Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @sqlite-labs/createsql (npm) GHSA-qwqp-6xhg-jhhv, MAL-2026-13713 | Malicious | Not scored | 10 Aug, 2026 | npm @sqlite-labs/createsql |
Malicious release: Malicious code in spoint (npm) GHSA-72h3-pwwh-68cx, MAL-2026-13725 | Malicious | Not scored | 10 Aug, 2026 | npm spoint |
Malicious release: Malicious code in svelte-kit-streak (npm) GHSA-rc4p-g2mc-7w8h, MAL-2026-13726 | Malicious | Not scored | 10 Aug, 2026 | npm svelte-kit-streak |
Malicious release: Malicious code in kit-map-streak (npm) GHSA-7wwj-2mjc-pmxq, MAL-2026-13724 | Malicious | Not scored | 10 Aug, 2026 | npm kit-map-streak |
Malicious release: Malicious code in godot-kit (npm) GHSA-j7m9-r9h4-rfw8, MAL-2026-13723 | Malicious | Not scored | 10 Aug, 2026 | npm godot-kit |
Malicious release: Malicious code in tailwind-elements-ui (npm) GHSA-mmpq-4w6p-rwg2, MAL-2026-13727 | Malicious | Not scored | 10 Aug, 2026 | npm tailwind-elements-ui |
Malicious release: Malicious code in @sqlite-table/sql-creator (npm) GHSA-4hxf-37q3-vfxh, MAL-2026-13718 | Malicious | Not scored | 10 Aug, 2026 | npm @sqlite-table/sql-creator |
Malicious release: Malicious code in @sqlite-prime/nodesql (npm) GHSA-f348-mwv9-7p8h, MAL-2026-13716 | Malicious | Not scored | 10 Aug, 2026 | npm @sqlite-prime/nodesql |
Malicious release: Malicious code in @sqlite-table/schema-generator (npm) GHSA-f86c-mf53-7934, MAL-2026-13717 | Malicious | Not scored | 10 Aug, 2026 | npm @sqlite-table/schema-generator |
Malicious release: Malicious code in fsbrowse (npm) GHSA-pvvh-h7rh-2c7g, MAL-2026-13722 | Malicious | Not scored | 10 Aug, 2026 | npm fsbrowse |
Malicious release: Malicious code in @sqlite-prime/createsql (npm) GHSA-v49c-g99c-qvf9, MAL-2026-13715 | Malicious | Not scored | 10 Aug, 2026 | npm @sqlite-prime/createsql |
Malicious release: Malicious code in commonjs-assertion (npm) GHSA-mfjj-4625-mpvr, MAL-2026-13719 | Malicious | Not scored | 10 Aug, 2026 | npm commonjs-assertion |
Malicious release: Malicious code in eth-library-toolkit (npm) GHSA-mqxc-259c-25w3, MAL-2026-13720 | Malicious | Not scored | 10 Aug, 2026 | npm eth-library-toolkit |
Malicious release: Malicious code in eth-library-utils (npm) GHSA-rp49-3975-7q6c, MAL-2026-13721 | Malicious | Not scored | 10 Aug, 2026 | npm eth-library-utils |
Malicious release: Malicious code in polymarket-stake-mathss (npm) MAL-2026-13707 | Malicious | Not scored | 10 Aug, 2026 | npm polymarket-stake-mathss |
Malicious release: Malicious code in xerohub-discord-voice (npm) MAL-2026-13708 | Malicious | Not scored | 10 Aug, 2026 | npm xerohub-discord-voice |
Malicious release: Malicious code in neverthrow-js (npm) MAL-2026-13706 | Malicious | Not scored | 10 Aug, 2026 | npm neverthrow-js |
Malicious release: Malicious code in chai-as-format (npm) MAL-2026-13701 | Malicious | Not scored | 10 Aug, 2026 | npm chai-as-format |
Malicious release: Malicious code in chai-as-promised-plus (npm) MAL-2026-13703 | Malicious | Not scored | 10 Aug, 2026 | npm chai-as-promised-plus |
Malicious release: Malicious code in chai-as-deployer (npm) GHSA-6q3r-v92v-89p4, GHSA-7qqp-m577-rp2w, MAL-2026-13700, SNYK-JS-CHAIASDEPLOYER-18609744 | Malicious | Not scored | 10 Aug, 2026 | npm chai-as-deployer |
Malicious release: Malicious code in chai-as-bench (npm) MAL-2026-13699 | Malicious | Not scored | 10 Aug, 2026 | npm chai-as-bench |
Malicious release: Malicious code in chai-as-map (npm) MAL-2026-13702 | Malicious | Not scored | 10 Aug, 2026 | npm chai-as-map |
Malicious release: Malicious code in chai-tracker (npm) GHSA-xvr2-rmx5-mrv3, MAL-2026-13704 | Malicious | Not scored | 10 Aug, 2026 | npm chai-tracker |
Malicious release: Malicious code in iconova-react (npm) GHSA-mvp5-cv38-rqfj, MAL-2026-13705 | Malicious | Not scored | 10 Aug, 2026 | npm iconova-react |
Malicious release: Malicious code in @kuperka/chainguard-sdk (npm) MAL-2026-13688 | Malicious | Not scored | 10 Aug, 2026 | npm @kuperka/chainguard-sdk |
Malicious release: Malicious code in @rblxts/services (npm) MAL-2026-13691 | Malicious | Not scored | 10 Aug, 2026 | npm @rblxts/services |
