Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in dom-weave (npm) GHSA-wx59-xwhx-3mmv, MAL-2026-10561 | Malicious | Not scored | 14 Jul, 2026 | npm dom-weave |
Malicious release: Malicious code in @codex2005/logger-core (npm) GHSA-jc68-fr59-2vfv, MAL-2026-10555 | Malicious | Not scored | 14 Jul, 2026 | npm @codex2005/logger-core |
Malicious release: Malicious code in better-tailwindcss (npm) GHSA-w8pj-3w7c-464w, MAL-2026-10550 | Malicious | Not scored | 14 Jul, 2026 | npm better-tailwindcss |
Malicious release: Malicious code in viteplugiin (npm) MAL-2026-10546 | Malicious | Not scored | 14 Jul, 2026 | npm viteplugiin |
Malicious release: Malicious code in chain-devkit (npm) MAL-2026-10531 | Malicious | Not scored | 14 Jul, 2026 | npm chain-devkit |
Malicious release: Malicious code in my-empty-package (npm) GHSA-39q9-338w-8vhv, MAL-2026-10535 | Malicious | Not scored | 14 Jul, 2026 | npm my-empty-package |
Malicious release: Malicious code in fluterjs (npm) GHSA-gj4r-435f-67cr, MAL-2026-10532 | Malicious | Not scored | 14 Jul, 2026 | npm fluterjs |
Malicious release: Malicious code in cbr-internal-utils (npm) MAL-2026-10530 | Malicious | Not scored | 14 Jul, 2026 | npm cbr-internal-utils |
Malicious release: Malicious code in neon-postgres (npm) MAL-2026-10537 | Malicious | Not scored | 14 Jul, 2026 | npm neon-postgres |
Malicious release: Malicious code in lusha-iam-widgets (npm) GHSA-8xrv-62w2-rp6g, MAL-2026-10533 | Malicious | Not scored | 14 Jul, 2026 | npm lusha-iam-widgets |
Malicious release: Malicious code in n8n-nodes-social-facebook (npm) MAL-2026-10536 | Malicious | Not scored | 14 Jul, 2026 | npm n8n-nodes-social-facebook |
Malicious release: Malicious code in proxy-seller-mcp (npm) MAL-2026-10541 | Malicious | Not scored | 14 Jul, 2026 | npm proxy-seller-mcp |
Malicious release: Malicious code in skrill-payments (npm) MAL-2026-10543 | Malicious | Not scored | 14 Jul, 2026 | npm skrill-payments |
Malicious release: Malicious code in neteller (npm) MAL-2026-10538 | Malicious | Not scored | 14 Jul, 2026 | npm neteller |
Malicious release: Malicious code in skrill-sdk (npm) MAL-2026-10544 | Malicious | Not scored | 14 Jul, 2026 | npm skrill-sdk |
Malicious release: Malicious code in skrill (npm) MAL-2026-10542 | Malicious | Not scored | 14 Jul, 2026 | npm skrill |
Malicious release: Malicious code in postcss-processor-utils (npm) GHSA-r5fg-j5cf-mfgx, MAL-2026-10540 | Malicious | Not scored | 14 Jul, 2026 | npm postcss-processor-utils |
Malicious release: Malicious code in postcss-animatecss (npm) MAL-2026-10539 | Malicious | Not scored | 14 Jul, 2026 | npm postcss-animatecss |
Malicious release: Malicious code in vite-plugin-model (npm) GHSA-p58m-2wrh-74xr, MAL-2026-10545 | Malicious | Not scored | 14 Jul, 2026 | npm vite-plugin-model |
Malicious release: Malicious code in motion-pull (npm) GHSA-6hf9-8x52-w6g3, MAL-2026-10534 | Malicious | Not scored | 14 Jul, 2026 | npm motion-pull |
Malicious release: Malicious code in @velkov/isows (npm) MAL-2026-10524 | Malicious | Not scored | 14 Jul, 2026 | npm @velkov/isows |
Malicious release: Malicious code in @wrenfield/abitype (npm) GHSA-6f83-g2m3-3wwr, MAL-2026-10529 | Malicious | Not scored | 14 Jul, 2026 | npm @wrenfield/abitype |
Malicious release: Malicious code in @tabrex/bs58 (npm) MAL-2026-10523 | Malicious | Not scored | 14 Jul, 2026 | npm @tabrex/bs58 |
Malicious release: Malicious code in @vite-mcp/vite-type (npm) GHSA-mqf9-3wx8-45cj, MAL-2026-10525 | Malicious | Not scored | 14 Jul, 2026 | npm @vite-mcp/vite-type |
Malicious release: Malicious code in @vitets/vite-ts (npm) GHSA-733v-wc48-f65r, MAL-2026-10528 | Malicious | Not scored | 14 Jul, 2026 | npm @vitets/vite-ts |
