Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in twilio-platform-async-data-fetch (npm) MAL-2026-10935 | Malicious | Not scored | 20 Jul, 2026 | npm twilio-platform-async-data-fetch |
Malicious release: Malicious code in twilio-platform-request (npm) MAL-2026-10936 | Malicious | Not scored | 20 Jul, 2026 | npm twilio-platform-request |
Malicious release: Malicious code in twilio-serverless (npm) MAL-2026-10937 | Malicious | Not scored | 20 Jul, 2026 | npm twilio-serverless |
Malicious release: Malicious code in twiliointernal-messaging-toolbox (npm) MAL-2026-10938 | Malicious | Not scored | 20 Jul, 2026 | npm twiliointernal-messaging-toolbox |
Malicious release: Malicious code in aftermath-finance (npm) MAL-2026-10941 | Malicious | Not scored | 20 Jul, 2026 | npm aftermath-finance |
Malicious release: Malicious code in aftermath-sui (npm) MAL-2026-10942 | Malicious | Not scored | 20 Jul, 2026 | npm aftermath-sui |
Malicious release: Malicious code in aftermathfi (npm) MAL-2026-10943 | Malicious | Not scored | 20 Jul, 2026 | npm aftermathfi |
Malicious release: Malicious code in zer0onetencent (npm) MAL-2026-10944 | Malicious | Not scored | 20 Jul, 2026 | npm zer0onetencent |
Malicious release: Malicious code in zer0onetencent2 (npm) MAL-2026-10945 | Malicious | Not scored | 20 Jul, 2026 | npm zer0onetencent2 |
Malicious release: Malicious code in @akrai/core (npm) MAL-2026-10946 | Malicious | Not scored | 20 Jul, 2026 | npm @akrai/core |
Malicious release: Malicious code in @akrai/report (npm) MAL-2026-10947 | Malicious | Not scored | 20 Jul, 2026 | npm @akrai/report |
Malicious release: Malicious code in @akrai/report_new (npm) MAL-2026-10948 | Malicious | Not scored | 20 Jul, 2026 | npm @akrai/report_new |
Malicious release: Malicious code in @iphouse/api (npm) MAL-2026-10949 | Malicious | Not scored | 20 Jul, 2026 | npm @iphouse/api |
Malicious release: Malicious code in @iphouse/core (npm) MAL-2026-10950 | Malicious | Not scored | 20 Jul, 2026 | npm @iphouse/core |
Malicious release: Malicious code in @markscan/api (npm) MAL-2026-10951 | Malicious | Not scored | 20 Jul, 2026 | npm @markscan/api |
Malicious release: Malicious code in @markscan/core (npm) MAL-2026-10952 | Malicious | Not scored | 20 Jul, 2026 | npm @markscan/core |
Malicious release: Malicious code in @markscan/reports (npm) MAL-2026-10953 | Malicious | Not scored | 20 Jul, 2026 | npm @markscan/reports |
Malicious release: Malicious code in @markscan/utils (npm) MAL-2026-10954 | Malicious | Not scored | 20 Jul, 2026 | npm @markscan/utils |
Malicious release: Malicious code in akrai-report (npm) MAL-2026-10955 | Malicious | Not scored | 20 Jul, 2026 | npm akrai-report |
Malicious release: Malicious code in akrai-report-new (npm) MAL-2026-10956 | Malicious | Not scored | 20 Jul, 2026 | npm akrai-report-new |
Malicious release: Malicious code in iphouse (npm) MAL-2026-10957 | Malicious | Not scored | 20 Jul, 2026 | npm iphouse |
Malicious release: Malicious code in iphouse-api (npm) MAL-2026-10958 | Malicious | Not scored | 20 Jul, 2026 | npm iphouse-api |
Malicious release: Malicious code in iphouse-core (npm) MAL-2026-10959 | Malicious | Not scored | 20 Jul, 2026 | npm iphouse-core |
Malicious release: Malicious code in markscan (npm) MAL-2026-10960 | Malicious | Not scored | 20 Jul, 2026 | npm markscan |
Malicious release: Malicious code in markscan-api (npm) MAL-2026-10961 | Malicious | Not scored | 20 Jul, 2026 | npm markscan-api |
Malicious release: Malicious code in markscan-core (npm) MAL-2026-10962 | Malicious | Not scored | 20 Jul, 2026 | npm markscan-core |
