Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @library-wide/library-shell (npm) GHSA-8j36-pr5c-f6vx, MAL-2026-17754 | Malicious | Not scored | 20 days ago | npm @library-wide/library-shell |
Malicious release: Malicious code in passwordcracker (npm) MAL-2026-17864 | Malicious | Not scored | 20 days ago | npm passwordcracker |
Malicious release: Malicious code in passwordcrackv2 (npm) MAL-2026-17865 | Malicious | Not scored | 20 days ago | npm passwordcrackv2 |
Tina: Code injection via unescaped Git branch name in generated client source CVE-2026-108259, GHSA-pwhx-cvv3-qj5c | High | 0.3% | 20 days ago | npm @tinacms/cli |
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment CVE-2026-108261, GHSA-x34j-47hf-4xg7 | Critical | 0.2% | 20 days ago | npm @tinacms/app npm tinacms |
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS CVE-2026-108260, GHSA-c42q-qvc3-j6vg | High | 0.3% | 20 days ago | npm @tinacms/web-components |
Malicious release: Malicious code in @fer2809fl/baileys (npm) GHSA-wv7g-r3r9-ww8v, MAL-2026-17750 | Malicious | Not scored | 20 days ago | npm @fer2809fl/baileys |
Malicious release: Malicious code in cloud-baileys (npm) GHSA-745p-g872-6x8c, MAL-2026-17751 | Malicious | Not scored | 20 days ago | npm cloud-baileys |
Malicious release: Malicious code in arsya-baileys (npm) GHSA-pv3g-8jvf-qc7x, MAL-2026-17387 | Malicious | Not scored | 20 days ago | npm arsya-baileys |
Malicious release: Malicious code in @myorder-frontend-commons/analytics (npm) GHSA-4xrc-8qvp-c7r5, MAL-2026-17749 | Malicious | Not scored | 20 days ago | npm @myorder-frontend-commons/analytics |
Malicious release: Malicious code in kmf-i18n (npm) MAL-2026-17747 | Malicious | Not scored | 20 days ago | npm kmf-i18n |
Malicious release: Malicious code in test-account-portal-fe (npm) MAL-2026-17748 | Malicious | Not scored | 20 days ago | npm test-account-portal-fe |
Malicious release: Malicious code in kmf-bootstrap (npm) MAL-2026-17746 | Malicious | Not scored | 20 days ago | npm kmf-bootstrap |
Malicious release: Malicious code in bungoma (npm) GHSA-jj55-mvw9-496r, MAL-2026-17389 | Malicious | Not scored | 20 days ago | npm bungoma |
Malicious release: Malicious code in @bellaxchuu/teambails (npm) MAL-2026-17348 | Malicious | Not scored | 20 days ago | npm @bellaxchuu/teambails |
Malicious release: Malicious code in @tunstock/remact-dom (npm) MAL-2026-17745 | Malicious | Not scored | 20 days ago | npm @tunstock/remact-dom |
Malicious release: Malicious code in kmf-vendor-pack (npm) MAL-2026-17744 | Malicious | Not scored | 20 days ago | npm kmf-vendor-pack |
Malicious release: Malicious code in tailwind-animatecss-form (npm) GHSA-pp69-57rc-3v49, MAL-2026-17743 | Malicious | Not scored | 20 days ago | npm tailwind-animatecss-form |
Malicious release: Malicious code in hanncap (npm) GHSA-jw9f-6xx8-mj3f, MAL-2026-17740 | Malicious | Not scored | 20 days ago | npm hanncap |
Malicious release: Malicious code in asepxyz-baileys (npm) GHSA-xv7g-p6pq-vg9q, MAL-2026-17733 | Malicious | Not scored | 20 days ago | npm asepxyz-baileys |
Malicious release: Malicious code in asepxyz-signal (npm) GHSA-38rx-c4rh-xc4p, MAL-2026-17735 | Malicious | Not scored | 20 days ago | npm asepxyz-signal |
Malicious release: Malicious code in asepxyz12 (npm) GHSA-3rxj-r3x6-3992, MAL-2026-17736 | Malicious | Not scored | 20 days ago | npm asepxyz12 |
Malicious release: Malicious code in @aseppxyzz12/baileys (npm) GHSA-4pw9-3c22-g559, MAL-2026-17731 | Malicious | Not scored | 20 days ago | npm @aseppxyzz12/baileys |
Malicious release: Malicious code in razamodsxasepxyz (npm) GHSA-f3vq-wx4x-jv6w, MAL-2026-17742 | Malicious | Not scored | 20 days ago | npm razamodsxasepxyz |
Malicious release: Malicious code in pahinuy (npm) GHSA-hcwg-cqc9-469q, MAL-2026-17741 | Malicious | Not scored | 20 days ago | npm pahinuy |
