Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @ppa-web-components/ppa-hotel-collection (npm) GHSA-4p22-gg56-8457, MAL-2026-18275 | Malicious | Not scored | 4 days ago | npm @ppa-web-components/ppa-hotel-collection |
Malicious release: Malicious code in @ppa-web-components/ppa-banner (npm) GHSA-mwcw-x8h4-mqcg, MAL-2026-18272 | Malicious | Not scored | 4 days ago | npm @ppa-web-components/ppa-banner |
Malicious release: Malicious code in @ppa-web-components/ppa-builder (npm) GHSA-5q5w-4m9f-ppmg, MAL-2026-18273 | Malicious | Not scored | 4 days ago | npm @ppa-web-components/ppa-builder |
Malicious release: Malicious code in @ppa-web-components/ppa-searchform (npm) GHSA-9p3j-rrmc-jc4p, MAL-2026-18287 | Malicious | Not scored | 4 days ago | npm @ppa-web-components/ppa-searchform |
Malicious release: Malicious code in @ppa-web-components/ppa-navigation (npm) GHSA-vc6h-rv88-87j5, MAL-2026-18286 | Malicious | Not scored | 4 days ago | npm @ppa-web-components/ppa-navigation |
Malicious release: Malicious code in sound-cloud-loader-api (npm) GHSA-5f99-52fc-5rc9, MAL-2026-18267 | Malicious | Not scored | 4 days ago | npm sound-cloud-loader-api |
Malicious release: Malicious code in tiktok-video-scraper (npm) GHSA-5xjv-xr86-9hrv, MAL-2026-18268 | Malicious | Not scored | 4 days ago | npm tiktok-video-scraper |
Malicious release: Malicious code in ionic-sound-cloud-loader-api (npm) GHSA-g89m-8c48-9x73, MAL-2026-18260 | Malicious | Not scored | 4 days ago | npm ionic-sound-cloud-loader-api |
Malicious release: Malicious code in insta-api-wrapper (npm) GHSA-j8vh-32vh-rj39, MAL-2026-18257 | Malicious | Not scored | 4 days ago | npm insta-api-wrapper |
Malicious release: Malicious code in insta-reel-search (npm) GHSA-v2r2-x76j-6fcx, MAL-2026-18258 | Malicious | Not scored | 4 days ago | npm insta-reel-search |
Malicious release: Malicious code in ionic-tiktok-scraper (npm) GHSA-wwj3-4v8w-w98j, MAL-2026-18261 | Malicious | Not scored | 4 days ago | npm ionic-tiktok-scraper |
Malicious release: Malicious code in ionic-youtube-streams (npm) GHSA-3cc7-77mx-rmj6, MAL-2026-18263 | Malicious | Not scored | 4 days ago | npm ionic-youtube-streams |
Malicious release: Malicious code in ionic-insta-search (npm) GHSA-4fw4-xm5r-mh69, MAL-2026-18259 | Malicious | Not scored | 4 days ago | npm ionic-insta-search |
Malicious release: Malicious code in cordova-plugin-geofence-appit (npm) GHSA-5pw8-3xv5-6cmg, MAL-2026-18256 | Malicious | Not scored | 4 days ago | npm cordova-plugin-geofence-appit |
Malicious release: Malicious code in youtube-info-streams (npm) GHSA-7mfw-r26v-9r9f, MAL-2026-18269 | Malicious | Not scored | 4 days ago | npm youtube-info-streams |
Malicious release: Malicious code in ionic-youtube-search (npm) GHSA-7p9r-26fp-m47g, MAL-2026-18262 | Malicious | Not scored | 4 days ago | npm ionic-youtube-search |
Malicious release: Malicious code in redis-dumper (npm) GHSA-8gg8-xq45-8fx5, MAL-2026-18266 | Malicious | Not scored | 4 days ago | npm redis-dumper |
Malicious release: Malicious code in ocsp-hashes (npm) GHSA-9v69-fx5h-r6p6, MAL-2026-18264 | Malicious | Not scored | 4 days ago | npm ocsp-hashes |
Malicious release: Malicious code in appit-cordova-admob (npm) GHSA-9w8h-674f-4x2j, MAL-2026-18253 | Malicious | Not scored | 4 days ago | npm appit-cordova-admob |
Malicious release: Malicious code in youtube-search-without-api-key (npm) GHSA-f6m2-r9qr-44fx, MAL-2026-18270 | Malicious | Not scored | 4 days ago | npm youtube-search-without-api-key |
Malicious release: Malicious code in appit-cordova-plugin-ionic (npm) GHSA-fr38-45mf-vcqf, MAL-2026-18254 | Malicious | Not scored | 4 days ago | npm appit-cordova-plugin-ionic |
Malicious release: Malicious code in p12-pem (npm) GHSA-74xg-w33f-jpv3, MAL-2026-18265 | Malicious | Not scored | 4 days ago | npm p12-pem |
Malicious release: Malicious code in cert-infos (npm) GHSA-8mjx-r4j6-3h6g, MAL-2026-18255 | Malicious | Not scored | 4 days ago | npm cert-infos |
Malicious release: Malicious code in @eforms/forms-api (npm) GHSA-39p9-96vf-fxjh, MAL-2026-18252 | Malicious | Not scored | 4 days ago | npm @eforms/forms-api |
