Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in test-skill-zip (npm) GHSA-qw86-6hcg-cj2j, MAL-2026-11189 | Malicious | Not scored | 29 Jul, 2026 | npm test-skill-zip |
Malicious release: Malicious code in lwp-web-client (npm) GHSA-rmm2-5g7m-wj7p, MAL-2026-11186 | Malicious | Not scored | 29 Jul, 2026 | npm lwp-web-client |
Malicious release: Malicious code in uniapi-bridge (npm) GHSA-wpp9-5p7g-7cjh, MAL-2026-11190 | Malicious | Not scored | 29 Jul, 2026 | npm uniapi-bridge |
Malicious release: Malicious code in flight-compare-analyzer (npm) GHSA-wwp4-2j5x-f2m9, MAL-2026-11185 | Malicious | Not scored | 29 Jul, 2026 | npm flight-compare-analyzer |
Malicious release: Malicious code in colder-cli (npm) GHSA-x646-p774-9w26, MAL-2026-11182 | Malicious | Not scored | 29 Jul, 2026 | npm colder-cli |
Malicious release: Malicious code in open-worker-cli (npm) GHSA-2p2c-gx9p-5wg8, MAL-2026-11188 | Malicious | Not scored | 29 Jul, 2026 | npm open-worker-cli |
Malicious release: Malicious code in aone-cloud-cli (npm) GHSA-c6xg-mcq6-m594, MAL-2026-11180 | Malicious | Not scored | 29 Jul, 2026 | npm aone-cloud-cli |
Malicious release: Malicious code in feedback-ai-sdk (npm) GHSA-fh6v-xfxj-m87q, MAL-2026-11184 | Malicious | Not scored | 29 Jul, 2026 | npm feedback-ai-sdk |
@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate GHSA-pc2w-4mq8-32qw | Low | Not scored | 29 Jul, 2026 | npm @dynatrace-oss/dynatrace-mcp-server |
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies CVE-2026-54666, GHSA-w284-33mx-6g9v | High | 0.4% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to code injection via unescaped enum string values CVE-2026-54664, GHSA-5f94-x226-ccpm | High | 0.5% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template CVE-2026-54661, GHSA-38c3-wv3c-v3xj | High | 0.5% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref` CVE-2026-54663, GHSA-x36r-4347-pm5x | Medium | 0.2% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template CVE-2026-54662, GHSA-hqj5-cw9f-rx67 | High | 0.3% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref` CVE-2026-54660, GHSA-h754-fxp7-88wx | High | 0.3% | 29 Jul, 2026 | npm swagger-typescript-api |
nanoid: non-secure generators can loop indefinitely with negative size CVE-2026-67214, GHSA-28wg-ghj8-5hjv | High | 0.3% | 29 Jul, 2026 | npm nanoid |
nanoid: custom generators can loop indefinitely when size is zero CVE-2026-67213, GHSA-2v37-7h3g-55p8 | High | 0.3% | 29 Jul, 2026 | npm nanoid |
Malicious release: Malicious code in zer0code (npm) GHSA-frrq-7m67-mgxg, MAL-2026-11191 | Malicious | Not scored | 29 Jul, 2026 | npm zer0code |
Malicious release: Malicious code in @finxsecdemo/utils (npm) MAL-2026-11170 | Malicious | Not scored | 29 Jul, 2026 | npm @finxsecdemo/utils |
Malicious release: Malicious code in test2221 (npm) MAL-2026-11192 | Malicious | Not scored | 29 Jul, 2026 | npm test2221 |
Malicious release: Malicious code in chain-manager (npm) GHSA-257g-ggr2-j398, MAL-2026-11181 | Malicious | Not scored | 29 Jul, 2026 | npm chain-manager |
Malicious release: Malicious code in @bowozzz/baileys (npm) GHSA-f9vh-885g-hv2f, MAL-2026-11176 | Malicious | Not scored | 29 Jul, 2026 | npm @bowozzz/baileys |
Malicious release: Malicious code in @mypwn/hawkeye (npm) MAL-2026-11157 | Malicious | Not scored | 29 Jul, 2026 | npm @mypwn/hawkeye |
Malicious release: Malicious code in @types-beta/sdk (npm) MAL-2026-11499 | Malicious | Not scored | 29 Jul, 2026 | npm @types-beta/sdk |
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution CVE-2026-54658, GHSA-6wcc-39rp-hh9p | Critical | 0.8% | 28 Jul, 2026 | npm @hypequery/clickhouse |
