Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in goofy-sdk (npm) MAL-2026-6997 | Malicious | Not scored | 08 Jul, 2026 | npm goofy-sdk |
Malicious release: Malicious code in @luminarycloudinternal/lcvis-st (npm) GHSA-pgh8-mm8r-r796, MAL-2026-6987 | Malicious | Not scored | 08 Jul, 2026 | npm @luminarycloudinternal/lcvis-st |
Malicious release: Malicious code in bytefaas-sdk (npm) MAL-2026-6993 | Malicious | Not scored | 08 Jul, 2026 | npm bytefaas-sdk |
Malicious release: Malicious code in searchresults (npm) GHSA-cpff-p65h-24c4, MAL-2026-7003 | Malicious | Not scored | 08 Jul, 2026 | npm searchresults |
Malicious release: Malicious code in thunder-rony (npm) MAL-2026-7004 | Malicious | Not scored | 08 Jul, 2026 | npm thunder-rony |
Malicious release: Malicious code in ronyfortest (npm) MAL-2026-7002 | Malicious | Not scored | 08 Jul, 2026 | npm ronyfortest |
Malicious release: Malicious code in rony-test (npm) MAL-2026-7001 | Malicious | Not scored | 08 Jul, 2026 | npm rony-test |
Malicious release: Malicious code in higherlogic-ocfe (npm) GHSA-6c7j-c4j8-rgq3, MAL-2026-6998 | Malicious | Not scored | 08 Jul, 2026 | npm higherlogic-ocfe |
Malicious release: Malicious code in babel-eslint-parser-legacy (npm) GHSA-xr98-72p4-pwg2, MAL-2026-6992 | Malicious | Not scored | 08 Jul, 2026 | npm babel-eslint-parser-legacy |
Malicious release: Malicious code in ag-charts-test (npm) GHSA-p9cr-rm9c-q8mg, MAL-2026-6989 | Malicious | Not scored | 08 Jul, 2026 | npm ag-charts-test |
Malicious release: Malicious code in visa-cli-tools (npm) GHSA-jx6g-7h69-4334, MAL-2026-7005 | Malicious | Not scored | 08 Jul, 2026 | npm visa-cli-tools |
Malicious release: Malicious code in ai-gen-ai-opt-in (npm) MAL-2026-6990 | Malicious | Not scored | 08 Jul, 2026 | npm ai-gen-ai-opt-in |
Malicious release: Malicious code in @luminarycloudinternal/frodo (npm) GHSA-p92p-63h9-qrvc, MAL-2026-6986 | Malicious | Not scored | 08 Jul, 2026 | npm @luminarycloudinternal/frodo |
Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set CVE-2026-59880, GHSA-xvcm-6775-5m9r | High | 0.7% | 08 Jul, 2026 | npm immutable |
protobufjs: Denial of Service via infinite loop in .proto option parsing CVE-2026-59877, GHSA-j3f2-48v5-ccww | High | 0.4% | 08 Jul, 2026 | npm protobufjs |
protobufjs: Text Format string map parsing can mutate returned map object prototype CVE-2026-59876, GHSA-jfj6-75fj-8934 | Medium | 0.3% | 08 Jul, 2026 | npm protobufjs |
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records CVE-2026-59875, GHSA-gvwx-54wh-qm9j | Medium | 0.4% | 08 Jul, 2026 | npm tar |
node-tar: Negative tar entry size causes infinite loop in archive replace CVE-2026-59874, GHSA-8x88-c5mf-7j5w | High | 0.4% | 08 Jul, 2026 | npm tar |
node-tar: Decompression/parse DoS via unlimited input CVE-2026-59873, GHSA-23hp-3jrh-7fpw | Critical | 0.6% | 08 Jul, 2026 | npm tar |
node-tar: Process crash via PAX numeric path type confusion CVE-2026-59871, GHSA-w8wr-v893-vjvp | High | 0.6% | 08 Jul, 2026 | npm tar |
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA CVE-2026-59870, GHSA-724g-mxrg-4qvm | High | 0.7% | 08 Jul, 2026 | npm js-yaml |
js-yaml: YAML merge-key chains can force quadratic CPU consumption CVE-2026-59869, GHSA-52cp-r559-cp3m | High | 0.6% | 08 Jul, 2026 | npm js-yaml |
js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml CVE-2026-59868, GHSA-g796-fgmg-93mv | High | 0.6% | 08 Jul, 2026 | npm js-yaml |
Socket.IO: Engine.IO Polling Transport Connection Exhaustion CVE-2026-59725, GHSA-r635-g3xr-vw7x | High | 0.6% | 08 Jul, 2026 | npm engine.io |
Socket.IO: Engine.IO WebTransport SID DoS CVE-2026-59724, GHSA-gr94-w7qr-f4j3 | High | 0.6% | 08 Jul, 2026 | npm engine.io |
