Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in tailwindcss-animate-tool (npm) GHSA-p7pp-v2qj-hwpq, MAL-2026-235 | Malicious | Not scored | 12 Jan, 2026 | npm tailwindcss-animate-tool |
Malicious release: Malicious code in express-sessions-id (npm) GHSA-fj4q-29wj-89xc, MAL-2026-218 | Malicious | Not scored | 12 Jan, 2026 | npm express-sessions-id |
Malicious release: Malicious code in cors-base (npm) GHSA-r6wm-7hr4-f9mh, MAL-2026-216 | Malicious | Not scored | 12 Jan, 2026 | npm cors-base |
Malicious release: Malicious code in simple-string-utils3 (npm) GHSA-25cq-qhpp-pxcx, MAL-2026-233 | Malicious | Not scored | 12 Jan, 2026 | npm simple-string-utils3 |
Malicious release: Malicious code in passport-google-auth-token (npm) GHSA-cj6c-5gcc-8xr5, MAL-2026-230 | Malicious | Not scored | 12 Jan, 2026 | npm passport-google-auth-token |
Malicious release: Malicious code in @maxcointech/simple-string-utils (npm) GHSA-rj99-vmg6-c6f8, MAL-2026-213 | Malicious | Not scored | 12 Jan, 2026 | npm @maxcointech/simple-string-utils |
Malicious release: Malicious code in jz-test-npm (npm) GHSA-xxv7-j7jp-phx8, MAL-2026-226 | Malicious | Not scored | 12 Jan, 2026 | npm jz-test-npm |
Malicious release: Malicious code in framer-motion-js (npm) GHSA-38xp-pcxg-58xm, MAL-2026-220 | Malicious | Not scored | 12 Jan, 2026 | npm framer-motion-js |
Malicious release: Malicious code in inquirer-js (npm) GHSA-3922-g725-hr6c, MAL-2026-224 | Malicious | Not scored | 12 Jan, 2026 | npm inquirer-js |
Malicious release: Malicious code in jsdom-js (npm) GHSA-3pxr-wwfp-6g73, MAL-2026-225 | Malicious | Not scored | 12 Jan, 2026 | npm jsdom-js |
Malicious release: Malicious code in immer-js (npm) GHSA-p865-gwfh-48x2, MAL-2026-223 | Malicious | Not scored | 12 Jan, 2026 | npm immer-js |
Malicious release: Malicious code in luxon-js (npm) GHSA-phgx-7qqx-fxcj, MAL-2026-228 | Malicious | Not scored | 12 Jan, 2026 | npm luxon-js |
Malicious release: Malicious code in react-hook-form-js (npm) GHSA-xgrq-mjjc-672q, MAL-2026-232 | Malicious | Not scored | 12 Jan, 2026 | npm react-hook-form-js |
Malicious release: Malicious code in huggingface-js (npm) GHSA-5fpx-j295-mggf, MAL-2026-222 | Malicious | Not scored | 12 Jan, 2026 | npm huggingface-js |
Malicious release: Malicious code in llamaindex-js (npm) GHSA-675f-h4p7-2vp4, MAL-2026-227 | Malicious | Not scored | 12 Jan, 2026 | npm llamaindex-js |
Malicious release: Malicious code in milvus-js (npm) GHSA-j947-h9rh-h2jr, MAL-2026-229 | Malicious | Not scored | 12 Jan, 2026 | npm milvus-js |
Malicious release: Malicious code in pinecone-js (npm) GHSA-vrwr-h8hh-fj7r, MAL-2026-231 | Malicious | Not scored | 12 Jan, 2026 | npm pinecone-js |
Malicious release: Malicious code in xml2js-js (npm) GHSA-3j4r-78pf-4g5h, MAL-2026-234 | Malicious | Not scored | 12 Jan, 2026 | npm xml2js-js |
Malicious release: Malicious code in auth-types (npm) GHSA-5484-6hqr-7386, MAL-2026-215 | Malicious | Not scored | 12 Jan, 2026 | npm auth-types |
Malicious release: Malicious code in analytics-browser (npm) GHSA-67vh-wg5g-567j, MAL-2026-214 | Malicious | Not scored | 12 Jan, 2026 | npm analytics-browser |
Malicious release: Malicious code in firestore-types (npm) GHSA-757j-rhvg-2fh2, MAL-2026-219 | Malicious | Not scored | 12 Jan, 2026 | npm firestore-types |
Malicious release: Malicious code in experimental-utils (npm) GHSA-pg6r-j522-h6w7, MAL-2026-217 | Malicious | Not scored | 12 Jan, 2026 | npm experimental-utils |
Malicious release: Malicious code in gradle-plugin (npm) GHSA-q63w-ghjp-qx4j, MAL-2026-221 | Malicious | Not scored | 12 Jan, 2026 | npm gradle-plugin |
Malicious release: Malicious code in @workleap-ai/shared (npm) GHSA-3594-6cm3-gmrr, MAL-2026-210 | Malicious | Not scored | 12 Jan, 2026 | npm @workleap-ai/shared |
Malicious release: Malicious code in @workleap-widgets/client (npm) GHSA-55gm-94x9-jg2r, MAL-2026-211 | Malicious | Not scored | 12 Jan, 2026 | npm @workleap-widgets/client |
