Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @drone-js-ext/vip-badge (npm) GHSA-h7v8-65vw-r7wh, MAL-2026-18277 | Malicious | Not scored | 5 days ago | npm @drone-js-ext/vip-badge |
Malicious release: Malicious code in tailwind-base-buttons (npm) GHSA-5j43-343m-gggg, MAL-2026-18250 | Malicious | Not scored | 6 days ago | npm tailwind-base-buttons |
Malicious release: Malicious code in noelc-css-blender (npm) GHSA-cj2x-975v-jmwf, MAL-2026-18249 | Malicious | Not scored | 6 days ago | npm noelc-css-blender |
Malicious release: Malicious code in tailwindcss-theme-kit (npm) GHSA-v5xr-xjx7-ggwf, MAL-2026-18251 | Malicious | Not scored | 6 days ago | npm tailwindcss-theme-kit |
Malicious release: Malicious code in overarch-windows-x64-yr (npm) GHSA-v5v8-j5gm-pq8v, MAL-2026-18248 | Malicious | Not scored | 6 days ago | npm overarch-windows-x64-yr |
Malicious release: Malicious code in @liauto/win32-x64 (npm) GHSA-32x9-4g9x-5cxj, MAL-2026-18247 | Malicious | Not scored | 6 days ago | npm @liauto/win32-x64 |
Malicious release: Malicious code in @sxm-web/client-sdk-core (npm) GHSA-v3mw-7pg4-rp68, MAL-2026-18319 | Malicious | Not scored | 7 days ago | npm @sxm-web/client-sdk-core |
Malicious release: Malicious code in @k18k/entrypoint-sdk-darwin-arm64 (npm) GHSA-8wf7-8825-99q7, MAL-2026-18243 | Malicious | Not scored | 7 days ago | npm @k18k/entrypoint-sdk-darwin-arm64 |
Malicious release: Malicious code in orqiva-runtime-win32-x64 (npm) GHSA-8j59-g9mq-7hf9, MAL-2026-18246 | Malicious | Not scored | 7 days ago | npm orqiva-runtime-win32-x64 |
Malicious release: Malicious code in @k18k/entrypoint-sdk-linux-x64 (npm) GHSA-9fhg-r3w6-g7r4, MAL-2026-18245 | Malicious | Not scored | 7 days ago | npm @k18k/entrypoint-sdk-linux-x64 |
Malicious release: Malicious code in @k18k/entrypoint-sdk-darwin-x64 (npm) GHSA-j58m-rwhr-923h, MAL-2026-18244 | Malicious | Not scored | 7 days ago | npm @k18k/entrypoint-sdk-darwin-x64 |
Malicious release: Malicious code in @greenlake/session (npm) GHSA-499v-qcp5-gx7x, MAL-2026-18283 | Malicious | Not scored | 7 days ago | npm @greenlake/session |
Malicious release: Malicious code in @greenlake/mfe-login-url (npm) GHSA-6vg7-x7p2-c749, MAL-2026-18318 | Malicious | Not scored | 7 days ago | npm @greenlake/mfe-login-url |
Malicious release: Malicious code in @greenlake/context-pane (npm) GHSA-5pp4-pvpc-g2xv, MAL-2026-18317 | Malicious | Not scored | 7 days ago | npm @greenlake/context-pane |
Malicious release: Malicious code in @greenlake/common-context (npm) GHSA-mm6p-8j6f-9fch, MAL-2026-18282 | Malicious | Not scored | 7 days ago | npm @greenlake/common-context |
Malicious release: Malicious code in @greenlake/auth (npm) GHSA-h6v3-2957-9j3g, MAL-2026-18316 | Malicious | Not scored | 7 days ago | npm @greenlake/auth |
Malicious release: Malicious code in skillward (npm) GHSA-9wgc-5pgr-25p3, MAL-2026-18220 | Malicious | Not scored | 7 days ago | npm skillward |
Malicious release: Malicious code in @grabcad/user-license (npm) GHSA-6w2v-744r-g5j5, MAL-2026-18217 | Malicious | Not scored | 7 days ago | npm @grabcad/user-license |
Malicious release: Malicious code in @grabcad/grabcad-shop-shared (npm) GHSA-cc6r-jh8f-6c76, MAL-2026-18215 | Malicious | Not scored | 7 days ago | npm @grabcad/grabcad-shop-shared |
Malicious release: Malicious code in @grabcad/company-server-shared (npm) GHSA-fpfw-7wv8-x4mh, MAL-2026-18214 | Malicious | Not scored | 7 days ago | npm @grabcad/company-server-shared |
Malicious release: Malicious code in @grabcad/preferences-client (npm) GHSA-mfh5-wvcp-2v6v, MAL-2026-18216 | Malicious | Not scored | 7 days ago | npm @grabcad/preferences-client |
Malicious release: Malicious code in @blueskydataplatform/shared-ui (npm) GHSA-6x9m-j5h8-w3vg, MAL-2026-18212 | Malicious | Not scored | 7 days ago | npm @blueskydataplatform/shared-ui |
Malicious release: Malicious code in @cecm-web-sdk/core (npm) GHSA-88qx-q5v7-q7x5, MAL-2026-18213 | Malicious | Not scored | 7 days ago | npm @cecm-web-sdk/core |
Malicious release: Malicious code in @ecg-internal/js-react-i18n (npm) GHSA-5x9g-7rj9-4xc8, MAL-2026-18209 | Malicious | Not scored | 7 days ago | npm @ecg-internal/js-react-i18n |
