Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in react-fast-utilsa (npm) MAL-2026-1835 | Malicious | Not scored | 18 Mar, 2026 | npm react-fast-utilsa |
Malicious release: Malicious code in rce-pkg-1 (npm) MAL-2026-1833 | Malicious | Not scored | 18 Mar, 2026 | npm rce-pkg-1 |
Malicious release: Malicious code in rce-pkg-2 (npm) MAL-2026-1834 | Malicious | Not scored | 18 Mar, 2026 | npm rce-pkg-2 |
Malicious release: Malicious code in ranko887 (npm) MAL-2026-1832 | Malicious | Not scored | 18 Mar, 2026 | npm ranko887 |
Malicious release: Malicious code in rabbitmq-sdk (npm) MAL-2026-1831 | Malicious | Not scored | 18 Mar, 2026 | npm rabbitmq-sdk |
Malicious release: Malicious code in r1dfg6789 (npm) MAL-2026-1830 | Malicious | Not scored | 18 Mar, 2026 | npm r1dfg6789 |
Malicious release: Malicious code in pru-lib-ng (npm) MAL-2026-1829 | Malicious | Not scored | 18 Mar, 2026 | npm pru-lib-ng |
Malicious release: Malicious code in proleis-web-scanner (npm) MAL-2026-1828 | Malicious | Not scored | 18 Mar, 2026 | npm proleis-web-scanner |
Malicious release: Malicious code in proleis-web-gallery (npm) MAL-2026-1827 | Malicious | Not scored | 18 Mar, 2026 | npm proleis-web-gallery |
Malicious release: Malicious code in proleis-web-file-input (npm) MAL-2026-1826 | Malicious | Not scored | 18 Mar, 2026 | npm proleis-web-file-input |
Malicious release: Malicious code in proleis-web-animations (npm) MAL-2026-1824 | Malicious | Not scored | 18 Mar, 2026 | npm proleis-web-animations |
Malicious release: Malicious code in proleis-web-app (npm) MAL-2026-1825 | Malicious | Not scored | 18 Mar, 2026 | npm proleis-web-app |
Malicious release: Malicious code in proleis-rest-client (npm) MAL-2026-1823 | Malicious | Not scored | 18 Mar, 2026 | npm proleis-rest-client |
Malicious release: Malicious code in postcss-hotfix (npm) MAL-2026-1822 | Malicious | Not scored | 18 Mar, 2026 | npm postcss-hotfix |
Malicious release: Malicious code in portal-lime (npm) MAL-2026-1821 | Malicious | Not scored | 18 Mar, 2026 | npm portal-lime |
Malicious release: Malicious code in player-common-controls (npm) MAL-2026-1820 | Malicious | Not scored | 18 Mar, 2026 | npm player-common-controls |
Malicious release: Malicious code in player-common-composites (npm) MAL-2026-1819 | Malicious | Not scored | 18 Mar, 2026 | npm player-common-composites |
Malicious release: Malicious code in player-button (npm) MAL-2026-1818 | Malicious | Not scored | 18 Mar, 2026 | npm player-button |
Malicious release: Malicious code in plate-playground-template (npm) MAL-2026-1817 | Malicious | Not scored | 18 Mar, 2026 | npm plate-playground-template |
Malicious release: Malicious code in pkgnewfefame1 (npm) MAL-2026-1816 | Malicious | Not scored | 18 Mar, 2026 | npm pkgnewfefame1 |
Malicious release: Malicious code in pkg1511222 (npm) MAL-2026-1815 | Malicious | Not scored | 18 Mar, 2026 | npm pkg1511222 |
Malicious release: Malicious code in phx-core5 (npm) MAL-2026-1814 | Malicious | Not scored | 18 Mar, 2026 | npm phx-core5 |
Malicious release: Malicious code in phx-core4 (npm) MAL-2026-1813 | Malicious | Not scored | 18 Mar, 2026 | npm phx-core4 |
Malicious release: Malicious code in phx-core3 (npm) MAL-2026-1812 | Malicious | Not scored | 18 Mar, 2026 | npm phx-core3 |
Malicious release: Malicious code in phx-core2 (npm) MAL-2026-1811 | Malicious | Not scored | 18 Mar, 2026 | npm phx-core2 |
