Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @athena-ui-components/layout (npm) GHSA-pxvw-xj38-w572, MAL-2026-7046 | Malicious | Not scored | 07 Jul, 2026 | npm @athena-ui-components/layout |
Malicious release: Malicious code in @athena-ui-components/lang (npm) GHSA-46v5-8jw4-p6qf, MAL-2026-7045 | Malicious | Not scored | 07 Jul, 2026 | npm @athena-ui-components/lang |
Malicious release: Malicious code in @athena-ui-components/hooks (npm) GHSA-8g26-m82g-jjx5, MAL-2026-7044 | Malicious | Not scored | 07 Jul, 2026 | npm @athena-ui-components/hooks |
Malicious release: Malicious code in @athena-ui-components/helpers (npm) GHSA-p73j-mwv5-4gjc, MAL-2026-7043 | Malicious | Not scored | 07 Jul, 2026 | npm @athena-ui-components/helpers |
Malicious release: Malicious code in @athena-ui-components/graceful-degradation (npm) GHSA-vrr4-w48w-cq9x, MAL-2026-7042 | Malicious | Not scored | 07 Jul, 2026 | npm @athena-ui-components/graceful-degradation |
Malicious release: Malicious code in @asurion-core/eventualize-react-b (npm) GHSA-cw33-jmg4-w63q, MAL-2026-7041 | Malicious | Not scored | 07 Jul, 2026 | npm @asurion-core/eventualize-react-b |
Malicious release: Malicious code in @asurion-core/eventualize-react- (npm) GHSA-88mr-jh8v-7q5h, MAL-2026-7040 | Malicious | Not scored | 07 Jul, 2026 | npm @asurion-core/eventualize-react- |
Malicious release: Malicious code in @apps-locations/events (npm) GHSA-cfpm-pr85-48vm, MAL-2026-7039 | Malicious | Not scored | 07 Jul, 2026 | npm @apps-locations/events |
Malicious release: Malicious code in @apps-legacy-reports/events (npm) GHSA-xp27-3rf5-38wq, MAL-2026-7038 | Malicious | Not scored | 07 Jul, 2026 | npm @apps-legacy-reports/events |
Malicious release: Malicious code in @applicationbuildingcenter/xcube-schema (npm) GHSA-69ph-wr9g-x699, MAL-2026-7037 | Malicious | Not scored | 07 Jul, 2026 | npm @applicationbuildingcenter/xcube-schema |
Malicious release: Malicious code in @app-tray-ui/stencil-component (npm) GHSA-3wp9-cx62-gwh6, MAL-2026-7036 | Malicious | Not scored | 07 Jul, 2026 | npm @app-tray-ui/stencil-component |
Malicious release: Malicious code in @aoflcorp/freighter (npm) GHSA-p4g5-mjpj-wqgx, MAL-2026-7035 | Malicious | Not scored | 07 Jul, 2026 | npm @aoflcorp/freighter |
Malicious release: Malicious code in @alphasedboy/game (npm) GHSA-9587-gmc9-6qh8, MAL-2026-7034 | Malicious | Not scored | 07 Jul, 2026 | npm @alphasedboy/game |
Malicious release: Malicious code in @2011-08-19/n (npm) GHSA-rrrq-hmq4-fvxq, MAL-2026-7033 | Malicious | Not scored | 07 Jul, 2026 | npm @2011-08-19/n |
Malicious release: Malicious code in @pimy-b2cweb/apiclient-b2cweb-r2 (npm) MAL-2026-10655 | Malicious | Not scored | 07 Jul, 2026 | npm @pimy-b2cweb/apiclient-b2cweb-r2 |
Malicious release: Malicious code in @pimy-b2cweb/frontend-lib (npm) MAL-2026-10656 | Malicious | Not scored | 07 Jul, 2026 | npm @pimy-b2cweb/frontend-lib |
Malicious release: Malicious code in @higherlogic/ocfe (npm) GHSA-m2wg-xw25-9g9c, MAL-2026-6911 | Malicious | Not scored | 07 Jul, 2026 | npm @higherlogic/ocfe |
Malicious release: Malicious code in paperclip-adapter-helpers (npm) GHSA-v3ch-6vv8-xr3w, MAL-2026-6981 | Malicious | Not scored | 07 Jul, 2026 | npm paperclip-adapter-helpers |
Malicious release: Malicious code in express-firegate (npm) GHSA-59r7-h2ch-m4v2, MAL-2026-6909 | Malicious | Not scored | 07 Jul, 2026 | npm express-firegate |
Malicious release: Malicious code in express-deflect (npm) GHSA-968w-6262-r9f5, MAL-2026-6908 | Malicious | Not scored | 07 Jul, 2026 | npm express-deflect |
Malicious release: Malicious code in chai-spycore (npm) GHSA-w3fq-7xj5-8gmv, MAL-2026-6907 | Malicious | Not scored | 07 Jul, 2026 | npm chai-spycore |
Malicious release: Malicious code in zluri-ad-connector (npm) MAL-2026-6910 | Malicious | Not scored | 07 Jul, 2026 | npm zluri-ad-connector |
Malicious release: Malicious code in vps-adapter-core (npm) GHSA-hvxm-858v-vhw9, MAL-2026-6949 | Malicious | Not scored | 07 Jul, 2026 | npm vps-adapter-core |
Malicious release: Malicious code in paperclip-host-utils (npm) GHSA-m74w-fv2m-jcvw, MAL-2026-6947 | Malicious | Not scored | 07 Jul, 2026 | npm paperclip-host-utils |
