Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in package-uploader (npm) GHSA-q8q6-p47p-ppp3, MAL-2026-5932 | Malicious | Not scored | 16 Jun, 2026 | npm package-uploader |
Malicious release: Malicious code in mci-sdk (npm) GHSA-7cjh-m5vf-hp3r, MAL-2026-5931 | Malicious | Not scored | 16 Jun, 2026 | npm mci-sdk |
Malicious release: Malicious code in chai-test-mocks (npm) MAL-2026-5928 | Malicious | Not scored | 16 Jun, 2026 | npm chai-test-mocks |
Malicious release: Malicious code in aillmgen (npm) GHSA-cqfc-w7g9-4c7p, MAL-2026-5927 | Malicious | Not scored | 16 Jun, 2026 | npm aillmgen |
Malicious release: Malicious code in @kalipto/local (npm) GHSA-653g-2cfx-6gpc, MAL-2026-5922 | Malicious | Not scored | 16 Jun, 2026 | npm @kalipto/local |
Malicious release: Malicious code in test-copppss (npm) MAL-2026-5926 | Malicious | Not scored | 16 Jun, 2026 | npm test-copppss |
Malicious release: Malicious code in @welcome-onboarding-web/mobile-focus-account-beta-merging (npm) MAL-2026-5923 | Malicious | Not scored | 16 Jun, 2026 | npm @welcome-onboarding-web/mobile-focus-account-beta-merging |
Malicious release: Malicious code in binproto (npm) MAL-2026-5924 | Malicious | Not scored | 16 Jun, 2026 | npm binproto |
Malicious release: Malicious code in motion-lib (npm) GHSA-4qw9-xmhp-hc7v, MAL-2026-5925 | Malicious | Not scored | 16 Jun, 2026 | npm motion-lib |
Malicious release: Malicious code in js-digest (npm) MAL-2026-5912 | Malicious | Not scored | 16 Jun, 2026 | npm js-digest |
Malicious release: Malicious code in pretie_x2 (npm) GHSA-wqxw-wj7c-pv2x, MAL-2026-5920 | Malicious | Not scored | 16 Jun, 2026 | npm pretie_x2 |
Malicious release: Malicious code in pretie_x1 (npm) GHSA-m9g3-3j2m-gf65, MAL-2026-5919 | Malicious | Not scored | 16 Jun, 2026 | npm pretie_x1 |
Malicious release: Malicious code in nottuff7 (npm) GHSA-f4m6-gffx-m3mq, MAL-2026-5918 | Malicious | Not scored | 16 Jun, 2026 | npm nottuff7 |
Malicious release: Malicious code in nottuff23 (npm) GHSA-w6gq-6584-67xq, MAL-2026-5915 | Malicious | Not scored | 16 Jun, 2026 | npm nottuff23 |
Malicious release: Malicious code in nottuff25 (npm) GHSA-2gj2-9868-32pf, MAL-2026-5916 | Malicious | Not scored | 16 Jun, 2026 | npm nottuff25 |
Malicious release: Malicious code in nottuff4 (npm) GHSA-r54f-vpj7-r35g, MAL-2026-5917 | Malicious | Not scored | 16 Jun, 2026 | npm nottuff4 |
Malicious release: Malicious code in nottuff15 (npm) GHSA-pvm5-2r8w-jpqq, MAL-2026-5914 | Malicious | Not scored | 16 Jun, 2026 | npm nottuff15 |
Malicious release: Malicious code in mastraqqq (npm) GHSA-7vj9-63m9-3x7f, MAL-2026-5913 | Malicious | Not scored | 16 Jun, 2026 | npm mastraqqq |
Malicious release: Malicious code in proto-bin (npm) MAL-2026-5921 | Malicious | Not scored | 16 Jun, 2026 | npm proto-bin |
Malicious release: Malicious code in utils-common-helpers (npm) GHSA-fq4g-5xjj-r935, MAL-2026-5911 | Malicious | Not scored | 16 Jun, 2026 | npm utils-common-helpers |
Malicious release: Malicious code in react-hook-use-debounce-throttle-12 (npm) GHSA-2x4w-64xc-78fv, MAL-2026-5909 | Malicious | Not scored | 16 Jun, 2026 | npm react-hook-use-debounce-throttle-12 |
Malicious release: Malicious code in chai-plugin-helper (npm) MAL-2026-5905 | Malicious | Not scored | 16 Jun, 2026 | npm chai-plugin-helper |
Malicious release: Malicious code in chain-chai-test (npm) GHSA-6626-c428-r9qf, MAL-2026-5908 | Malicious | Not scored | 16 Jun, 2026 | npm chain-chai-test |
Malicious release: Malicious code in chai-as-polished (npm) GHSA-jpr9-h23w-g7gg, MAL-2026-5901 | Malicious | Not scored | 16 Jun, 2026 | npm chai-as-polished |
Malicious release: Malicious code in chai-as-tokenized (npm) GHSA-4hvx-q2w4-f48v, MAL-2026-5902 | Malicious | Not scored | 16 Jun, 2026 | npm chai-as-tokenized |
