Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in npm_pkg_1094 (npm) GHSA-mmwr-73mc-579v, MAL-2026-14090 | Malicious | Not scored | 14 Aug, 2026 | npm npm_pkg_1094 |
Malicious release: Malicious code in npm_pkg_1093 (npm) GHSA-m24g-rf73-rmgw, MAL-2026-14089 | Malicious | Not scored | 14 Aug, 2026 | npm npm_pkg_1093 |
Malicious release: Malicious code in rimo-env-validator (npm) GHSA-vxrx-29h5-w69f, MAL-2026-14092 | Malicious | Not scored | 14 Aug, 2026 | npm rimo-env-validator |
Malicious release: Malicious code in utils-bundle (npm) GHSA-w78x-223m-8f3j, MAL-2026-14098 | Malicious | Not scored | 14 Aug, 2026 | npm utils-bundle |
Malicious release: Malicious code in elf-stats-cranberry-wishlist-933 (npm) GHSA-6hmg-xwg7-v3gq, MAL-2026-14079 | Malicious | Not scored | 14 Aug, 2026 | npm elf-stats-cranberry-wishlist-933 |
Malicious release: Malicious code in elf-stats-caroling-stocking-510 (npm) GHSA-ggp7-664r-m55m, MAL-2026-14078 | Malicious | Not scored | 14 Aug, 2026 | npm elf-stats-caroling-stocking-510 |
Malicious release: Malicious code in thepackagethatworks_ (npm) GHSA-9vjx-6rvc-2p3c, MAL-2026-14097 | Malicious | Not scored | 14 Aug, 2026 | npm thepackagethatworks_ |
Malicious release: Malicious code in google-logging-utils-internal (npm) GHSA-jcx5-6w99-v44p, MAL-2026-14082 | Malicious | Not scored | 14 Aug, 2026 | npm google-logging-utils-internal |
Malicious release: Malicious code in mw-filesystem-events-nodream-es6 (npm) GHSA-2cr5-3f7h-7vv6, MAL-2026-14087 | Malicious | Not scored | 14 Aug, 2026 | npm mw-filesystem-events-nodream-es6 |
Malicious release: Malicious code in rtms-manager-dev (npm) GHSA-88hw-5c75-wg74, MAL-2026-14093 | Malicious | Not scored | 14 Aug, 2026 | npm rtms-manager-dev |
Malicious release: Malicious code in expect-bundle (npm) GHSA-f24w-wg35-f2f2, MAL-2026-14080 | Malicious | Not scored | 14 Aug, 2026 | npm expect-bundle |
Malicious release: Malicious code in nolimitcity (npm) GHSA-ph66-8fq6-fjpg, MAL-2026-14088 | Malicious | Not scored | 14 Aug, 2026 | npm nolimitcity |
Malicious release: Malicious code in saps_secplayground_npm_ai (npm) GHSA-637f-42g5-85p4, MAL-2026-14094 | Malicious | Not scored | 14 Aug, 2026 | npm saps_secplayground_npm_ai |
Malicious release: Malicious code in fr-ito-web-react (npm) MAL-2026-14019 | Malicious | Not scored | 14 Aug, 2026 | npm fr-ito-web-react |
Malicious release: Malicious code in preinstall-hook-webhook-callback-demo (npm) MAL-2026-14016 | Malicious | Not scored | 13 Aug, 2026 | npm preinstall-hook-webhook-callback-demo |
Malicious release: Malicious code in wct-st (npm) MAL-2026-13990 | Malicious | Not scored | 13 Aug, 2026 | npm wct-st |
Malicious release: Malicious code in webautomation_js (npm) MAL-2026-13991 | Malicious | Not scored | 13 Aug, 2026 | npm webautomation_js |
Malicious release: Malicious code in @secauditb20y/sec-test-r3b (npm) MAL-2026-13989 | Malicious | Not scored | 13 Aug, 2026 | npm @secauditb20y/sec-test-r3b |
Malicious release: Malicious code in root-locator (npm) GHSA-57g4-vm3v-74xg, MAL-2026-14009 | Malicious | Not scored | 13 Aug, 2026 | npm root-locator |
Malicious release: Malicious code in source-analyzer (npm) GHSA-p68g-6893-44r8, MAL-2026-14013 | Malicious | Not scored | 13 Aug, 2026 | npm source-analyzer |
Malicious release: Malicious code in path-match-js (npm) GHSA-cgj7-7fj2-6r74, MAL-2026-14005 | Malicious | Not scored | 13 Aug, 2026 | npm path-match-js |
Malicious release: Malicious code in react-shield (npm) GHSA-gmx3-395m-pwc2, MAL-2026-14007 | Malicious | Not scored | 13 Aug, 2026 | npm react-shield |
Malicious release: Malicious code in @jacksher/install-exec-poc (npm) GHSA-4fj2-wwv5-x646, MAL-2026-13972 | Malicious | Not scored | 13 Aug, 2026 | npm @jacksher/install-exec-poc |
Malicious release: Malicious code in node-config-svg-contract (npm) MAL-2026-13985 | Malicious | Not scored | 13 Aug, 2026 | npm node-config-svg-contract |
