Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in victim-package-c (npm) GHSA-jr87-jqjj-7rvr, MAL-2026-401 | Malicious | Not scored | 21 Jan, 2026 | npm victim-package-c |
Malicious release: Malicious code in victim-package-b (npm) GHSA-v876-w8f6-cgvx, MAL-2026-400 | Malicious | Not scored | 21 Jan, 2026 | npm victim-package-b |
Malicious release: Malicious code in potdf (npm) GHSA-h4f3-mj3f-p437, MAL-2026-377 | Malicious | Not scored | 21 Jan, 2026 | npm potdf |
Malicious release: Malicious code in mised-discordjs-selfbot-v14 (npm) GHSA-gc2c-3rm2-3685, MAL-2026-374 | Malicious | Not scored | 20 Jan, 2026 | npm mised-discordjs-selfbot-v14 |
Malicious release: Malicious code in theme-neutral (npm) GHSA-v7pw-qfwc-r9mp, MAL-2026-371 | Malicious | Not scored | 20 Jan, 2026 | npm theme-neutral |
Malicious release: Malicious code in sezzle (npm) GHSA-rcxc-74j6-jx55, MAL-2026-370 | Malicious | Not scored | 20 Jan, 2026 | npm sezzle |
Malicious release: Malicious code in webmd-debug (npm) GHSA-42w3-2gcj-hc45, MAL-2026-373 | Malicious | Not scored | 20 Jan, 2026 | npm webmd-debug |
Malicious release: Malicious code in mw-shared-utils (npm) GHSA-cf6g-q59f-wmxh, MAL-2026-369 | Malicious | Not scored | 20 Jan, 2026 | npm mw-shared-utils |
Malicious release: Malicious code in mw-proto-models (npm) GHSA-jc7r-cfpv-fj23, MAL-2026-368 | Malicious | Not scored | 20 Jan, 2026 | npm mw-proto-models |
Malicious release: Malicious code in webmd-cookie (npm) GHSA-mmmm-g8pw-whc5, MAL-2026-372 | Malicious | Not scored | 20 Jan, 2026 | npm webmd-cookie |
Malicious release: Malicious code in dreame-claude (npm) GHSA-9vmw-qh86-x859, MAL-2026-359 | Malicious | Not scored | 20 Jan, 2026 | npm dreame-claude |
Malicious release: Malicious code in uq-global-ec-uikit (npm) GHSA-24pr-w8vf-w5jr, MAL-2026-367 | Malicious | Not scored | 20 Jan, 2026 | npm uq-global-ec-uikit |
Malicious release: Malicious code in pl-global-ec-uikit (npm) GHSA-266w-v9rj-m6hr, MAL-2026-363 | Malicious | Not scored | 20 Jan, 2026 | npm pl-global-ec-uikit |
Malicious release: Malicious code in shared-global-ec-uikit (npm) GHSA-frc8-mxgg-69vc, MAL-2026-364 | Malicious | Not scored | 20 Jan, 2026 | npm shared-global-ec-uikit |
Malicious release: Malicious code in gu-global-ec-uikit (npm) GHSA-j4wf-2wr3-cw9j, MAL-2026-361 | Malicious | Not scored | 20 Jan, 2026 | npm gu-global-ec-uikit |
Malicious release: Malicious code in excel-to-json-test (npm) GHSA-v9fq-7c29-2276, MAL-2026-360 | Malicious | Not scored | 20 Jan, 2026 | npm excel-to-json-test |
Malicious release: Malicious code in telia-eventapi-client (npm) GHSA-f8r2-582m-37gr, MAL-2026-365 | Malicious | Not scored | 20 Jan, 2026 | npm telia-eventapi-client |
Malicious release: Malicious code in testing-package-bose (npm) GHSA-88rw-h3mh-h632, MAL-2026-366 | Malicious | Not scored | 20 Jan, 2026 | npm testing-package-bose |
Malicious release: Malicious code in chai-bin (npm) GHSA-j2jh-fj26-q47j, MAL-2026-357 | Malicious | Not scored | 20 Jan, 2026 | npm chai-bin |
Malicious release: Malicious code in health-check-node (npm) GHSA-rvgr-g3cf-g8jh, MAL-2026-362 | Malicious | Not scored | 20 Jan, 2026 | npm health-check-node |
Malicious release: Malicious code in dot-env-buffer (npm) GHSA-qh4x-mq28-mhqh, MAL-2026-358 | Malicious | Not scored | 20 Jan, 2026 | npm dot-env-buffer |
Malicious release: Malicious code in advanced-svg-fetcher (npm) GHSA-qr98-w5xw-vjrx, MAL-2026-353 | Malicious | Not scored | 20 Jan, 2026 | npm advanced-svg-fetcher |
Malicious release: Malicious code in dux-portal (npm) GHSA-5hr4-9hqr-m4wv, MAL-2026-354 | Malicious | Not scored | 20 Jan, 2026 | npm dux-portal |
Malicious release: Malicious code in dux-portal-privacy (npm) GHSA-f3fp-v63j-533v, MAL-2026-355 | Malicious | Not scored | 20 Jan, 2026 | npm dux-portal-privacy |
Malicious release: Malicious code in react-server-dom-unbundled (npm) GHSA-mq7q-f9vp-f9qx, MAL-2026-356 | Malicious | Not scored | 20 Jan, 2026 | npm react-server-dom-unbundled |
