Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in unified-help-center-alpha (npm) GHSA-xxxp-m3cp-c8f7, MAL-2026-11406 | Malicious | Not scored | 30 Jul, 2026 | npm unified-help-center-alpha |
Malicious release: Malicious code in ember-livereload-indicator (npm) MAL-2026-11291 | Malicious | Not scored | 30 Jul, 2026 | npm ember-livereload-indicator |
Malicious release: Malicious code in ethers-v6 (npm) MAL-2026-11297 | Malicious | Not scored | 30 Jul, 2026 | npm ethers-v6 |
Malicious release: Malicious code in pullingpackageeeeeeeeee (npm) GHSA-275r-557m-9c6w, MAL-2026-11359 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageeeeeeeeee |
Malicious release: Malicious code in pullingpackageeee (npm) GHSA-49h2-vq5m-22hf, MAL-2026-11355 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageeee |
Malicious release: Malicious code in pullingpackage (npm) GHSA-f2gr-qgm3-wg22, MAL-2026-11351 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackage |
Malicious release: Malicious code in pullingpackageeeeeee (npm) GHSA-hq8m-wmq9-632v, MAL-2026-11356 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageeeeeee |
Malicious release: Malicious code in pullingpackageeeeeeee (npm) GHSA-hvqj-6qw4-pfrf, MAL-2026-11357 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageeeeeeee |
Malicious release: Malicious code in pullingpackageee (npm) GHSA-m86j-3g6g-q7r7, MAL-2026-11354 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageee |
Malicious release: Malicious code in pullingpackaged (npm) GHSA-vf7m-5f8w-gw69, MAL-2026-11352 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackaged |
Malicious release: Malicious code in pullingpackageeeeeeeeeee (npm) GHSA-wm5v-jh9g-w34v, MAL-2026-11360 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageeeeeeeeeee |
Malicious release: Malicious code in pullingpackageeeeeeeee (npm) GHSA-wrw3-chmv-4qvc, MAL-2026-11358 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageeeeeeeee |
Malicious release: Malicious code in pullingpackagee (npm) GHSA-x98q-m69m-vp6m, MAL-2026-11353 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackagee |
Malicious release: Malicious code in @dotconf-pro/dotenv (npm) GHSA-h9vh-7j23-g2jx, MAL-2026-11209 | Malicious | Not scored | 30 Jul, 2026 | npm @dotconf-pro/dotenv |
Malicious release: Malicious code in @dotconf-pro/dotconf-pro (npm) GHSA-mwqq-h3r9-h32w, MAL-2026-11208 | Malicious | Not scored | 30 Jul, 2026 | npm @dotconf-pro/dotconf-pro |
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS) CVE-2026-68499, GHSA-6hxr-mr5r-9836 | Medium | 0.2% | 30 Jul, 2026 | npm re2 |
Malicious release: Malicious code in rumjs (npm) GHSA-8xj6-6h67-j7p3, MAL-2026-11375 | Malicious | Not scored | 30 Jul, 2026 | npm rumjs |
Malicious release: Malicious code in @404c3s4r/testxxx (npm) MAL-2026-11207 | Malicious | Not scored | 30 Jul, 2026 | npm @404c3s4r/testxxx |
re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS) CVE-2026-67550, GHSA-ff84-5f28-78qj | Medium | 0.2% | 30 Jul, 2026 | npm re2 |
Malicious release: Malicious code in streak-metrics-math (npm) GHSA-57m5-24x9-2xr5, MAL-2026-11388 | Malicious | Not scored | 30 Jul, 2026 | npm streak-metrics-math |
Malicious release: Malicious code in svelte-metric-map (npm) GHSA-f9p7-g3fg-9695, MAL-2026-11390 | Malicious | Not scored | 30 Jul, 2026 | npm svelte-metric-map |
Malicious release: Malicious code in streak-metrics-core (npm) GHSA-pc2m-7f6m-25cm, MAL-2026-11387 | Malicious | Not scored | 30 Jul, 2026 | npm streak-metrics-core |
Malicious release: Malicious code in svelte-streak-metric (npm) GHSA-ph6j-2jmh-g26m, MAL-2026-11391 | Malicious | Not scored | 30 Jul, 2026 | npm svelte-streak-metric |
Malicious release: Malicious code in thedata (npm) GHSA-g67p-r2r2-224w, MAL-2026-11400 | Malicious | Not scored | 30 Jul, 2026 | npm thedata |
Malicious release: Malicious code in consumerweb-risk (npm) GHSA-5439-r8p8-2gmx, MAL-2026-11269 | Malicious | Not scored | 30 Jul, 2026 | npm consumerweb-risk |
