Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in cmp-api-stub (npm) GHSA-q9xg-g7r9-mqrx, MAL-2026-6662 | Malicious | Not scored | 29 Jun, 2026 | npm cmp-api-stub |
Malicious release: Malicious code in app-hotmart-blog-headless (npm) GHSA-vq57-p4j4-v553, MAL-2026-6654 | Malicious | Not scored | 29 Jun, 2026 | npm app-hotmart-blog-headless |
Malicious release: Malicious code in rc-icon (npm) GHSA-vr47-669q-c6p5, MAL-2026-6670 | Malicious | Not scored | 29 Jun, 2026 | npm rc-icon |
Malicious release: Malicious code in @mcconnect/mcc-common-lib (npm) GHSA-xpr4-wg5r-33c8, MAL-2026-6631 | Malicious | Not scored | 29 Jun, 2026 | npm @mcconnect/mcc-common-lib |
Malicious release: Malicious code in pvd3 (npm) GHSA-4m95-g5w6-4x4w, MAL-2026-6669 | Malicious | Not scored | 29 Jun, 2026 | npm pvd3 |
Malicious release: Malicious code in hrb-cas-auth-js (npm) GHSA-fvhw-928m-gxmw, MAL-2026-6664 | Malicious | Not scored | 29 Jun, 2026 | npm hrb-cas-auth-js |
Malicious release: Malicious code in @flipbit2-bb/scope-test (npm) GHSA-5782-j92p-q2m3, MAL-2026-6621 | Malicious | Not scored | 29 Jun, 2026 | npm @flipbit2-bb/scope-test |
Malicious release: Malicious code in clx-cookieparser (npm) GHSA-jpg2-3r22-63v7, MAL-2026-6661 | Malicious | Not scored | 29 Jun, 2026 | npm clx-cookieparser |
Malicious release: Malicious code in bundrix (npm) GHSA-vrw9-m2mj-2fp9, MAL-2026-6658 | Malicious | Not scored | 29 Jun, 2026 | npm bundrix |
Malicious release: Malicious code in auth-state-service (npm) GHSA-53ph-27qg-w52c, MAL-2026-6655 | Malicious | Not scored | 29 Jun, 2026 | npm auth-state-service |
Malicious release: Malicious code in authsessionbridge (npm) GHSA-m936-8h93-fqm9, MAL-2026-6657 | Malicious | Not scored | 29 Jun, 2026 | npm authsessionbridge |
Malicious release: Malicious code in authmatrix (npm) GHSA-qr38-fjw7-r54v, MAL-2026-6656 | Malicious | Not scored | 29 Jun, 2026 | npm authmatrix |
Malicious release: Malicious code in vkzmn (npm) GHSA-96mc-pfwc-4h47, MAL-2026-6594 | Malicious | Not scored | 29 Jun, 2026 | npm vkzmn |
Malicious release: Malicious code in django-bkvision (PyPI) MAL-2026-6593 | Malicious | Not scored | 29 Jun, 2026 | PyPI django-bkvision |
Malicious release: Malicious code in maplibre-gl-vue3 (npm) MAL-2026-6592 | Malicious | Not scored | 29 Jun, 2026 | npm maplibre-gl-vue3 |
Malicious release: Malicious code in endpointmap (npm) GHSA-p3qr-5g48-8w89, MAL-2026-6588 | Malicious | Not scored | 29 Jun, 2026 | npm endpointmap |
Malicious release: Malicious code in envfile-sync (npm) MAL-2026-6589 | Malicious | Not scored | 29 Jun, 2026 | npm envfile-sync |
Malicious release: Malicious code in envfile-sync-cli (npm) GHSA-7f8c-p7q8-mw86, MAL-2026-6590 | Malicious | Not scored | 29 Jun, 2026 | npm envfile-sync-cli |
Malicious release: Malicious code in clob-client-math (npm) MAL-2026-6587 | Malicious | Not scored | 29 Jun, 2026 | npm clob-client-math |
Malicious release: Malicious code in ledgerflow-deploy-utils (npm) MAL-2026-6591 | Malicious | Not scored | 29 Jun, 2026 | npm ledgerflow-deploy-utils |
Malicious release: Malicious code in loadutils (npm) GHSA-mvpj-6xxg-pjm9, MAL-2026-6580 | Malicious | Not scored | 29 Jun, 2026 | npm loadutils |
Malicious release: Malicious code in layerd-unit-codec-parser (npm) GHSA-3h97-jj75-q7j4, MAL-2026-6578 | Malicious | Not scored | 29 Jun, 2026 | npm layerd-unit-codec-parser |
Malicious release: Malicious code in pino-debugging (npm) GHSA-jwq5-g2xm-r48w, MAL-2026-6583 | Malicious | Not scored | 29 Jun, 2026 | npm pino-debugging |
Malicious release: Malicious code in openai-agents-helpers (npm) GHSA-3mxc-g5f6-qr8c, MAL-2026-6582 | Malicious | Not scored | 29 Jun, 2026 | npm openai-agents-helpers |
Malicious release: Malicious code in poly-kelly (npm) GHSA-c37j-v3j2-6gf8, MAL-2026-6584 | Malicious | Not scored | 29 Jun, 2026 | npm poly-kelly |
