Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in chai-leaf (npm) GHSA-m3c7-2j38-rjh7, MAL-2026-10940 | Malicious | Not scored | 21 Jul, 2026 | npm chai-leaf |
Malicious release: Malicious code in chai-as-reddit (npm) GHSA-vc32-h28h-pmhm, MAL-2026-10939 | Malicious | Not scored | 21 Jul, 2026 | npm chai-as-reddit |
Malicious release: Malicious code in ts-vitest (npm) GHSA-2g3m-3343-pgvq, MAL-2026-10990 | Malicious | Not scored | 21 Jul, 2026 | npm ts-vitest |
Malicious release: Malicious code in date-format-utils-xz (npm) MAL-2026-11001 | Malicious | Not scored | 21 Jul, 2026 | npm date-format-utils-xz |
Malicious release: Malicious code in faust-cont (npm) MAL-2026-11042 | Malicious | Not scored | 21 Jul, 2026 | npm faust-cont |
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered CVE-2026-73423, GHSA-8mv7-9c27-98vc | Medium | 0.3% | 20 Jul, 2026 | npm astro |
Astro: Unauthenticated path override in the @astrojs/vercel ISR function CVE-2026-73424, GHSA-x27w-589x-frm2 | Medium | 0.4% | 20 Jul, 2026 | npm @astrojs/vercel |
@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped CVE-2026-73425, GHSA-hp3v-mfqw-h74c | Low | 0.3% | 20 Jul, 2026 | npm @astrojs/netlify |
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect CVE-2026-59730, GHSA-r557-wffq-wvrc | Low | 0.5% | 20 Jul, 2026 | npm @astrojs/node |
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) CVE-2026-59729, GHSA-f48w-9m4c-m7f5 | Medium | 0.5% | 20 Jul, 2026 | npm astro |
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields CVE-2026-59728, GHSA-8j5q-mfj2-5q9q | Medium | 0.3% | 20 Jul, 2026 | npm @astrojs/rss |
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands CVE-2026-59727, GHSA-7pw4-f3q4-r2p2 | Low | 0.4% | 20 Jul, 2026 | npm astro |
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning CVE-2026-67320, GHSA-gcfj-64vw-6mp9 | High | 0.5% | 20 Jul, 2026 | npm axios |
Axios form serializer maxDepth bypass via {} metatoken CVE-2026-67321, GHSA-hcpx-6fm6-wx23 | Medium | 0.5% | 20 Jul, 2026 | npm axios |
Axios: Nested axios option objects can consume polluted prototype values CVE-2026-67319, GHSA-7q8q-rj6j-mhjq | Medium | 0.3% | 20 Jul, 2026 | npm axios |
Axios: HTTP/2 streamed uploads bypass `maxBodyLength` CVE-2026-67318, GHSA-mwf2-3pr3-8698 | Medium | 0.6% | 20 Jul, 2026 | npm axios |
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` CVE-2026-67317, GHSA-jqh4-m9w3-8hp9 | Medium | 0.6% | 20 Jul, 2026 | npm axios |
Axios: Prototype pollution gadgets can alter axios request construction CVE-2026-67316, GHSA-mmx7-hfxf-jppx | Medium | 0.4% | 20 Jul, 2026 | npm axios |
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios CVE-2026-67315, GHSA-f4gw-2p7v-4548 | Medium | 0.5% | 20 Jul, 2026 | npm axios |
Astro: Reflected XSS via unescaped View Transition animation properties CVE-2026-73422, GHSA-4g3v-8h47-v7g6 | Medium | 0.5% | 20 Jul, 2026 | npm astro |
Malicious release: Malicious code in upjsma (npm) GHSA-9g67-fm87-8p6v, MAL-2026-10928 | Malicious | Not scored | 20 Jul, 2026 | npm upjsma |
Axios: Excessive recursion in formDataToJSON can cause denial of service CVE-2026-67313, GHSA-42h9-826w-cgv3 | Medium | 0.5% | 20 Jul, 2026 | npm axios |
Axios: Prototype pollution auth subfields can inject Basic auth CVE-2026-67314, GHSA-xj6q-8x83-jv6g | Medium | 0.4% | 20 Jul, 2026 | npm axios |
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service CVE-2026-67312, GHSA-pmv8-rq9r-6j72 | Medium | 0.5% | 20 Jul, 2026 | npm axios |
Malicious release: Malicious code in tilaver-mfa (npm) GHSA-4j5x-wjw6-qvq5, MAL-2026-10925 | Malicious | Not scored | 20 Jul, 2026 | npm tilaver-mfa |
Malicious release: Malicious code in s3-lambda-dynamodb-cdk (npm) GHSA-6xqw-c34f-9275, MAL-2026-10924 | Malicious | Not scored | 20 Jul, 2026 | npm s3-lambda-dynamodb-cdk |