Malicious release: Malicious code in markscan-reports (npm) MAL-2026-10963 | Malicious | Not scored | 20 Jul, 2026 | npm markscan-reports |
Malicious release: Malicious code in markscan-utils (npm) MAL-2026-10964 | Malicious | Not scored | 20 Jul, 2026 | npm markscan-utils |
Malicious release: Malicious code in supplyhub (npm) MAL-2026-11043 | Malicious | Not scored | 20 Jul, 2026 | npm supplyhub |
Malicious release: Malicious code in tailwind-gutenberg-block-zero (npm) MAL-2026-11044 | Malicious | Not scored | 20 Jul, 2026 | npm tailwind-gutenberg-block-zero |
Malicious release: Malicious code in chart-animation-helper (npm) GHSA-8vgc-wrpv-6v7h, MAL-2026-10781 | Malicious | Not scored | 19 Jul, 2026 | npm chart-animation-helper |
Malicious release: Malicious code in zoom-widget-xss-poc-paresh (npm) GHSA-gq92-h7j2-g9x5, MAL-2026-10782 | Malicious | Not scored | 19 Jul, 2026 | npm zoom-widget-xss-poc-paresh |
fast-uri vulnerable to host confusion via literal backslash authority delimiter CVE-2026-16221, GHSA-v2hh-gcrm-f6hx | High | 0.4% | 19 Jul, 2026 | npm fast-uri |
Malicious release: Malicious code in relativity-pdfjs-dist (npm) MAL-2026-10778 | Malicious | Not scored | 18 Jul, 2026 | npm relativity-pdfjs-dist |
Malicious release: Malicious code in telemetry-axios (npm) GHSA-89mf-39r2-ff96, MAL-2026-10773 | Malicious | Not scored | 17 Jul, 2026 | npm telemetry-axios |
Malicious release: Malicious code in axios-native (npm) GHSA-9j78-5mc3-56h7, MAL-2026-10772 | Malicious | Not scored | 17 Jul, 2026 | npm axios-native |
CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard CVE-2026-55177, GHSA-r95q-fp26-h3hc | High | 0.4% | 17 Jul, 2026 | npm @tak-ps/cloudtak |
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes CVE-2026-53496, GHSA-g77h-45rf-hcx4 | Medium | 0.5% | 17 Jul, 2026 | npm exifreader |
mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath CVE-2026-54561, GHSA-f7wf-v2vw-mpcx | Medium | 0.2% | 17 Jul, 2026 | npm mcp-memory-keeper |
TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard CVE-2026-54546, GHSA-vqrw-qphh-p34v | Medium | 0.4% | 17 Jul, 2026 | npm @tak-ps/cloudtak |
Malicious release: Malicious code in n8n-nodes-final-mile (npm) MAL-2026-10776 | Malicious | Not scored | 17 Jul, 2026 | npm n8n-nodes-final-mile |
Malicious release: Malicious code in n8n-nodes-devops-utils (npm) MAL-2026-10775 | Malicious | Not scored | 17 Jul, 2026 | npm n8n-nodes-devops-utils |
Malicious release: Malicious code in n8n-nodes-probe (npm) MAL-2026-10777 | Malicious | Not scored | 17 Jul, 2026 | npm n8n-nodes-probe |
Malicious release: Malicious code in easyway2 (npm) MAL-2026-10769 | Malicious | Not scored | 17 Jul, 2026 | npm easyway2 |
Malicious release: Malicious code in n8n-nodes-api-finder (npm) MAL-2026-10774 | Malicious | Not scored | 17 Jul, 2026 | npm n8n-nodes-api-finder |
Malicious release: Malicious code in my-tailwind-gutenberg-block (npm) GHSA-mhvw-mw3c-6mc5, MAL-2026-10761 | Malicious | Not scored | 16 Jul, 2026 | npm my-tailwind-gutenberg-block |
Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema CVE-2026-63397, GHSA-w757-xvvv-vgfw | High | 0.5% | 16 Jul, 2026 | npm @genql/cli |
Whistle vulnerable to path traversal CVE-2026-55629, GHSA-3vfr-4gwf-qxfp | High | 0.6% | 16 Jul, 2026 | npm whistle |
Malicious release: Malicious code in @ai-support-agent/cli (npm) MAL-2026-10707 | Malicious | Not scored | 16 Jul, 2026 | npm @ai-support-agent/cli |
Malicious release: Malicious code in @cyberrant-rantai/rantai (npm) MAL-2026-10709 | Malicious | Not scored | 16 Jul, 2026 | npm @cyberrant-rantai/rantai |