Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in godxxx (npm) MAL-2026-16461 | Malicious | Not scored | 23 Sep, 2026 | npm godxxx |
Malicious release: Malicious code in godzz (npm) MAL-2026-16462 | Malicious | Not scored | 23 Sep, 2026 | npm godzz |
Malicious release: Malicious code in godzzz (npm) MAL-2026-16463 | Malicious | Not scored | 23 Sep, 2026 | npm godzzz |
Malicious release: Malicious code in some-tool-package (npm) GHSA-55vw-cpj6-w7w8, MAL-2026-16455 | Malicious | Not scored | 23 Sep, 2026 | npm some-tool-package |
Malicious release: Malicious code in better-md (npm) GHSA-r4h9-57fh-5fj3, MAL-2026-16446 | Malicious | Not scored | 23 Sep, 2026 | npm better-md |
Malicious release: Malicious code in iso-datetime-core (npm) GHSA-fc7h-qf7q-qxw4, MAL-2026-16449 | Malicious | Not scored | 23 Sep, 2026 | npm iso-datetime-core |
Malicious release: Malicious code in debounce-throttle-base (npm) GHSA-g9m6-qcpw-g96x, MAL-2026-16448 | Malicious | Not scored | 23 Sep, 2026 | npm debounce-throttle-base |
Malicious release: Malicious code in webp-https-errors (npm) GHSA-gmm9-q3gf-4hfr, MAL-2026-16459 | Malicious | Not scored | 23 Sep, 2026 | npm webp-https-errors |
Malicious release: Malicious code in solo-async-pipe (npm) GHSA-j96p-xm58-6233, MAL-2026-16454 | Malicious | Not scored | 23 Sep, 2026 | npm solo-async-pipe |
Malicious release: Malicious code in semver-bump-io (npm) GHSA-m877-5x7f-7r88, MAL-2026-16453 | Malicious | Not scored | 23 Sep, 2026 | npm semver-bump-io |
Malicious release: Malicious code in moudeva (npm) MAL-2026-16442 | Malicious | Not scored | 23 Sep, 2026 | npm moudeva |
Malicious release: Malicious code in moidevl (npm) MAL-2026-16441 | Malicious | Not scored | 23 Sep, 2026 | npm moidevl |
Malicious release: Malicious code in caphsmgiwy (npm) GHSA-35mc-7f44-62rg, MAL-2026-16447 | Malicious | Not scored | 23 Sep, 2026 | npm caphsmgiwy |
Malicious release: Malicious code in tuxcmdfhjkw (npm) GHSA-67q5-w9wg-mvvv, MAL-2026-16458 | Malicious | Not scored | 23 Sep, 2026 | npm tuxcmdfhjkw |
Malicious release: Malicious code in xsjukcnv8low26 (npm) GHSA-6g8g-gw7h-prch, MAL-2026-16460 | Malicious | Not scored | 23 Sep, 2026 | npm xsjukcnv8low26 |
Malicious release: Malicious code in luftzxyuiwgbgsp (npm) GHSA-cppx-756q-g98p, MAL-2026-16451 | Malicious | Not scored | 23 Sep, 2026 | npm luftzxyuiwgbgsp |
Malicious release: Malicious code in mob4zchvuine (npm) GHSA-f232-pcw4-j7qg, MAL-2026-16452 | Malicious | Not scored | 23 Sep, 2026 | npm mob4zchvuine |
Malicious release: Malicious code in tib2jcvowuyma (npm) GHSA-hqgj-c9q6-8qv8, MAL-2026-16456 | Malicious | Not scored | 23 Sep, 2026 | npm tib2jcvowuyma |
Malicious release: Malicious code in kamafhbnowct (npm) GHSA-j87m-pgqx-mpg5, MAL-2026-16450 | Malicious | Not scored | 23 Sep, 2026 | npm kamafhbnowct |
Malicious release: Malicious code in tibcwmpoeafh (npm) GHSA-vcg8-c5h2-55w6, MAL-2026-16457 | Malicious | Not scored | 23 Sep, 2026 | npm tibcwmpoeafh |
Malicious release: Malicious code in n8n-nodes-healthmon (npm) MAL-2026-16444 | Malicious | Not scored | 23 Sep, 2026 | npm n8n-nodes-healthmon |
Malicious release: Malicious code in n8n-nodes-metricsagent (npm) MAL-2026-16445 | Malicious | Not scored | 23 Sep, 2026 | npm n8n-nodes-metricsagent |
Malicious release: Malicious code in my-company-device (npm) MAL-2026-16443 | Malicious | Not scored | 23 Sep, 2026 | npm my-company-device |
Malicious release: Malicious code in internallib_v550 (npm) MAL-2026-16439 | Malicious | Not scored | 23 Sep, 2026 | npm internallib_v550 |
Malicious release: Malicious code in turbo-ws (npm) GHSA-3933-m2c5-xfm8, MAL-2026-16440 | Malicious | Not scored | 23 Sep, 2026 | npm turbo-ws |
Malicious release: Malicious code in internallib_v497 (npm) GHSA-94q5-67r5-mwjx, MAL-2026-16438 | Malicious | Not scored | 23 Sep, 2026 | npm internallib_v497 |
Malicious release: Malicious code in catplatebarcodeparser (npm) MAL-2026-16434 | Malicious | Not scored | 23 Sep, 2026 | npm catplatebarcodeparser |
