Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @servicepoint/vue-project (npm) GHSA-vwg7-c28p-rvrp, MAL-2026-260 | Malicious | Not scored | 16 Jan, 2026 | npm @servicepoint/vue-project |
Malicious release: Malicious code in chakra-ui-2--styled-system (npm) GHSA-w98q-q9gh-mhj2, MAL-2026-274 | Malicious | Not scored | 16 Jan, 2026 | npm chakra-ui-2--styled-system |
Malicious release: Malicious code in @spx-smartsorting/vue (npm) GHSA-wc42-f5gw-656w, MAL-2026-262 | Malicious | Not scored | 16 Jan, 2026 | npm @spx-smartsorting/vue |
Malicious release: Malicious code in forms-new-design (npm) GHSA-x7cr-x9qx-f6j4, MAL-2026-286 | Malicious | Not scored | 16 Jan, 2026 | npm forms-new-design |
Malicious release: Malicious code in vue_frontend_rpc (npm) GHSA-x89m-w75w-f74w, MAL-2026-319 | Malicious | Not scored | 16 Jan, 2026 | npm vue_frontend_rpc |
Malicious release: Malicious code in sd-ccp-module-client (npm) GHSA-xf24-7298-x53c, MAL-2026-305 | Malicious | Not scored | 16 Jan, 2026 | npm sd-ccp-module-client |
Malicious release: Malicious code in flag-v21 (npm) MAL-2026-283 | Malicious | Not scored | 16 Jan, 2026 | npm flag-v21 |
Malicious release: Malicious code in flag-v211 (npm) MAL-2026-284 | Malicious | Not scored | 16 Jan, 2026 | npm flag-v211 |
Malicious release: Malicious code in omnicore-ds2-sdk2 (npm) MAL-2026-298 | Malicious | Not scored | 16 Jan, 2026 | npm omnicore-ds2-sdk2 |
Malicious release: Malicious code in s3-cache-handler (npm) MAL-2026-302 | Malicious | Not scored | 16 Jan, 2026 | npm s3-cache-handler |
Malicious release: Malicious code in sky1oauth2 (npm) MAL-2026-310 | Malicious | Not scored | 16 Jan, 2026 | npm sky1oauth2 |
Malicious release: Malicious code in spire.officejs-externs (npm) MAL-2026-312 | Malicious | Not scored | 16 Jan, 2026 | npm spire.officejs-externs |
Malicious release: Malicious code in spire.officejs-fonts (npm) MAL-2026-313 | Malicious | Not scored | 16 Jan, 2026 | npm spire.officejs-fonts |
Malicious release: Malicious code in experian-design-system (npm) GHSA-jvff-mx8m-g6wr, MAL-2026-282 | Malicious | Not scored | 15 Jan, 2026 | npm experian-design-system |
Malicious release: Malicious code in webmd-page-common (npm) GHSA-j3m8-jhfm-w3qc, MAL-2026-258 | Malicious | Not scored | 14 Jan, 2026 | npm webmd-page-common |
Malicious release: Malicious code in silvermine (npm) GHSA-g37j-jvxp-qrjv, MAL-2026-257 | Malicious | Not scored | 14 Jan, 2026 | npm silvermine |
Malicious release: Malicious code in ts-tweetnacl (npm) GHSA-vj23-9g2p-fvww, MAL-2026-247 | Malicious | Not scored | 13 Jan, 2026 | npm ts-tweetnacl |
Malicious release: Malicious code in admin1001 (npm) GHSA-j48w-xpqc-jv3w, MAL-2026-246 | Malicious | Not scored | 13 Jan, 2026 | npm admin1001 |
Malicious release: Malicious code in @flipster/utils (npm) GHSA-6r97-q2pc-v98m, MAL-2026-249 | Malicious | Not scored | 13 Jan, 2026 | npm @flipster/utils |
Malicious release: Malicious code in cnamts-captcha-component (npm) GHSA-p55f-fh32-33wx, MAL-2026-245 | Malicious | Not scored | 13 Jan, 2026 | npm cnamts-captcha-component |
Malicious release: Malicious code in helium-module (npm) GHSA-v72c-68qv-fq35, MAL-2026-244 | Malicious | Not scored | 13 Jan, 2026 | npm helium-module |
Malicious release: Malicious code in francium-utils (npm) GHSA-45m3-pf6h-c243, MAL-2026-242 | Malicious | Not scored | 13 Jan, 2026 | npm francium-utils |
Malicious release: Malicious code in francium-ui (npm) GHSA-4x69-gp4j-mpm5, MAL-2026-241 | Malicious | Not scored | 13 Jan, 2026 | npm francium-ui |
Malicious release: Malicious code in francium-web-visitors (npm) GHSA-5c69-2ppp-w4fv, MAL-2026-243 | Malicious | Not scored | 13 Jan, 2026 | npm francium-web-visitors |
Malicious release: Malicious code in extended-path (npm) GHSA-3j82-vrp8-g357, MAL-2026-240 | Malicious | Not scored | 13 Jan, 2026 | npm extended-path |
