Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in simplipayng (npm) GHSA-qw5j-q6g9-pqhf, MAL-2026-12437 | Malicious | Not scored | 05 Aug, 2026 | npm simplipayng |
Malicious release: Malicious code in block_package (npm) MAL-2026-12340 | Malicious | Not scored | 05 Aug, 2026 | npm block_package |
Malicious release: Malicious code in trapp-configuration (npm) GHSA-4x68-h3j7-vc7v, MAL-2026-12485 | Malicious | Not scored | 05 Aug, 2026 | npm trapp-configuration |
Malicious release: Malicious code in mcp-audit-sync-internal (npm) MAL-2026-12401 | Malicious | Not scored | 05 Aug, 2026 | npm mcp-audit-sync-internal |
Malicious release: Malicious code in eslint-plugin-vitest-ts (npm) GHSA-pw3r-jw68-935v, MAL-2026-12370 | Malicious | Not scored | 05 Aug, 2026 | npm eslint-plugin-vitest-ts |
Malicious release: Malicious code in streak-calendar-core (npm) GHSA-6vcc-7wg6-pwfr, MAL-2026-12458 | Malicious | Not scored | 05 Aug, 2026 | npm streak-calendar-core |
Malicious release: Malicious code in bnpl-blocks-independent-bnpl-search (npm) GHSA-v43r-98qv-2v96, MAL-2026-12341 | Malicious | Not scored | 05 Aug, 2026 | npm bnpl-blocks-independent-bnpl-search |
Malicious release: Malicious code in @nasddatax/common (npm) GHSA-mx45-4vrr-4fgp, MAL-2026-12323 | Malicious | Not scored | 05 Aug, 2026 | npm @nasddatax/common |
Malicious release: Malicious code in uniswap-sdk-v4 (npm) MAL-2026-12490 | Malicious | Not scored | 05 Aug, 2026 | npm uniswap-sdk-v4 |
Malicious release: Malicious code in dolyame-ui-form (npm) GHSA-x6j7-22fv-cjwc, MAL-2026-12367 | Malicious | Not scored | 05 Aug, 2026 | npm dolyame-ui-form |
Malicious release: Malicious code in csv-parser-helper (npm) MAL-2026-12360 | Malicious | Not scored | 05 Aug, 2026 | npm csv-parser-helper |
Malicious release: Malicious code in invest-module-cookie (npm) GHSA-j5gr-vpx9-45fh, MAL-2026-12393 | Malicious | Not scored | 05 Aug, 2026 | npm invest-module-cookie |
Malicious release: Malicious code in runtime-sentinel (npm) MAL-2026-12432 | Malicious | Not scored | 05 Aug, 2026 | npm runtime-sentinel |
Malicious release: Malicious code in elephant-array-utils (npm) MAL-2026-12369 | Malicious | Not scored | 05 Aug, 2026 | npm elephant-array-utils |
Malicious release: Malicious code in digital-interview-digital-interview-core (npm) GHSA-q8v7-w9cp-xx9g, MAL-2026-12362 | Malicious | Not scored | 05 Aug, 2026 | npm digital-interview-digital-interview-core |
Malicious release: Malicious code in time-linters-webapp-eslint-config (npm) GHSA-xm67-8mvr-77j7, MAL-2026-12479 | Malicious | Not scored | 05 Aug, 2026 | npm time-linters-webapp-eslint-config |
Malicious release: Malicious code in chart-data-utils (npm) MAL-2026-12350 | Malicious | Not scored | 05 Aug, 2026 | npm chart-data-utils |
Malicious release: Malicious code in statist-browser-typed-client-automlplatform.nlppl.searchy (npm) GHSA-w6p7-7c73-jqc9, MAL-2026-12443 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-automlplatform.nlppl.searchy |
Malicious release: Malicious code in react-fontawesome-icons (npm) GHSA-xvfg-jp9r-63q2, MAL-2026-12423 | Malicious | Not scored | 05 Aug, 2026 | npm react-fontawesome-icons |
Malicious release: Malicious code in boxy-fixture-allure (npm) GHSA-cq8x-34cv-8xxm, MAL-2026-12342 | Malicious | Not scored | 05 Aug, 2026 | npm boxy-fixture-allure |
Malicious release: Malicious code in streak-int-lib (npm) GHSA-266j-4pvf-xhwr, MAL-2026-12467 | Malicious | Not scored | 05 Aug, 2026 | npm streak-int-lib |
Malicious release: Malicious code in pvm-autodoc (npm) GHSA-9352-468r-x8fr, MAL-2026-12421 | Malicious | Not scored | 05 Aug, 2026 | npm pvm-autodoc |
Malicious release: Malicious code in statist-browser-typed-client-twork.tsales.nitro.metrics (npm) MAL-2026-12455 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-twork.tsales.nitro.metrics |
Malicious release: Malicious code in streak-metricsa (npm) MAL-2026-12470 | Malicious | Not scored | 05 Aug, 2026 | npm streak-metricsa |
Malicious release: Malicious code in foodi (npm) MAL-2026-12383 | Malicious | Not scored | 05 Aug, 2026 | npm foodi |