Malicious release: Malicious code in tutor_table (npm) GHSA-hfhc-f96x-2fm6, MAL-2026-349 | Malicious | Not scored | 19 Jan, 2026 | npm tutor_table |
Malicious release: Malicious code in react-native-webview-forked (npm) GHSA-gfr9-mcfv-qqvc, MAL-2026-348 | Malicious | Not scored | 19 Jan, 2026 | npm react-native-webview-forked |
Malicious release: Malicious code in @bingads-webui-theme-2018/theme-fluent (npm) GHSA-xxhf-h8wv-fvxf, MAL-2026-347 | Malicious | Not scored | 19 Jan, 2026 | npm @bingads-webui-theme-2018/theme-fluent |
Malicious release: Malicious code in internallib_v355 (npm) GHSA-w4wq-pc2v-rw4r, MAL-2026-339 | Malicious | Not scored | 19 Jan, 2026 | npm internallib_v355 |
Malicious release: Malicious code in ofjaaah-auth-module (npm) GHSA-58p8-pqhg-w25w, MAL-2026-341 | Malicious | Not scored | 19 Jan, 2026 | npm ofjaaah-auth-module |
Malicious release: Malicious code in ofjaaah-security-lib (npm) GHSA-6vhq-9rv5-4fhh, MAL-2026-344 | Malicious | Not scored | 19 Jan, 2026 | npm ofjaaah-security-lib |
Malicious release: Malicious code in ofjaaah-build-tools (npm) GHSA-6w58-gfqh-9m8f, MAL-2026-342 | Malicious | Not scored | 19 Jan, 2026 | npm ofjaaah-build-tools |
Malicious release: Malicious code in private-payment-lib (npm) GHSA-cj92-mmxc-m23c, MAL-2026-345 | Malicious | Not scored | 19 Jan, 2026 | npm private-payment-lib |
Malicious release: Malicious code in ofjaaah-internal-utils (npm) GHSA-f477-h27j-73mq, MAL-2026-343 | Malicious | Not scored | 19 Jan, 2026 | npm ofjaaah-internal-utils |
Malicious release: Malicious code in internal-company-sdk (npm) GHSA-gjfx-xc74-r6gx, MAL-2026-338 | Malicious | Not scored | 19 Jan, 2026 | npm internal-company-sdk |
Malicious release: Malicious code in @cda-apps/source (npm) GHSA-6gqx-gcxc-q57c, MAL-2026-336 | Malicious | Not scored | 19 Jan, 2026 | npm @cda-apps/source |
Malicious release: Malicious code in chai-as-executed (npm) GHSA-v4xj-7hwf-8j5p, MAL-2026-337 | Malicious | Not scored | 19 Jan, 2026 | npm chai-as-executed |
Malicious release: Malicious code in libsignal-yazxzcode (npm) GHSA-7f3f-f4mw-rcrm, MAL-2026-340 | Malicious | Not scored | 19 Jan, 2026 | npm libsignal-yazxzcode |
Malicious release: Malicious code in zod-js (npm) GHSA-6h2f-4qcq-99fr, MAL-2026-346 | Malicious | Not scored | 19 Jan, 2026 | npm zod-js |
Malicious release: Malicious code in wac-react-relay (npm) GHSA-h56r-m52j-p8mj, MAL-2026-335 | Malicious | Not scored | 19 Jan, 2026 | npm wac-react-relay |
Malicious release: Malicious code in @brokenzzz/garfish (npm) GHSA-vxcp-cr2c-vq4r, MAL-2026-329 | Malicious | Not scored | 19 Jan, 2026 | npm @brokenzzz/garfish |
Malicious release: Malicious code in 1231dai (npm) GHSA-7v67-7g8x-pph4, MAL-2026-328 | Malicious | Not scored | 19 Jan, 2026 | npm 1231dai |
Malicious release: Malicious code in viem-js (npm) GHSA-257w-wr4p-5rxp, MAL-2026-334 | Malicious | Not scored | 19 Jan, 2026 | npm viem-js |
Malicious release: Malicious code in cyrpto (npm) GHSA-4pxr-pch5-8x98, MAL-2026-331 | Malicious | Not scored | 19 Jan, 2026 | npm cyrpto |
Malicious release: Malicious code in tailwin (npm) GHSA-vfm7-jg7w-6mwv, MAL-2026-332 | Malicious | Not scored | 19 Jan, 2026 | npm tailwin |
Malicious release: Malicious code in tronweb-tool (npm) GHSA-6w7h-3h2q-h6qm, MAL-2026-333 | Malicious | Not scored | 19 Jan, 2026 | npm tronweb-tool |
Malicious release: Malicious code in @daffadeveloper/signal-node (npm) GHSA-m9wr-f6xx-j3p9, MAL-2026-330 | Malicious | Not scored | 19 Jan, 2026 | npm @daffadeveloper/signal-node |
Malicious release: Malicious code in typedoc-plugin-fuel-variants (npm) MAL-2026-324 | Malicious | Not scored | 17 Jan, 2026 | npm typedoc-plugin-fuel-variants |
Malicious release: Malicious code in eslint-plugin-fuel-react (npm) MAL-2026-323 | Malicious | Not scored | 17 Jan, 2026 | npm eslint-plugin-fuel-react |
Malicious release: Malicious code in mapkit-example-vanillajs (npm) GHSA-w856-vp94-4mqj, MAL-2026-327 | Malicious | Not scored | 17 Jan, 2026 | npm mapkit-example-vanillajs |