Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in openblox-ts (npm) GHSA-59qx-85r3-h37j, MAL-2026-101 | Malicious | Not scored | 07 Jan, 2026 | npm openblox-ts |
Malicious release: Malicious code in eslint-plugin-supertest (npm) GHSA-8p6w-g2jw-h46q, MAL-2026-100 | Malicious | Not scored | 07 Jan, 2026 | npm eslint-plugin-supertest |
Malicious release: Malicious code in redis-cookie-ts (npm) GHSA-jm3x-2mc2-v7xf, MAL-2026-102 | Malicious | Not scored | 07 Jan, 2026 | npm redis-cookie-ts |
Malicious release: Malicious code in elastic-docs-v3-utilities (npm) GHSA-2jpc-7j69-3hpx, MAL-2026-85 | Malicious | Not scored | 06 Jan, 2026 | npm elastic-docs-v3-utilities |
Malicious release: Malicious code in evm-gateway-contracts-private (npm) GHSA-pc73-wmwf-xpcr, MAL-2026-88 | Malicious | Not scored | 06 Jan, 2026 | npm evm-gateway-contracts-private |
Malicious release: Malicious code in code-review-frontend (npm) GHSA-876w-v2q8-4hmr, MAL-2026-84 | Malicious | Not scored | 06 Jan, 2026 | npm code-review-frontend |
Malicious release: Malicious code in x-clients-features (npm) GHSA-p2x4-8c93-j38q, MAL-2026-95 | Malicious | Not scored | 06 Jan, 2026 | npm x-clients-features |
Malicious release: Malicious code in electra-web-player-event (npm) GHSA-cmrr-4hqq-rhhf, MAL-2026-87 | Malicious | Not scored | 06 Jan, 2026 | npm electra-web-player-event |
Malicious release: Malicious code in shopify-perf-kit (npm) GHSA-jw6p-pj4v-q43j, MAL-2026-94 | Malicious | Not scored | 06 Jan, 2026 | npm shopify-perf-kit |
Malicious release: Malicious code in importmap-polyfil (npm) GHSA-m365-ph8h-jmwf, MAL-2026-89 | Malicious | Not scored | 06 Jan, 2026 | npm importmap-polyfil |
Malicious release: Malicious code in okta-loginpage-render (npm) GHSA-mpr5-992q-49cx, MAL-2026-92 | Malicious | Not scored | 06 Jan, 2026 | npm okta-loginpage-render |
Malicious release: Malicious code in matic-transfer-consumer (npm) GHSA-p7h3-8m4j-fw27, MAL-2026-90 | Malicious | Not scored | 06 Jan, 2026 | npm matic-transfer-consumer |
Malicious release: Malicious code in electra-web-player (npm) GHSA-pcx5-h28j-38cg, MAL-2026-86 | Malicious | Not scored | 06 Jan, 2026 | npm electra-web-player |
Malicious release: Malicious code in okta-signin-widget (npm) GHSA-r3jx-4g39-9qjm, MAL-2026-93 | Malicious | Not scored | 06 Jan, 2026 | npm okta-signin-widget |
Malicious release: Malicious code in okta-auth-js (npm) GHSA-vf5w-f7rc-4hrj, MAL-2026-91 | Malicious | Not scored | 06 Jan, 2026 | npm okta-auth-js |
Malicious release: Malicious code in polymarket-clob (npm) GHSA-hcj7-4cx9-9g6q, MAL-2026-77 | Malicious | Not scored | 06 Jan, 2026 | npm polymarket-clob |
Malicious release: Malicious code in ethos2.0 (npm) GHSA-3526-6w6q-27cm, MAL-2026-75 | Malicious | Not scored | 06 Jan, 2026 | npm ethos2.0 |
Malicious release: Malicious code in react-native-kyc (npm) GHSA-4p2x-3qwc-7rx3, MAL-2026-78 | Malicious | Not scored | 06 Jan, 2026 | npm react-native-kyc |
Malicious release: Malicious code in smartspacestoreapp (npm) GHSA-4xhh-rhhc-8xw6, MAL-2026-80 | Malicious | Not scored | 06 Jan, 2026 | npm smartspacestoreapp |
Malicious release: Malicious code in wikibuy-mobile-analytics (npm) GHSA-5rjq-m8xg-68ww, MAL-2026-83 | Malicious | Not scored | 06 Jan, 2026 | npm wikibuy-mobile-analytics |
Malicious release: Malicious code in open-telemetry-mini-client (npm) GHSA-8962-3mh7-58pr, MAL-2026-76 | Malicious | Not scored | 06 Jan, 2026 | npm open-telemetry-mini-client |
Malicious release: Malicious code in seanp-test-package-do-not-use2 (npm) GHSA-fm2f-ghwv-hvrw, MAL-2026-79 | Malicious | Not scored | 06 Jan, 2026 | npm seanp-test-package-do-not-use2 |
Malicious release: Malicious code in upgrade-mobile (npm) GHSA-ggjj-h3c7-hv47, MAL-2026-81 | Malicious | Not scored | 06 Jan, 2026 | npm upgrade-mobile |
Malicious release: Malicious code in wikibuy-mobile (npm) GHSA-m4g9-w4p4-6rhg, MAL-2026-82 | Malicious | Not scored | 06 Jan, 2026 | npm wikibuy-mobile |
Malicious release: Malicious code in cp_amm (npm) GHSA-qjp3-7854-4xfc, MAL-2026-74 | Malicious | Not scored | 06 Jan, 2026 | npm cp_amm |
