Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @egencia/uitk-react-foundation (npm) MAL-2026-16519 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-react-foundation |
Malicious release: Malicious code in @egencia/uitk-react-layout-flex (npm) MAL-2026-16520 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-react-layout-flex |
Malicious release: Malicious code in @egencia/uitk-global-styles-6 (npm) MAL-2026-16517 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-global-styles-6 |
Malicious release: Malicious code in @egencia/uitk-react (npm) MAL-2026-16518 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-react |
Malicious release: Malicious code in @egencia/uitk-global-styles (npm) MAL-2026-16516 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-global-styles |
Malicious release: Malicious code in @egencia/design-tokens (npm) MAL-2026-16515 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/design-tokens |
Malicious release: Malicious code in @client-web-next/utils (npm) MAL-2026-16514 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/utils |
Malicious release: Malicious code in @client-web-next/ui (npm) MAL-2026-16512 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/ui |
Malicious release: Malicious code in @client-web-next/ui-business (npm) MAL-2026-16513 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/ui-business |
Malicious release: Malicious code in @client-web-next/transfer-state (npm) MAL-2026-16510 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/transfer-state |
Malicious release: Malicious code in @client-web-next/ua-parser (npm) MAL-2026-16511 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/ua-parser |
Malicious release: Malicious code in @client-web-next/tarjeta-button (npm) MAL-2026-16508 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/tarjeta-button |
Malicious release: Malicious code in @client-web-next/timer (npm) MAL-2026-16509 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/timer |
Malicious release: Malicious code in @client-web-next/origination-microfront (npm) MAL-2026-16506 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/origination-microfront |
Malicious release: Malicious code in @client-web-next/providers (npm) MAL-2026-16507 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/providers |
Malicious release: Malicious code in @client-web-next/logger (npm) MAL-2026-16504 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/logger |
Malicious release: Malicious code in @client-web-next/navigation-link (npm) MAL-2026-16505 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/navigation-link |
Malicious release: Malicious code in @client-web-next/footer (npm) MAL-2026-16502 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/footer |
Malicious release: Malicious code in @client-web-next/icons (npm) MAL-2026-16503 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/icons |
Malicious release: Malicious code in @client-web-next/feature-flags (npm) MAL-2026-16501 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/feature-flags |
Malicious release: Malicious code in @client-web-next/env-util (npm) MAL-2026-16499 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/env-util |
Malicious release: Malicious code in @client-web-next/event-bus-listener (npm) MAL-2026-16500 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/event-bus-listener |
Malicious release: Malicious code in @client-web-next/api-metrics (npm) MAL-2026-16497 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/api-metrics |
Malicious release: Malicious code in @client-web-next/cms (npm) MAL-2026-16498 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/cms |
Malicious release: Malicious code in @client-web-next/analytics (npm) MAL-2026-16496 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/analytics |
Malicious release: Malicious code in @client-web-next/ab-tests (npm) MAL-2026-16494 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/ab-tests |
Malicious release: Malicious code in @client-web-next/adaptive (npm) MAL-2026-16495 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/adaptive |
Malicious release: Malicious code in @client-web-next/ab-landing-form (npm) MAL-2026-16493 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/ab-landing-form |
Malicious release: Malicious code in @cartradetech/example-package (npm) MAL-2026-16492 | Malicious | Not scored | 22 Sep, 2026 | npm @cartradetech/example-package |
Malicious release: Malicious code in @adominadmininstr/fmt-date-helper (npm) MAL-2026-16491 | Malicious | Not scored | 22 Sep, 2026 | npm @adominadmininstr/fmt-date-helper |
Malicious release: Malicious code in @adominadmininstr/date-util-helper (npm) MAL-2026-16490 | Malicious | Not scored | 22 Sep, 2026 | npm @adominadmininstr/date-util-helper |
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header CVE-2026-56682, GHSA-32gc-64m7-hj7v | Medium | 0.5% | 22 Sep, 2026 | npm 9router |
Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme CVE-2026-75510, GHSA-8gr3-5j6f-25gp | Medium | 0.5% | 22 Sep, 2026 | npm @novu/js |
9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header CVE-2026-56681, GHSA-5mj8-gf6m-fhw8 | High | 1.1% | 22 Sep, 2026 | npm 9router |
Malicious release: Malicious code in @mikudeveloper/baileys (npm) GHSA-2xx9-x9v7-25x2, MAL-2026-16386 | Malicious | Not scored | 22 Sep, 2026 | npm @mikudeveloper/baileys |
Malicious release: Malicious code in @mr-supun-fernando/supunmd-bail (npm) MAL-2026-16387 | Malicious | Not scored | 22 Sep, 2026 | npm @mr-supun-fernando/supunmd-bail |
Malicious release: Malicious code in tlxbnhd (npm) MAL-2026-16385 | Malicious | Not scored | 22 Sep, 2026 | npm tlxbnhd |
Malicious release: Malicious code in tldriver (npm) MAL-2026-16384 | Malicious | Not scored | 22 Sep, 2026 | npm tldriver |
Malicious release: Malicious code in mxdriver (npm) MAL-2026-16383 | Malicious | Not scored | 22 Sep, 2026 | npm mxdriver |
Malicious release: Malicious code in chai-logger (npm) MAL-2026-16380 | Malicious | Not scored | 22 Sep, 2026 | npm chai-logger |
Malicious release: Malicious code in @tesla-insurance/vinless-quote (npm) GHSA-6m9v-pw95-fc67, MAL-2026-16378 | Malicious | Not scored | 22 Sep, 2026 | npm @tesla-insurance/vinless-quote |
Malicious release: Malicious code in @user-services/web-components (npm) GHSA-f3g4-6hpx-9mcq, MAL-2026-16379 | Malicious | Not scored | 22 Sep, 2026 | npm @user-services/web-components |
Malicious release: Malicious code in take-home-caller-id (npm) MAL-2026-16382 | Malicious | Not scored | 22 Sep, 2026 | npm take-home-caller-id |
Malicious release: Malicious code in cisco-github-simple (npm) MAL-2026-16381 | Malicious | Not scored | 22 Sep, 2026 | npm cisco-github-simple |
Malicious release: Malicious code in test-react-app-out (npm) GHSA-vx3p-fwmg-p7g8, MAL-2026-16375 | Malicious | Not scored | 22 Sep, 2026 | npm test-react-app-out |
Malicious release: Malicious code in test-react-app-in (npm) GHSA-wm2w-4m2r-mv73, MAL-2026-16374 | Malicious | Not scored | 22 Sep, 2026 | npm test-react-app-in |
Malicious release: Malicious code in test-react-app-way (npm) GHSA-264w-9h55-v637, MAL-2026-16376 | Malicious | Not scored | 22 Sep, 2026 | npm test-react-app-way |
Malicious release: Malicious code in @zig-design-system/react (npm) GHSA-rqjq-px4f-2m8r, MAL-2026-16372 | Malicious | Not scored | 21 Sep, 2026 | npm @zig-design-system/react |
Malicious release: Malicious code in wos-library (npm) GHSA-mfwv-9gcf-2mww, MAL-2026-16373 | Malicious | Not scored | 21 Sep, 2026 | npm wos-library |
Malicious release: Malicious code in @vite-tab/tabui (npm) GHSA-q5h9-3mvh-45cf, MAL-2026-16371 | Malicious | Not scored | 21 Sep, 2026 | npm @vite-tab/tabui |