Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in testis-pack (npm) MAL-2026-10074 | Malicious | Not scored | 09 Jul, 2026 | npm testis-pack |
Malicious release: Malicious code in testudo-pack (npm) MAL-2026-10075 | Malicious | Not scored | 09 Jul, 2026 | npm testudo-pack |
Malicious release: Malicious code in @wagni_bot/bsc (npm) MAL-2026-11109 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/bsc |
Malicious release: Malicious code in @wagni_bot/eth (npm) MAL-2026-11110 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/eth |
Malicious release: Malicious code in @wagni_bot/hyperliquid (npm) MAL-2026-11111 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/hyperliquid |
Malicious release: Malicious code in @wagni_bot/metamask (npm) MAL-2026-11112 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/metamask |
Malicious release: Malicious code in @wagni_bot/opensea (npm) MAL-2026-11113 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/opensea |
Malicious release: Malicious code in @wagni_bot/polygon (npm) MAL-2026-11114 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/polygon |
Malicious release: Malicious code in @wagni_bot/polymarket (npm) MAL-2026-11115 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/polymarket |
Malicious release: Malicious code in @wagni_bot/wagni (npm) MAL-2026-11116 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/wagni |
Malicious release: Malicious code in @wagni_bot/web3 (npm) MAL-2026-11117 | Malicious | Not scored | 09 Jul, 2026 | npm @wagni_bot/web3 |
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint) CVE-2026-59723, GHSA-3cj3-hqcr-g934 | High | 0.2% | 08 Jul, 2026 | npm cline |
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes CVE-2026-58191, GHSA-3wgp-x9p5-c7cc | Medium | 0.6% | 08 Jul, 2026 | npm @appium/base-driver |
elysia has Inefficient Algorithmic Complexity and Interpretation Conflict CVE-2026-56669, GHSA-9643-4qgh-g8mx | High | 0.6% | 08 Jul, 2026 | npm elysia |
Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript CVE-2026-55596, GHSA-qj6x-xx2h-8hvv | High | 0.3% | 08 Jul, 2026 | npm @platejs/media |
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays CVE-2026-49866, GHSA-cwc9-cp4j-mcvv | High | 0.6% | 08 Jul, 2026 | npm @libp2p/gossipsub |
Malicious release: Malicious code in tslint-conf (npm) GHSA-wchw-4whx-qhq5, MAL-2026-7022 | Malicious | Not scored | 08 Jul, 2026 | npm tslint-conf |
Malicious release: Malicious code in @vite-js/ui (npm) GHSA-x4cp-w826-x466, MAL-2026-7021 | Malicious | Not scored | 08 Jul, 2026 | npm @vite-js/ui |
Waku has an Open Redirect via `unstable_redirect` Helper CVE-2026-49456, GHSA-43fc-v873-qw85 | Low | 0.4% | 08 Jul, 2026 | npm waku |
Waku: Cross-Origin CSRF on RSC Server Action Dispatch CVE-2026-49455, GHSA-75w3-gmqx-993q | Medium | 0.2% | 08 Jul, 2026 | npm waku |
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce CVE-2026-55575, GHSA-g357-x5c3-c72p | High | 0.5% | 08 Jul, 2026 | npm liquidjs |
Malicious release: Malicious code in n8n-nodes-barcode-generator (npm) MAL-2026-7018 | Malicious | Not scored | 08 Jul, 2026 | npm n8n-nodes-barcode-generator |
Malicious release: Malicious code in react-v17 (npm) MAL-2026-7020 | Malicious | Not scored | 08 Jul, 2026 | npm react-v17 |
Malicious release: Malicious code in npm-rce-poc (npm) GHSA-pqpr-7m94-xhm4, MAL-2026-7019 | Malicious | Not scored | 08 Jul, 2026 | npm npm-rce-poc |
Malicious release: Malicious code in none123s (npm) GHSA-rqf4-7r8q-fxmq, MAL-2026-7024 | Malicious | Not scored | 08 Jul, 2026 | npm none123s |
Malicious release: Malicious code in @vraksha/gh-helper (npm) MAL-2026-7016 | Malicious | Not scored | 08 Jul, 2026 | npm @vraksha/gh-helper |