Malicious release: Malicious code in express-mongo-limit (npm) GHSA-rw8f-rf6x-jj3j, MAL-2026-7012 | Malicious | Not scored | 07 Jul, 2026 | npm express-mongo-limit |
showdown allows stored cross-site scripting through table header ID injection CVE-2026-59710, GHSA-22g5-r2x5-97cx | Medium | 0.3% | 06 Jul, 2026 | npm showdown |
9router: Login brute-force protection bypass via spoofed X-Forwarded-For header CVE-2026-55501, GHSA-7cfm-pqrj-xgq7 | High | 0.4% | 06 Jul, 2026 | npm 9router |
9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover CVE-2026-55500, GHSA-qvfm-67h2-2qfx | Critical | 0.5% | 06 Jul, 2026 | npm 9router |
9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats CVE-2026-59801, CVE-2026-62327, CVE-2026-62328, GHSA-vjc7-jrh9-9j86 | Critical | 6.3% | 06 Jul, 2026 | npm 9router |
showdown metadata title handling allows cross-site scripting CVE-2026-59711, GHSA-cr32-g25g-vxjj | Medium | 0.2% | 06 Jul, 2026 | npm showdown |
Decompress: Archive extraction can create files and links outside of the target directory CVE-2026-53486, GHSA-mp2f-45pm-3cg9 | Critical | 0.7% | 06 Jul, 2026 | npm @xhmikosr/decompress npm decompress |
Malicious release: Malicious code in xnder-sdk-js (npm) GHSA-wwv8-px7f-vfq4, MAL-2026-6906 | Malicious | Not scored | 06 Jul, 2026 | npm xnder-sdk-js |
Malicious release: Malicious code in winston-prism (npm) GHSA-3xpg-2wmm-jjj2, MAL-2026-6905 | Malicious | Not scored | 06 Jul, 2026 | npm winston-prism |
Malicious release: Malicious code in wime-zle (npm) GHSA-6474-9f9h-hmwx, MAL-2026-6902 | Malicious | Not scored | 06 Jul, 2026 | npm wime-zle |
Malicious release: Malicious code in vite-plugin-svg-paths (npm) GHSA-7hpm-7845-8cr6, MAL-2026-6901 | Malicious | Not scored | 06 Jul, 2026 | npm vite-plugin-svg-paths |
Malicious release: Malicious code in winston-js-express (npm) GHSA-fhrx-mrfp-3fvg, MAL-2026-6904 | Malicious | Not scored | 06 Jul, 2026 | npm winston-js-express |
Malicious release: Malicious code in tailwindcss-animatecss-latest (npm) GHSA-cjj7-4xf8-fgf8, MAL-2026-6888 | Malicious | Not scored | 06 Jul, 2026 | npm tailwindcss-animatecss-latest |
Malicious release: Malicious code in windrule-utils (npm) GHSA-3qh2-hc9r-frmf, MAL-2026-6903 | Malicious | Not scored | 06 Jul, 2026 | npm windrule-utils |
Malicious release: Malicious code in tailwindcss-fonttypo-inter (npm) GHSA-c37g-65pv-vg82, MAL-2026-6890 | Malicious | Not scored | 06 Jul, 2026 | npm tailwindcss-fonttypo-inter |
Malicious release: Malicious code in twcompose-utils (npm) GHSA-pc7p-pxpj-3cw5, MAL-2026-6899 | Malicious | Not scored | 06 Jul, 2026 | npm twcompose-utils |
Malicious release: Malicious code in renderctx (npm) GHSA-jq76-fhr4-3987, MAL-2026-6871 | Malicious | Not scored | 06 Jul, 2026 | npm renderctx |
Malicious release: Malicious code in txs-data (npm) GHSA-w5pf-vc8f-rv6r, MAL-2026-6900 | Malicious | Not scored | 06 Jul, 2026 | npm txs-data |
Malicious release: Malicious code in ts-lint-builders (npm) GHSA-5mvf-x573-2gv4, MAL-2026-6897 | Malicious | Not scored | 06 Jul, 2026 | npm ts-lint-builders |
Malicious release: Malicious code in ts-eslinter (npm) GHSA-h269-vrf6-9f75, MAL-2026-6896 | Malicious | Not scored | 06 Jul, 2026 | npm ts-eslinter |
Malicious release: Malicious code in rma-utils (npm) GHSA-c633-xc97-ch23, MAL-2026-6872 | Malicious | Not scored | 06 Jul, 2026 | npm rma-utils |
Malicious release: Malicious code in ts-relayer-pub (npm) GHSA-crww-p6q9-g9px, MAL-2026-6898 | Malicious | Not scored | 06 Jul, 2026 | npm ts-relayer-pub |
Malicious release: Malicious code in competion (npm) GHSA-pjm5-4wrj-r328, MAL-2026-6832 | Malicious | Not scored | 06 Jul, 2026 | npm competion |
Malicious release: Malicious code in ts-bigtn (npm) GHSA-7mfc-w2gr-ggj9, MAL-2026-6895 | Malicious | Not scored | 06 Jul, 2026 | npm ts-bigtn |
Malicious release: Malicious code in color-cli-log (npm) GHSA-57f7-j94v-w2hw, MAL-2026-6830 | Malicious | Not scored | 06 Jul, 2026 | npm color-cli-log |
Malicious release: Malicious code in test-prettier (npm) GHSA-6h3j-xcmr-vmwx, MAL-2026-6893 | Malicious | Not scored | 06 Jul, 2026 | npm test-prettier |