Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in n8n-nodes-csv-parse (npm) GHSA-ffvh-hxxc-qgqq, MAL-2026-1467 | Malicious | Not scored | 16 Mar, 2026 | npm n8n-nodes-csv-parse |
Malicious release: Malicious code in n8n-nodes-xml-utils (npm) GHSA-fm65-938r-jvjw, MAL-2026-1472 | Malicious | Not scored | 16 Mar, 2026 | npm n8n-nodes-xml-utils |
Malicious release: Malicious code in n8n-nodes-text-utils (npm) GHSA-m4cr-jqq9-pf5g, MAL-2026-1471 | Malicious | Not scored | 16 Mar, 2026 | npm n8n-nodes-text-utils |
Malicious release: Malicious code in hariprasath (npm) GHSA-fm2v-p7vm-ccc3, MAL-2026-1465 | Malicious | Not scored | 16 Mar, 2026 | npm hariprasath |
Malicious release: Malicious code in supplychain-security-demo (npm) GHSA-mcp5-j24x-66wp, MAL-2026-1466 | Malicious | Not scored | 16 Mar, 2026 | npm supplychain-security-demo |
Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling CVE-2026-32774, GHSA-pg4p-2985-gvxr, GHSA-vggc-6pg2-xvp9 | Medium | 0.3% | 16 Mar, 2026 | npm vulnogram |
XSS in @leanprover/unicode-input-component CVE-2026-32732, GHSA-6ggm-pwr9-r5h2 | Low | 0.3% | 16 Mar, 2026 | npm @leanprover/unicode-input-component |
Malicious release: Malicious code in @jaime9008/math-service (npm) GHSA-rg2r-h6hr-96rp, MAL-2026-1483 | Malicious | Not scored | 16 Mar, 2026 | npm @jaime9008/math-service |
Malicious release: Malicious code in pretty-changelog-logger (npm) GHSA-3vhh-6v5q-2pqr, MAL-2026-1464 | Malicious | Not scored | 16 Mar, 2026 | npm pretty-changelog-logger |
Malicious release: Malicious code in changelog-logger-wrapper (npm) GHSA-7mxm-q4r9-c76c, MAL-2026-1460 | Malicious | Not scored | 16 Mar, 2026 | npm changelog-logger-wrapper |
Malicious release: Malicious code in polymarket-validator (npm) GHSA-8gcg-fc8h-ph97, MAL-2026-1463 | Malicious | Not scored | 16 Mar, 2026 | npm polymarket-validator |
Malicious release: Malicious code in changelog-logger-utilities (npm) GHSA-9qjw-vmcc-7pvj, MAL-2026-1459 | Malicious | Not scored | 16 Mar, 2026 | npm changelog-logger-utilities |
Malicious release: Malicious code in npm-demoo-1111 (npm) GHSA-74gg-g7w6-f3vx, MAL-2026-1462 | Malicious | Not scored | 16 Mar, 2026 | npm npm-demoo-1111 |
Malicious release: Malicious code in npm-demo-1112 (npm) GHSA-qq4j-p46h-m3gr, MAL-2026-1461 | Malicious | Not scored | 16 Mar, 2026 | npm npm-demo-1112 |
Malicious release: Malicious code in trello-enterprises (npm) MAL-2026-1486 | Malicious | Not scored | 16 Mar, 2026 | npm trello-enterprises |
Malicious release: Malicious code in react-refresh-update (npm) MAL-2026-1485 | Malicious | Not scored | 16 Mar, 2026 | npm react-refresh-update |
Malicious release: Malicious code in internal-lib-vulnerable (npm) MAL-2026-1484 | Malicious | Not scored | 16 Mar, 2026 | npm internal-lib-vulnerable |
Malicious release: Malicious code in vitest-config (npm) GHSA-hwjw-5fqq-736g, MAL-2026-1487 | Malicious | Not scored | 16 Mar, 2026 | npm vitest-config |
Malicious release: Malicious code in @wealth-common/font (npm) GHSA-cgmf-p7fr-9qwp, MAL-2026-1458 | Malicious | Not scored | 16 Mar, 2026 | npm @wealth-common/font |
Malicious release: Malicious code in @myisrfn/baileys-mod (npm) GHSA-p985-7chr-5h8c, MAL-2026-1450 | Malicious | Not scored | 16 Mar, 2026 | npm @myisrfn/baileys-mod |
Malicious release: Malicious code in @sheniraid/baileys (npm) GHSA-5g36-7rfc-494g, MAL-2026-1451 | Malicious | Not scored | 16 Mar, 2026 | npm @sheniraid/baileys |
Malicious release: Malicious code in @sheniraid/libsignal-node (npm) GHSA-q823-m447-4rqv, MAL-2026-1452 | Malicious | Not scored | 16 Mar, 2026 | npm @sheniraid/libsignal-node |
Malicious release: Malicious code in big-numben (npm) GHSA-3q53-ww3h-grwr, MAL-2026-1441 | Malicious | Not scored | 16 Mar, 2026 | npm big-numben |
Malicious release: Malicious code in es-lint-builder (npm) GHSA-5mcx-ff2q-gjjf, MAL-2026-1443 | Malicious | Not scored | 16 Mar, 2026 | npm es-lint-builder |
Malicious release: Malicious code in bignumber-tool.js (npm) GHSA-9729-xvw4-vxhv, MAL-2026-1442 | Malicious | Not scored | 16 Mar, 2026 | npm bignumber-tool.js |
