Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in iac-scanner (npm) GHSA-69pc-2883-mff3, MAL-2026-11467 | Malicious | Not scored | 31 Jul, 2026 | npm iac-scanner |
Malicious release: Malicious code in @404c3s4r/lodash (npm) GHSA-3357-xmhq-8r86, MAL-2026-11434 | Malicious | Not scored | 31 Jul, 2026 | npm @404c3s4r/lodash |
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization CVE-2026-65841, GHSA-45qg-252v-3f7p | Medium | 0.5% | 31 Jul, 2026 | npm jodit |
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS CVE-2026-62324, GHSA-j839-gqq4-gf9j | Medium | 0.3% | 31 Jul, 2026 | npm jodit |
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging CVE-2026-54737, GHSA-mj3g-7xcc-x4vh | High | 0.5% | 31 Jul, 2026 | npm @phun-ky/defaults-deep |
Malicious release: Malicious code in eth-bridge (npm) GHSA-5hj6-99cc-g84q, MAL-2026-11461 | Malicious | Not scored | 31 Jul, 2026 | npm eth-bridge |
hashi-vault-js has a path traversal and query parameter injection CVE-2026-55100, GHSA-g956-2f74-rmv7 | High | 0.6% | 31 Jul, 2026 | npm hashi-vault-js |
dssrf: any users using 1.1.1.1 DNS is impacted by SSRF CVE-2026-54729, GHSA-5846-7qm3-r52j | High | 0.5% | 31 Jul, 2026 | npm dssrf |
Malicious release: Malicious code in vite-tsconfig-svg (npm) GHSA-3w4v-4hp3-9934, MAL-2026-11497 | Malicious | Not scored | 31 Jul, 2026 | npm vite-tsconfig-svg |
Malicious release: Malicious code in rollup-plugin-polyfill-hold (npm) GHSA-7p2c-jxw4-jxvv, MAL-2026-11479 | Malicious | Not scored | 31 Jul, 2026 | npm rollup-plugin-polyfill-hold |
`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation GHSA-p7w7-4929-vpj5 | High | Not scored | 31 Jul, 2026 | npm @dynatrace-oss/dynatrace-mcp-server |
@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification GHSA-xrmj-5g4g-8987 | Medium | Not scored | 31 Jul, 2026 | npm @dynatrace-oss/dynatrace-mcp-server |
@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL GHSA-pqh8-p93p-2rx7 | Medium | Not scored | 31 Jul, 2026 | npm @dynatrace-oss/dynatrace-mcp-server |
Malicious release: Malicious code in @0xlr/question-types (npm) GHSA-3x4g-gcc2-3jrc, MAL-2026-11432 | Malicious | Not scored | 31 Jul, 2026 | npm @0xlr/question-types |
Malicious release: Malicious code in @0xlr/test-callback (npm) GHSA-p6vh-r7p3-72r9, MAL-2026-11433 | Malicious | Not scored | 31 Jul, 2026 | npm @0xlr/test-callback |
Malicious release: Malicious code in @0xlr/dep-confusion-poc (npm) GHSA-r4wg-xfm2-45qv, MAL-2026-11431 | Malicious | Not scored | 31 Jul, 2026 | npm @0xlr/dep-confusion-poc |
fast-uri vulnerable to host confusion via backslash authority introducer CVE-2026-18446, GHSA-7p8r-x3mc-p8w7 | High | 0.4% | 31 Jul, 2026 | npm fast-uri |
Malicious release: Malicious code in rollup-plugin-polyfill-helper (npm) GHSA-583c-qcpm-pcw6, MAL-2026-11478 | Malicious | Not scored | 31 Jul, 2026 | npm rollup-plugin-polyfill-helper |
Malicious release: Malicious code in vite-config-svg (npm) GHSA-qhvp-2j38-vcxv, MAL-2026-11496 | Malicious | Not scored | 31 Jul, 2026 | npm vite-config-svg |
Malicious release: Malicious code in @peptide-packets/peptide-modify (npm) GHSA-9q28-pqxf-8mgj, MAL-2026-11448 | Malicious | Not scored | 31 Jul, 2026 | npm @peptide-packets/peptide-modify |
Malicious release: Malicious code in @peptide-packets/js-unimode (npm) GHSA-c4rp-69c2-g2m3, MAL-2026-11447 | Malicious | Not scored | 31 Jul, 2026 | npm @peptide-packets/js-unimode |
Malicious release: Malicious code in soccketio (npm) GHSA-6j64-8q3f-7w69, MAL-2026-11381 | Malicious | Not scored | 31 Jul, 2026 | npm soccketio |
Malicious release: Malicious code in socketi (npm) GHSA-9gmr-4p5m-j5vr, MAL-2026-11382 | Malicious | Not scored | 31 Jul, 2026 | npm socketi |
Malicious release: Malicious code in asdsafsafdasdsaasdasda (npm) GHSA-ffx4-p8v3-667v, MAL-2026-11242 | Malicious | Not scored | 31 Jul, 2026 | npm asdsafsafdasdsaasdasda |
