Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in nanoid-js (npm) GHSA-5fj2-vwp3-544j, MAL-2026-418 | Malicious | Not scored | 21 Jan, 2026 | npm nanoid-js |
Malicious release: Malicious code in storage-types (npm) GHSA-f8wv-3jjp-qw4w, MAL-2026-430 | Malicious | Not scored | 21 Jan, 2026 | npm storage-types |
Malicious release: Malicious code in plugin-vue (npm) GHSA-hxxj-55p6-h93r, MAL-2026-425 | Malicious | Not scored | 21 Jan, 2026 | npm plugin-vue |
Malicious release: Malicious code in babel-js (npm) GHSA-qg2h-qpcj-f7c2, MAL-2026-407 | Malicious | Not scored | 21 Jan, 2026 | npm babel-js |
Malicious release: Malicious code in plugin-react-swc (npm) GHSA-w743-w2hh-6f23, MAL-2026-424 | Malicious | Not scored | 21 Jan, 2026 | npm plugin-react-swc |
Malicious release: Malicious code in aws-crt-nodejs (npm) GHSA-jpvg-2xxh-xxvh, MAL-2026-406 | Malicious | Not scored | 21 Jan, 2026 | npm aws-crt-nodejs |
Malicious release: Malicious code in debox-rn (npm) GHSA-87pg-vff6-6494, MAL-2026-414 | Malicious | Not scored | 21 Jan, 2026 | npm debox-rn |
Malicious release: Malicious code in testpkg-yilider690 (npm) GHSA-m3mx-92hq-fgm8, MAL-2026-431 | Malicious | Not scored | 21 Jan, 2026 | npm testpkg-yilider690 |
Malicious release: Malicious code in connect-web (npm) GHSA-2wv3-j8p3-gcmm, MAL-2026-412 | Malicious | Not scored | 21 Jan, 2026 | npm connect-web |
Malicious release: Malicious code in oce-icons (npm) GHSA-72g5-9m6h-j5f9, MAL-2026-422 | Malicious | Not scored | 21 Jan, 2026 | npm oce-icons |
Malicious release: Malicious code in oce-components (npm) GHSA-9h78-r65j-hjrj, MAL-2026-420 | Malicious | Not scored | 21 Jan, 2026 | npm oce-components |
Malicious release: Malicious code in oce-collaborate (npm) GHSA-9vff-q7rf-xvxw, MAL-2026-419 | Malicious | Not scored | 21 Jan, 2026 | npm oce-collaborate |
Malicious release: Malicious code in collaborate (npm) GHSA-g57h-gf4v-9mvh, MAL-2026-411 | Malicious | Not scored | 21 Jan, 2026 | npm collaborate |
Malicious release: Malicious code in oce-validate (npm) GHSA-h69m-f63v-crpg, MAL-2026-423 | Malicious | Not scored | 21 Jan, 2026 | npm oce-validate |
Malicious release: Malicious code in oce-freecoin (npm) GHSA-mc7q-fxfg-4c65, MAL-2026-421 | Malicious | Not scored | 21 Jan, 2026 | npm oce-freecoin |
Malicious release: Malicious code in shroom-kit (npm) GHSA-rhcw-7jjc-v2rq, MAL-2026-428 | Malicious | Not scored | 21 Jan, 2026 | npm shroom-kit |
Malicious release: Malicious code in clerk-js (npm) GHSA-vr7m-h7j3-rxq6, MAL-2026-410 | Malicious | Not scored | 21 Jan, 2026 | npm clerk-js |
Malicious release: Malicious code in kanban-webcomponent (npm) GHSA-9934-hp5h-qv2g, MAL-2026-417 | Malicious | Not scored | 21 Jan, 2026 | npm kanban-webcomponent |
Malicious release: Malicious code in bitbot (npm) GHSA-hg44-4gm2-crmv, MAL-2026-408 | Malicious | Not scored | 21 Jan, 2026 | npm bitbot |
Malicious release: Malicious code in coopshares-webcomponent (npm) GHSA-pv7x-9f66-mjm7, MAL-2026-413 | Malicious | Not scored | 21 Jan, 2026 | npm coopshares-webcomponent |
Malicious release: Malicious code in wallet-adapter-react (npm) GHSA-wpmx-5pw3-796j, MAL-2026-433 | Malicious | Not scored | 21 Jan, 2026 | npm wallet-adapter-react |
Malicious release: Malicious code in hw-app-eth (npm) GHSA-8frc-jmg6-9xvq, MAL-2026-416 | Malicious | Not scored | 21 Jan, 2026 | npm hw-app-eth |
Malicious release: Malicious code in sign-client (npm) GHSA-h5ch-v4cm-8vfg, MAL-2026-429 | Malicious | Not scored | 21 Jan, 2026 | npm sign-client |
Malicious release: Malicious code in anthropic-sdk (npm) GHSA-j8wc-8p9m-6fm6, MAL-2026-405 | Malicious | Not scored | 21 Jan, 2026 | npm anthropic-sdk |
Malicious release: Malicious code in universal-provider (npm) GHSA-mv62-2gmc-3q9v, MAL-2026-432 | Malicious | Not scored | 21 Jan, 2026 | npm universal-provider |
Malicious release: Malicious code in @kyriba/platform-frontend (npm) GHSA-7xwj-v69j-gcx4, MAL-2026-380 | Malicious | Not scored | 21 Jan, 2026 | npm @kyriba/platform-frontend |