Malicious release: Malicious code in lyonscg (npm) GHSA-p8xh-97x2-qrcm, MAL-2026-212 | Malicious | Not scored | 12 Jan, 2026 | npm lyonscg |
Malicious release: Malicious code in @t4i-cms-components/contact-card (npm) GHSA-r269-vxj8-7hg5, MAL-2026-209 | Malicious | Not scored | 12 Jan, 2026 | npm @t4i-cms-components/contact-card |
Malicious release: Malicious code in @gwp-gtmt-components/event-listener (npm) GHSA-x4fv-rfjv-fmxg, MAL-2026-208 | Malicious | Not scored | 12 Jan, 2026 | npm @gwp-gtmt-components/event-listener |
Malicious release: Malicious code in body-parser-js (npm) GHSA-7qgr-25rr-m3wp, MAL-2026-203 | Malicious | Not scored | 12 Jan, 2026 | npm body-parser-js |
Malicious release: Malicious code in terser-js (npm) GHSA-84hm-p25j-g6v9, MAL-2026-206 | Malicious | Not scored | 12 Jan, 2026 | npm terser-js |
Malicious release: Malicious code in yargs-js (npm) GHSA-cphf-84vm-2c35, MAL-2026-207 | Malicious | Not scored | 12 Jan, 2026 | npm yargs-js |
Malicious release: Malicious code in pako-js (npm) GHSA-qj9v-4mmh-fg5v, MAL-2026-204 | Malicious | Not scored | 12 Jan, 2026 | npm pako-js |
Malicious release: Malicious code in rxjs-js (npm) GHSA-qv83-7mq6-fxx4, MAL-2026-205 | Malicious | Not scored | 12 Jan, 2026 | npm rxjs-js |
Malicious release: Malicious code in shopee-chat (npm) GHSA-wp95-qq4v-wmpr, MAL-2026-198 | Malicious | Not scored | 11 Jan, 2026 | npm shopee-chat |
Malicious release: Malicious code in conmiyagi-map (npm) GHSA-wjx6-w662-h65v, MAL-2026-190 | Malicious | Not scored | 11 Jan, 2026 | npm conmiyagi-map |
QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting CVE-2026-0824, GHSA-xf94-h87h-g9wr | Low | 0.3% | 10 Jan, 2026 | npm @questdb/web-console |
Malicious release: Malicious code in mui7 (npm) GHSA-h94m-cfr5-p5rq, MAL-2026-194 | Malicious | Not scored | 10 Jan, 2026 | npm mui7 |
Malicious release: Malicious code in oe-oauth (npm) GHSA-7724-j9h5-v5hg, MAL-2026-196 | Malicious | Not scored | 10 Jan, 2026 | npm oe-oauth |
Malicious release: Malicious code in wac-relay-runtime (npm) GHSA-4xcf-f3v9-8hj8, MAL-2026-202 | Malicious | Not scored | 10 Jan, 2026 | npm wac-relay-runtime |
Malicious release: Malicious code in mui7icons (npm) GHSA-4wwj-2cvp-337q, MAL-2026-195 | Malicious | Not scored | 10 Jan, 2026 | npm mui7icons |
Malicious release: Malicious code in vet-bones (npm) GHSA-8hjq-rhjq-69g4, MAL-2026-199 | Malicious | Not scored | 10 Jan, 2026 | npm vet-bones |
Malicious release: Malicious code in wac-react (npm) GHSA-6whj-v3jx-j7r4, MAL-2026-200 | Malicious | Not scored | 10 Jan, 2026 | npm wac-react |
Malicious release: Malicious code in wac-react-dom (npm) GHSA-6w23-3m7m-ffrm, MAL-2026-201 | Malicious | Not scored | 10 Jan, 2026 | npm wac-react-dom |
Malicious release: Malicious code in resto_ui_components (npm) GHSA-w8w9-253c-7fx4, MAL-2026-197 | Malicious | Not scored | 10 Jan, 2026 | npm resto_ui_components |
Malicious release: Malicious code in shopping-cart-service (npm) GHSA-46gh-xv9p-94jc, MAL-2026-188 | Malicious | Not scored | 10 Jan, 2026 | npm shopping-cart-service |
HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover CVE-2026-22704, GHSA-3fm2-xfq7-7778 | High | 1.0% | 10 Jan, 2026 | npm @haxtheweb/haxcms-nodejs |
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes CVE-2026-22610, GHSA-jrmj-c5cx-3cw6 | High | 0.4% | 09 Jan, 2026 | npm @angular/compiler npm @angular/core |
Malicious release: Malicious code in n8n-nodes-hfgjf-irtuinvcm-lasdqewriit (npm) GHSA-77g5-qpc3-x24r, MAL-2026-178 | Malicious | Not scored | 09 Jan, 2026 | npm n8n-nodes-hfgjf-irtuinvcm-lasdqewriit |
Malicious release: Malicious code in n8n-nodes-vbmkajdsa-uehfitvv-ueqjhhhksdlkkmz (npm) GHSA-h97w-mg4r-5r4j, MAL-2026-179 | Malicious | Not scored | 09 Jan, 2026 | npm n8n-nodes-vbmkajdsa-uehfitvv-ueqjhhhksdlkkmz |
Malicious release: Malicious code in n8n-nodes-ggdv-hdfvcnnje-uyrokvbkl (npm) GHSA-vcf2-c6m4-cxvw, MAL-2026-177 | Malicious | Not scored | 09 Jan, 2026 | npm n8n-nodes-ggdv-hdfvcnnje-uyrokvbkl |