Malicious release: Malicious code in @drone-js-ext/core (npm) GHSA-938p-x8vr-2r33, MAL-2026-18276 | Malicious | Not scored | 4 days ago | npm @drone-js-ext/core |
Malicious release: Malicious code in @drone-js-ext/vip-badge (npm) GHSA-h7v8-65vw-r7wh, MAL-2026-18277 | Malicious | Not scored | 4 days ago | npm @drone-js-ext/vip-badge |
Malicious release: Malicious code in tailwind-base-buttons (npm) GHSA-5j43-343m-gggg, MAL-2026-18250 | Malicious | Not scored | 4 days ago | npm tailwind-base-buttons |
Malicious release: Malicious code in noelc-css-blender (npm) GHSA-cj2x-975v-jmwf, MAL-2026-18249 | Malicious | Not scored | 4 days ago | npm noelc-css-blender |
Malicious release: Malicious code in tailwindcss-theme-kit (npm) GHSA-v5xr-xjx7-ggwf, MAL-2026-18251 | Malicious | Not scored | 4 days ago | npm tailwindcss-theme-kit |
Malicious release: Malicious code in overarch-windows-x64-yr (npm) GHSA-v5v8-j5gm-pq8v, MAL-2026-18248 | Malicious | Not scored | 5 days ago | npm overarch-windows-x64-yr |
Malicious release: Malicious code in @liauto/win32-x64 (npm) GHSA-32x9-4g9x-5cxj, MAL-2026-18247 | Malicious | Not scored | 5 days ago | npm @liauto/win32-x64 |
Malicious release: Malicious code in @sxm-web/client-sdk-core (npm) GHSA-v3mw-7pg4-rp68, MAL-2026-18319 | Malicious | Not scored | 5 days ago | npm @sxm-web/client-sdk-core |
graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service CVE-2026-115887, GHSA-x8rm-f576-gq67 | High | 0.4% | 6 days ago | npm graphql-scalars |
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body CVE-2026-115754, CVE-2026-115897, GHSA-m5mm-p8h7-m29v | Low | 0.3% | 6 days ago | npm serialize-javascript |
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution CVE-2026-115895, GHSA-834v-8h66-3h79 | High | 0.4% | 6 days ago | npm happy-dom |
Malicious release: Malicious code in @k18k/entrypoint-sdk-darwin-arm64 (npm) GHSA-8wf7-8825-99q7, MAL-2026-18243 | Malicious | Not scored | 6 days ago | npm @k18k/entrypoint-sdk-darwin-arm64 |
Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root GHSA-h4fr-cmh5-qr62 | Low | Not scored | 6 days ago | crates.io fallow-cli crates.io fallow-config crates.io fallow-core npm @fallow-cli/fallow-node +1 more |
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words GHSA-f2hq-32vh-53cc | High | Not scored | 6 days ago | npm postal-mime |
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient GHSA-8c8m-p3m8-cjg8 | Medium | Not scored | 6 days ago | npm nodemailer |
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient GHSA-m943-m63m-w62w | Medium | Not scored | 6 days ago | npm nodemailer |
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name GHSA-85x2-q946-cp5h | Medium | Not scored | 6 days ago | npm nodemailer |
Malicious release: Malicious code in orqiva-runtime-win32-x64 (npm) GHSA-8j59-g9mq-7hf9, MAL-2026-18246 | Malicious | Not scored | 6 days ago | npm orqiva-runtime-win32-x64 |
Malicious release: Malicious code in @k18k/entrypoint-sdk-linux-x64 (npm) GHSA-9fhg-r3w6-g7r4, MAL-2026-18245 | Malicious | Not scored | 6 days ago | npm @k18k/entrypoint-sdk-linux-x64 |
Malicious release: Malicious code in @k18k/entrypoint-sdk-darwin-x64 (npm) GHSA-j58m-rwhr-923h, MAL-2026-18244 | Malicious | Not scored | 6 days ago | npm @k18k/entrypoint-sdk-darwin-x64 |
Malicious release: Malicious code in @greenlake/session (npm) GHSA-499v-qcp5-gx7x, MAL-2026-18283 | Malicious | Not scored | 6 days ago | npm @greenlake/session |
Malicious release: Malicious code in @greenlake/mfe-login-url (npm) GHSA-6vg7-x7p2-c749, MAL-2026-18318 | Malicious | Not scored | 6 days ago | npm @greenlake/mfe-login-url |
Malicious release: Malicious code in @greenlake/context-pane (npm) GHSA-5pp4-pvpc-g2xv, MAL-2026-18317 | Malicious | Not scored | 6 days ago | npm @greenlake/context-pane |
Malicious release: Malicious code in @greenlake/common-context (npm) GHSA-mm6p-8j6f-9fch, MAL-2026-18282 | Malicious | Not scored | 6 days ago | npm @greenlake/common-context |
Malicious release: Malicious code in @greenlake/auth (npm) GHSA-h6v3-2957-9j3g, MAL-2026-18316 | Malicious | Not scored | 6 days ago | npm @greenlake/auth |
odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values GHSA-2rqm-h6hv-g79v | Medium | Not scored | 6 days ago | npm odf-kit |