Malicious release: Malicious code in notafollower (npm) MAL-2026-13986 | Malicious | Not scored | 13 Aug, 2026 | npm notafollower |
Malicious release: Malicious code in datefmt-util-helper (npm) MAL-2026-13978 | Malicious | Not scored | 13 Aug, 2026 | npm datefmt-util-helper |
Malicious release: Malicious code in @khaznatech/common (npm) MAL-2026-13973 | Malicious | Not scored | 13 Aug, 2026 | npm @khaznatech/common |
Malicious release: Malicious code in @khaznatech/utils (npm) MAL-2026-13975 | Malicious | Not scored | 13 Aug, 2026 | npm @khaznatech/utils |
Malicious release: Malicious code in @khaznatech/core (npm) MAL-2026-13974 | Malicious | Not scored | 13 Aug, 2026 | npm @khaznatech/core |
Malicious release: Malicious code in check-audit (npm) GHSA-qqm3-3cpw-q9xx, MAL-2026-13976 | Malicious | Not scored | 13 Aug, 2026 | npm check-audit |
Malicious release: Malicious code in in-install (npm) GHSA-3qfv-pgqh-pvpw, MAL-2026-13982 | Malicious | Not scored | 13 Aug, 2026 | npm in-install |
Malicious release: Malicious code in cspell-esm (npm) GHSA-97mm-cxmj-h672, MAL-2026-13977 | Malicious | Not scored | 13 Aug, 2026 | npm cspell-esm |
Malicious release: Malicious code in napi-raw (npm) GHSA-588j-2jx3-7mqj, MAL-2026-13984 | Malicious | Not scored | 13 Aug, 2026 | npm napi-raw |
Malicious release: Malicious code in eslint-generate-prerelease (npm) GHSA-wqfp-7qwr-4r4g, MAL-2026-13979 | Malicious | Not scored | 13 Aug, 2026 | npm eslint-generate-prerelease |
Malicious release: Malicious code in knip-bun (npm) GHSA-xrrj-hrq9-xvxg, MAL-2026-13983 | Malicious | Not scored | 13 Aug, 2026 | npm knip-bun |
Malicious release: Malicious code in eslint-generate-release (npm) GHSA-3pw3-hc35-j73p, MAL-2026-13980 | Malicious | Not scored | 13 Aug, 2026 | npm eslint-generate-release |
Malicious release: Malicious code in eslint-publish-release (npm) GHSA-rqq3-8xp4-pvcq, MAL-2026-13981 | Malicious | Not scored | 13 Aug, 2026 | npm eslint-publish-release |
Malicious release: Malicious code in resolve-audit (npm) GHSA-69qf-g8jq-47xv, MAL-2026-13987 | Malicious | Not scored | 13 Aug, 2026 | npm resolve-audit |
Malicious release: Malicious code in @hzero-front-ui/cfg (npm) MAL-2026-13968 | Malicious | Not scored | 13 Aug, 2026 | npm @hzero-front-ui/cfg |
Malicious release: Malicious code in @hzero-front-ui/c7n-ui (npm) MAL-2026-13967 | Malicious | Not scored | 13 Aug, 2026 | npm @hzero-front-ui/c7n-ui |
Malicious release: Malicious code in @hzero-front-ui/core (npm) MAL-2026-13969 | Malicious | Not scored | 13 Aug, 2026 | npm @hzero-front-ui/core |
Malicious release: Malicious code in @hzero-front-ui/hzero-ui (npm) MAL-2026-13970 | Malicious | Not scored | 13 Aug, 2026 | npm @hzero-front-ui/hzero-ui |
Malicious release: Malicious code in @hzero-front-ui/themes (npm) MAL-2026-13971 | Malicious | Not scored | 13 Aug, 2026 | npm @hzero-front-ui/themes |
Malicious release: Malicious code in xrblocks-mcp (npm) MAL-2026-13988 | Malicious | Not scored | 13 Aug, 2026 | npm xrblocks-mcp |
Malicious release: Malicious code in tizen-webdriver-cli (npm) MAL-2026-13966 | Malicious | Not scored | 13 Aug, 2026 | npm tizen-webdriver-cli |
Malicious release: Malicious code in nc-verify-127942 (npm) MAL-2026-13965 | Malicious | Not scored | 13 Aug, 2026 | npm nc-verify-127942 |
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS CVE-2026-73654, GHSA-p28v-f755-9qrg | High | 0.6% | 13 Aug, 2026 | npm @trigger.dev/core |
Malicious release: Malicious code in @solana-js/web3 (npm) MAL-2026-13941 | Malicious | Not scored | 13 Aug, 2026 | npm @solana-js/web3 |
Malicious release: Malicious code in external-process-live-log (npm) MAL-2026-13949 | Malicious | Not scored | 13 Aug, 2026 | npm external-process-live-log |
Malicious release: Malicious code in @leonardo0902/vortex-kit (npm) MAL-2026-13939 | Malicious | Not scored | 13 Aug, 2026 | npm @leonardo0902/vortex-kit |