Malicious release: Malicious code in tcb-web-copy-to-clipboard (npm) GHSA-3pj2-pfvc-578w, MAL-2026-12475 | Malicious | Not scored | 05 Aug, 2026 | npm tcb-web-copy-to-clipboard |
Malicious release: Malicious code in gcli-control (PyPI) MAL-2026-12502 | Malicious | Not scored | 05 Aug, 2026 | PyPI gcli-control |
Malicious release: Malicious code in streak-day-engine (npm) MAL-2026-12462 | Malicious | Not scored | 05 Aug, 2026 | npm streak-day-engine |
Malicious release: Malicious code in statist-browser-typed-client-social.shorts.editor (npm) GHSA-47qq-jwjf-m75c, MAL-2026-12454 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-social.shorts.editor |
Malicious release: Malicious code in pfp-forms-mobile-sme-group-tiles (npm) GHSA-9vp2-g2wh-59wm, MAL-2026-12413 | Malicious | Not scored | 05 Aug, 2026 | npm pfp-forms-mobile-sme-group-tiles |
Malicious release: Malicious code in @copilot-mcp/apex (npm) MAL-2026-12314 | Malicious | Not scored | 05 Aug, 2026 | npm @copilot-mcp/apex |
Malicious release: Malicious code in @zahlen/checkout-react (npm) GHSA-x74p-x7r9-958g, MAL-2026-12333 | Malicious | Not scored | 05 Aug, 2026 | npm @zahlen/checkout-react |
Malicious release: Malicious code in statist-browser-typed-client-sme.rko.finance.web (npm) GHSA-xp46-hchp-5mhp, MAL-2026-12453 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-sme.rko.finance.web |
Malicious release: Malicious code in statist-browser-typed-client-eventea.projects.pfpacquiring (npm) GHSA-p42f-p569-4px5, MAL-2026-12445 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-eventea.projects.pfpacquiring |
Malicious release: Malicious code in streak-daykit (npm) GHSA-7vmx-4mxx-6vxr, MAL-2026-12466 | Malicious | Not scored | 05 Aug, 2026 | npm streak-daykit |
Malicious release: Malicious code in postcss-animate-css-vars (npm) GHSA-432g-6qr7-8hvh, MAL-2026-12418 | Malicious | Not scored | 05 Aug, 2026 | npm postcss-animate-css-vars |
Malicious release: Malicious code in dolyame-boxy-atom-bnpl-email-form (npm) GHSA-5984-qppr-c9h5, MAL-2026-12363 | Malicious | Not scored | 05 Aug, 2026 | npm dolyame-boxy-atom-bnpl-email-form |
Malicious release: Malicious code in hubert-verify-primary-email-am (npm) GHSA-9pwr-3vg2-xwcw, MAL-2026-12391 | Malicious | Not scored | 05 Aug, 2026 | npm hubert-verify-primary-email-am |
Malicious release: Malicious code in dolyame-boxy-independent-bnpl-info-images (npm) GHSA-r7x5-x2pm-qx2v, MAL-2026-12365 | Malicious | Not scored | 05 Aug, 2026 | npm dolyame-boxy-independent-bnpl-info-images |
Malicious release: Malicious code in saas-f-testing (npm) GHSA-fvrj-4h6r-8rcg, MAL-2026-12434 | Malicious | Not scored | 05 Aug, 2026 | npm saas-f-testing |
Malicious release: Malicious code in @lizhao1/memorax-code-internal (npm) MAL-2026-12320 | Malicious | Not scored | 05 Aug, 2026 | npm @lizhao1/memorax-code-internal |
Malicious release: Malicious code in quorvex (npm) MAL-2026-12422 | Malicious | Not scored | 05 Aug, 2026 | npm quorvex |
Malicious release: Malicious code in rollup-packages-node-polyfills (npm) GHSA-gp6f-mxh4-x3mh, MAL-2026-12428 | Malicious | Not scored | 05 Aug, 2026 | npm rollup-packages-node-polyfills |
Malicious release: Malicious code in warp-drive-internal-tooling (npm) MAL-2026-12500 | Malicious | Not scored | 05 Aug, 2026 | npm warp-drive-internal-tooling |
Malicious release: Malicious code in aegis-runtime (npm) MAL-2026-12335 | Malicious | Not scored | 05 Aug, 2026 | npm aegis-runtime |
Malicious release: Malicious code in calendar-streak-core (npm) MAL-2026-12345 | Malicious | Not scored | 05 Aug, 2026 | npm calendar-streak-core |
Malicious release: Malicious code in ccxt-trading (npm) MAL-2026-12347 | Malicious | Not scored | 05 Aug, 2026 | npm ccxt-trading |
Malicious release: Malicious code in @rentwise/common (npm) GHSA-x23q-mgjg-53mq, MAL-2026-12328 | Malicious | Not scored | 05 Aug, 2026 | npm @rentwise/common |
Malicious release: Malicious code in statist-browser-typed-client-coretech.web.metrics (npm) GHSA-426h-xcw5-2p4m, MAL-2026-12444 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-coretech.web.metrics |
Malicious release: Malicious code in utility-kit-ts (npm) GHSA-p66g-m465-g72x, MAL-2026-12493 | Malicious | Not scored | 05 Aug, 2026 | npm utility-kit-ts |