Malicious release: Malicious code in switchpaymentsapiserv-paypal (npm) GHSA-rg3f-q822-6rx6, MAL-2026-11392 | Malicious | Not scored | 30 Jul, 2026 | npm switchpaymentsapiserv-paypal |
Malicious release: Malicious code in create-backend-scaffold (npm) GHSA-p8mm-7vhx-3cr2, MAL-2026-11270 | Malicious | Not scored | 30 Jul, 2026 | npm create-backend-scaffold |
dssrf has an SSRF bypass with remove_at_symbol_in_string CVE-2026-54722, GHSA-cg4g-m8jx-vjv2 | High | 0.6% | 30 Jul, 2026 | npm dssrf |
Malicious release: Malicious code in pretty-log-cli (npm) GHSA-pvmx-6w3g-745q, MAL-2026-11349 | Malicious | Not scored | 30 Jul, 2026 | npm pretty-log-cli |
Malicious release: Malicious code in logform-core (npm) GHSA-f2wx-p6h3-rgg2, MAL-2026-11328 | Malicious | Not scored | 30 Jul, 2026 | npm logform-core |
Malicious release: Malicious code in @wbnr/design (npm) MAL-2026-11196 | Malicious | Not scored | 30 Jul, 2026 | npm @wbnr/design |
Malicious release: Malicious code in react-fast-refresh-helper (npm) GHSA-p32r-hmph-46qm, MAL-2026-11366 | Malicious | Not scored | 30 Jul, 2026 | npm react-fast-refresh-helper |
Malicious release: Malicious code in litespeed-cache (npm) GHSA-vxgg-x9mm-892p, MAL-2026-11193 | Malicious | Not scored | 30 Jul, 2026 | npm litespeed-cache |
Malicious release: Malicious code in n8n-nodes-trust-me-im-totally-safe (npm) GHSA-58v7-66mp-4mf4, MAL-2026-11194 | Malicious | Not scored | 30 Jul, 2026 | npm n8n-nodes-trust-me-im-totally-safe |
Malicious release: Malicious code in @ai-plus/de-agent-sdk (npm) GHSA-4c3x-2hh8-6pp9, MAL-2026-11175 | Malicious | Not scored | 29 Jul, 2026 | npm @ai-plus/de-agent-sdk |
Malicious release: Malicious code in @ai-plus/de-agent (npm) GHSA-w62v-8p95-rhf2, MAL-2026-11174 | Malicious | Not scored | 29 Jul, 2026 | npm @ai-plus/de-agent |
undici vulnerable to CRLF Injection via blob-like body 'type' property CVE-2026-15157, GHSA-m8rv-5g2x-5cg5 | Medium | 0.3% | 29 Jul, 2026 | npm undici |
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives CVE-2026-14643, GHSA-jr45-8vmc-qm54 | High | 0.4% | 29 Jul, 2026 | npm undici |
undici vulnerable to downstream response desynchronization via retry interceptor CVE-2026-16728, GHSA-8xcm-r25x-g524 | Medium | 0.3% | 29 Jul, 2026 | npm undici |
Malicious release: Malicious code in @ai-agent-node/createnode (npm) GHSA-79rw-4w2g-9hr5, MAL-2026-11172 | Malicious | Not scored | 29 Jul, 2026 | npm @ai-agent-node/createnode |
Malicious release: Malicious code in @ai-agent-node/nodesql (npm) GHSA-fm4j-w897-7h3g, MAL-2026-11173 | Malicious | Not scored | 29 Jul, 2026 | npm @ai-agent-node/nodesql |
Malicious release: Malicious code in @ai-agent-node/agent-node (npm) GHSA-h95p-8cf6-7qrc, MAL-2026-11171 | Malicious | Not scored | 29 Jul, 2026 | npm @ai-agent-node/agent-node |
Malicious release: Malicious code in @zannstore/baileys (npm) GHSA-vw26-8qc4-8hmg, MAL-2026-11179 | Malicious | Not scored | 29 Jul, 2026 | npm @zannstore/baileys |
mathlive's Lack of Escaping of HTML allows for XSS CVE-2026-54705, GHSA-fm7p-gw32-828p | Medium | 0.3% | 29 Jul, 2026 | npm mathlive |
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields CVE-2026-16729, GHSA-v3r7-h72x-cjcm | Medium | 0.3% | 29 Jul, 2026 | npm undici |
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives CVE-2026-13697, GHSA-4cwx-7wf7-3272 | Critical | 0.6% | 29 Jul, 2026 | npm undici |
Malicious release: Malicious code in @peptide-unit/js-unimode (npm) GHSA-hghj-5h7q-fq5h, MAL-2026-11177 | Malicious | Not scored | 29 Jul, 2026 | npm @peptide-unit/js-unimode |
Malicious release: Malicious code in @peptide-unit/peptide-modify (npm) GHSA-mw2h-4g9g-g7vv, MAL-2026-11178 | Malicious | Not scored | 29 Jul, 2026 | npm @peptide-unit/peptide-modify |
Malicious release: Malicious code in lzd-unified-station-sdk (npm) GHSA-2rgv-qvc2-5q4h, MAL-2026-11187 | Malicious | Not scored | 29 Jul, 2026 | npm lzd-unified-station-sdk |
Malicious release: Malicious code in def-open-client (npm) GHSA-pxmg-gr7p-wx8p, MAL-2026-11183 | Malicious | Not scored | 29 Jul, 2026 | npm def-open-client |