Malicious release: Malicious code in postcss-initial-provider (npm) GHSA-44hx-h55m-c65w, MAL-2026-13696 | Malicious | Not scored | 10 Aug, 2026 | npm postcss-initial-provider |
Malicious release: Malicious code in chai-jsonss (npm) MAL-2026-13692 | Malicious | Not scored | 10 Aug, 2026 | npm chai-jsonss |
Malicious release: Malicious code in @noobaihome/amis-simple-area-widget (npm) MAL-2026-13689 | Malicious | Not scored | 10 Aug, 2026 | npm @noobaihome/amis-simple-area-widget |
Malicious release: Malicious code in @noobaihome/amis-uni-area-widget (npm) MAL-2026-13690 | Malicious | Not scored | 10 Aug, 2026 | npm @noobaihome/amis-uni-area-widget |
Malicious release: Malicious code in cryptostock (npm) MAL-2026-13693 | Malicious | Not scored | 10 Aug, 2026 | npm cryptostock |
Malicious release: Malicious code in env-local (npm) MAL-2026-13694 | Malicious | Not scored | 10 Aug, 2026 | npm env-local |
Malicious release: Malicious code in simple-date-formatter-new-9 (npm) MAL-2026-13698 | Malicious | Not scored | 10 Aug, 2026 | npm simple-date-formatter-new-9 |
Malicious release: Malicious code in simple-date-formatter-new-10 (npm) MAL-2026-13697 | Malicious | Not scored | 10 Aug, 2026 | npm simple-date-formatter-new-10 |
Malicious release: Malicious code in tokocrytodev (npm) MAL-2026-13687 | Malicious | Not scored | 10 Aug, 2026 | npm tokocrytodev |
Malicious release: Malicious code in @ssgw/icon (npm) MAL-2026-13684 | Malicious | Not scored | 10 Aug, 2026 | npm @ssgw/icon |
Malicious release: Malicious code in hex-encode-utils (npm) MAL-2026-13695 | Malicious | Not scored | 10 Aug, 2026 | npm hex-encode-utils |
Malicious release: Malicious code in statist-browser-typed-client-eventea.projects.pwakasko (npm) GHSA-4fvg-gp6j-v2qm, MAL-2026-13673 | Malicious | Not scored | 08 Aug, 2026 | npm statist-browser-typed-client-eventea.projects.pwakasko |
Malicious release: Malicious code in test-noexist-xyz-99 (npm) GHSA-682j-6frp-w6rq, MAL-2026-13680 | Malicious | Not scored | 08 Aug, 2026 | npm test-noexist-xyz-99 |
Malicious release: Malicious code in statist-browser-typed-client-eventea.projects.tdeal (npm) GHSA-966c-8786-6cx7, MAL-2026-13674 | Malicious | Not scored | 08 Aug, 2026 | npm statist-browser-typed-client-eventea.projects.tdeal |
Malicious release: Malicious code in specials-resources-server (npm) GHSA-9wh2-7j4m-r43r, MAL-2026-13669 | Malicious | Not scored | 08 Aug, 2026 | npm specials-resources-server |
Malicious release: Malicious code in statist-browser-typed-client-eventea.projects.pwainsurance (npm) GHSA-hm23-rg8r-xhmg, MAL-2026-13672 | Malicious | Not scored | 08 Aug, 2026 | npm statist-browser-typed-client-eventea.projects.pwainsurance |
Malicious release: Malicious code in statist-browser-typed-client-eventea.projects.pwafamily (npm) GHSA-qmv3-2w4r-rwwq, MAL-2026-13670 | Malicious | Not scored | 08 Aug, 2026 | npm statist-browser-typed-client-eventea.projects.pwafamily |
Malicious release: Malicious code in statist-browser-typed-client-eventea.projects.tdevice (npm) GHSA-rrvf-xjx8-gmjh, MAL-2026-13675 | Malicious | Not scored | 08 Aug, 2026 | npm statist-browser-typed-client-eventea.projects.tdevice |
Malicious release: Malicious code in statist-browser-typed-client-eventea.projects.pwahelp (npm) GHSA-wvc6-wpjx-jgx8, MAL-2026-13671 | Malicious | Not scored | 08 Aug, 2026 | npm statist-browser-typed-client-eventea.projects.pwahelp |
Malicious release: Malicious code in svelte-kit-cache (npm) GHSA-9fg7-rqp2-7hpg, MAL-2026-13677 | Malicious | Not scored | 08 Aug, 2026 | npm svelte-kit-cache |
Malicious release: Malicious code in svelte-streak-kit (npm) GHSA-2w6v-q693-8jjm, MAL-2026-13679 | Malicious | Not scored | 08 Aug, 2026 | npm svelte-streak-kit |
Malicious release: Malicious code in @coralxyz/anchor (npm) MAL-2026-13629 | Malicious | Not scored | 08 Aug, 2026 | npm @coralxyz/anchor |
Malicious release: Malicious code in titan-exchange-shared-permissions (npm) MAL-2026-13664 | Malicious | Not scored | 08 Aug, 2026 | npm titan-exchange-shared-permissions |
Malicious release: Malicious code in modern-localization (npm) MAL-2026-13633 | Malicious | Not scored | 08 Aug, 2026 | npm modern-localization |