Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys CVE-2026-45321, GHSA-g7cv-rxg3-hmpx | CriticalExploited | 3.3% | 12 May, 2026 | npm @tanstack/arktype-adapter npm @tanstack/eslint-plugin-router npm @tanstack/eslint-plugin-start npm @tanstack/history +38 more |
n8n Vulnerable to Remote Code Execution via Expression Injection CVE-2025-68613, GHSA-v98v-ff95-f3cp | CriticalExploited | 99.0% | 19 Dec, 2025 | npm n8n |
React Server Components are Vulnerable to RCE CVE-2025-55182, GHSA-fv66-9v8q-g76r | CriticalExploited | 99.8% | 03 Dec, 2025 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
@react-native-community/cli has arbitrary OS command injection CVE-2025-11953, GHSA-399j-vxmf-hjvr | CriticalExploited | 94.0% | 03 Nov, 2025 | npm @react-native-community/cli npm @react-native-community/cli-server-api |
Heap buffer overflow in GPU CVE-2022-4135, GHSA-995f-9x5r-2rcj | CriticalExploited | 31.9% | 25 Nov, 2022 | npm electron |
Remote Code Execution Vulnerability in NPM mongo-express CVE-2019-10758, GHSA-h47j-hc6x-h3qq, SNYK-JS-MONGOEXPRESS-473215 | CriticalExploited | 84.7% | 24 Dec, 2019 | npm mongo-express |