Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in local-config-parser (npm) GHSA-f463-rm4g-746g, MAL-2026-11167 | Malicious | Not scored | 28 Jul, 2026 | npm local-config-parser |
Malicious release: Malicious code in aone-sandbox (npm) GHSA-mv5v-q5f3-gf7h, MAL-2026-11164 | Malicious | Not scored | 28 Jul, 2026 | npm aone-sandbox |
Malicious release: Malicious code in lib-mtop (npm) GHSA-vrrg-j2c5-mj4v, MAL-2026-11166 | Malicious | Not scored | 28 Jul, 2026 | npm lib-mtop |
Malicious release: Malicious code in cloud-config-fetcher (npm) GHSA-25r8-r3cf-28q4, MAL-2026-11165 | Malicious | Not scored | 28 Jul, 2026 | npm cloud-config-fetcher |
Malicious release: Malicious code in smart-config-manager (npm) GHSA-v644-r975-m85m, MAL-2026-11169 | Malicious | Not scored | 28 Jul, 2026 | npm smart-config-manager |
Malicious release: Malicious code in simple-probe-utils (npm) MAL-2026-11147 | Malicious | Not scored | 28 Jul, 2026 | npm simple-probe-utils |
Malicious release: Malicious code in korvica (npm) MAL-2026-11140 | Malicious | Not scored | 28 Jul, 2026 | npm korvica |
Malicious release: Malicious code in streak-core-lib (npm) MAL-2026-11148 | Malicious | Not scored | 28 Jul, 2026 | npm streak-core-lib |
Malicious release: Malicious code in vtranalytic (PyPI) MAL-2026-11156 | Malicious | Not scored | 28 Jul, 2026 | PyPI vtranalytic |
Malicious release: Malicious code in color-convert-helper (npm) MAL-2026-11134 | Malicious | Not scored | 28 Jul, 2026 | npm color-convert-helper |
Malicious release: Malicious code in json-schema-inspector (npm) MAL-2026-11138 | Malicious | Not scored | 28 Jul, 2026 | npm json-schema-inspector |
Malicious release: Malicious code in bianira-ui (npm) MAL-2026-11132 | Malicious | Not scored | 28 Jul, 2026 | npm bianira-ui |
Malicious release: Malicious code in streak-core-math (npm) MAL-2026-11149 | Malicious | Not scored | 28 Jul, 2026 | npm streak-core-math |
Malicious release: Malicious code in @crbrc/xbt (npm) MAL-2026-11122 | Malicious | Not scored | 28 Jul, 2026 | npm @crbrc/xbt |
Malicious release: Malicious code in kordyn (npm) MAL-2026-11139 | Malicious | Not scored | 28 Jul, 2026 | npm kordyn |
Malicious release: Malicious code in rollup-runtime-core-polyfills (npm) MAL-2026-11145 | Malicious | Not scored | 28 Jul, 2026 | npm rollup-runtime-core-polyfills |
Malicious release: Malicious code in react-puller (npm) MAL-2026-11144 | Malicious | Not scored | 28 Jul, 2026 | npm react-puller |
Malicious release: Malicious code in blots (npm) MAL-2026-11158 | Malicious | Not scored | 28 Jul, 2026 | npm blots |
Malicious release: Malicious code in array-node-utils (npm) MAL-2026-11130 | Malicious | Not scored | 28 Jul, 2026 | npm array-node-utils |
Malicious release: Malicious code in text-line-parser (npm) MAL-2026-11151 | Malicious | Not scored | 28 Jul, 2026 | npm text-line-parser |
Malicious release: Malicious code in sigchain-js (npm) GHSA-xq2c-h4ch-xmwj, MAL-2026-11146 | Malicious | Not scored | 28 Jul, 2026 | npm sigchain-js |
Malicious release: Malicious code in @apexfnd/apex (npm) MAL-2026-11121 | Malicious | Not scored | 28 Jul, 2026 | npm @apexfnd/apex |
Malicious release: Malicious code in node-array-plus (npm) MAL-2026-11142 | Malicious | Not scored | 28 Jul, 2026 | npm node-array-plus |
Malicious release: Malicious code in streak-daily-lib (npm) MAL-2026-11150 | Malicious | Not scored | 28 Jul, 2026 | npm streak-daily-lib |
Malicious release: Malicious code in parallely (npm) GHSA-rmhx-v9xh-x4jv, MAL-2026-11143 | Malicious | Not scored | 28 Jul, 2026 | npm parallely |
