, 2026 | npm @ikeacn/ui |
Malicious release: Malicious code in corporate-blocking (npm) MAL-2026-463 | Malicious | Not scored | 22 Jan, 2026 | npm corporate-blocking |
Malicious release: Malicious code in pay-by-bank-dashboard-server (npm) GHSA-chxm-rhfj-8x2f, MAL-2026-460 | Malicious | Not scored | 22 Jan, 2026 | npm pay-by-bank-dashboard-server |
Malicious release: Malicious code in un112 (npm) MAL-2026-459 | Malicious | Not scored | 22 Jan, 2026 | npm un112 |
Malicious release: Malicious code in @mailpoet/eslint-config (npm) GHSA-2c25-xv7m-4cp8, MAL-2026-456 | Malicious | Not scored | 22 Jan, 2026 | npm @mailpoet/eslint-config |
Malicious release: Malicious code in @mailpoet/components (npm) GHSA-6qjh-33jg-r2wf, MAL-2026-455 | Malicious | Not scored | 22 Jan, 2026 | npm @mailpoet/components |
Malicious release: Malicious code in @fortinet/fortigate-autoscale (npm) GHSA-fph3-6mrp-9v2j, MAL-2026-453 | Malicious | Not scored | 22 Jan, 2026 | npm @fortinet/fortigate-autoscale |
Malicious release: Malicious code in @mailpoet/component (npm) GHSA-h25f-8r9p-7452, MAL-2026-454 | Malicious | Not scored | 22 Jan, 2026 | npm @mailpoet/component |
Malicious release: Malicious code in @brl-laiwb/ng-laiwb-api (npm) GHSA-9mfj-j283-9f88, MAL-2026-452 | Malicious | Not scored | 22 Jan, 2026 | npm @brl-laiwb/ng-laiwb-api |
Malicious release: Malicious code in @alluxio/common-ui (npm) GHSA-w72q-x24f-3gq9, MAL-2026-451 | Malicious | Not scored | 22 Jan, 2026 | npm @alluxio/common-ui |
Malicious release: Malicious code in csv-parsing-xz (npm) GHSA-42cg-2rj4-8h6f, MAL-2026-458 | Malicious | Not scored | 22 Jan, 2026 | npm csv-parsing-xz |
Malicious release: Malicious code in csv-parsing-xx (npm) GHSA-j64q-7vw7-x9pp, MAL-2026-457 | Malicious | Not scored | 22 Jan, 2026 | npm csv-parsing-xx |
Malicious release: Malicious code in rank253222 (npm) MAL-2026-448 | Malicious | Not scored | 22 Jan, 2026 | npm rank253222 |
Malicious release: Malicious code in tv-admin-commons (npm) GHSA-87xf-ghj4-8h7x, MAL-2026-439 | Malicious | Not scored | 21 Jan, 2026 | npm tv-admin-commons |
Malicious release: Malicious code in ts-tweetnacl-utils (npm) GHSA-hp92-6jf4-773f, MAL-2026-438 | Malicious | Not scored | 21 Jan, 2026 | npm ts-tweetnacl-utils |
Malicious release: Malicious code in lumo-api-client (npm) GHSA-vxqc-gmrh-x7m2, MAL-2026-437 | Malicious | Not scored | 21 Jan, 2026 | npm lumo-api-client |
Malicious release: Malicious code in jquery-ajaxchimp (npm) GHSA-xxq4-gc37-grmh, MAL-2026-436 | Malicious | Not scored | 21 Jan, 2026 | npm jquery-ajaxchimp |
Malicious release: Malicious code in aligntype (npm) GHSA-fp6q-w5hw-mvvx, MAL-2026-435 | Malicious | Not scored | 21 Jan, 2026 | npm aligntype |
Malicious release: Malicious code in chai-async-test (npm) GHSA-wjj4-r47f-m9q8, MAL-2026-409 | Malicious | Not scored | 21 Jan, 2026 | npm chai-async-test |
Malicious release: Malicious code in dotenv-expanded (npm) GHSA-94jw-vmxc-vv4v, MAL-2026-415 | Malicious | Not scored | 21 Jan, 2026 | npm dotenv-expanded |
Malicious release: Malicious code in qdrant-js (npm) GHSA-8p85-84qw-3m2v, MAL-2026-426 | Malicious | Not scored | 21 Jan, 2026 | npm qdrant-js |
Malicious release: Malicious code in weaviate-js (npm) GHSA-hwmx-j3gv-65mh, MAL-2026-434 | Malicious | Not scored | 21 Jan, 2026 | npm weaviate-js |
Malicious release: Malicious code in replicate-js (npm) GHSA-qfp4-ffv5-3xrg, MAL-2026-427 | Malicious | Not scored | 21 Jan, 2026 | npm replicate-js |