CyberChef: Prototype pollution in Series Chart operation CVE-2026-57439, GHSA-fx6f-382r-j72c | Medium | 0.1% | 08 Jul, 2026 | npm cyberchef |
Malicious release: Malicious code in promo-helper (npm) GHSA-mvg5-c69w-jg7r, MAL-2026-6985 | Malicious | Not scored | 08 Jul, 2026 | npm promo-helper |
Malicious release: Malicious code in @vite-ln/build-ts (npm) GHSA-p85w-qq28-35h6, MAL-2026-6984 | Malicious | Not scored | 08 Jul, 2026 | npm @vite-ln/build-ts |
Malicious release: Malicious code in paysafe-cards (npm) MAL-2026-6982 | Malicious | Not scored | 08 Jul, 2026 | npm paysafe-cards |
Malicious release: Malicious code in domains-billing-types (npm) MAL-2026-6980 | Malicious | Not scored | 08 Jul, 2026 | npm domains-billing-types |
n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation CVE-2026-59257, GHSA-hwmj-qg4v-cvg9 | Medium | 0.6% | 08 Jul, 2026 | npm n8n |
n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects CVE-2026-59253, GHSA-2xgm-wc4g-5jvg | Medium | 0.3% | 08 Jul, 2026 | npm n8n |
Malicious release: Malicious code in @vwfs-its/sf-sac-frontend (npm) MAL-2026-6972 | Malicious | Not scored | 08 Jul, 2026 | npm @vwfs-its/sf-sac-frontend |
Malicious release: Malicious code in dependency_confusions (npm) MAL-2026-10085 | Malicious | Not scored | 08 Jul, 2026 | npm dependency_confusions |
Malicious release: Malicious code in gitlens (npm) GHSA-mgwg-48mg-h7pg, MAL-2026-6973 | Malicious | Not scored | 08 Jul, 2026 | npm gitlens |
Malicious release: Malicious code in rony-testing (npm) GHSA-7p38-gfgq-g3f3, MAL-2026-6968 | Malicious | Not scored | 08 Jul, 2026 | npm rony-testing |
Malicious release: Malicious code in na-rony (npm) GHSA-f83g-5hxf-2g39, MAL-2026-6964 | Malicious | Not scored | 08 Jul, 2026 | npm na-rony |
Malicious release: Malicious code in na-rony-test-karem (npm) GHSA-pfc9-hmhj-8x4p, MAL-2026-6966 | Malicious | Not scored | 08 Jul, 2026 | npm na-rony-test-karem |
Malicious release: Malicious code in na-rony-test (npm) GHSA-ppr7-xf9p-cqpg, MAL-2026-6965 | Malicious | Not scored | 08 Jul, 2026 | npm na-rony-test |
Malicious release: Malicious code in karem-dp (npm) GHSA-qfm3-6pmh-jr8j, MAL-2026-6963 | Malicious | Not scored | 08 Jul, 2026 | npm karem-dp |
Malicious release: Malicious code in nam-os-a-man (npm) GHSA-qq66-gj73-6pqm, MAL-2026-6967 | Malicious | Not scored | 08 Jul, 2026 | npm nam-os-a-man |
Malicious release: Malicious code in gas-log (npm) GHSA-24x9-3433-gqp9, MAL-2026-6962 | Malicious | Not scored | 08 Jul, 2026 | npm gas-log |
Malicious release: Malicious code in vite-json-pwa (npm) GHSA-3f72-wf55-pqjc, MAL-2026-6969 | Malicious | Not scored | 08 Jul, 2026 | npm vite-json-pwa |
Malicious release: Malicious code in nodemon-node (npm) GHSA-58j3-rgh4-9rjc, MAL-2026-6957 | Malicious | Not scored | 08 Jul, 2026 | npm nodemon-node |
Malicious release: Malicious code in ts-await (npm) GHSA-xpmf-x27p-9vcc, MAL-2026-6958 | Malicious | Not scored | 08 Jul, 2026 | npm ts-await |
Malicious release: Malicious code in rio-design-tokens (npm) GHSA-53fp-9cgx-r5rg, MAL-2026-6956 | Malicious | Not scored | 08 Jul, 2026 | npm rio-design-tokens |
@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers CVE-2026-67331, GHSA-j8v8-g9cx-5qf4 | High | 0.4% | 07 Jul, 2026 | npm @better-auth/scim |
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows CVE-2026-67334, GHSA-2vg6-77g8-24mp | Medium | 0.3% | 07 Jul, 2026 | npm @better-auth/scim npm better-auth |
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive CVE-2026-53518, GHSA-7w99-5wm4-3g79 | High | 0.4% | 07 Jul, 2026 | npm @better-auth/oauth-provider npm better-auth |
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints CVE-2026-53513, GHSA-5rr4-8452-hf4v | Critical | 0.2% | 07 Jul, 2026 | npm @better-auth/sso |