Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in decimal-format-utils (npm) GHSA-63g4-gv37-rfv8, MAL-2026-6368 | Malicious | Not scored | 24 Jun, 2026 | npm decimal-format-utils |
Malicious release: Malicious code in rollup-runtime-polyfill-core (npm) GHSA-cx5m-r6wc-pp56, MAL-2026-6372 | Malicious | Not scored | 24 Jun, 2026 | npm rollup-runtime-polyfill-core |
Malicious release: Malicious code in assertcore (npm) GHSA-8f9p-rcjg-hhx4, MAL-2026-6365 | Malicious | Not scored | 24 Jun, 2026 | npm assertcore |
Malicious release: Malicious code in backpack-ios (npm) MAL-2026-6366 | Malicious | Not scored | 24 Jun, 2026 | npm backpack-ios |
Malicious release: Malicious code in llm-traces-app (npm) MAL-2026-6371 | Malicious | Not scored | 24 Jun, 2026 | npm llm-traces-app |
Malicious release: Malicious code in twilio-voice-js-reference-components (npm) GHSA-5wvr-g236-9w68, GHSA-6547-hjjw-237x, MAL-2026-6373 | Malicious | Not scored | 24 Jun, 2026 | npm twilio-voice-js-reference-components |
Malicious release: Malicious code in openllmapi (npm) MAL-2026-6364 | Malicious | Not scored | 24 Jun, 2026 | npm openllmapi |
Malicious release: Malicious code in monty-data (npm) MAL-2026-6362 | Malicious | Not scored | 24 Jun, 2026 | npm monty-data |
Malicious release: Malicious code in npmkekw (npm) MAL-2026-6363 | Malicious | Not scored | 24 Jun, 2026 | npm npmkekw |
Malicious release: Malicious code in tailwind-textform-fill (npm) GHSA-4wh6-h6rw-f94h, MAL-2026-6360 | Malicious | Not scored | 24 Jun, 2026 | npm tailwind-textform-fill |
Malicious release: Malicious code in html-to-gutenberg (npm) GHSA-2gqj-wrf5-35w8, MAL-2026-6359 | Malicious | Not scored | 24 Jun, 2026 | npm html-to-gutenberg |
Malicious release: Malicious code in fetch-page-assets (npm) GHSA-vxq2-vhm7-7mhq, MAL-2026-6358 | Malicious | Not scored | 24 Jun, 2026 | npm fetch-page-assets |
Malicious release: Malicious code in vscode-test-web (npm) GHSA-vxwh-gqjr-fxcw, MAL-2026-6361 | Malicious | Not scored | 24 Jun, 2026 | npm vscode-test-web |
Malicious release: Malicious code in delta-time-32bb (npm) MAL-2026-6351 | Malicious | Not scored | 23 Jun, 2026 | npm delta-time-32bb |
Malicious release: Malicious code in npm-bug-bounty-test1-rhyselsmore (npm) MAL-2026-6354 | Malicious | Not scored | 23 Jun, 2026 | npm npm-bug-bounty-test1-rhyselsmore |
Malicious release: Malicious code in ppt-creator (npm) MAL-2026-6355 | Malicious | Not scored | 23 Jun, 2026 | npm ppt-creator |
Malicious release: Malicious code in bug-monorepo (npm) MAL-2026-6349 | Malicious | Not scored | 23 Jun, 2026 | npm bug-monorepo |
Malicious release: Malicious code in theme-color-picker (npm) GHSA-89wv-9w8v-q55g, MAL-2026-6357 | Malicious | Not scored | 23 Jun, 2026 | npm theme-color-picker |
Malicious release: Malicious code in chai-as-operated (npm) MAL-2026-6350 | Malicious | Not scored | 23 Jun, 2026 | npm chai-as-operated |
Malicious release: Malicious code in markdownlint-cli2-fix (npm) GHSA-75g7-vcxw-p99c, MAL-2026-6353 | Malicious | Not scored | 23 Jun, 2026 | npm markdownlint-cli2-fix |
Malicious release: Malicious code in buffer-wrap-67d7 (npm) MAL-2026-6348 | Malicious | Not scored | 23 Jun, 2026 | npm buffer-wrap-67d7 |
Malicious release: Malicious code in hex-conv-ae7a (npm) MAL-2026-6352 | Malicious | Not scored | 23 Jun, 2026 | npm hex-conv-ae7a |
Malicious release: Malicious code in safe-json-38bd (npm) MAL-2026-6356 | Malicious | Not scored | 23 Jun, 2026 | npm safe-json-38bd |
Malicious release: Malicious code in wagmi_util (npm) MAL-2026-6347 | Malicious | Not scored | 23 Jun, 2026 | npm wagmi_util |
Malicious release: Malicious code in log-taker (npm) GHSA-x8v5-5q93-844w, MAL-2026-6338 | Malicious | Not scored | 23 Jun, 2026 | npm log-taker |
