Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in sign-client (npm) GHSA-h5ch-v4cm-8vfg, MAL-2026-429 | Malicious | Not scored | 21 Jan, 2026 | npm sign-client |
Malicious release: Malicious code in anthropic-sdk (npm) GHSA-j8wc-8p9m-6fm6, MAL-2026-405 | Malicious | Not scored | 21 Jan, 2026 | npm anthropic-sdk |
Malicious release: Malicious code in universal-provider (npm) GHSA-mv62-2gmc-3q9v, MAL-2026-432 | Malicious | Not scored | 21 Jan, 2026 | npm universal-provider |
Malicious release: Malicious code in @kyriba/platform-frontend (npm) GHSA-7xwj-v69j-gcx4, MAL-2026-380 | Malicious | Not scored | 21 Jan, 2026 | npm @kyriba/platform-frontend |
Malicious release: Malicious code in internallib_v962 (npm) GHSA-fxh9-x2px-vcw4, MAL-2026-391 | Malicious | Not scored | 21 Jan, 2026 | npm internallib_v962 |
Malicious release: Malicious code in @joaoxxx/internallib-v325 (npm) GHSA-hj85-hf2m-4xg9, MAL-2026-379 | Malicious | Not scored | 21 Jan, 2026 | npm @joaoxxx/internallib-v325 |
Malicious release: Malicious code in internallib_v325 (npm) GHSA-vvqp-5rpp-x73f, MAL-2026-390 | Malicious | Not scored | 21 Jan, 2026 | npm internallib_v325 |
Malicious release: Malicious code in jsonwebauth (npm) GHSA-c7fj-3rmw-57px, MAL-2026-392 | Malicious | Not scored | 21 Jan, 2026 | npm jsonwebauth |
Malicious release: Malicious code in chai-dex (npm) GHSA-grj8-vvpv-hx8q, MAL-2026-387 | Malicious | Not scored | 21 Jan, 2026 | npm chai-dex |
Malicious release: Malicious code in chai-chain-async (npm) GHSA-9fmw-9xvf-xpqq, MAL-2026-386 | Malicious | Not scored | 21 Jan, 2026 | npm chai-chain-async |
Malicious release: Malicious code in private-internal-sdk (npm) GHSA-35m9-w5cr-7fgm, MAL-2026-396 | Malicious | Not scored | 21 Jan, 2026 | npm private-internal-sdk |
Malicious release: Malicious code in worldnormal (npm) GHSA-h55w-3xx5-rm4c, MAL-2026-403 | Malicious | Not scored | 21 Jan, 2026 | npm worldnormal |
Malicious release: Malicious code in worldposition (npm) GHSA-q829-xgcw-c34f, MAL-2026-404 | Malicious | Not scored | 21 Jan, 2026 | npm worldposition |
Malicious release: Malicious code in manage-root (npm) GHSA-rjrr-8983-84gg, MAL-2026-393 | Malicious | Not scored | 21 Jan, 2026 | npm manage-root |
Malicious release: Malicious code in vworldviewdir (npm) GHSA-w3h3-7w7v-8v6p, MAL-2026-402 | Malicious | Not scored | 21 Jan, 2026 | npm vworldviewdir |
Malicious release: Malicious code in @mikudev/beles (npm) GHSA-gphr-5mfq-w76r, MAL-2026-381 | Malicious | Not scored | 21 Jan, 2026 | npm @mikudev/beles |
Malicious release: Malicious code in @mikudev/ridwan-baileys-mod (npm) GHSA-p27v-6qg4-qjx2, MAL-2026-382 | Malicious | Not scored | 21 Jan, 2026 | npm @mikudev/ridwan-baileys-mod |
Malicious release: Malicious code in @mikudev/signal (npm) GHSA-rfrp-qchq-82j8, MAL-2026-384 | Malicious | Not scored | 21 Jan, 2026 | npm @mikudev/signal |
Malicious release: Malicious code in @mikudev/ridwan-signal (npm) GHSA-73hp-vpp4-4q38, MAL-2026-383 | Malicious | Not scored | 21 Jan, 2026 | npm @mikudev/ridwan-signal |
Malicious release: Malicious code in tor-libsignal (npm) GHSA-4x99-4pvp-6hgp, MAL-2026-398 | Malicious | Not scored | 21 Jan, 2026 | npm tor-libsignal |
Malicious release: Malicious code in torbaileys (npm) GHSA-57wh-gp48-wh22, MAL-2026-399 | Malicious | Not scored | 21 Jan, 2026 | npm torbaileys |
Malicious release: Malicious code in genki-analytics (npm) GHSA-pr49-cw2w-3qfm, MAL-2026-389 | Malicious | Not scored | 21 Jan, 2026 | npm genki-analytics |
Malicious release: Malicious code in charlie_charlie_kirky (npm) GHSA-4grw-7cr5-76pg, MAL-2026-388 | Malicious | Not scored | 21 Jan, 2026 | npm charlie_charlie_kirky |
Malicious release: Malicious code in recaptcha-cors (npm) GHSA-c2vp-98j7-jr92, MAL-2026-397 | Malicious | Not scored | 21 Jan, 2026 | npm recaptcha-cors |
Malicious release: Malicious code in n8n-nodes-zl-vietts (npm) GHSA-pq6r-5rc5-6grw, MAL-2026-394 | Malicious | Not scored | 21 Jan, 2026 | npm n8n-nodes-zl-vietts |