Malicious release: Malicious code in @joyfill/layouts (npm) GHSA-887f-rwr9-wp54, MAL-2026-11161 | Malicious | Not scored | 28 Jul, 2026 | npm @joyfill/layouts |
Malicious release: Malicious code in @joyfill/components (npm) GHSA-x4p3-wjxx-m4x5, MAL-2026-11160 | Malicious | Not scored | 28 Jul, 2026 | npm @joyfill/components |
Malicious release: Malicious code in postcss-motion-utils (npm) GHSA-m763-9wch-p9gg, MAL-2026-11168 | Malicious | Not scored | 28 Jul, 2026 | npm postcss-motion-utils |
QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding CVE-2026-54609, GHSA-85rg-p3fr-xc2f, PYSEC-2026-3615 | High | 0.5% | 28 Jul, 2026 | Maven com.quietterminal:qti-neon PyPI qti-neon npm qti-neon |
Malicious release: Malicious code in aone-kit-cli (npm) GHSA-55qq-2qq4-c47g, MAL-2026-11163 | Malicious | Not scored | 28 Jul, 2026 | npm aone-kit-cli |
Malicious release: Malicious code in aone-kit (npm) GHSA-7w6g-48pj-7977, MAL-2026-11162 | Malicious | Not scored | 28 Jul, 2026 | npm aone-kit |
Malicious release: Malicious code in local-config-parser (npm) GHSA-f463-rm4g-746g, MAL-2026-11167 | Malicious | Not scored | 28 Jul, 2026 | npm local-config-parser |
Malicious release: Malicious code in aone-sandbox (npm) GHSA-mv5v-q5f3-gf7h, MAL-2026-11164 | Malicious | Not scored | 28 Jul, 2026 | npm aone-sandbox |
Malicious release: Malicious code in lib-mtop (npm) GHSA-vrrg-j2c5-mj4v, MAL-2026-11166 | Malicious | Not scored | 28 Jul, 2026 | npm lib-mtop |
Malicious release: Malicious code in cloud-config-fetcher (npm) GHSA-25r8-r3cf-28q4, MAL-2026-11165 | Malicious | Not scored | 28 Jul, 2026 | npm cloud-config-fetcher |
Malicious release: Malicious code in smart-config-manager (npm) GHSA-v644-r975-m85m, MAL-2026-11169 | Malicious | Not scored | 28 Jul, 2026 | npm smart-config-manager |
@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition GHSA-vg6v-j97m-h5xq | Medium | Not scored | 28 Jul, 2026 | npm @novu/application-generic |
@wakaru/cli arbitrary file write during bundle unpack CVE-2026-54545, GHSA-7wpj-vvmv-pgm8 | High | 0.2% | 28 Jul, 2026 | npm @wakaru/cli |
Malicious release: Malicious code in simple-probe-utils (npm) MAL-2026-11147 | Malicious | Not scored | 28 Jul, 2026 | npm simple-probe-utils |
Malicious release: Malicious code in korvica (npm) MAL-2026-11140 | Malicious | Not scored | 28 Jul, 2026 | npm korvica |
Malicious release: Malicious code in streak-core-lib (npm) MAL-2026-11148 | Malicious | Not scored | 28 Jul, 2026 | npm streak-core-lib |
Malicious release: Malicious code in color-convert-helper (npm) MAL-2026-11134 | Malicious | Not scored | 28 Jul, 2026 | npm color-convert-helper |
Malicious release: Malicious code in json-schema-inspector (npm) MAL-2026-11138 | Malicious | Not scored | 28 Jul, 2026 | npm json-schema-inspector |
Malicious release: Malicious code in bianira-ui (npm) MAL-2026-11132 | Malicious | Not scored | 28 Jul, 2026 | npm bianira-ui |
Malicious release: Malicious code in streak-core-math (npm) MAL-2026-11149 | Malicious | Not scored | 28 Jul, 2026 | npm streak-core-math |
Malicious release: Malicious code in @crbrc/xbt (npm) MAL-2026-11122 | Malicious | Not scored | 28 Jul, 2026 | npm @crbrc/xbt |
Malicious release: Malicious code in kordyn (npm) MAL-2026-11139 | Malicious | Not scored | 28 Jul, 2026 | npm kordyn |
Malicious release: Malicious code in rollup-runtime-core-polyfills (npm) MAL-2026-11145 | Malicious | Not scored | 28 Jul, 2026 | npm rollup-runtime-core-polyfills |
Malicious release: Malicious code in react-puller (npm) MAL-2026-11144 | Malicious | Not scored | 28 Jul, 2026 | npm react-puller |
Malicious release: Malicious code in blots (npm) MAL-2026-11158 | Malicious | Not scored | 28 Jul, 2026 | npm blots |