Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in tripica-library (npm) MAL-2026-507 | Malicious | Not scored | 26 Jan, 2026 | npm tripica-library |
Malicious release: Malicious code in braintree-web-latest (npm) GHSA-97xw-rj6v-j7xc, MAL-2026-554 | Malicious | Not scored | 25 Jan, 2026 | npm braintree-web-latest |
Malicious release: Malicious code in overstock-component-library (npm) GHSA-7jpx-8c37-86g4, MAL-2026-512 | Malicious | Not scored | 25 Jan, 2026 | npm overstock-component-library |
Malicious release: Malicious code in overstock-login-layer (npm) GHSA-mwfv-m2qw-57w9, MAL-2026-516 | Malicious | Not scored | 25 Jan, 2026 | npm overstock-login-layer |
Malicious release: Malicious code in ostk-otel-autoconfig (npm) GHSA-wcfp-f27x-6p4p, MAL-2026-511 | Malicious | Not scored | 25 Jan, 2026 | npm ostk-otel-autoconfig |
Malicious release: Malicious code in overstock-component-library-v3 (npm) GHSA-9wh8-6mc2-6396, MAL-2026-513 | Malicious | Not scored | 25 Jan, 2026 | npm overstock-component-library-v3 |
Malicious release: Malicious code in zabittest11 (npm) MAL-2026-500 | Malicious | Not scored | 25 Jan, 2026 | npm zabittest11 |
Malicious release: Malicious code in overstock-jenkins (npm) GHSA-wg22-7286-wgvx, MAL-2026-515 | Malicious | Not scored | 23 Jan, 2026 | npm overstock-jenkins |
Malicious release: Malicious code in overstock-health-express (npm) GHSA-8689-38pm-xg5f, MAL-2026-514 | Malicious | Not scored | 23 Jan, 2026 | npm overstock-health-express |
Malicious release: Malicious code in h-jsencrypt (npm) GHSA-5cc8-j5c8-6wrc, MAL-2026-495 | Malicious | Not scored | 23 Jan, 2026 | npm h-jsencrypt |
Malicious release: Malicious code in eits (npm) GHSA-6pm6-xfgg-f722, MAL-2026-494 | Malicious | Not scored | 23 Jan, 2026 | npm eits |
Malicious release: Malicious code in hemi-btc-staking-actions (npm) GHSA-96cq-3x5w-5fr2, MAL-2026-496 | Malicious | Not scored | 23 Jan, 2026 | npm hemi-btc-staking-actions |
Malicious release: Malicious code in test-on-other (npm) MAL-2026-497 | Malicious | Not scored | 23 Jan, 2026 | npm test-on-other |
Malicious release: Malicious code in oxnoxon (npm) GHSA-3qj6-c6x2-w2w6, MAL-2026-493 | Malicious | Not scored | 23 Jan, 2026 | npm oxnoxon |
Malicious release: Malicious code in test-on-other-again (npm) MAL-2026-491 | Malicious | Not scored | 23 Jan, 2026 | npm test-on-other-again |
Malicious release: Malicious code in rank4222wun (npm) GHSA-3phq-qxp9-55pv, MAL-2026-489 | Malicious | Not scored | 23 Jan, 2026 | npm rank4222wun |
Malicious release: Malicious code in a5xm (npm) GHSA-8v27-jw75-7v3c, MAL-2026-486 | Malicious | Not scored | 23 Jan, 2026 | npm a5xm |
Malicious release: Malicious code in ntwsc (npm) GHSA-g39p-gprj-c37g, MAL-2026-487 | Malicious | Not scored | 23 Jan, 2026 | npm ntwsc |
Malicious release: Malicious code in ntwsx (npm) GHSA-qqcc-7qrm-mf75, MAL-2026-488 | Malicious | Not scored | 23 Jan, 2026 | npm ntwsx |
Malicious release: Malicious code in a4wu (npm) GHSA-q3gw-cjjf-gqq5, MAL-2026-485 | Malicious | Not scored | 23 Jan, 2026 | npm a4wu |
Duplicate Advisory: npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability CVE-2026-0775, GHSA-3966-f6p6-2qr9 | High | 0.3% | 23 Jan, 2026 | npm npm |
gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755) CVE-2026-0755, GHSA-4h5r-5jm8-jxjm | Critical | 3.4% | 23 Jan, 2026 | npm gemini-mcp-tool |
Malicious release: Malicious code in kwp-shared-components-production-system (npm) GHSA-5rrx-w333-h86q, MAL-2026-480 | Malicious | Not scored | 23 Jan, 2026 | npm kwp-shared-components-production-system |
Malicious release: Malicious code in translation-note (npm) GHSA-7888-g6c7-rm6g, MAL-2026-484 | Malicious | Not scored | 23 Jan, 2026 | npm translation-note |
Malicious release: Malicious code in @acqui-calm-library/acqui-hero-carousel-section (npm) MAL-2026-471 | Malicious | Not scored | 23 Jan, 2026 | npm @acqui-calm-library/acqui-hero-carousel-section |