Malicious release: Malicious code in crypto-promiser (npm) GHSA-pgcc-398f-7cv2, MAL-2026-7010 | Malicious | Not scored | 08 Jul, 2026 | npm crypto-promiser |
Malicious release: Malicious code in vps-new-manager (npm) GHSA-vm7q-854p-gw38, MAL-2026-7014 | Malicious | Not scored | 08 Jul, 2026 | npm vps-new-manager |
Malicious release: Malicious code in events-alias (npm) MAL-2026-7011 | Malicious | Not scored | 08 Jul, 2026 | npm events-alias |
Malicious release: Malicious code in chai-as-const (npm) GHSA-c2cc-6c6f-8qrp, MAL-2026-7008 | Malicious | Not scored | 08 Jul, 2026 | npm chai-as-const |
Malicious release: Malicious code in configration (npm) GHSA-6vxp-hr6q-qq8g, MAL-2026-7009 | Malicious | Not scored | 08 Jul, 2026 | npm configration |
Malicious release: Malicious code in next-locomotive-init (npm) GHSA-v4q3-jmq9-q449, MAL-2026-7013 | Malicious | Not scored | 08 Jul, 2026 | npm next-locomotive-init |
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication CVE-2026-59897, GHSA-xgm2-5f3f-mvvc | Medium | 0.2% | 08 Jul, 2026 | npm hono |
hono/jsx does not isolate context per request, leading to cross-request data disclosure CVE-2026-59896, GHSA-hvrm-45r6-mjfj | Medium | 0.3% | 08 Jul, 2026 | npm hono |
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility CVE-2026-59895, GHSA-w62v-xxxg-mg59 | Medium | 0.3% | 08 Jul, 2026 | npm hono |
OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVE-2026-59892, GHSA-45rx-2jwx-cxfr | High | 0.6% | 08 Jul, 2026 | npm @opentelemetry/propagator-jaeger |
linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text CVE-2026-59887, GHSA-v245-v573-v5vm | High | 0.5% | 08 Jul, 2026 | npm linkify-it |
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS CVE-2026-59879, GHSA-v56q-mh7h-f735 | High | 0.6% | 08 Jul, 2026 | npm immutable |
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch CVE-2026-59731, GHSA-vj59-8hwv-xxmv | High | 0.3% | 08 Jul, 2026 | npm astro |
Malicious release: Malicious code in @vite-tab/tab (npm) GHSA-74pv-97c8-9hfp, MAL-2026-6988 | Malicious | Not scored | 08 Jul, 2026 | npm @vite-tab/tab |
Malicious release: Malicious code in luludawang-kit (npm) GHSA-vgv8-886r-fvp5, MAL-2026-6999 | Malicious | Not scored | 08 Jul, 2026 | npm luludawang-kit |
Malicious release: Malicious code in ec-checker (npm) MAL-2026-6996 | Malicious | Not scored | 08 Jul, 2026 | npm ec-checker |
Malicious release: Malicious code in chai-redirection (npm) GHSA-89c7-5mf7-c86r, MAL-2026-6995 | Malicious | Not scored | 08 Jul, 2026 | npm chai-redirection |
Malicious release: Malicious code in chai-presentation (npm) MAL-2026-6994 | Malicious | Not scored | 08 Jul, 2026 | npm chai-presentation |
Malicious release: Malicious code in airkey-mfa-react (npm) GHSA-85x8-7x9f-f978, MAL-2026-6991 | Malicious | Not scored | 08 Jul, 2026 | npm airkey-mfa-react |
Malicious release: Malicious code in pipo-sdk (npm) MAL-2026-7000 | Malicious | Not scored | 08 Jul, 2026 | npm pipo-sdk |
Malicious release: Malicious code in goofy-sdk (npm) MAL-2026-6997 | Malicious | Not scored | 08 Jul, 2026 | npm goofy-sdk |
Malicious release: Malicious code in @luminarycloudinternal/lcvis-st (npm) GHSA-pgh8-mm8r-r796, MAL-2026-6987 | Malicious | Not scored | 08 Jul, 2026 | npm @luminarycloudinternal/lcvis-st |
Malicious release: Malicious code in bytefaas-sdk (npm) MAL-2026-6993 | Malicious | Not scored | 08 Jul, 2026 | npm bytefaas-sdk |
Malicious release: Malicious code in searchresults (npm) GHSA-cpff-p65h-24c4, MAL-2026-7003 | Malicious | Not scored | 08 Jul, 2026 | npm searchresults |