Malicious release: Malicious code in chai-as-enhanced (npm) GHSA-5572-pgc4-7mjf, MAL-2026-239 | Malicious | Not scored | 13 Jan, 2026 | npm chai-as-enhanced |
Malicious release: Malicious code in paytmsiddlewaree (npm) GHSA-w8jh-cww6-w5qq, MAL-2026-238 | Malicious | Not scored | 13 Jan, 2026 | npm paytmsiddlewaree |
Malicious release: Malicious code in tailwindcss-animate-tool (npm) GHSA-p7pp-v2qj-hwpq, MAL-2026-235 | Malicious | Not scored | 12 Jan, 2026 | npm tailwindcss-animate-tool |
Malicious release: Malicious code in express-sessions-id (npm) GHSA-fj4q-29wj-89xc, MAL-2026-218 | Malicious | Not scored | 12 Jan, 2026 | npm express-sessions-id |
Malicious release: Malicious code in cors-base (npm) GHSA-r6wm-7hr4-f9mh, MAL-2026-216 | Malicious | Not scored | 12 Jan, 2026 | npm cors-base |
Malicious release: Malicious code in simple-string-utils3 (npm) GHSA-25cq-qhpp-pxcx, MAL-2026-233 | Malicious | Not scored | 12 Jan, 2026 | npm simple-string-utils3 |
Malicious release: Malicious code in passport-google-auth-token (npm) GHSA-cj6c-5gcc-8xr5, MAL-2026-230 | Malicious | Not scored | 12 Jan, 2026 | npm passport-google-auth-token |
Malicious release: Malicious code in @maxcointech/simple-string-utils (npm) GHSA-rj99-vmg6-c6f8, MAL-2026-213 | Malicious | Not scored | 12 Jan, 2026 | npm @maxcointech/simple-string-utils |
Malicious release: Malicious code in jz-test-npm (npm) GHSA-xxv7-j7jp-phx8, MAL-2026-226 | Malicious | Not scored | 12 Jan, 2026 | npm jz-test-npm |
Malicious release: Malicious code in framer-motion-js (npm) GHSA-38xp-pcxg-58xm, MAL-2026-220 | Malicious | Not scored | 12 Jan, 2026 | npm framer-motion-js |
Malicious release: Malicious code in inquirer-js (npm) GHSA-3922-g725-hr6c, MAL-2026-224 | Malicious | Not scored | 12 Jan, 2026 | npm inquirer-js |
Malicious release: Malicious code in jsdom-js (npm) GHSA-3pxr-wwfp-6g73, MAL-2026-225 | Malicious | Not scored | 12 Jan, 2026 | npm jsdom-js |
Malicious release: Malicious code in immer-js (npm) GHSA-p865-gwfh-48x2, MAL-2026-223 | Malicious | Not scored | 12 Jan, 2026 | npm immer-js |
Malicious release: Malicious code in luxon-js (npm) GHSA-phgx-7qqx-fxcj, MAL-2026-228 | Malicious | Not scored | 12 Jan, 2026 | npm luxon-js |
Malicious release: Malicious code in react-hook-form-js (npm) GHSA-xgrq-mjjc-672q, MAL-2026-232 | Malicious | Not scored | 12 Jan, 2026 | npm react-hook-form-js |
Malicious release: Malicious code in huggingface-js (npm) GHSA-5fpx-j295-mggf, MAL-2026-222 | Malicious | Not scored | 12 Jan, 2026 | npm huggingface-js |
Malicious release: Malicious code in llamaindex-js (npm) GHSA-675f-h4p7-2vp4, MAL-2026-227 | Malicious | Not scored | 12 Jan, 2026 | npm llamaindex-js |
Malicious release: Malicious code in milvus-js (npm) GHSA-j947-h9rh-h2jr, MAL-2026-229 | Malicious | Not scored | 12 Jan, 2026 | npm milvus-js |
Malicious release: Malicious code in pinecone-js (npm) GHSA-vrwr-h8hh-fj7r, MAL-2026-231 | Malicious | Not scored | 12 Jan, 2026 | npm pinecone-js |
Malicious release: Malicious code in xml2js-js (npm) GHSA-3j4r-78pf-4g5h, MAL-2026-234 | Malicious | Not scored | 12 Jan, 2026 | npm xml2js-js |
Malicious release: Malicious code in auth-types (npm) GHSA-5484-6hqr-7386, MAL-2026-215 | Malicious | Not scored | 12 Jan, 2026 | npm auth-types |
Malicious release: Malicious code in analytics-browser (npm) GHSA-67vh-wg5g-567j, MAL-2026-214 | Malicious | Not scored | 12 Jan, 2026 | npm analytics-browser |
Malicious release: Malicious code in firestore-types (npm) GHSA-757j-rhvg-2fh2, MAL-2026-219 | Malicious | Not scored | 12 Jan, 2026 | npm firestore-types |
Malicious release: Malicious code in experimental-utils (npm) GHSA-pg6r-j522-h6w7, MAL-2026-217 | Malicious | Not scored | 12 Jan, 2026 | npm experimental-utils |
Malicious release: Malicious code in gradle-plugin (npm) GHSA-q63w-ghjp-qx4j, MAL-2026-221 | Malicious | Not scored | 12 Jan, 2026 | npm gradle-plugin |