Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @shell-cabinet/routes (npm) GHSA-53jv-685j-pchq, GHSA-qmhh-w396-g2p9, MAL-2026-5428, SNYK-JS-SHELLCABINETROUTES-18758918 | Malicious | Not scored | 09 Jun, 2026 | npm @shell-cabinet/routes |
Malicious release: Malicious code in @easy-entry/routes (npm) GHSA-9gwm-xrv4-c436, GHSA-g9fq-cx25-24m4, MAL-2026-5410, SNYK-JS-EASYENTRYROUTES-18758928 | Malicious | Not scored | 09 Jun, 2026 | npm @easy-entry/routes |
Malicious release: Malicious code in @easy-entry/landing-routes (npm) GHSA-cqm2-3c85-97rm, GHSA-xp5g-jv74-3fxh, MAL-2026-5408, SNYK-JS-EASYENTRYLANDINGROUTES-18758923 | Malicious | Not scored | 09 Jun, 2026 | npm @easy-entry/landing-routes |
Malicious release: Malicious code in shopify-app-bridge-internal (npm) GHSA-f435-6j4p-6q42, MAL-2026-5452 | Malicious | Not scored | 09 Jun, 2026 | npm shopify-app-bridge-internal |
Malicious release: Malicious code in @sourceflow-uk/sourceflow-tracker (npm) GHSA-6pqf-hp72-2v55, GHSA-j9q7-mjw2-vvpr, MAL-2026-5430, SNYK-JS-SOURCEFLOWUKSOURCEFLOWTRACKER-18758931 | Malicious | Not scored | 09 Jun, 2026 | npm @sourceflow-uk/sourceflow-tracker |
Malicious release: Malicious code in ac_calendar_ts (npm) GHSA-xgwp-29j2-jxj3, MAL-2026-5434 | Malicious | Not scored | 09 Jun, 2026 | npm ac_calendar_ts |
Malicious release: Malicious code in ac_semantic-ui_ts (npm) GHSA-hjh8-hv66-6mwc, MAL-2026-5435 | Malicious | Not scored | 09 Jun, 2026 | npm ac_semantic-ui_ts |
Malicious release: Malicious code in @oplus/obus-web-sdk (npm) MAL-2026-5425 | Malicious | Not scored | 09 Jun, 2026 | npm @oplus/obus-web-sdk |
Malicious release: Malicious code in @oplus/obus-web-sdk-plugin-recovery (npm) MAL-2026-5426 | Malicious | Not scored | 09 Jun, 2026 | npm @oplus/obus-web-sdk-plugin-recovery |
Malicious release: Malicious code in @oplus/obus-core (npm) MAL-2026-5424 | Malicious | Not scored | 09 Jun, 2026 | npm @oplus/obus-core |
Malicious release: Malicious code in tao-subnet-metrics (PyPI) MAL-2026-5457 | Malicious | Not scored | 09 Jun, 2026 | PyPI tao-subnet-metrics |
Malicious release: Malicious code in ultimate-ai-power (PyPI) MAL-2026-5458 | Malicious | Not scored | 09 Jun, 2026 | PyPI ultimate-ai-power |
Malicious release: Malicious code in comos-sdk (npm) GHSA-xr7v-2mxc-cw5x, MAL-2026-5405 | Malicious | Not scored | 09 Jun, 2026 | npm comos-sdk |
Malicious release: Malicious code in cubifyanything (PyPI) MAL-2026-5404 | Malicious | Not scored | 09 Jun, 2026 | PyPI cubifyanything |
Malicious release: Malicious code in @0xlr/sentry-web (npm) GHSA-pq34-wqrw-jw86, MAL-2026-5387 | Malicious | Not scored | 09 Jun, 2026 | npm @0xlr/sentry-web |
Malicious release: Malicious code in @0xlr/clerk-auth (npm) GHSA-57r8-xw4c-5j59, MAL-2026-5385 | Malicious | Not scored | 09 Jun, 2026 | npm @0xlr/clerk-auth |
Malicious release: Malicious code in @0xlr/prisma-client-js (npm) GHSA-mrxf-wq2g-xvxm, MAL-2026-5386 | Malicious | Not scored | 09 Jun, 2026 | npm @0xlr/prisma-client-js |
Malicious release: Malicious code in @0xlr/vercel-analytics (npm) GHSA-p9mc-hf7g-gjfx, MAL-2026-5391 | Malicious | Not scored | 09 Jun, 2026 | npm @0xlr/vercel-analytics |
Malicious release: Malicious code in @0xlr/stripe-frontend (npm) GHSA-c3gr-xj4c-rc53, MAL-2026-5389 | Malicious | Not scored | 09 Jun, 2026 | npm @0xlr/stripe-frontend |
Malicious release: Malicious code in @0xlr/stripe-checkout-js (npm) GHSA-3fr8-m4cc-93fj, MAL-2026-5388 | Malicious | Not scored | 09 Jun, 2026 | npm @0xlr/stripe-checkout-js |
Malicious release: Malicious code in ui-weave (npm) GHSA-x2w5-px4q-j9wq, MAL-2026-5406 | Malicious | Not scored | 09 Jun, 2026 | npm ui-weave |
Malicious release: Malicious code in @0xlr/supabase-db (npm) GHSA-236w-q9vm-8r42, MAL-2026-5390 | Malicious | Not scored | 09 Jun, 2026 | npm @0xlr/supabase-db |
Malicious release: Malicious code in kraken-ui (npm) GHSA-g324-m33p-jjf4, MAL-2026-5399 | Malicious | Not scored | 09 Jun, 2026 | npm kraken-ui |
Malicious release: Malicious code in @sflyinc-knapsack/shutterfly-react (npm) GHSA-55g7-853c-wpj5, MAL-2026-5393 | Malicious | Not scored | 09 Jun, 2026 | npm @sflyinc-knapsack/shutterfly-react |
