Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @uwr/colors (npm) GHSA-8rcq-736v-r8j8, MAL-2026-10179 | Malicious | Not scored | 10 Jul, 2026 | npm @uwr/colors |
Malicious release: Malicious code in fkext-browser-min (npm) GHSA-rc5q-c5vp-6g46, MAL-2026-10183 | Malicious | Not scored | 10 Jul, 2026 | npm fkext-browser-min |
Malicious release: Malicious code in @broadpeak/smartlib-ad (npm) MAL-2026-10178 | Malicious | Not scored | 10 Jul, 2026 | npm @broadpeak/smartlib-ad |
Malicious release: Malicious code in consumerweb (npm) GHSA-5jfq-x73h-v53x, MAL-2026-10181 | Malicious | Not scored | 10 Jul, 2026 | npm consumerweb |
Malicious release: Malicious code in express-guardian (npm) MAL-2026-10182 | Malicious | Not scored | 10 Jul, 2026 | npm express-guardian |
Malicious release: Malicious code in mongoose-schema-unique (npm) MAL-2026-10184 | Malicious | Not scored | 10 Jul, 2026 | npm mongoose-schema-unique |
Malicious release: Malicious code in auth-next-gen (npm) GHSA-8qpp-8j53-4wh7, MAL-2026-10180 | Malicious | Not scored | 10 Jul, 2026 | npm auth-next-gen |
Malicious release: Malicious code in @jaymara/jsononifier (npm) MAL-2026-10177 | Malicious | Not scored | 10 Jul, 2026 | npm @jaymara/jsononifier |
Malicious release: Malicious code in chai-as-doc (npm) MAL-2026-10175 | Malicious | Not scored | 10 Jul, 2026 | npm chai-as-doc |
Malicious release: Malicious code in uncaxss (npm) MAL-2026-10176 | Malicious | Not scored | 10 Jul, 2026 | npm uncaxss |
SafeInstall agent guard shell parsing can miss raw package execution GHSA-xrmc-c5cg-rv7x | High | Not scored | 10 Jul, 2026 | npm safeinstall-cli |
mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials CVE-2026-61459, GHSA-wmg3-h8mf-wgvr, PYSEC-2026-3685 | Critical | 2.4% | 10 Jul, 2026 | PyPI mcp-server-kubernetes npm mcp-server-kubernetes |
Malicious release: Malicious code in @injectivelabs/sdk-ts (npm) GHSA-5fc4-fm2x-6f4r, MAL-2026-10165 | Malicious | Not scored | 10 Jul, 2026 | npm @injectivelabs/sdk-ts |
Malicious release: Malicious code in paysafe-vault (npm) MAL-2026-10173 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-vault |
Malicious release: Malicious code in paysafe-payments (npm) MAL-2026-10172 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-payments |
Malicious release: Malicious code in paysafe-node (npm) MAL-2026-10171 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-node |
Malicious release: Malicious code in paysafe-kyc (npm) MAL-2026-10170 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-kyc |
Malicious release: Malicious code in paysafe-fraud (npm) MAL-2026-10168 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-fraud |
Malicious release: Malicious code in paysafe-js (npm) MAL-2026-10169 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-js |
Malicious release: Malicious code in paysafe-checkout (npm) MAL-2026-10167 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-checkout |
Malicious release: Malicious code in paysafe-api (npm) MAL-2026-10166 | Malicious | Not scored | 10 Jul, 2026 | npm paysafe-api |
Malicious release: Malicious code in type-atob (npm) GHSA-w8g3-2xjv-6vf6, MAL-2026-10174 | Malicious | Not scored | 10 Jul, 2026 | npm type-atob |
Malicious release: Malicious code in llama-tokenizer (npm) GHSA-q4hv-j85h-9h7j, MAL-2026-10163 | Malicious | Not scored | 10 Jul, 2026 | npm llama-tokenizer |
Malicious release: Malicious code in type-async (npm) GHSA-rfhj-93m8-qhgx, MAL-2026-10164 | Malicious | Not scored | 10 Jul, 2026 | npm type-async |
9router /v1 APIs has unauthenticated access via reverse proxy locality collapse CVE-2026-56675, GHSA-x5c9-v98j-722r | High | 0.5% | 10 Jul, 2026 | npm 9router |
