Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in lib-frontsga (npm) GHSA-gjrm-rjj5-9x2v, MAL-2026-13448 | Malicious | Not scored | 06 Aug, 2026 | npm lib-frontsga |
Malicious release: Malicious code in pilgrimage-portal-client (npm) GHSA-r69p-2jjg-vh25, MAL-2026-13453 | Malicious | Not scored | 06 Aug, 2026 | npm pilgrimage-portal-client |
Malicious release: Malicious code in wos-library-ui (npm) GHSA-j5rq-m53m-6xfx, GHSA-wh36-rj36-m3ff, MAL-2026-13467 | Malicious | Not scored | 06 Aug, 2026 | npm wos-library-ui |
Malicious release: Malicious code in @wbnr/frontend-shared (npm) GHSA-9vgv-g4jx-8g9w, MAL-2026-13436 | Malicious | Not scored | 06 Aug, 2026 | npm @wbnr/frontend-shared |
Malicious release: Malicious code in commonweb-balance (npm) GHSA-wmh3-jw93-5988, MAL-2026-13439 | Malicious | Not scored | 06 Aug, 2026 | npm commonweb-balance |
Malicious release: Malicious code in consumerweb-creditcollection (npm) GHSA-5h26-cm3q-vvcf, MAL-2026-13441 | Malicious | Not scored | 06 Aug, 2026 | npm consumerweb-creditcollection |
Malicious release: Malicious code in connect-contingency (npm) GHSA-3q7q-6272-2v37, MAL-2026-13440 | Malicious | Not scored | 06 Aug, 2026 | npm connect-contingency |
Malicious release: Malicious code in content-common (npm) MAL-2026-13442 | Malicious | Not scored | 06 Aug, 2026 | npm content-common |
Malicious release: Malicious code in cewe-npm-cops (npm) GHSA-823q-q648-p3m6, MAL-2026-13438 | Malicious | Not scored | 06 Aug, 2026 | npm cewe-npm-cops |
Malicious release: Malicious code in merchantweb-lang-cookie-reset (npm) GHSA-5vjj-p6vh-456m, MAL-2026-13449 | Malicious | Not scored | 06 Aug, 2026 | npm merchantweb-lang-cookie-reset |
Malicious release: Malicious code in alphalend-abi (PyPI) MAL-2026-13472 | Malicious | Not scored | 06 Aug, 2026 | PyPI alphalend-abi |
Malicious release: Malicious code in @ch4acko3/frontal-lobe (npm) MAL-2026-13430 | Malicious | Not scored | 06 Aug, 2026 | npm @ch4acko3/frontal-lobe |
Malicious release: Malicious code in @avi892nash/aegis-grid-runner (npm) MAL-2026-13429 | Malicious | Not scored | 06 Aug, 2026 | npm @avi892nash/aegis-grid-runner |
Malicious release: Malicious code in alphalend-layouts (PyPI) MAL-2026-13473 | Malicious | Not scored | 06 Aug, 2026 | PyPI alphalend-layouts |
Malicious release: Malicious code in stretchshop (npm) MAL-2026-13460 | Malicious | Not scored | 06 Aug, 2026 | npm stretchshop |
Malicious release: Malicious code in streak-map-cache (npm) GHSA-v2fj-c673-2gjm, MAL-2026-13459 | Malicious | Not scored | 06 Aug, 2026 | npm streak-map-cache |
Malicious release: Malicious code in @love-moon/conductor-cli (npm) MAL-2026-13428 | Malicious | Not scored | 06 Aug, 2026 | npm @love-moon/conductor-cli |
Malicious release: Malicious code in diezyyasha-baileys (npm) GHSA-78fc-2672-hcjg, MAL-2026-13443 | Malicious | Not scored | 06 Aug, 2026 | npm diezyyasha-baileys |
Malicious release: Malicious code in @diezyyasha/libsignal-node (npm) GHSA-rcr5-gcjg-gx4j, MAL-2026-13474 | Malicious | Not scored | 06 Aug, 2026 | npm @diezyyasha/libsignal-node |
Malicious release: Malicious code in @leejungkiin/awkit (npm) MAL-2026-13427 | Malicious | Not scored | 06 Aug, 2026 | npm @leejungkiin/awkit |
Malicious release: Malicious code in @holocronlab/botruntime-runtime (npm) MAL-2026-13419 | Malicious | Not scored | 06 Aug, 2026 | npm @holocronlab/botruntime-runtime |
Malicious release: Malicious code in @innocarpe/deepseek-build (npm) MAL-2026-13420 | Malicious | Not scored | 06 Aug, 2026 | npm @innocarpe/deepseek-build |
Malicious release: Malicious code in fetchrtds (npm) MAL-2026-13423 | Malicious | Not scored | 06 Aug, 2026 | npm fetchrtds |
Malicious release: Malicious code in tailwindcss-hide-scrollbar (npm) GHSA-rvh2-7968-hpfx, MAL-2026-13424 | Malicious | Not scored | 06 Aug, 2026 | npm tailwindcss-hide-scrollbar |