Malicious release: Malicious code in bignumber.js-new (npm) GHSA-wfxh-ph5v-mqgv, MAL-2026-72 | Malicious | Not scored | 06 Jan, 2026 | npm bignumber.js-new |
Malicious release: Malicious code in chai-as-required (npm) GHSA-fxq5-9w23-cggc, MAL-2026-73 | Malicious | Not scored | 06 Jan, 2026 | npm chai-as-required |
Malicious release: Malicious code in redis-request-parser (npm) GHSA-wffw-vj4r-vqc2, MAL-2026-71 | Malicious | Not scored | 06 Jan, 2026 | npm redis-request-parser |
Malicious release: Malicious code in @shop-cicd/webpack-package-artifact (npm) GHSA-m92m-8f5v-2qc4, MAL-2026-70 | Malicious | Not scored | 06 Jan, 2026 | npm @shop-cicd/webpack-package-artifact |
Malicious release: Malicious code in n8n-performance-metrics (npm) GHSA-f36h-5w69-v3gg, MAL-2026-69 | Malicious | Not scored | 06 Jan, 2026 | npm n8n-performance-metrics |
Malicious release: Malicious code in n8n-nodes-performance-metrics (npm) GHSA-f6mv-mcr8-fx9v, MAL-2026-68 | Malicious | Not scored | 06 Jan, 2026 | npm n8n-nodes-performance-metrics |
Malicious release: Malicious code in redis-cookie-parser (npm) GHSA-8p37-qwm5-pmmc, MAL-2026-67 | Malicious | Not scored | 06 Jan, 2026 | npm redis-cookie-parser |
Malicious release: Malicious code in eslint-supertest (npm) GHSA-w2jj-v9w4-6c56, MAL-2026-58 | Malicious | Not scored | 06 Jan, 2026 | npm eslint-supertest |
Malicious release: Malicious code in redis-cookie-js (npm) GHSA-x45j-xp3r-xhpr, MAL-2026-66 | Malicious | Not scored | 06 Jan, 2026 | npm redis-cookie-js |
Malicious release: Malicious code in oj-sp-common-util (npm) GHSA-ccq6-q67g-g6h4, MAL-2026-63 | Malicious | Not scored | 06 Jan, 2026 | npm oj-sp-common-util |
Malicious release: Malicious code in oj-sp-messages-banner (npm) GHSA-j6gc-mh7f-664c, MAL-2026-65 | Malicious | Not scored | 06 Jan, 2026 | npm oj-sp-messages-banner |
Malicious release: Malicious code in oj-sp-css-additions (npm) GHSA-x2r2-5qgq-gv97, MAL-2026-64 | Malicious | Not scored | 06 Jan, 2026 | npm oj-sp-css-additions |
Malicious release: Malicious code in oj-sp-common (npm) GHSA-8m9j-cv9p-hw75, MAL-2026-61 | Malicious | Not scored | 06 Jan, 2026 | npm oj-sp-common |
Malicious release: Malicious code in oj-sp-about-page (npm) GHSA-v7cp-744w-37v6, MAL-2026-60 | Malicious | Not scored | 06 Jan, 2026 | npm oj-sp-about-page |
Malicious release: Malicious code in oj-sp-common-strings (npm) GHSA-wv3r-36w4-jc8g, MAL-2026-62 | Malicious | Not scored | 06 Jan, 2026 | npm oj-sp-common-strings |
Malicious release: Malicious code in hello-world-npm-demo-example (npm) GHSA-28cc-p24p-9v6w, MAL-2026-59 | Malicious | Not scored | 06 Jan, 2026 | npm hello-world-npm-demo-example |
Malicious release: Malicious code in react-transition-group-legacy (npm) MAL-2026-57 | Malicious | Not scored | 05 Jan, 2026 | npm react-transition-group-legacy |
Malicious release: Malicious code in @crepo/crepo-url-query-mapper (npm) MAL-2026-56 | Malicious | Not scored | 05 Jan, 2026 | npm @crepo/crepo-url-query-mapper |
Malicious release: Malicious code in faceplate-ui (npm) GHSA-vwmp-5366-h59v, MAL-2026-50 | Malicious | Not scored | 05 Jan, 2026 | npm faceplate-ui |
Malicious release: Malicious code in diskho (npm) MAL-2026-49 | Malicious | Not scored | 05 Jan, 2026 | npm diskho |
Malicious release: Malicious code in shop-state (npm) MAL-2026-48 | Malicious | Not scored | 05 Jan, 2026 | npm shop-state |
Malicious release: Malicious code in @airtel-web/legos (npm) GHSA-22x6-7f33-8w4f, MAL-2026-44 | Malicious | Not scored | 05 Jan, 2026 | npm @airtel-web/legos |
Malicious release: Malicious code in @signify/vue-components (npm) GHSA-j8hr-3qpv-xqf3, MAL-2026-45 | Malicious | Not scored | 05 Jan, 2026 | npm @signify/vue-components |
Malicious release: Malicious code in published_at (npm) GHSA-8xrh-276g-pwhf, MAL-2026-43 | Malicious | Not scored | 05 Jan, 2026 | npm published_at |
Malicious release: Malicious code in spire.officejs-document (npm) MAL-2026-41 | Malicious | Not scored | 05 Jan, 2026 | npm spire.officejs-document |