9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF CVE-2026-55641, GHSA-86m2-fcxq-5q7c | High | 0.3% | 10 Jul, 2026 | npm 9router |
9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass CVE-2026-55638, GHSA-8gmq-j984-vp4r | High | 6.6% | 10 Jul, 2026 | npm 9router |
adm-zip: Crafted ZIP file triggers 4GB memory allocation CVE-2026-39244, GHSA-xcpc-8h2w-3j85 | High | 0.8% | 10 Jul, 2026 | npm adm-zip |
Malicious release: Malicious code in @bcryptln/becryptjs (npm) GHSA-9qhg-2wvw-j95c, MAL-2026-10162 | Malicious | Not scored | 10 Jul, 2026 | npm @bcryptln/becryptjs |
Malicious release: Malicious code in rollup-packages-polyfill-core (npm) MAL-2026-10160 | Malicious | Not scored | 10 Jul, 2026 | npm rollup-packages-polyfill-core |
Malicious release: Malicious code in buffer-util-internal (npm) MAL-2026-10151 | Malicious | Not scored | 10 Jul, 2026 | npm buffer-util-internal |
Malicious release: Malicious code in ap3-components-ui (npm) GHSA-qhgr-v9vh-3784, MAL-2026-10150 | Malicious | Not scored | 10 Jul, 2026 | npm ap3-components-ui |
Malicious release: Malicious code in notify-utilities (npm) MAL-2026-10158 | Malicious | Not scored | 10 Jul, 2026 | npm notify-utilities |
Malicious release: Malicious code in notify-logs (npm) MAL-2026-10156 | Malicious | Not scored | 10 Jul, 2026 | npm notify-logs |
Malicious release: Malicious code in notify-theme (npm) MAL-2026-10157 | Malicious | Not scored | 10 Jul, 2026 | npm notify-theme |
Malicious release: Malicious code in notify-dist (npm) MAL-2026-10154 | Malicious | Not scored | 10 Jul, 2026 | npm notify-dist |
Malicious release: Malicious code in notify-funcs (npm) MAL-2026-10155 | Malicious | Not scored | 10 Jul, 2026 | npm notify-funcs |
Malicious release: Malicious code in notifier-log (npm) MAL-2026-10153 | Malicious | Not scored | 10 Jul, 2026 | npm notifier-log |
Malicious release: Malicious code in notifier-funcs (npm) MAL-2026-10152 | Malicious | Not scored | 10 Jul, 2026 | npm notifier-funcs |
Malicious release: Malicious code in npm-rce-safe-proof-yourname (npm) MAL-2026-10159 | Malicious | Not scored | 10 Jul, 2026 | npm npm-rce-safe-proof-yourname |
Malicious release: Malicious code in sidecar-mcp (npm) GHSA-6fg7-6wv2-gx3j, MAL-2026-10161 | Malicious | Not scored | 10 Jul, 2026 | npm sidecar-mcp |
Malicious release: Malicious code in @amtrav/webservice (npm) GHSA-frwh-6rv4-8cg3, MAL-2026-10140 | Malicious | Not scored | 10 Jul, 2026 | npm @amtrav/webservice |
Malicious release: Malicious code in @genie-auth/config (npm) GHSA-vmm7-6q5r-pfj9, MAL-2026-10141 | Malicious | Not scored | 10 Jul, 2026 | npm @genie-auth/config |
Malicious release: Malicious code in motiondnb (npm) GHSA-278r-46x5-pfjm, MAL-2026-10145 | Malicious | Not scored | 10 Jul, 2026 | npm motiondnb |
Malicious release: Malicious code in ng-search-api (npm) GHSA-rgrc-mmg8-pgrr, MAL-2026-10146 | Malicious | Not scored | 10 Jul, 2026 | npm ng-search-api |
9router: Image prefetch DNS rebinding allows SSRF to internal services CVE-2026-56676, GHSA-cmhj-wh2f-9cgx | High | 0.2% | 10 Jul, 2026 | npm 9router |
Malicious release: Malicious code in react-jsonwebtoken (npm) MAL-2026-10132 | Malicious | Not scored | 10 Jul, 2026 | npm react-jsonwebtoken |
Malicious release: Malicious code in theta-sdk-js (npm) GHSA-qj2r-27rj-cc82, MAL-2026-10135 | Malicious | Not scored | 10 Jul, 2026 | npm theta-sdk-js |
Malicious release: Malicious code in polygon-gamma-apis (npm) GHSA-hg4h-mv37-7x88, MAL-2026-10148 | Malicious | Not scored | 10 Jul, 2026 | npm polygon-gamma-apis |
Malicious release: Malicious code in polygon-gama-apis (npm) GHSA-pvwq-8chv-g96r, MAL-2026-10147 | Malicious | Not scored | 10 Jul, 2026 | npm polygon-gama-apis |