Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in desmosisfire (npm) GHSA-mwq6-6g7q-rjxp, MAL-2026-14454 | Malicious | Not scored | 25 Aug, 2026 | npm desmosisfire |
Malicious release: Malicious code in schoolhomework (npm) GHSA-mx5q-7285-qm6f, MAL-2026-14463 | Malicious | Not scored | 25 Aug, 2026 | npm schoolhomework |
Malicious release: Malicious code in classlesson (npm) GHSA-rxrv-wfcx-mpjc, MAL-2026-14447 | Malicious | Not scored | 25 Aug, 2026 | npm classlesson |
Malicious release: Malicious code in pleasedoyourhomework (npm) GHSA-w62m-775m-86f2, MAL-2026-14462 | Malicious | Not scored | 25 Aug, 2026 | npm pleasedoyourhomework |
Malicious release: Malicious code in classroomwork (npm) GHSA-wqmh-qmf4-3f8p, MAL-2026-14450 | Malicious | Not scored | 25 Aug, 2026 | npm classroomwork |
Malicious release: Malicious code in sonsonsahur (npm) GHSA-xv2p-qw82-6xmj, MAL-2026-14466 | Malicious | Not scored | 25 Aug, 2026 | npm sonsonsahur |
Malicious release: Malicious code in tungtungisgoated (npm) GHSA-xv9m-378j-86x3, MAL-2026-14469 | Malicious | Not scored | 25 Aug, 2026 | npm tungtungisgoated |
Malicious release: Malicious code in digitalexp-style-module-l9 (npm) GHSA-r7fr-v3m3-mpq2, MAL-2026-14445 | Malicious | Not scored | 25 Aug, 2026 | npm digitalexp-style-module-l9 |
Malicious release: Malicious code in unifi-credential-server (npm) MAL-2026-15692 | Malicious | Not scored | 24 Aug, 2026 | npm unifi-credential-server |
Malicious release: Malicious code in react-hook-doms (npm) MAL-2026-15691 | Malicious | Not scored | 24 Aug, 2026 | npm react-hook-doms |
Malicious release: Malicious code in mongosooe (npm) MAL-2026-15690 | Malicious | Not scored | 24 Aug, 2026 | npm mongosooe |
Malicious release: Malicious code in lil-swisgom-hlepers (npm) MAL-2026-15689 | Malicious | Not scored | 24 Aug, 2026 | npm lil-swisgom-hlepers |
Malicious release: Malicious code in leaflet-opencage-geocoding (npm) MAL-2026-15688 | Malicious | Not scored | 24 Aug, 2026 | npm leaflet-opencage-geocoding |
Malicious release: Malicious code in @medisend/shared (npm) GHSA-f6mp-mchf-ppcc, MAL-2026-14423 | Malicious | Not scored | 24 Aug, 2026 | npm @medisend/shared |
Malicious release: Malicious code in chai-as-mno (npm) MAL-2026-14427 | Malicious | Not scored | 24 Aug, 2026 | npm chai-as-mno |
Malicious release: Malicious code in @medisend/auth (npm) GHSA-cpvc-ph75-5rf3, MAL-2026-14421 | Malicious | Not scored | 24 Aug, 2026 | npm @medisend/auth |
Malicious release: Malicious code in @medisend/core (npm) GHSA-wfxf-4cwg-r55p, MAL-2026-14422 | Malicious | Not scored | 24 Aug, 2026 | npm @medisend/core |
Malicious release: Malicious code in kelly-stake-sizing (npm) GHSA-h8rr-x7cp-4h62, MAL-2026-14432 | Malicious | Not scored | 24 Aug, 2026 | npm kelly-stake-sizing |
Malicious release: Malicious code in openai-pr-reviewer (npm) GHSA-wpv4-wxrh-hvmh, MAL-2026-14434 | Malicious | Not scored | 24 Aug, 2026 | npm openai-pr-reviewer |
Malicious release: Malicious code in consumerweb-serverutils (npm) MAL-2026-14428 | Malicious | Not scored | 24 Aug, 2026 | npm consumerweb-serverutils |
Malicious release: Malicious code in babel-polyfill-plugin-corejs2 (npm) GHSA-9g6r-83hw-6cq2, MAL-2026-14426 | Malicious | Not scored | 24 Aug, 2026 | npm babel-polyfill-plugin-corejs2 |
Malicious release: Malicious code in poly-price-node (npm) MAL-2026-14436 | Malicious | Not scored | 24 Aug, 2026 | npm poly-price-node |
Malicious release: Malicious code in auth-otp (npm) MAL-2026-14425 | Malicious | Not scored | 24 Aug, 2026 | npm auth-otp |
Malicious release: Malicious code in remove-bg-serverless-azure (npm) GHSA-65rf-pp5h-8fw9, MAL-2026-14438 | Malicious | Not scored | 24 Aug, 2026 | npm remove-bg-serverless-azure |
Malicious release: Malicious code in dim-hydration-ui (npm) GHSA-6797-g855-4767, MAL-2026-14429 | Malicious | Not scored | 24 Aug, 2026 | npm dim-hydration-ui |