Malicious release: Malicious code in @ecg-internal/aurora-js-formatters (npm) GHSA-9976-3w38-mrmj, MAL-2026-18207 | Malicious | Not scored | 7 days ago | npm @ecg-internal/aurora-js-formatters |
Malicious release: Malicious code in @ecg-internal/media-util-js-lib (npm) GHSA-hcw5-m6mm-qg3q, MAL-2026-18210 | Malicious | Not scored | 7 days ago | npm @ecg-internal/media-util-js-lib |
Malicious release: Malicious code in @ecg-internal/favourites-ui (npm) GHSA-g8hh-8pxg-jr3x, MAL-2026-18208 | Malicious | Not scored | 7 days ago | npm @ecg-internal/favourites-ui |
Malicious release: Malicious code in @ecg-internal/adobe-dmp-js (npm) GHSA-vcj4-3hxm-4rf3, MAL-2026-18206 | Malicious | Not scored | 7 days ago | npm @ecg-internal/adobe-dmp-js |
Malicious release: Malicious code in @ecg-internal/reviews-dialog-ui (npm) GHSA-r47j-grcr-p9h9, MAL-2026-18211 | Malicious | Not scored | 7 days ago | npm @ecg-internal/reviews-dialog-ui |
Malicious release: Malicious code in @tekmidian/pai (npm) GHSA-xvgg-qjjh-gq34, MAL-2026-18205 | Malicious | Not scored | 7 days ago | npm @tekmidian/pai |
Malicious release: Malicious code in react-native-bright-sdk (npm) MAL-2026-18290 | Malicious | Not scored | 8 days ago | npm react-native-bright-sdk |
Malicious release: Malicious code in @factiii/runner (npm) GHSA-9j83-qj34-g5vc, MAL-2026-18204 | Malicious | Not scored | 8 days ago | npm @factiii/runner |
Malicious release: Malicious code in @seggy116/next-diff (npm) GHSA-fv2r-964m-pc2m, MAL-2026-18200 | Malicious | Not scored | 8 days ago | npm @seggy116/next-diff |
Malicious release: Malicious code in @pkgship/frps-linux-amd64 (npm) GHSA-x55v-jc52-q424, MAL-2026-18199 | Malicious | Not scored | 8 days ago | npm @pkgship/frps-linux-amd64 |
Malicious release: Malicious code in @pkgship/frpc-linux-amd64 (npm) GHSA-9pc4-vxvx-5676, MAL-2026-18198 | Malicious | Not scored | 8 days ago | npm @pkgship/frpc-linux-amd64 |
Malicious release: Malicious code in kvarzo8f3atestmetest (npm) GHSA-8vpc-rm6r-5m6c, MAL-2026-18201 | Malicious | Not scored | 8 days ago | npm kvarzo8f3atestmetest |
Malicious release: Malicious code in sdk-utils-testmetest (npm) GHSA-m6qq-33mj-mv9w, MAL-2026-18202 | Malicious | Not scored | 8 days ago | npm sdk-utils-testmetest |
Malicious release: Malicious code in @lumen-labs-dev/whisper-node (npm) GHSA-8mqm-233x-2g2j, MAL-2026-18194 | Malicious | Not scored | 8 days ago | npm @lumen-labs-dev/whisper-node |
Malicious release: Malicious code in darknode-cli (npm) GHSA-6m47-rc2c-6xpg, MAL-2026-18195 | Malicious | Not scored | 8 days ago | npm darknode-cli |
Malicious release: Malicious code in x402-prompt-injection-scan (npm) GHSA-w84w-rhx7-2f7g, MAL-2026-18197 | Malicious | Not scored | 8 days ago | npm x402-prompt-injection-scan |
Malicious release: Malicious code in imgdecode (npm) GHSA-hw69-vrvf-87h5, MAL-2026-18196 | Malicious | Not scored | 8 days ago | npm imgdecode |
Malicious release: Malicious code in @liauto/darwin-x64 (npm) GHSA-pmg6-2w6r-4q4h, MAL-2026-18190 | Malicious | Not scored | 8 days ago | npm @liauto/darwin-x64 |
Malicious release: Malicious code in @pkgship/frpc-darwin-amd64 (npm) GHSA-fhh5-55p8-29hj, MAL-2026-18191 | Malicious | Not scored | 8 days ago | npm @pkgship/frpc-darwin-amd64 |
Malicious release: Malicious code in opencode-skills-collection (npm) GHSA-9855-prwc-mfp2, MAL-2026-18193 | Malicious | Not scored | 8 days ago | npm opencode-skills-collection |
Malicious release: Malicious code in agentic-awesome-skills (npm) GHSA-rgwm-3jj9-h563, MAL-2026-18192 | Malicious | Not scored | 8 days ago | npm agentic-awesome-skills |
Malicious release: Malicious code in net-codec-testmetest (npm) MAL-2026-18186 | Malicious | Not scored | 8 days ago | npm net-codec-testmetest |
Malicious release: Malicious code in log-rotate-testmetest (npm) MAL-2026-18185 | Malicious | Not scored | 8 days ago | npm log-rotate-testmetest |
Malicious release: Malicious code in formatting-subtitles (npm) MAL-2026-18184 | Malicious | Not scored | 8 days ago | npm formatting-subtitles |
Malicious release: Malicious code in @conduitops/logview-archive (npm) MAL-2026-18183 | Malicious | Not scored | 8 days ago | npm @conduitops/logview-archive |
Malicious release: Malicious code in simplewave (npm) MAL-2026-18187 | Malicious | Not scored | 8 days ago | npm simplewave |