Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in chai-as-soul (npm) MAL-2026-14343 | Malicious | Not scored | 21 Aug, 2026 | npm chai-as-soul |
Malicious release: Malicious code in coin-fees (npm) MAL-2026-14342 | Malicious | Not scored | 21 Aug, 2026 | npm coin-fees |
Malicious release: Malicious code in exam-kit (npm) GHSA-3g8c-37c3-75vv, MAL-2026-14331 | Malicious | Not scored | 20 Aug, 2026 | npm exam-kit |
Malicious release: Malicious code in @pablo_clueless/sniffr (npm) GHSA-2gvc-mrh5-885x, MAL-2026-14330 | Malicious | Not scored | 20 Aug, 2026 | npm @pablo_clueless/sniffr |
Malicious release: Malicious code in @pablo_clueless/printr (npm) GHSA-3jxq-xch2-6hpm, MAL-2026-14329 | Malicious | Not scored | 20 Aug, 2026 | npm @pablo_clueless/printr |
Malicious release: Malicious code in ethereum-validator (npm) GHSA-f4c6-m557-c5qf, MAL-2026-14327 | Malicious | Not scored | 20 Aug, 2026 | npm ethereum-validator |
Malicious release: Malicious code in goldstar-api-server (npm) GHSA-w5wj-pp55-835w, MAL-2026-14328 | Malicious | Not scored | 20 Aug, 2026 | npm goldstar-api-server |
Malicious release: Malicious code in create-react-app-text (npm) GHSA-9324-2pfx-4w9r, MAL-2026-14324 | Malicious | Not scored | 20 Aug, 2026 | npm create-react-app-text |
Malicious release: Malicious code in create-react-app-ui (npm) GHSA-qvrq-vg6m-5cr8, MAL-2026-14325 | Malicious | Not scored | 20 Aug, 2026 | npm create-react-app-ui |
Malicious release: Malicious code in create-react-app-ux (npm) GHSA-rxpg-3mx3-fwqm, MAL-2026-14326 | Malicious | Not scored | 20 Aug, 2026 | npm create-react-app-ux |
Malicious release: Malicious code in cig-data-patcher (npm) GHSA-wvvc-v5v3-7mcx, MAL-2026-14323 | Malicious | Not scored | 20 Aug, 2026 | npm cig-data-patcher |
Malicious release: Malicious code in debug-fnt (npm) GHSA-qpp9-fwpx-39f8, MAL-2026-14322 | Malicious | Not scored | 20 Aug, 2026 | npm debug-fnt |
Malicious release: Malicious code in test-flow-entire6 (npm) GHSA-34c9-jfcv-757f, MAL-2026-14320 | Malicious | Not scored | 20 Aug, 2026 | npm test-flow-entire6 |
Malicious release: Malicious code in test-flow-1 (npm) GHSA-4cwc-wpx2-j752, MAL-2026-14319 | Malicious | Not scored | 20 Aug, 2026 | npm test-flow-1 |
Malicious release: Malicious code in test-flow-entire7 (npm) GHSA-c7wg-wr5p-3pw9, MAL-2026-14321 | Malicious | Not scored | 20 Aug, 2026 | npm test-flow-entire7 |
Malicious release: Malicious code in frenchworldcupwin (npm) GHSA-hp4f-wg89-v3fg, MAL-2026-14318 | Malicious | Not scored | 20 Aug, 2026 | npm frenchworldcupwin |
Malicious release: Malicious code in fetch-webjs-script (npm) GHSA-qpx8-cvmq-8jh7, MAL-2026-14317 | Malicious | Not scored | 20 Aug, 2026 | npm fetch-webjs-script |
Malicious release: Malicious code in @httttt/mcp-demo (npm) GHSA-phcp-xhhf-xcvq, MAL-2026-14315 | Malicious | Not scored | 20 Aug, 2026 | npm @httttt/mcp-demo |
Malicious release: Malicious code in expect-dotenv (npm) GHSA-h7q6-7chv-cgh2, MAL-2026-14316 | Malicious | Not scored | 20 Aug, 2026 | npm expect-dotenv |
Malicious release: Malicious code in express-route-engine (npm) MAL-2026-14307 | Malicious | Not scored | 19 Aug, 2026 | npm express-route-engine |
Malicious release: Malicious code in mc-provider (npm) GHSA-8r2v-hr8v-g7hw, MAL-2026-14305 | Malicious | Not scored | 19 Aug, 2026 | npm mc-provider |
Malicious release: Malicious code in base99-85x (npm) MAL-2026-14304 | Malicious | Not scored | 19 Aug, 2026 | npm base99-85x |
Malicious release: Malicious code in x6842179305 (npm) MAL-2026-14303 | Malicious | Not scored | 19 Aug, 2026 | npm x6842179305 |
Malicious release: Malicious code in ai-texts-utils (npm) GHSA-3p3q-38q9-rr37, MAL-2026-14302 | Malicious | Not scored | 19 Aug, 2026 | npm ai-texts-utils |
Malicious release: Malicious code in node-runtime-utils (npm) GHSA-c436-rrhg-m984, MAL-2026-14313 | Malicious | Not scored | 19 Aug, 2026 | npm node-runtime-utils |