Malicious release: Malicious code in asepxyzz (npm) GHSA-hmqh-m5mj-f7mm, MAL-2026-17739 | Malicious | Not scored | 20 days ago | npm asepxyzz |
Malicious release: Malicious code in asepxyznew (npm) GHSA-m23r-8cxr-4gw3, MAL-2026-17737 | Malicious | Not scored | 20 days ago | npm asepxyznew |
Malicious release: Malicious code in asepxyz (npm) GHSA-qvwh-x99q-h49x, MAL-2026-17732 | Malicious | Not scored | 20 days ago | npm asepxyz |
Malicious release: Malicious code in asepxyz-eslint-config (npm) GHSA-rhjp-rpj7-8x4q, MAL-2026-17734 | Malicious | Not scored | 20 days ago | npm asepxyz-eslint-config |
Malicious release: Malicious code in asepxyzxrazamodsnew-baileys (npm) GHSA-v95p-rhxh-mm8g, MAL-2026-17738 | Malicious | Not scored | 20 days ago | npm asepxyzxrazamodsnew-baileys |
Malicious release: Malicious code in pxnpm (npm) MAL-2026-17710 | Malicious | Not scored | 20 days ago | npm pxnpm |
Malicious release: Malicious code in wix-reg-poc-bypass (npm) MAL-2026-17711 | Malicious | Not scored | 21 days ago | npm wix-reg-poc-bypass |
Malicious release: Malicious code in @brick-v2/brand (npm) MAL-2026-17714 | Malicious | Not scored | 21 days ago | npm @brick-v2/brand |
Malicious release: Malicious code in @brick-v2/core (npm) MAL-2026-17715 | Malicious | Not scored | 21 days ago | npm @brick-v2/core |
Malicious release: Malicious code in @brick-v2/form (npm) MAL-2026-17716 | Malicious | Not scored | 21 days ago | npm @brick-v2/form |
Malicious release: Malicious code in @brick-v2/icons (npm) MAL-2026-17717 | Malicious | Not scored | 21 days ago | npm @brick-v2/icons |
Malicious release: Malicious code in @brick-v2/table (npm) MAL-2026-17718 | Malicious | Not scored | 21 days ago | npm @brick-v2/table |
Malicious release: Malicious code in @brick-v2/tour (npm) MAL-2026-17719 | Malicious | Not scored | 21 days ago | npm @brick-v2/tour |
Malicious release: Malicious code in @galicia-toolkit-cheques-nc/front (npm) MAL-2026-17720 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit-cheques-nc/front |
Malicious release: Malicious code in @galicia-toolkit-nestjs/archetype (npm) MAL-2026-17721 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit-nestjs/archetype |
Malicious release: Malicious code in @galicia-toolkit-nestjs/commons (npm) MAL-2026-17722 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit-nestjs/commons |
Malicious release: Malicious code in @galicia-toolkit-nestjs/paas (npm) MAL-2026-17723 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit-nestjs/paas |
Malicious release: Malicious code in @galicia-toolkit-nestjs/swagger (npm) MAL-2026-17724 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit-nestjs/swagger |
Malicious release: Malicious code in @galicia-toolkit-nestjs-20/archetype (npm) MAL-2026-17725 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit-nestjs-20/archetype |
Malicious release: Malicious code in @galicia-toolkit-nestjs-20/commons (npm) MAL-2026-17726 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit-nestjs-20/commons |
Malicious release: Malicious code in @galicia-toolkit-nestjs-20/paas (npm) MAL-2026-17727 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit-nestjs-20/paas |
Malicious release: Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm) MAL-2026-17728 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit-nestjs-20-lite/archetype |
Malicious release: Malicious code in @galicia-toolkit-nestjs-20-lite/commons (npm) MAL-2026-17729 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit-nestjs-20-lite/commons |
Malicious release: Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm) MAL-2026-17730 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit-nestjs-20-lite/paas |
fast-jwt: Verifier cache accepts expired JWTs without iat. CVE-2026-107719, GHSA-x937-hj6v-793p | Medium | 0.3% | 21 days ago | npm fast-jwt |