Malicious release: Malicious code in @ccfly/setup-linux-x64 (npm) MAL-2026-13418 | Malicious | Not scored | 06 Aug, 2026 | npm @ccfly/setup-linux-x64 |
Malicious release: Malicious code in @ccfly/setup-linux-arm64 (npm) MAL-2026-13417 | Malicious | Not scored | 06 Aug, 2026 | npm @ccfly/setup-linux-arm64 |
Malicious release: Malicious code in @atom8n/inspector (npm) MAL-2026-13414 | Malicious | Not scored | 06 Aug, 2026 | npm @atom8n/inspector |
Malicious release: Malicious code in @astralcore/aura-wb (npm) MAL-2026-13413 | Malicious | Not scored | 06 Aug, 2026 | npm @astralcore/aura-wb |
Malicious release: Malicious code in @aubea/mars (npm) MAL-2026-13415 | Malicious | Not scored | 06 Aug, 2026 | npm @aubea/mars |
Malicious release: Malicious code in xayoub-xctxteam (PyPI) MAL-2026-13426 | Malicious | Not scored | 06 Aug, 2026 | PyPI xayoub-xctxteam |
Malicious release: Malicious code in @addai/entity-runtime (npm) MAL-2026-13410 | Malicious | Not scored | 06 Aug, 2026 | npm @addai/entity-runtime |
Malicious release: Malicious code in @addai/node (npm) MAL-2026-13411 | Malicious | Not scored | 06 Aug, 2026 | npm @addai/node |
Malicious release: Malicious code in @addai/ainode (npm) MAL-2026-13409 | Malicious | Not scored | 06 Aug, 2026 | npm @addai/ainode |
Malicious release: Malicious code in @activepieces/piece-base44 (npm) MAL-2026-13408 | Malicious | Not scored | 06 Aug, 2026 | npm @activepieces/piece-base44 |
Malicious release: Malicious code in @0l00000l/auth (npm) MAL-2026-13407 | Malicious | Not scored | 06 Aug, 2026 | npm @0l00000l/auth |
Malicious release: Malicious code in 9remote (npm) MAL-2026-13406 | Malicious | Not scored | 06 Aug, 2026 | npm 9remote |
Malicious release: Malicious code in beautiful-ui-monitoring (npm) MAL-2026-13422 | Malicious | Not scored | 06 Aug, 2026 | npm beautiful-ui-monitoring |
Malicious release: Malicious code in @trackunit/iris-app-sdk-vite (npm) MAL-2026-13421 | Malicious | Not scored | 06 Aug, 2026 | npm @trackunit/iris-app-sdk-vite |
Malicious release: Malicious code in @apicity/meta (npm) MAL-2026-13412 | Malicious | Not scored | 06 Aug, 2026 | npm @apicity/meta |
Malicious release: Malicious code in typst-resume-cli (npm) MAL-2026-13425 | Malicious | Not scored | 06 Aug, 2026 | npm typst-resume-cli |
Malicious release: Malicious code in agenttunnels (npm) MAL-2026-13400 | Malicious | Not scored | 06 Aug, 2026 | npm agenttunnels |
Malicious release: Malicious code in @activepieces/piece-google-bigquery (npm) MAL-2026-13394 | Malicious | Not scored | 06 Aug, 2026 | npm @activepieces/piece-google-bigquery |
Malicious release: Malicious code in @activepieces/piece-google-contacts (npm) MAL-2026-13395 | Malicious | Not scored | 06 Aug, 2026 | npm @activepieces/piece-google-contacts |
Malicious release: Malicious code in @activepieces/piece-google-forms (npm) MAL-2026-13396 | Malicious | Not scored | 06 Aug, 2026 | npm @activepieces/piece-google-forms |
Malicious release: Malicious code in tsihealth-client (npm) GHSA-jcwv-5jc7-grp5, MAL-2026-13404 | Malicious | Not scored | 06 Aug, 2026 | npm tsihealth-client |
Malicious release: Malicious code in @xiaohhhh1/canvas-agent (npm) MAL-2026-13398 | Malicious | Not scored | 06 Aug, 2026 | npm @xiaohhhh1/canvas-agent |
Malicious release: Malicious code in vitest-preview-pro-all (npm) MAL-2026-13405 | Malicious | Not scored | 06 Aug, 2026 | npm vitest-preview-pro-all |
Malicious release: Malicious code in agenthub-multiagent-mcp (npm) MAL-2026-13399 | Malicious | Not scored | 06 Aug, 2026 | npm agenthub-multiagent-mcp |
Malicious release: Malicious code in streak-cache-map (npm) GHSA-wpj4-68w6-w2fh, MAL-2026-13403 | Malicious | Not scored | 06 Aug, 2026 | npm streak-cache-map |
Malicious release: Malicious code in helmet-pro (npm) MAL-2026-13401 | Malicious | Not scored | 06 Aug, 2026 | npm helmet-pro |