Malicious release: Malicious code in catqrcodeconverter (npm) MAL-2026-16435 | Malicious | Not scored | 23 Sep, 2026 | npm catqrcodeconverter |
Malicious release: Malicious code in eslint-plugin-i18n-shreddit (npm) MAL-2026-16437 | Malicious | Not scored | 23 Sep, 2026 | npm eslint-plugin-i18n-shreddit |
Malicious release: Malicious code in efhthrthrthregerht (npm) MAL-2026-16436 | Malicious | Not scored | 23 Sep, 2026 | npm efhthrthrthregerht |
Malicious release: Malicious code in @vitemirrorte/element-plus-vite-cli (npm) MAL-2026-16433 | Malicious | Not scored | 23 Sep, 2026 | npm @vitemirrorte/element-plus-vite-cli |
Malicious release: Malicious code in @wizloft/harness-file-providers (npm) GHSA-2jrv-g43f-qm7f, MAL-2026-16427 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-file-providers |
Malicious release: Malicious code in @wizloft/harness-commands (npm) GHSA-cv26-mq7q-h5hq, MAL-2026-16425 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-commands |
Malicious release: Malicious code in @wizloft/harness-cli-adapter (npm) GHSA-hmmw-27v2-3qc8, MAL-2026-16424 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-cli-adapter |
Malicious release: Malicious code in @wizloft/harness-project (npm) GHSA-xj44-gx57-mm59, MAL-2026-16432 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-project |
Malicious release: Malicious code in @wizloft/harness-memory (npm) GHSA-3mjw-625p-wvhf, MAL-2026-16428 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-memory |
Malicious release: Malicious code in @wizloft/harness-plugin-file-memory (npm) GHSA-64w5-qg43-54g7, MAL-2026-16430 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-plugin-file-memory |
Malicious release: Malicious code in @wizloft/harness-plugin-file-events (npm) GHSA-6866-wx9h-j2rh, MAL-2026-16429 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-plugin-file-events |
Malicious release: Malicious code in @wizloft/harness-authority (npm) GHSA-8h24-fp89-4cw3, MAL-2026-16423 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-authority |
Malicious release: Malicious code in @wizloft/harness-evidence (npm) GHSA-mjfj-x5qx-p7v8, MAL-2026-16426 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-evidence |
Malicious release: Malicious code in @wizloft/harness-plugin-memory-context (npm) GHSA-r4qq-8p58-gfpv, MAL-2026-16431 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-plugin-memory-context |
Malicious release: Malicious code in @httttt/mcp-npx-fetch-1 (npm) GHSA-q6m6-3rfx-7f62, MAL-2026-16422 | Malicious | Not scored | 23 Sep, 2026 | npm @httttt/mcp-npx-fetch-1 |
Malicious release: Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm) GHSA-mhjf-v53x-7p87, MAL-2026-16476 | Malicious | Not scored | 23 Sep, 2026 | npm @memtensor/memos-cloud-openclaw-plugin |
ReactPress has SQL injection via dynamic column names in TypeORM query builders CVE-2026-61685, GHSA-wmw4-mw6x-6vfm | High | 0.5% | 22 Sep, 2026 | npm @fecommunity/reactpress |
Malicious release: Malicious code in @gsutevil/hta-stage (npm) MAL-2026-16419 | Malicious | Not scored | 22 Sep, 2026 | npm @gsutevil/hta-stage |
Malicious release: Malicious code in n8n-nodes-data-transformer-utils (npm) MAL-2026-16418 | Malicious | Not scored | 22 Sep, 2026 | npm n8n-nodes-data-transformer-utils |
Malicious release: Malicious code in @tvg-mar/promos-context (npm) GHSA-f42w-v662-25cr, MAL-2026-16412 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/promos-context |
Malicious release: Malicious code in @tvg-mar/promos-gtm (npm) GHSA-8g69-976g-h44g, MAL-2026-16413 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/promos-gtm |
Malicious release: Malicious code in @tvg-mar/storyblok-bridge (npm) GHSA-3wxx-x983-53mg, MAL-2026-16414 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/storyblok-bridge |
Malicious release: Malicious code in @tvg-mar/utils (npm) GHSA-p6w4-mmhj-wc4v, MAL-2026-16416 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/utils |