Malicious release: Malicious code in react-check-error (npm) GHSA-fphr-9c8m-c35g, MAL-2026-6341 | Malicious | Not scored | 23 Jun, 2026 | npm react-check-error |
Malicious release: Malicious code in triage-bot (npm) MAL-2026-6346 | Malicious | Not scored | 23 Jun, 2026 | npm triage-bot |
Malicious release: Malicious code in therdweb (npm) GHSA-g2vx-7x66-f2wv, MAL-2026-6342 | Malicious | Not scored | 23 Jun, 2026 | npm therdweb |
Malicious release: Malicious code in thidweb (npm) GHSA-3vx6-4gr6-qj63, MAL-2026-6343 | Malicious | Not scored | 23 Jun, 2026 | npm thidweb |
Malicious release: Malicious code in rainbownkit (npm) GHSA-vj5m-3jrw-83gx, MAL-2026-6340 | Malicious | Not scored | 23 Jun, 2026 | npm rainbownkit |
Malicious release: Malicious code in thurdweb (npm) GHSA-vx4c-33rj-4xv8, MAL-2026-6345 | Malicious | Not scored | 23 Jun, 2026 | npm thurdweb |
Malicious release: Malicious code in thirdwebjs (npm) GHSA-8jr3-m3cj-m436, MAL-2026-6344 | Malicious | Not scored | 23 Jun, 2026 | npm thirdwebjs |
Malicious release: Malicious code in rainbokit (npm) GHSA-56vv-8v7m-r49g, MAL-2026-6339 | Malicious | Not scored | 23 Jun, 2026 | npm rainbokit |
Malicious release: Malicious code in hunsterx-package (npm) GHSA-29mh-6rgm-mmfw, MAL-2026-6337 | Malicious | Not scored | 23 Jun, 2026 | npm hunsterx-package |
Malicious release: Malicious code in @zynkit/probe (npm) GHSA-2pxg-2qw7-jff9, MAL-2026-6314 | Malicious | Not scored | 23 Jun, 2026 | npm @zynkit/probe |
Malicious release: Malicious code in @frostnode/probe (npm) GHSA-73jc-hjg9-95v9, MAL-2026-6304 | Malicious | Not scored | 23 Jun, 2026 | npm @frostnode/probe |
Malicious release: Malicious code in @gleamkit/probe (npm) GHSA-6gc9-mcvc-x8c9, MAL-2026-6306 | Malicious | Not scored | 23 Jun, 2026 | npm @gleamkit/probe |
Malicious release: Malicious code in ts-grok (npm) GHSA-qp73-r9hh-6vq9, MAL-2026-6321 | Malicious | Not scored | 23 Jun, 2026 | npm ts-grok |
Malicious release: Malicious code in ts-escrow (npm) GHSA-fjgh-3fjv-prm3, MAL-2026-6320 | Malicious | Not scored | 23 Jun, 2026 | npm ts-escrow |
Malicious release: Malicious code in ts-bn-lint-helper (npm) GHSA-27pp-cq88-wg87, MAL-2026-6318 | Malicious | Not scored | 23 Jun, 2026 | npm ts-bn-lint-helper |
Malicious release: Malicious code in ts-bn-lint (npm) MAL-2026-6317 | Malicious | Not scored | 23 Jun, 2026 | npm ts-bn-lint |
Malicious release: Malicious code in ts-escro (npm) GHSA-5hm9-jj3m-6q76, MAL-2026-6319 | Malicious | Not scored | 23 Jun, 2026 | npm ts-escro |
Malicious release: Malicious code in @muaththir/api (npm) GHSA-vxx9-pq69-m5rh, MAL-2026-6328 | Malicious | Not scored | 23 Jun, 2026 | npm @muaththir/api |
Malicious release: Malicious code in ts-biginteger-lib (npm) GHSA-6v6m-rhh8-ww9v, MAL-2026-6316 | Malicious | Not scored | 23 Jun, 2026 | npm ts-biginteger-lib |
Malicious release: Malicious code in cursorai-agent (npm) GHSA-xq66-q5q9-992p, MAL-2026-6332 | Malicious | Not scored | 23 Jun, 2026 | npm cursorai-agent |
Malicious release: Malicious code in @ravespaceio/rave-engine (npm) GHSA-72c8-h2pr-vwjg, MAL-2026-6330 | Malicious | Not scored | 23 Jun, 2026 | npm @ravespaceio/rave-engine |
Malicious release: Malicious code in @ravespaceio/browser-input (npm) GHSA-w9pc-2fqh-jmjg, MAL-2026-6329 | Malicious | Not scored | 23 Jun, 2026 | npm @ravespaceio/browser-input |
Malicious release: Malicious code in web3-crypto-address-utils (npm) MAL-2026-6324 | Malicious | Not scored | 23 Jun, 2026 | npm web3-crypto-address-utils |
Malicious release: Malicious code in web3-eth-util (npm) GHSA-g69q-p7f8-4jp3, MAL-2026-6325 | Malicious | Not scored | 23 Jun, 2026 | npm web3-eth-util |
Malicious release: Malicious code in web3-eth-utils (npm) GHSA-f5r2-qmg4-83w6, MAL-2026-6326 | Malicious | Not scored | 23 Jun, 2026 | npm web3-eth-utils |