Malicious release: Malicious code in @open-banking/cabinet-providers (npm) GHSA-423v-5hgq-8rxh, GHSA-r2wq-c8cp-gp8h, MAL-2026-5392, SNYK-JS-OPENBANKINGCABINETPROVIDERS-18758922 | Malicious | Not scored | 09 Jun, 2026 | npm @open-banking/cabinet-providers |
Malicious release: Malicious code in savant-listing (npm) GHSA-j69h-7gg8-2fxp, GHSA-j9c7-3gvf-x8xg, MAL-2026-5401 | Malicious | Not scored | 09 Jun, 2026 | npm savant-listing |
Malicious release: Malicious code in screenpipe-mcp-http (npm) MAL-2026-5402 | Malicious | Not scored | 09 Jun, 2026 | npm screenpipe-mcp-http |
Malicious release: Malicious code in multica (npm) MAL-2026-5400 | Malicious | Not scored | 09 Jun, 2026 | npm multica |
Malicious release: Malicious code in create-docs-mcp (npm) MAL-2026-5397 | Malicious | Not scored | 09 Jun, 2026 | npm create-docs-mcp |
Malicious release: Malicious code in t-invest-mcp-server (npm) MAL-2026-5403 | Malicious | Not scored | 09 Jun, 2026 | npm t-invest-mcp-server |
Malicious release: Malicious code in @sqlite-node/createsql (npm) GHSA-9w2p-6gjc-vrqv, MAL-2026-5396 | Malicious | Not scored | 09 Jun, 2026 | npm @sqlite-node/createsql |
Malicious release: Malicious code in @sql-access/nodesql (npm) GHSA-qpx3-6fx4-259q, MAL-2026-5394 | Malicious | Not scored | 09 Jun, 2026 | npm @sql-access/nodesql |
Malicious release: Malicious code in hey-base32 (npm) MAL-2026-5398 | Malicious | Not scored | 09 Jun, 2026 | npm hey-base32 |
Malicious release: Malicious code in @sql-trigger/nodesql (npm) GHSA-9f9w-wg5j-m53j, MAL-2026-5395 | Malicious | Not scored | 09 Jun, 2026 | npm @sql-trigger/nodesql |
Malicious release: Malicious code in kecak256 (npm) GHSA-4vrf-wcrh-g5j5, MAL-2026-5342 | Malicious | Not scored | 09 Jun, 2026 | npm kecak256 |
Malicious release: Malicious code in enquriers (npm) GHSA-c8vc-qqjp-wg87, MAL-2026-5384 | Malicious | Not scored | 09 Jun, 2026 | npm enquriers |
Malicious release: Malicious code in progerss-cli (npm) GHSA-pr99-g8pf-f3rr, MAL-2026-5343 | Malicious | Not scored | 09 Jun, 2026 | npm progerss-cli |
Malicious release: Malicious code in @doaction/wasm-loader (npm) GHSA-54mr-v524-rmw6, MAL-2026-5383 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/wasm-loader |
Malicious release: Malicious code in @doaction/types (npm) GHSA-m5q9-qwgm-wvqx, MAL-2026-5382 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/types |
Malicious release: Malicious code in @doaction/examples (npm) GHSA-3hg6-5qgp-v676, MAL-2026-5372 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/examples |
Malicious release: Malicious code in @doaction/pay (npm) GHSA-55rv-c39c-944m, MAL-2026-5375 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/pay |
Malicious release: Malicious code in @doaction/mapstore (npm) GHSA-6mxf-8m2v-f345, MAL-2026-5374 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/mapstore |
Malicious release: Malicious code in @doaction/http (npm) GHSA-cpf3-vrxh-mv98, MAL-2026-5373 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/http |
Malicious release: Malicious code in @doaction/sudo-prompt (npm) GHSA-f9qh-hqgp-pgvc, MAL-2026-5380 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/sudo-prompt |
Malicious release: Malicious code in @doaction/signalhub (npm) GHSA-gq53-mvg2-fxjf, MAL-2026-5378 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/signalhub |
Malicious release: Malicious code in @doaction/rrweb-sdk (npm) GHSA-j6f2-qf2j-5mh5, MAL-2026-5376 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/rrweb-sdk |
Malicious release: Malicious code in @doaction/storage (npm) GHSA-v89r-6g3x-gjjv, MAL-2026-5379 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/storage |
Malicious release: Malicious code in @doaction/systeminformation (npm) GHSA-xj3m-q8rc-3f5j, MAL-2026-5381 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/systeminformation |
Malicious release: Malicious code in @doaction/shared (npm) GHSA-5784-q7wq-ch43, MAL-2026-5377 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/shared |
Malicious release: Malicious code in @doaction/auth (npm) GHSA-5cwj-c46v-mpmf, MAL-2026-5369 | Malicious | Not scored | 09 Jun, 2026 | npm @doaction/auth |