Malicious release: Malicious code in ethers-secure (npm) MAL-2026-11135 | Malicious | Not scored | 28 Jul, 2026 | npm ethers-secure |
Malicious release: Malicious code in tidal-embed-player (npm) GHSA-7w7p-cq73-h3p4, MAL-2026-11152 | Malicious | Not scored | 28 Jul, 2026 | npm tidal-embed-player |
Malicious release: Malicious code in basic-vite (npm) MAL-2026-11131 | Malicious | Not scored | 28 Jul, 2026 | npm basic-vite |
Malicious release: Malicious code in triage_bot_using_sdkv3 (npm) MAL-2026-11153 | Malicious | Not scored | 28 Jul, 2026 | npm triage_bot_using_sdkv3 |
Malicious release: Malicious code in jobber-app-template-react (npm) GHSA-wvfj-f49f-7vqw, MAL-2026-11137 | Malicious | Not scored | 28 Jul, 2026 | npm jobber-app-template-react |
Malicious release: Malicious code in @yancyyu/agentcli (npm) MAL-2026-11123 | Malicious | Not scored | 28 Jul, 2026 | npm @yancyyu/agentcli |
Malicious release: Malicious code in xerohub-discord-voice-v3 (npm) MAL-2026-11155 | Malicious | Not scored | 28 Jul, 2026 | npm xerohub-discord-voice-v3 |
Malicious release: Malicious code in xerohub-discord-voice-v2 (npm) MAL-2026-11154 | Malicious | Not scored | 28 Jul, 2026 | npm xerohub-discord-voice-v2 |
Malicious release: Malicious code in lib-streak-math (npm) MAL-2026-11141 | Malicious | Not scored | 28 Jul, 2026 | npm lib-streak-math |
Malicious release: Malicious code in @ai_/autoprefixers (npm) MAL-2026-11120 | Malicious | Not scored | 28 Jul, 2026 | npm @ai_/autoprefixers |
Malicious release: Malicious code in app-sim-layer (npm) MAL-2026-11126 | Malicious | Not scored | 28 Jul, 2026 | npm app-sim-layer |
Malicious release: Malicious code in app-sima-layer (npm) MAL-2026-11127 | Malicious | Not scored | 28 Jul, 2026 | npm app-sima-layer |
Malicious release: Malicious code in app-svm-layer (npm) MAL-2026-11129 | Malicious | Not scored | 28 Jul, 2026 | npm app-svm-layer |
Malicious release: Malicious code in api-rust-sdk (npm) MAL-2026-11125 | Malicious | Not scored | 28 Jul, 2026 | npm api-rust-sdk |
Malicious release: Malicious code in api-node-sdk (npm) MAL-2026-11124 | Malicious | Not scored | 28 Jul, 2026 | npm api-node-sdk |
Malicious release: Malicious code in fluid-type-ui (npm) GHSA-4w4v-pw3v-q85q, MAL-2026-11136 | Malicious | Not scored | 28 Jul, 2026 | npm fluid-type-ui |
Malicious release: Malicious code in chain-analyze (npm) GHSA-vmj5-cm6w-jrgj, MAL-2026-11133 | Malicious | Not scored | 28 Jul, 2026 | npm chain-analyze |
Malicious release: Malicious code in toll_free (npm) MAL-2026-11159 | Malicious | Not scored | 28 Jul, 2026 | npm toll_free |
Malicious release: Malicious code in app-soda-layer (npm) MAL-2026-11128 | Malicious | Not scored | 28 Jul, 2026 | npm app-soda-layer |
Malicious release: Malicious code in array-sort-helper (npm) MAL-2026-11118 | Malicious | Not scored | 28 Jul, 2026 | npm array-sort-helper |
Malicious release: Malicious code in json-to-table-util (npm) MAL-2026-11119 | Malicious | Not scored | 28 Jul, 2026 | npm json-to-table-util |
Malicious release: Malicious code in num-format-helper (npm) MAL-2026-11107 | Malicious | Not scored | 28 Jul, 2026 | npm num-format-helper |
Malicious release: Malicious code in date-sanitize-helper (npm) MAL-2026-11106 | Malicious | Not scored | 28 Jul, 2026 | npm date-sanitize-helper |
Malicious release: Malicious code in string-format-kit (npm) MAL-2026-11108 | Malicious | Not scored | 28 Jul, 2026 | npm string-format-kit |
Malicious release: Malicious code in @vaultflow/update-flow (npm) GHSA-gv55-mvjq-232h, MAL-2026-11097 | Malicious | Not scored | 28 Jul, 2026 | npm @vaultflow/update-flow |