Malicious release: Malicious code in moontose (npm) GHSA-3675-4v4m-cxv9, MAL-2026-11334 | Malicious | Not scored | 31 Jul, 2026 | npm moontose |
Malicious release: Malicious code in mongostose (npm) GHSA-6ww9-9hr9-f9m9, MAL-2026-11333 | Malicious | Not scored | 31 Jul, 2026 | npm mongostose |
Malicious release: Malicious code in asdsafsadad (npm) GHSA-7j38-gr5c-v4mv, MAL-2026-11241 | Malicious | Not scored | 31 Jul, 2026 | npm asdsafsadad |
Malicious release: Malicious code in vcse (npm) GHSA-84xr-327r-c8vf, MAL-2026-11408 | Malicious | Not scored | 31 Jul, 2026 | npm vcse |
Malicious release: Malicious code in passtpor (npm) GHSA-j9c9-vv76-9f83, MAL-2026-11345 | Malicious | Not scored | 31 Jul, 2026 | npm passtpor |
Malicious release: Malicious code in socktio (npm) GHSA-q2q2-2vj8-r6q4, MAL-2026-11383 | Malicious | Not scored | 31 Jul, 2026 | npm socktio |
Malicious release: Malicious code in passsport1 (npm) GHSA-whq9-wwww-4g3q, MAL-2026-11344 | Malicious | Not scored | 31 Jul, 2026 | npm passsport1 |
Malicious release: Malicious code in scketio (npm) GHSA-xgm9-mpc5-qf5w, MAL-2026-11376 | Malicious | Not scored | 31 Jul, 2026 | npm scketio |
Malicious release: Malicious code in rlp.git (npm) GHSA-79vf-868m-fv3g, MAL-2026-11372 | Malicious | Not scored | 30 Jul, 2026 | npm rlp.git |
Malicious release: Malicious code in fsextrra (npm) GHSA-224j-655w-2vrq, MAL-2026-11313 | Malicious | Not scored | 30 Jul, 2026 | npm fsextrra |
Malicious release: Malicious code in node-fs-extra-master (npm) GHSA-9qpq-q9v6-pw27, MAL-2026-11340 | Malicious | Not scored | 30 Jul, 2026 | npm node-fs-extra-master |
Malicious release: Malicious code in fs-extra-master (npm) GHSA-cg95-x585-4q9p, MAL-2026-11312 | Malicious | Not scored | 30 Jul, 2026 | npm fs-extra-master |
Malicious release: Malicious code in rlp-master (npm) GHSA-pcfm-f78r-p9wq, MAL-2026-11371 | Malicious | Not scored | 30 Jul, 2026 | npm rlp-master |
Malicious release: Malicious code in ethe.json (npm) MAL-2026-11295 | Malicious | Not scored | 30 Jul, 2026 | npm ethe.json |
Malicious release: Malicious code in ethers-io-ethers (npm) MAL-2026-11296 | Malicious | Not scored | 30 Jul, 2026 | npm ethers-io-ethers |
Malicious release: Malicious code in ethers.json (npm) MAL-2026-11298 | Malicious | Not scored | 30 Jul, 2026 | npm ethers.json |
Malicious release: Malicious code in ethersss (npm) MAL-2026-11300 | Malicious | Not scored | 30 Jul, 2026 | npm ethersss |
Malicious release: Malicious code in eth.json (npm) MAL-2026-11293 | Malicious | Not scored | 30 Jul, 2026 | npm eth.json |
Malicious release: Malicious code in ethe (npm) MAL-2026-11294 | Malicious | Not scored | 30 Jul, 2026 | npm ethe |
Malicious release: Malicious code in ethers.jsonn (npm) MAL-2026-11299 | Malicious | Not scored | 30 Jul, 2026 | npm ethers.jsonn |
Malicious release: Malicious code in easyinstaller (npm) GHSA-2qhv-3chw-2w9g, MAL-2026-11286 | Malicious | Not scored | 30 Jul, 2026 | npm easyinstaller |
Malicious release: Malicious code in rph-validator (npm) GHSA-3h87-jp5v-6338, MAL-2026-11373 | Malicious | Not scored | 30 Jul, 2026 | npm rph-validator |
Malicious release: Malicious code in host-inspector-module (npm) GHSA-4cwm-hc83-jf82, MAL-2026-11317 | Malicious | Not scored | 30 Jul, 2026 | npm host-inspector-module |
Malicious release: Malicious code in express-bubble (npm) GHSA-4qc8-p57w-wf57, MAL-2026-11303 | Malicious | Not scored | 30 Jul, 2026 | npm express-bubble |
Malicious release: Malicious code in express-sequelize-wrapper (npm) GHSA-4rxq-hv39-2x82, MAL-2026-11304 | Malicious | Not scored | 30 Jul, 2026 | npm express-sequelize-wrapper |
Malicious release: Malicious code in ideascloud (npm) GHSA-69jp-v94c-58pm, MAL-2026-11318 | Malicious | Not scored | 30 Jul, 2026 | npm ideascloud |