Malicious release: Malicious code in chai-guid (npm) GHSA-g8gv-g8mr-x8pc, MAL-2026-5903 | Malicious | Not scored | 16 Jun, 2026 | npm chai-guid |
Malicious release: Malicious code in chai-plugin-kit (npm) MAL-2026-5906 | Malicious | Not scored | 16 Jun, 2026 | npm chai-plugin-kit |
Malicious release: Malicious code in chai-plugin (npm) MAL-2026-5904 | Malicious | Not scored | 16 Jun, 2026 | npm chai-plugin |
Malicious release: Malicious code in chai-solidity-testkit (npm) MAL-2026-5907 | Malicious | Not scored | 16 Jun, 2026 | npm chai-solidity-testkit |
Malicious release: Malicious code in chai-as-decrypted (npm) GHSA-w7rc-qq2w-vqhg, MAL-2026-5900 | Malicious | Not scored | 16 Jun, 2026 | npm chai-as-decrypted |
Malicious release: Malicious code in uidai_reusable_components (npm) GHSA-8gm2-m96j-547g, MAL-2026-5910 | Malicious | Not scored | 16 Jun, 2026 | npm uidai_reusable_components |
Malicious release: Malicious code in easyllmai (npm) MAL-2026-5895 | Malicious | Not scored | 16 Jun, 2026 | npm easyllmai |
Malicious release: Malicious code in caspian-day-js (npm) MAL-2026-5892 | Malicious | Not scored | 16 Jun, 2026 | npm caspian-day-js |
Malicious release: Malicious code in strict-engine-peer (npm) MAL-2026-5898 | Malicious | Not scored | 16 Jun, 2026 | npm strict-engine-peer |
Malicious release: Malicious code in jest-test-plugin-utils (npm) GHSA-7969-jc8h-fp32, MAL-2026-5896 | Malicious | Not scored | 16 Jun, 2026 | npm jest-test-plugin-utils |
Malicious release: Malicious code in noderzero (npm) MAL-2026-5897 | Malicious | Not scored | 16 Jun, 2026 | npm noderzero |
Malicious release: Malicious code in create-vercel-integration (npm) MAL-2026-5894 | Malicious | Not scored | 16 Jun, 2026 | npm create-vercel-integration |
Malicious release: Malicious code in @dsft/ft-utils (npm) GHSA-2578-g4v9-hc4p, MAL-2026-5890 | Malicious | Not scored | 16 Jun, 2026 | npm @dsft/ft-utils |
Malicious release: Malicious code in @dsft/ft-element (npm) GHSA-5g88-35hm-8xr7, MAL-2026-5889 | Malicious | Not scored | 16 Jun, 2026 | npm @dsft/ft-element |
Malicious release: Malicious code in stripe-cli-init-plugin (npm) MAL-2026-5899 | Malicious | Not scored | 16 Jun, 2026 | npm stripe-cli-init-plugin |
Malicious release: Malicious code in conducts (npm) GHSA-93mx-rvh8-rm26, MAL-2026-5887 | Malicious | Not scored | 16 Jun, 2026 | npm conducts |
Malicious release: Malicious code in atlassian-forge-skills (npm) GHSA-7gj4-qpcp-64p2, MAL-2026-5891 | Malicious | Not scored | 16 Jun, 2026 | npm atlassian-forge-skills |
Malicious release: Malicious code in claude-jar (npm) MAL-2026-5893 | Malicious | Not scored | 16 Jun, 2026 | npm claude-jar |
Malicious release: Malicious code in @vantuz/sdk-core (npm) GHSA-pxhh-8x7x-7g7j, MAL-2026-5886 | Malicious | Not scored | 16 Jun, 2026 | npm @vantuz/sdk-core |
Malicious release: Malicious code in middleware-jwt (npm) GHSA-g9mr-rvmw-fg9c, MAL-2026-5888 | Malicious | Not scored | 16 Jun, 2026 | npm middleware-jwt |
Malicious release: Malicious code in vortnode (npm) GHSA-c3fw-fh7f-9h58, MAL-2026-5884 | Malicious | Not scored | 16 Jun, 2026 | npm vortnode |
Malicious release: Malicious code in wordpad-text-ui (npm) GHSA-83j8-j97r-9p9h, MAL-2026-5885 | Malicious | Not scored | 16 Jun, 2026 | npm wordpad-text-ui |
Malicious release: Malicious code in claude-token-tracker-mcp (npm) GHSA-w56m-5ch4-5xjw, MAL-2026-10693 | Malicious | Not scored | 16 Jun, 2026 | npm claude-token-tracker-mcp |
Malicious release: Malicious code in obfus-jsxy (npm) GHSA-9xh7-qcrr-h88h, MAL-2026-5881 | Malicious | Not scored | 16 Jun, 2026 | npm obfus-jsxy |
Malicious release: Malicious code in redis-xyz (npm) GHSA-mc4w-cxr6-qw8r, MAL-2026-5883 | Malicious | Not scored | 16 Jun, 2026 | npm redis-xyz |