Malicious release: Malicious code in @vite-ts/vite-ui (npm) GHSA-jm6h-xxm2-2mr3, MAL-2026-10527 | Malicious | Not scored | 14 Jul, 2026 | npm @vite-ts/vite-ui |
Malicious release: Malicious code in @vite-pro/vite-ui (npm) GHSA-phpx-wpr2-26pv, MAL-2026-10526 | Malicious | Not scored | 14 Jul, 2026 | npm @vite-pro/vite-ui |
Malicious release: Malicious code in @amedit/vercel-builder-probe (npm) GHSA-wvc3-vq7q-w2mw, MAL-2026-10548 | Malicious | Not scored | 14 Jul, 2026 | npm @amedit/vercel-builder-probe |
Malicious release: Malicious code in flick-test-app (npm) GHSA-94ph-qqm7-h26r, MAL-2026-10522 | Malicious | Not scored | 14 Jul, 2026 | npm flick-test-app |
Malicious release: Malicious code in @flcik/flick.js (npm) GHSA-f5p8-w3hq-m27h, MAL-2026-10521 | Malicious | Not scored | 14 Jul, 2026 | npm @flcik/flick.js |
Malicious release: Malicious code in fastify-bundler (npm) GHSA-f99h-9jhg-jrxw, MAL-2026-10520 | Malicious | Not scored | 14 Jul, 2026 | npm fastify-bundler |
Malicious release: Malicious code in @tqm-mfe/main (npm) GHSA-cg4c-94r8-hqjq, MAL-2026-10517 | Malicious | Not scored | 14 Jul, 2026 | npm @tqm-mfe/main |
Malicious release: Malicious code in chai-as-sets (npm) MAL-2026-10519 | Malicious | Not scored | 14 Jul, 2026 | npm chai-as-sets |
Malicious release: Malicious code in chai-as-auth (npm) MAL-2026-10518 | Malicious | Not scored | 14 Jul, 2026 | npm chai-as-auth |
SAP Approuter has an Open Redirect vulnerability CVE-2026-44745, GHSA-44p5-3m5g-vfhj | High | 0.5% | 14 Jul, 2026 | npm @sap/approuter |
SAP Approuter Vulnerable to HTTP Request Smuggling CVE-2026-27690, GHSA-8m85-wqg7-c529 | Critical | 0.7% | 14 Jul, 2026 | npm @sap/approuter |
Malicious release: Malicious code in polymarket-bot-logger (npm) GHSA-v4pc-gmg8-h48w, MAL-2026-10516 | Malicious | Not scored | 13 Jul, 2026 | npm polymarket-bot-logger |
Malicious release: Malicious code in nodemon-client (npm) GHSA-cw3m-3cvq-pwp2, MAL-2026-10513 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-client |
Malicious release: Malicious code in nodemon-eslint (npm) GHSA-v57g-fjf5-426h, MAL-2026-10514 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-eslint |
Malicious release: Malicious code in nodemon-web (npm) GHSA-62c9-p25c-7xxm, MAL-2026-10515 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-web |
Malicious release: Malicious code in type-astr (npm) GHSA-q9rm-w335-55w5, MAL-2026-10510 | Malicious | Not scored | 13 Jul, 2026 | npm type-astr |
Malicious release: Malicious code in type-swap (npm) GHSA-w8hw-4vch-mrj4, MAL-2026-10511 | Malicious | Not scored | 13 Jul, 2026 | npm type-swap |
Malicious release: Malicious code in type-unique (npm) GHSA-h8x5-f48q-v2h7, MAL-2026-10512 | Malicious | Not scored | 13 Jul, 2026 | npm type-unique |
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs CVE-2026-62197, GHSA-3x84-qq85-fj65 | Medium | 0.3% | 13 Jul, 2026 | npm openclaw |
OpenClaw Feishu permission tools could ignore per-account disablement CVE-2026-62188, GHSA-w8wf-3qvj-6xqf | High | 0.4% | 13 Jul, 2026 | npm @openclaw/feishu |
OpenClaw Feishu tools could ignore per-account disablement CVE-2026-62187, GHSA-2q7j-2vhx-56g8 | High | 0.4% | 13 Jul, 2026 | npm @openclaw/feishu |
Malicious release: Malicious code in nodemon-delog (npm) GHSA-7gjf-8j8g-xm9p, MAL-2026-10507 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-delog |
Malicious release: Malicious code in nodemon-elint (npm) MAL-2026-10508 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-elint |
Malicious release: Malicious code in chai-as-verified (npm) MAL-2026-10504 | Malicious | Not scored | 13 Jul, 2026 | npm chai-as-verified |
Malicious release: Malicious code in node-fsagent (npm) GHSA-qgvj-fw22-j5v6, MAL-2026-10506 | Malicious | Not scored | 13 Jul, 2026 | npm node-fsagent |