Malicious release: Malicious code in checkmarx-claude-cache (npm) MAL-2026-6576 | Malicious | Not scored | 29 Jun, 2026 | npm checkmarx-claude-cache |
Malicious release: Malicious code in ollama-helpers (npm) GHSA-73pg-hv45-6r54, MAL-2026-6581 | Malicious | Not scored | 29 Jun, 2026 | npm ollama-helpers |
Malicious release: Malicious code in int_sezzle_sfra (npm) MAL-2026-6577 | Malicious | Not scored | 29 Jun, 2026 | npm int_sezzle_sfra |
Malicious release: Malicious code in stake-math (npm) GHSA-qcc9-j6wh-4h9h, MAL-2026-6585 | Malicious | Not scored | 29 Jun, 2026 | npm stake-math |
Malicious release: Malicious code in lessload (npm) GHSA-62jh-gmff-xfrm, MAL-2026-6579 | Malicious | Not scored | 29 Jun, 2026 | npm lessload |
Malicious release: Malicious code in yastatic-s3 (npm) GHSA-mj8p-qhh7-gvg4, MAL-2026-6586 | Malicious | Not scored | 29 Jun, 2026 | npm yastatic-s3 |
Malicious release: Malicious code in @ibrahim1337/baksen (npm) GHSA-pxqh-hxpm-7p3v, MAL-2026-6575 | Malicious | Not scored | 29 Jun, 2026 | npm @ibrahim1337/baksen |
Malicious release: Malicious code in @thone33/analytics-injector (npm) GHSA-7mg5-m9qh-r4rp, MAL-2026-6563 | Malicious | Not scored | 29 Jun, 2026 | npm @thone33/analytics-injector |
Malicious release: Malicious code in @thone33/core-utils (npm) GHSA-w2wf-8vp4-86mq, MAL-2026-6564 | Malicious | Not scored | 29 Jun, 2026 | npm @thone33/core-utils |
Malicious release: Malicious code in longzy-basic-ui (npm) MAL-2026-6569 | Malicious | Not scored | 29 Jun, 2026 | npm longzy-basic-ui |
Malicious release: Malicious code in pkg-fallback (npm) MAL-2026-6570 | Malicious | Not scored | 29 Jun, 2026 | npm pkg-fallback |
Malicious release: Malicious code in express-mocha-test (npm) GHSA-7jq4-grp7-9wq3, MAL-2026-6568 | Malicious | Not scored | 29 Jun, 2026 | npm express-mocha-test |
Malicious release: Malicious code in @epic-common/observability-node (npm) MAL-2026-6562 | Malicious | Not scored | 29 Jun, 2026 | npm @epic-common/observability-node |
Malicious release: Malicious code in yandex-geobase (npm) GHSA-86q5-cfp8-j54g, MAL-2026-6574 | Malicious | Not scored | 29 Jun, 2026 | npm yandex-geobase |
Malicious release: Malicious code in react-wp-viewer (npm) GHSA-566x-g457-qg8g, MAL-2026-6571 | Malicious | Not scored | 29 Jun, 2026 | npm react-wp-viewer |
Malicious release: Malicious code in date-uuid (npm) MAL-2026-6566 | Malicious | Not scored | 29 Jun, 2026 | npm date-uuid |
Malicious release: Malicious code in eslint-commit-parser (npm) GHSA-qmq6-r6mp-r586, MAL-2026-6567 | Malicious | Not scored | 29 Jun, 2026 | npm eslint-commit-parser |
Malicious release: Malicious code in @uisp/utils (npm) GHSA-8gmj-7w3h-39fx, MAL-2026-6565 | Malicious | Not scored | 29 Jun, 2026 | npm @uisp/utils |
Malicious release: Malicious code in rebrandly-domains-digger (npm) GHSA-44wx-4683-p2h3, MAL-2026-6572 | Malicious | Not scored | 29 Jun, 2026 | npm rebrandly-domains-digger |
Malicious release: Malicious code in rebrandly-domains-search-client (npm) GHSA-6q7q-73w8-xvcf, MAL-2026-6573 | Malicious | Not scored | 29 Jun, 2026 | npm rebrandly-domains-search-client |
Malicious release: Malicious code in ulid-xyz (npm) GHSA-56hj-rr4f-w39g, MAL-2026-6672 | Malicious | Not scored | 29 Jun, 2026 | npm ulid-xyz |
Malicious release: Malicious code in @digitalcnzz/commonmodule (npm) MAL-2026-6595 | Malicious | Not scored | 29 Jun, 2026 | npm @digitalcnzz/commonmodule |
Malicious release: Malicious code in @digitalcnzz/embedded-sdk (npm) MAL-2026-6596 | Malicious | Not scored | 29 Jun, 2026 | npm @digitalcnzz/embedded-sdk |
Malicious release: Malicious code in @longzy/react-native-polyfill (npm) MAL-2026-6597 | Malicious | Not scored | 29 Jun, 2026 | npm @longzy/react-native-polyfill |
Malicious release: Malicious code in @sailing-package/core (npm) MAL-2026-6598 | Malicious | Not scored | 29 Jun, 2026 | npm @sailing-package/core |