Malicious release: Malicious code in @landing-platform/data-bridge (npm) MAL-2026-472 | Malicious | Not scored | 23 Jan, 2026 | npm @landing-platform/data-bridge |
Malicious release: Malicious code in @transaction-list/transaction-list-lg (npm) MAL-2026-473 | Malicious | Not scored | 23 Jan, 2026 | npm @transaction-list/transaction-list-lg |
Malicious release: Malicious code in @transaction-list/transaction-list-md (npm) MAL-2026-474 | Malicious | Not scored | 23 Jan, 2026 | npm @transaction-list/transaction-list-md |
Malicious release: Malicious code in @transaction-list/transaction-list-sm (npm) MAL-2026-475 | Malicious | Not scored | 23 Jan, 2026 | npm @transaction-list/transaction-list-sm |
Malicious release: Malicious code in @transaction-list/transaction-list-xs (npm) MAL-2026-476 | Malicious | Not scored | 23 Jan, 2026 | npm @transaction-list/transaction-list-xs |
Malicious release: Malicious code in bttr-devs (npm) MAL-2026-477 | Malicious | Not scored | 23 Jan, 2026 | npm bttr-devs |
Malicious release: Malicious code in domino-elements (npm) MAL-2026-478 | Malicious | Not scored | 23 Jan, 2026 | npm domino-elements |
Malicious release: Malicious code in integromat-ui (npm) MAL-2026-479 | Malicious | Not scored | 23 Jan, 2026 | npm integromat-ui |
Malicious release: Malicious code in oasis-os-provider-messaging (npm) MAL-2026-481 | Malicious | Not scored | 23 Jan, 2026 | npm oasis-os-provider-messaging |
Malicious release: Malicious code in public-site-boostmoney-ui (npm) MAL-2026-482 | Malicious | Not scored | 23 Jan, 2026 | npm public-site-boostmoney-ui |
Malicious release: Malicious code in public-site-cms-ui (npm) MAL-2026-483 | Malicious | Not scored | 23 Jan, 2026 | npm public-site-cms-ui |
Orval Mock Generation Code Injection via const CVE-2026-24132, GHSA-f456-rf33-4626 | High | 0.7% | 22 Jan, 2026 | npm @orval/mock |
Malicious release: Malicious code in uuu8lgd (npm) MAL-2026-466 | Malicious | Not scored | 22 Jan, 2026 | npm uuu8lgd |
Malicious release: Malicious code in @ikeacn/utils (npm) GHSA-8hww-h75w-hmhr, MAL-2026-465 | Malicious | Not scored | 22 Jan, 2026 | npm @ikeacn/utils |
Malicious release: Malicious code in @ikeacn/icons (npm) GHSA-f867-45wh-g5pw, MAL-2026-464 | Malicious | Not scored | 22 Jan, 2026 | npm @ikeacn/icons |
Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass CVE-2025-65098, GHSA-4xc5-wfwc-jw47 | High | 0.3% | 22 Jan, 2026 | npm @typebot.io/js |
Malicious release: Malicious code in @corp-front/corporate-filter-company-select (npm) MAL-2026-461 | Malicious | Not scored | 22 Jan, 2026 | npm @corp-front/corporate-filter-company-select |
Malicious release: Malicious code in @ikeacn/ui (npm) GHSA-f6r6-w68v-687q, MAL-2026-462 | Malicious | Not scored | 22 Jan, 2026 | npm @ikeacn/ui |
Malicious release: Malicious code in corporate-blocking (npm) MAL-2026-463 | Malicious | Not scored | 22 Jan, 2026 | npm corporate-blocking |
Malicious release: Malicious code in pay-by-bank-dashboard-server (npm) GHSA-chxm-rhfj-8x2f, MAL-2026-460 | Malicious | Not scored | 22 Jan, 2026 | npm pay-by-bank-dashboard-server |
Malicious release: Malicious code in un112 (npm) MAL-2026-459 | Malicious | Not scored | 22 Jan, 2026 | npm un112 |
Malicious release: Malicious code in @mailpoet/eslint-config (npm) GHSA-2c25-xv7m-4cp8, MAL-2026-456 | Malicious | Not scored | 22 Jan, 2026 | npm @mailpoet/eslint-config |
Malicious release: Malicious code in @mailpoet/components (npm) GHSA-6qjh-33jg-r2wf, MAL-2026-455 | Malicious | Not scored | 22 Jan, 2026 | npm @mailpoet/components |
Malicious release: Malicious code in @fortinet/fortigate-autoscale (npm) GHSA-fph3-6mrp-9v2j, MAL-2026-453 | Malicious | Not scored | 22 Jan, 2026 | npm @fortinet/fortigate-autoscale |
Malicious release: Malicious code in @mailpoet/component (npm) GHSA-h25f-8r9p-7452, MAL-2026-454 | Malicious | Not scored | 22 Jan, 2026 | npm @mailpoet/component |