Malicious release: Malicious code in internallib_v962 (npm) GHSA-fxh9-x2px-vcw4, MAL-2026-391 | Malicious | Not scored | 21 Jan, 2026 | npm internallib_v962 |
Malicious release: Malicious code in @joaoxxx/internallib-v325 (npm) GHSA-hj85-hf2m-4xg9, MAL-2026-379 | Malicious | Not scored | 21 Jan, 2026 | npm @joaoxxx/internallib-v325 |
Malicious release: Malicious code in internallib_v325 (npm) GHSA-vvqp-5rpp-x73f, MAL-2026-390 | Malicious | Not scored | 21 Jan, 2026 | npm internallib_v325 |
Malicious release: Malicious code in jsonwebauth (npm) GHSA-c7fj-3rmw-57px, MAL-2026-392 | Malicious | Not scored | 21 Jan, 2026 | npm jsonwebauth |
Malicious release: Malicious code in chai-dex (npm) GHSA-grj8-vvpv-hx8q, MAL-2026-387 | Malicious | Not scored | 21 Jan, 2026 | npm chai-dex |
Malicious release: Malicious code in chai-chain-async (npm) GHSA-9fmw-9xvf-xpqq, MAL-2026-386 | Malicious | Not scored | 21 Jan, 2026 | npm chai-chain-async |
Malicious release: Malicious code in private-internal-sdk (npm) GHSA-35m9-w5cr-7fgm, MAL-2026-396 | Malicious | Not scored | 21 Jan, 2026 | npm private-internal-sdk |
Malicious release: Malicious code in worldnormal (npm) GHSA-h55w-3xx5-rm4c, MAL-2026-403 | Malicious | Not scored | 21 Jan, 2026 | npm worldnormal |
Malicious release: Malicious code in worldposition (npm) GHSA-q829-xgcw-c34f, MAL-2026-404 | Malicious | Not scored | 21 Jan, 2026 | npm worldposition |
Malicious release: Malicious code in manage-root (npm) GHSA-rjrr-8983-84gg, MAL-2026-393 | Malicious | Not scored | 21 Jan, 2026 | npm manage-root |
Malicious release: Malicious code in vworldviewdir (npm) GHSA-w3h3-7w7v-8v6p, MAL-2026-402 | Malicious | Not scored | 21 Jan, 2026 | npm vworldviewdir |
Malicious release: Malicious code in @mikudev/beles (npm) GHSA-gphr-5mfq-w76r, MAL-2026-381 | Malicious | Not scored | 21 Jan, 2026 | npm @mikudev/beles |
Malicious release: Malicious code in @mikudev/ridwan-baileys-mod (npm) GHSA-p27v-6qg4-qjx2, MAL-2026-382 | Malicious | Not scored | 21 Jan, 2026 | npm @mikudev/ridwan-baileys-mod |
Malicious release: Malicious code in @mikudev/signal (npm) GHSA-rfrp-qchq-82j8, MAL-2026-384 | Malicious | Not scored | 21 Jan, 2026 | npm @mikudev/signal |
Malicious release: Malicious code in @mikudev/ridwan-signal (npm) GHSA-73hp-vpp4-4q38, MAL-2026-383 | Malicious | Not scored | 21 Jan, 2026 | npm @mikudev/ridwan-signal |
Malicious release: Malicious code in tor-libsignal (npm) GHSA-4x99-4pvp-6hgp, MAL-2026-398 | Malicious | Not scored | 21 Jan, 2026 | npm tor-libsignal |
Malicious release: Malicious code in torbaileys (npm) GHSA-57wh-gp48-wh22, MAL-2026-399 | Malicious | Not scored | 21 Jan, 2026 | npm torbaileys |
Malicious release: Malicious code in genki-analytics (npm) GHSA-pr49-cw2w-3qfm, MAL-2026-389 | Malicious | Not scored | 21 Jan, 2026 | npm genki-analytics |
Malicious release: Malicious code in charlie_charlie_kirky (npm) GHSA-4grw-7cr5-76pg, MAL-2026-388 | Malicious | Not scored | 21 Jan, 2026 | npm charlie_charlie_kirky |
Malicious release: Malicious code in recaptcha-cors (npm) GHSA-c2vp-98j7-jr92, MAL-2026-397 | Malicious | Not scored | 21 Jan, 2026 | npm recaptcha-cors |
Malicious release: Malicious code in n8n-nodes-zl-vietts (npm) GHSA-pq6r-5rc5-6grw, MAL-2026-394 | Malicious | Not scored | 21 Jan, 2026 | npm n8n-nodes-zl-vietts |
Malicious release: Malicious code in @diendh/n8n-nodes-tiktok-v2 (npm) GHSA-qcqh-23wh-vv44, MAL-2026-378 | Malicious | Not scored | 21 Jan, 2026 | npm @diendh/n8n-nodes-tiktok-v2 |
Malicious release: Malicious code in blocks-builder-manifest-generator (npm) GHSA-2fxr-35cv-vcwg, MAL-2026-385 | Malicious | Not scored | 21 Jan, 2026 | npm blocks-builder-manifest-generator |
Malicious release: Malicious code in natateste (npm) GHSA-29hr-9v6r-9qx7, MAL-2026-395 | Malicious | Not scored | 21 Jan, 2026 | npm natateste |