Malicious release: Malicious code in alb-lambda-cdk (npm) GHSA-crmc-3m53-3crf, MAL-2026-10920 | Malicious | Not scored | 20 Jul, 2026 | npm alb-lambda-cdk |
Malicious release: Malicious code in lambda-cloudwatch-cdk (npm) GHSA-m74r-g438-3r92, MAL-2026-10922 | Malicious | Not scored | 20 Jul, 2026 | npm lambda-cloudwatch-cdk |
Malicious release: Malicious code in iot-kfh-s3 (npm) GHSA-qg52-c79f-3q5c, MAL-2026-10921 | Malicious | Not scored | 20 Jul, 2026 | npm iot-kfh-s3 |
Malicious release: Malicious code in lwc-slds-lbc (npm) GHSA-xm8f-w286-57x5, MAL-2026-10923 | Malicious | Not scored | 20 Jul, 2026 | npm lwc-slds-lbc |
Malicious release: Malicious code in your-unique-package-name1337 (npm) GHSA-3w8q-c7m7-62q5, MAL-2026-10906 | Malicious | Not scored | 20 Jul, 2026 | npm your-unique-package-name1337 |
Malicious release: Malicious code in win-build-utils (npm) GHSA-7ffq-88v5-rmwc, MAL-2026-10905 | Malicious | Not scored | 20 Jul, 2026 | npm win-build-utils |
Malicious release: Malicious code in solana-web3-v1 (npm) GHSA-x736-hhp7-jrh7, MAL-2026-10904 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-v1 |
Malicious release: Malicious code in solana-web3-lts (npm) GHSA-8wj2-r9xj-g9p3, MAL-2026-10901 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-lts |
Malicious release: Malicious code in solana-web3-stable (npm) GHSA-c26v-wr8c-3xj8, MAL-2026-10903 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-stable |
Malicious release: Malicious code in solana-web3-patched (npm) GHSA-p492-8qvf-j49c, MAL-2026-10902 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-patched |
Malicious release: Malicious code in solana-web3-fork (npm) GHSA-rf7g-mf44-5m44, MAL-2026-10900 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-fork |
Malicious release: Malicious code in solana-web3-fixed (npm) GHSA-vc55-fvgr-m9jv, MAL-2026-10899 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-fixed |
Malicious release: Malicious code in solana-rpc-client (npm) GHSA-p7xx-6w55-gfrg, MAL-2026-10898 | Malicious | Not scored | 20 Jul, 2026 | npm solana-rpc-client |
Malicious release: Malicious code in golan125-homepage-test (npm) GHSA-6p3c-6jvh-3pg8, MAL-2026-10897 | Malicious | Not scored | 20 Jul, 2026 | npm golan125-homepage-test |
Malicious release: Malicious code in flow-eslint-oxidized (npm) GHSA-frhf-jqq4-m95m, MAL-2026-10896 | Malicious | Not scored | 20 Jul, 2026 | npm flow-eslint-oxidized |
Malicious release: Malicious code in exodus-payments (npm) GHSA-hrvv-3w2f-pp24, MAL-2026-10895 | Malicious | Not scored | 20 Jul, 2026 | npm exodus-payments |
Malicious release: Malicious code in exodus-checkout (npm) GHSA-mqx8-fhj5-w597, MAL-2026-10894 | Malicious | Not scored | 20 Jul, 2026 | npm exodus-checkout |
Malicious release: Malicious code in ecto-cargo-wk1tm59a (npm) GHSA-wx6c-2wgg-hcwq, MAL-2026-10893 | Malicious | Not scored | 20 Jul, 2026 | npm ecto-cargo-wk1tm59a |
Malicious release: Malicious code in claude-code-timer (npm) GHSA-6649-vv4q-q9fw, MAL-2026-10892 | Malicious | Not scored | 20 Jul, 2026 | npm claude-code-timer |
Malicious release: Malicious code in bytecraft (npm) GHSA-r2fr-28j9-gjh5, MAL-2026-10891 | Malicious | Not scored | 20 Jul, 2026 | npm bytecraft |
Malicious release: Malicious code in @public-for-cdao/utils (npm) GHSA-f6vj-gmjr-rr3c, MAL-2026-10889 | Malicious | Not scored | 20 Jul, 2026 | npm @public-for-cdao/utils |
Malicious release: Malicious code in @public-for-cdao/signer (npm) GHSA-rjhf-whh4-86cq, MAL-2026-10888 | Malicious | Not scored | 20 Jul, 2026 | npm @public-for-cdao/signer |
Malicious release: Malicious code in @public-for-cdao/deploy (npm) GHSA-8jx6-7rv4-9r5g, MAL-2026-10886 | Malicious | Not scored | 20 Jul, 2026 | npm @public-for-cdao/deploy |
Malicious release: Malicious code in @public-for-cdao/sdk (npm) GHSA-9gf9-q25g-2m67, MAL-2026-10887 | Malicious | Not scored | 20 Jul, 2026 | npm @public-for-cdao/sdk |