Malicious release: Malicious code in @diendh/n8n-nodes-tiktok-v2 (npm) GHSA-qcqh-23wh-vv44, MAL-2026-378 | Malicious | Not scored | 21 Jan, 2026 | npm @diendh/n8n-nodes-tiktok-v2 |
Malicious release: Malicious code in blocks-builder-manifest-generator (npm) GHSA-2fxr-35cv-vcwg, MAL-2026-385 | Malicious | Not scored | 21 Jan, 2026 | npm blocks-builder-manifest-generator |
Malicious release: Malicious code in natateste (npm) GHSA-29hr-9v6r-9qx7, MAL-2026-395 | Malicious | Not scored | 21 Jan, 2026 | npm natateste |
Malicious release: Malicious code in victim-package-c (npm) GHSA-jr87-jqjj-7rvr, MAL-2026-401 | Malicious | Not scored | 21 Jan, 2026 | npm victim-package-c |
Malicious release: Malicious code in victim-package-b (npm) GHSA-v876-w8f6-cgvx, MAL-2026-400 | Malicious | Not scored | 21 Jan, 2026 | npm victim-package-b |
Malicious release: Malicious code in potdf (npm) GHSA-h4f3-mj3f-p437, MAL-2026-377 | Malicious | Not scored | 21 Jan, 2026 | npm potdf |
Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation CVE-2026-21852, GHSA-jh7p-qr78-84p7 | Medium | 27.5% | 21 Jan, 2026 | npm @anthropic-ai/claude-code |
Wrangler affected by OS Command Injection in `wrangler pages deploy` CVE-2026-0933, GHSA-36p8-mvp6-cv38 | High | 1.5% | 20 Jan, 2026 | npm wrangler |
binary-parser library has a code injection vulnerability CVE-2026-1245, GHSA-m39p-34qh-rh3w | Medium | 0.6% | 20 Jan, 2026 | npm binary-parser |
Turbo Frame responses can restore stale session cookies CVE-2025-66803, GHSA-qppm-g56g-fpvp | Medium | 0.3% | 20 Jan, 2026 | npm @hotwired/turbo |
Malicious release: Malicious code in mised-discordjs-selfbot-v14 (npm) GHSA-gc2c-3rm2-3685, MAL-2026-374 | Malicious | Not scored | 20 Jan, 2026 | npm mised-discordjs-selfbot-v14 |
Malicious release: Malicious code in theme-neutral (npm) GHSA-v7pw-qfwc-r9mp, MAL-2026-371 | Malicious | Not scored | 20 Jan, 2026 | npm theme-neutral |
Malicious release: Malicious code in sezzle (npm) GHSA-rcxc-74j6-jx55, MAL-2026-370 | Malicious | Not scored | 20 Jan, 2026 | npm sezzle |
Malicious release: Malicious code in webmd-debug (npm) GHSA-42w3-2gcj-hc45, MAL-2026-373 | Malicious | Not scored | 20 Jan, 2026 | npm webmd-debug |
Malicious release: Malicious code in mw-shared-utils (npm) GHSA-cf6g-q59f-wmxh, MAL-2026-369 | Malicious | Not scored | 20 Jan, 2026 | npm mw-shared-utils |
Malicious release: Malicious code in mw-proto-models (npm) GHSA-jc7r-cfpv-fj23, MAL-2026-368 | Malicious | Not scored | 20 Jan, 2026 | npm mw-proto-models |
Malicious release: Malicious code in webmd-cookie (npm) GHSA-mmmm-g8pw-whc5, MAL-2026-372 | Malicious | Not scored | 20 Jan, 2026 | npm webmd-cookie |
Malicious release: Malicious code in dreame-claude (npm) GHSA-9vmw-qh86-x859, MAL-2026-359 | Malicious | Not scored | 20 Jan, 2026 | npm dreame-claude |
Malicious release: Malicious code in uq-global-ec-uikit (npm) GHSA-24pr-w8vf-w5jr, MAL-2026-367 | Malicious | Not scored | 20 Jan, 2026 | npm uq-global-ec-uikit |
Malicious release: Malicious code in pl-global-ec-uikit (npm) GHSA-266w-v9rj-m6hr, MAL-2026-363 | Malicious | Not scored | 20 Jan, 2026 | npm pl-global-ec-uikit |
Malicious release: Malicious code in shared-global-ec-uikit (npm) GHSA-frc8-mxgg-69vc, MAL-2026-364 | Malicious | Not scored | 20 Jan, 2026 | npm shared-global-ec-uikit |
Malicious release: Malicious code in gu-global-ec-uikit (npm) GHSA-j4wf-2wr3-cw9j, MAL-2026-361 | Malicious | Not scored | 20 Jan, 2026 | npm gu-global-ec-uikit |
Malicious release: Malicious code in excel-to-json-test (npm) GHSA-v9fq-7c29-2276, MAL-2026-360 | Malicious | Not scored | 20 Jan, 2026 | npm excel-to-json-test |
Malicious release: Malicious code in telia-eventapi-client (npm) GHSA-f8r2-582m-37gr, MAL-2026-365 | Malicious | Not scored | 20 Jan, 2026 | npm telia-eventapi-client |
Malicious release: Malicious code in testing-package-bose (npm) GHSA-88rw-h3mh-h632, MAL-2026-366 | Malicious | Not scored | 20 Jan, 2026 | npm testing-package-bose |