Malicious release: Malicious code in phx-core1 (npm) MAL-2026-1810 | Malicious | Not scored | 18 Mar, 2026 | npm phx-core1 |
Malicious release: Malicious code in ph-common (npm) MAL-2026-1809 | Malicious | Not scored | 18 Mar, 2026 | npm ph-common |
Malicious release: Malicious code in path-to-regexp-updated (npm) MAL-2026-1808 | Malicious | Not scored | 18 Mar, 2026 | npm path-to-regexp-updated |
Malicious release: Malicious code in paramount-cmp-html5 (npm) MAL-2026-1807 | Malicious | Not scored | 18 Mar, 2026 | npm paramount-cmp-html5 |
Malicious release: Malicious code in ok-jest-config (npm) MAL-2026-1806 | Malicious | Not scored | 18 Mar, 2026 | npm ok-jest-config |
Malicious release: Malicious code in notification-settings-layout (npm) MAL-2026-1805 | Malicious | Not scored | 18 Mar, 2026 | npm notification-settings-layout |
Malicious release: Malicious code in not-remix (npm) GHSA-gqr5-q75j-59gr, MAL-2026-1804 | Malicious | Not scored | 18 Mar, 2026 | npm not-remix |
Malicious release: Malicious code in node-intend (npm) MAL-2026-1803 | Malicious | Not scored | 18 Mar, 2026 | npm node-intend |
Malicious release: Malicious code in node-cli-dotenv (npm) MAL-2026-1802 | Malicious | Not scored | 18 Mar, 2026 | npm node-cli-dotenv |
Malicious release: Malicious code in no6gg (npm) MAL-2026-1801 | Malicious | Not scored | 18 Mar, 2026 | npm no6gg |
Malicious release: Malicious code in nicfv (npm) MAL-2026-1800 | Malicious | Not scored | 18 Mar, 2026 | npm nicfv |
Malicious release: Malicious code in nf-cl-logger-test2 (npm) MAL-2026-1799 | Malicious | Not scored | 18 Mar, 2026 | npm nf-cl-logger-test2 |
Malicious release: Malicious code in nf-cl-logger-test (npm) MAL-2026-1798 | Malicious | Not scored | 18 Mar, 2026 | npm nf-cl-logger-test |
Malicious release: Malicious code in nextiva-dot-com (npm) MAL-2026-1797 | Malicious | Not scored | 18 Mar, 2026 | npm nextiva-dot-com |
Malicious release: Malicious code in netlify-claude-ai (npm) MAL-2026-1796 | Malicious | Not scored | 18 Mar, 2026 | npm netlify-claude-ai |
Malicious release: Malicious code in nchain-clone (npm) MAL-2026-1795 | Malicious | Not scored | 18 Mar, 2026 | npm nchain-clone |
Malicious release: Malicious code in my-benefits-web (npm) MAL-2026-1794 | Malicious | Not scored | 18 Mar, 2026 | npm my-benefits-web |
SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks CVE-2026-33060, GHSA-3xm7-qw7j-qc8v | Medium | 0.3% | 18 Mar, 2026 | npm @aborruso/ckan-mcp-server |
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. CVE-2026-32763, GHSA-wmrf-hv6w-mr66 | High | 0.4% | 18 Mar, 2026 | npm kysely |
Malicious release: Malicious code in mitel (npm) MAL-2026-1793 | Malicious | Not scored | 18 Mar, 2026 | npm mitel |
Malicious release: Malicious code in metro-evaluator (npm) MAL-2026-1792 | Malicious | Not scored | 18 Mar, 2026 | npm metro-evaluator |
Malicious release: Malicious code in meridix (npm) MAL-2026-1791 | Malicious | Not scored | 18 Mar, 2026 | npm meridix |
Malicious release: Malicious code in manifest-confusion-poc-audit (npm) MAL-2026-1790 | Malicious | Not scored | 18 Mar, 2026 | npm manifest-confusion-poc-audit |
Malicious release: Malicious code in loyalty-card (npm) MAL-2026-1789 | Malicious | Not scored | 18 Mar, 2026 | npm loyalty-card |
Malicious release: Malicious code in libxmlrussia2 (npm) MAL-2026-1788 | Malicious | Not scored | 18 Mar, 2026 | npm libxmlrussia2 |