Malicious release: Malicious code in webpack-cdn-fetcher (npm) GHSA-gjvp-mjhq-rfwc, MAL-2026-14314 | Malicious | Not scored | 19 Aug, 2026 | npm webpack-cdn-fetcher |
Malicious release: Malicious code in eslint-config-consumerweb (npm) GHSA-2pxg-969f-jc3q, MAL-2026-14311 | Malicious | Not scored | 19 Aug, 2026 | npm eslint-config-consumerweb |
Malicious release: Malicious code in griffin-transliterator (npm) GHSA-4hcm-p7x4-q9h9, MAL-2026-14312 | Malicious | Not scored | 19 Aug, 2026 | npm griffin-transliterator |
Malicious release: Malicious code in bunnyhijack-test-0x00 (npm) GHSA-8x5v-wf85-xhj5, MAL-2026-14310 | Malicious | Not scored | 19 Aug, 2026 | npm bunnyhijack-test-0x00 |
Malicious release: Malicious code in @idanefraim/my-ui-kit (npm) GHSA-hwmr-jv5f-67q9, MAL-2026-14309 | Malicious | Not scored | 19 Aug, 2026 | npm @idanefraim/my-ui-kit |
Malicious release: Malicious code in evm-validation (npm) GHSA-gvxq-2rq2-f7x6, MAL-2026-14301 | Malicious | Not scored | 19 Aug, 2026 | npm evm-validation |
Malicious release: Malicious code in eth-react-provider (npm) GHSA-rr86-r66c-qc54, MAL-2026-14300 | Malicious | Not scored | 19 Aug, 2026 | npm eth-react-provider |
Malicious release: Malicious code in emoji-prints-fancy (npm) GHSA-m523-mggx-3fgr, MAL-2026-14298 | Malicious | Not scored | 19 Aug, 2026 | npm emoji-prints-fancy |
Malicious release: Malicious code in gear-composer (npm) MAL-2026-14299 | Malicious | Not scored | 19 Aug, 2026 | npm gear-composer |
Malicious release: Malicious code in gfff5 (npm) MAL-2026-14296 | Malicious | Not scored | 19 Aug, 2026 | npm gfff5 |
Malicious release: Malicious code in homekit-mcp (npm) MAL-2026-14297 | Malicious | Not scored | 19 Aug, 2026 | npm homekit-mcp |
Malicious release: Malicious code in anhn-cli (npm) GHSA-7fvf-fgwq-85q6, MAL-2026-14290 | Malicious | Not scored | 19 Aug, 2026 | npm anhn-cli |
Malicious release: Malicious code in @wizloft/harness-plugin-repository-files (npm) GHSA-p4gf-f4rj-hfh8, MAL-2026-14288 | Malicious | Not scored | 19 Aug, 2026 | npm @wizloft/harness-plugin-repository-files |
Malicious release: Malicious code in @wizloft/harness-kernel (npm) GHSA-9f63-qfxp-2726, MAL-2026-14287 | Malicious | Not scored | 19 Aug, 2026 | npm @wizloft/harness-kernel |
Malicious release: Malicious code in @wizloft/harness-validation (npm) GHSA-7g98-grc6-6xjh, MAL-2026-14289 | Malicious | Not scored | 19 Aug, 2026 | npm @wizloft/harness-validation |
Malicious release: Malicious code in @wizloft/harness (npm) GHSA-hv3x-6r5c-g4cp, MAL-2026-14285 | Malicious | Not scored | 19 Aug, 2026 | npm @wizloft/harness |
Malicious release: Malicious code in @wizloft/harness-context (npm) GHSA-wjhv-xmmw-qqf9, MAL-2026-14286 | Malicious | Not scored | 19 Aug, 2026 | npm @wizloft/harness-context |
Malicious release: Malicious code in log-res (npm) MAL-2026-14292 | Malicious | Not scored | 19 Aug, 2026 | npm log-res |
Malicious release: Malicious code in mc-registry (npm) GHSA-73h8-3qpw-h3wv, MAL-2026-14294 | Malicious | Not scored | 19 Aug, 2026 | npm mc-registry |
Malicious release: Malicious code in libas-signal (npm) MAL-2026-14291 | Malicious | Not scored | 19 Aug, 2026 | npm libas-signal |
Malicious release: Malicious code in matrixflow-js (npm) MAL-2026-14293 | Malicious | Not scored | 19 Aug, 2026 | npm matrixflow-js |
Malicious release: Malicious code in mcp-dev-toolkit (npm) MAL-2026-14295 | Malicious | Not scored | 19 Aug, 2026 | npm mcp-dev-toolkit |
Malicious release: Malicious code in layer2-sdk (npm) MAL-2026-14278 | Malicious | Not scored | 19 Aug, 2026 | npm layer2-sdk |
Malicious release: Malicious code in neverthrow-core (npm) MAL-2026-14283 | Malicious | Not scored | 19 Aug, 2026 | npm neverthrow-core |
Malicious release: Malicious code in localize-translate (npm) MAL-2026-14279 | Malicious | Not scored | 19 Aug, 2026 | npm localize-translate |