Malicious release: Malicious code in graphql-request-dom (npm) GHSA-xpwh-9c8h-h7g5, MAL-2026-1444 | Malicious | Not scored | 16 Mar, 2026 | npm graphql-request-dom |
Malicious release: Malicious code in testpoc01 (npm) GHSA-5g7p-pqgh-526c, MAL-2026-1447 | Malicious | Not scored | 16 Mar, 2026 | npm testpoc01 |
Malicious release: Malicious code in @omhc/libsignal-node (npm) GHSA-66xh-xm59-3f4v, MAL-2026-1439 | Malicious | Not scored | 16 Mar, 2026 | npm @omhc/libsignal-node |
Malicious release: Malicious code in omhcsilence-bails (npm) GHSA-7838-42h9-x99p, MAL-2026-1446 | Malicious | Not scored | 16 Mar, 2026 | npm omhcsilence-bails |
Malicious release: Malicious code in @vtim/xss-poc (npm) GHSA-w9f6-gprr-mq9q, MAL-2026-1440 | Malicious | Not scored | 16 Mar, 2026 | npm @vtim/xss-poc |
Malicious release: Malicious code in vtimmmmmm-test (npm) GHSA-x5fc-8733-w2fh, MAL-2026-1449 | Malicious | Not scored | 16 Mar, 2026 | npm vtimmmmmm-test |
Malicious release: Malicious code in nest-moralis (npm) GHSA-c29x-5m4q-2c7c, MAL-2026-1445 | Malicious | Not scored | 16 Mar, 2026 | npm nest-moralis |
Malicious release: Malicious code in up2-daemon (npm) GHSA-f7c6-mjg7-4m48, MAL-2026-1448 | Malicious | Not scored | 16 Mar, 2026 | npm up2-daemon |
Malicious release: Malicious code in monorepo-cop (npm) GHSA-25q2-f9vw-3hf3, MAL-2026-1523 | Malicious | Not scored | 16 Mar, 2026 | npm monorepo-cop |
Malicious release: Malicious code in transform-es2015-parameters (npm) GHSA-2gfq-7ff6-3mr7, MAL-2026-1562 | Malicious | Not scored | 16 Mar, 2026 | npm transform-es2015-parameters |
Malicious release: Malicious code in transform-es2015-shorthand-properties (npm) GHSA-3hr5-9jhx-97c5, MAL-2026-1563 | Malicious | Not scored | 16 Mar, 2026 | npm transform-es2015-shorthand-properties |
Malicious release: Malicious code in styled-components-a11y (npm) GHSA-42g4-g458-9wx9, MAL-2026-1530 | Malicious | Not scored | 16 Mar, 2026 | npm styled-components-a11y |
Malicious release: Malicious code in transform-spread (npm) GHSA-44fq-5mh8-r5hg, MAL-2026-1574 | Malicious | Not scored | 16 Mar, 2026 | npm transform-spread |
Malicious release: Malicious code in transform-remove-debugger (npm) GHSA-4ghw-5pcp-gwx4, MAL-2026-1509 | Malicious | Not scored | 16 Mar, 2026 | npm transform-remove-debugger |
Malicious release: Malicious code in transform-for-of (npm) GHSA-4h33-vfc6-f2hh, MAL-2026-1566 | Malicious | Not scored | 16 Mar, 2026 | npm transform-for-of |
Malicious release: Malicious code in transform-minify-booleans (npm) GHSA-4jcp-9jcj-hxmc, MAL-2026-1506 | Malicious | Not scored | 16 Mar, 2026 | npm transform-minify-booleans |
Malicious release: Malicious code in typescript-resolvers (npm) GHSA-54wx-3rwx-8xmw, MAL-2026-1536 | Malicious | Not scored | 16 Mar, 2026 | npm typescript-resolvers |
Malicious release: Malicious code in syntax-class-constructor-call (npm) GHSA-5q5v-hjmh-q323, MAL-2026-1548 | Malicious | Not scored | 16 Mar, 2026 | npm syntax-class-constructor-call |
Malicious release: Malicious code in relay-optimizer-plugin (npm) GHSA-5xjr-8v7w-38j9, MAL-2026-1539 | Malicious | Not scored | 16 Mar, 2026 | npm relay-optimizer-plugin |
Malicious release: Malicious code in require-in-package (npm) GHSA-5xq6-c5wc-f6x9, MAL-2026-1529 | Malicious | Not scored | 16 Mar, 2026 | npm require-in-package |
Malicious release: Malicious code in pear-wrk-wdk (npm) GHSA-6484-87wm-h229, MAL-2026-1547 | Malicious | Not scored | 16 Mar, 2026 | npm pear-wrk-wdk |
Malicious release: Malicious code in transform-inline-consecutive-adds (npm) GHSA-6jrx-v84r-9g5m, MAL-2026-1568 | Malicious | Not scored | 16 Mar, 2026 | npm transform-inline-consecutive-adds |
Malicious release: Malicious code in typescript-validation-schema (npm) GHSA-7fgc-cc3q-qj25, MAL-2026-1554 | Malicious | Not scored | 16 Mar, 2026 | npm typescript-validation-schema |
Malicious release: Malicious code in transform-es2015-spread (npm) GHSA-7fpm-p46r-h37g, MAL-2026-1564 | Malicious | Not scored | 16 Mar, 2026 | npm transform-es2015-spread |
Malicious release: Malicious code in transform-charcodes (npm) GHSA-8m7g-rpw2-w26v, MAL-2026-1559 | Malicious | Not scored | 16 Mar, 2026 | npm transform-charcodes |