Malicious release: Malicious code in secret-key-totp (npm) MAL-2026-14439 | Malicious | Not scored | 24 Aug, 2026 | npm secret-key-totp |
Malicious release: Malicious code in paypal-business-sdk (npm) MAL-2026-14435 | Malicious | Not scored | 24 Aug, 2026 | npm paypal-business-sdk |
Malicious release: Malicious code in manticore-log (npm) MAL-2026-14433 | Malicious | Not scored | 24 Aug, 2026 | npm manticore-log |
Malicious release: Malicious code in ppb-manticore (npm) MAL-2026-14437 | Malicious | Not scored | 24 Aug, 2026 | npm ppb-manticore |
Malicious release: Malicious code in @gsas/gsas-sdk (npm) MAL-2026-14420 | Malicious | Not scored | 24 Aug, 2026 | npm @gsas/gsas-sdk |
Malicious release: Malicious code in web-advertising (npm) MAL-2026-14440 | Malicious | Not scored | 24 Aug, 2026 | npm web-advertising |
Malicious release: Malicious code in @yuva2210/htx-poc-skills-rce (npm) MAL-2026-15686 | Malicious | Not scored | 24 Aug, 2026 | npm @yuva2210/htx-poc-skills-rce |
Malicious release: Malicious code in @yuva2210/okx-poc-rce-impact (npm) MAL-2026-15687 | Malicious | Not scored | 24 Aug, 2026 | npm @yuva2210/okx-poc-rce-impact |
Malicious release: Malicious code in @x-team/strapi (npm) MAL-2026-15685 | Malicious | Not scored | 24 Aug, 2026 | npm @x-team/strapi |
Malicious release: Malicious code in hydration-ui-dim (npm) GHSA-79qw-ww45-gpfp, MAL-2026-14431 | Malicious | Not scored | 24 Aug, 2026 | npm hydration-ui-dim |
Malicious release: Malicious code in svelte-ui-dim (npm) GHSA-qvqg-96qf-37vw, MAL-2026-14442 | Malicious | Not scored | 24 Aug, 2026 | npm svelte-ui-dim |
Malicious release: Malicious code in svelte-dim-ui (npm) GHSA-x8x3-xwj6-73vv, MAL-2026-14441 | Malicious | Not scored | 24 Aug, 2026 | npm svelte-dim-ui |
Malicious release: Malicious code in hydration-dim-ui (npm) GHSA-xf2r-j86w-6c3x, MAL-2026-14430 | Malicious | Not scored | 24 Aug, 2026 | npm hydration-dim-ui |
Malicious release: Malicious code in @pimy-b2cweb/common (npm) MAL-2026-15684 | Malicious | Not scored | 24 Aug, 2026 | npm @pimy-b2cweb/common |
Malicious release: Malicious code in @pimy-b2cweb/apiclient-common (npm) MAL-2026-15683 | Malicious | Not scored | 24 Aug, 2026 | npm @pimy-b2cweb/apiclient-common |
Malicious release: Malicious code in @ice-trade-components/common (npm) MAL-2026-15682 | Malicious | Not scored | 24 Aug, 2026 | npm @ice-trade-components/common |
Malicious release: Malicious code in @grab-food/order-sdk-web (npm) MAL-2026-15681 | Malicious | Not scored | 24 Aug, 2026 | npm @grab-food/order-sdk-web |
Malicious release: Malicious code in @cawraytestorg/packagetest2 (npm) MAL-2026-15680 | Malicious | Not scored | 24 Aug, 2026 | npm @cawraytestorg/packagetest2 |
Malicious release: Malicious code in @bpa-internal/bpa-utils (npm) MAL-2026-15679 | Malicious | Not scored | 24 Aug, 2026 | npm @bpa-internal/bpa-utils |
Malicious release: Malicious code in @bpa-internal/bpa-common (npm) MAL-2026-15677 | Malicious | Not scored | 24 Aug, 2026 | npm @bpa-internal/bpa-common |
Malicious release: Malicious code in @bpa-internal/bpa-types (npm) MAL-2026-15678 | Malicious | Not scored | 24 Aug, 2026 | npm @bpa-internal/bpa-types |
Malicious release: Malicious code in @bpa-internal/bpa-auth (npm) MAL-2026-15676 | Malicious | Not scored | 24 Aug, 2026 | npm @bpa-internal/bpa-auth |
Malicious release: Malicious code in @b2b-frontend/store (npm) MAL-2026-15675 | Malicious | Not scored | 24 Aug, 2026 | npm @b2b-frontend/store |
Malicious release: Malicious code in dotish (npm) GHSA-5xvx-37p2-x7j9, MAL-2026-14418 | Malicious | Not scored | 24 Aug, 2026 | npm dotish |
Malicious release: Malicious code in dims-svelte-ui (npm) GHSA-3jcp-rjh9-wq99, MAL-2026-14417 | Malicious | Not scored | 24 Aug, 2026 | npm dims-svelte-ui |