Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @flex-ng/header-component (npm) GHSA-4xgj-9m4q-8g8v, MAL-2026-10223 | Malicious | Not scored | 06 Jul, 2026 | npm @flex-ng/header-component |
Malicious release: Malicious code in tme-error (npm) GHSA-89rr-3jxw-7hhm, MAL-2026-10235 | Malicious | Not scored | 06 Jul, 2026 | npm tme-error |
Malicious release: Malicious code in enbd-react-lib (npm) GHSA-8g7r-j4vg-8w9q, MAL-2026-10230 | Malicious | Not scored | 06 Jul, 2026 | npm enbd-react-lib |
Malicious release: Malicious code in enbd-react-logger (npm) GHSA-96hr-p56w-4x2m, MAL-2026-10231 | Malicious | Not scored | 06 Jul, 2026 | npm enbd-react-logger |
Malicious release: Malicious code in box-react-uix (npm) GHSA-f4fv-qwcg-667v, MAL-2026-10227 | Malicious | Not scored | 06 Jul, 2026 | npm box-react-uix |
Malicious release: Malicious code in tme-xca-react (npm) GHSA-fh7f-j6p7-m9h7, MAL-2026-10237 | Malicious | Not scored | 06 Jul, 2026 | npm tme-xca-react |
Malicious release: Malicious code in @logdna-web/shared (npm) GHSA-fhg5-c6x3-mx25, MAL-2026-10225 | Malicious | Not scored | 06 Jul, 2026 | npm @logdna-web/shared |
Malicious release: Malicious code in enbd-react-error-boundry (npm) GHSA-jffm-72cc-xcwv, MAL-2026-10229 | Malicious | Not scored | 06 Jul, 2026 | npm enbd-react-error-boundry |
Malicious release: Malicious code in @flex-ng/error-component (npm) GHSA-pw64-8rr7-9h66, MAL-2026-10221 | Malicious | Not scored | 06 Jul, 2026 | npm @flex-ng/error-component |
Malicious release: Malicious code in @logdna-web/styles (npm) GHSA-qcrg-93h5-r265, MAL-2026-10226 | Malicious | Not scored | 06 Jul, 2026 | npm @logdna-web/styles |
Malicious release: Malicious code in zredis-typed (npm) GHSA-rmhj-j5m8-3cxj, MAL-2026-6944 | Malicious | Not scored | 06 Jul, 2026 | npm zredis-typed |
Malicious release: Malicious code in tme-xca (npm) GHSA-w846-5p2c-7hwq, MAL-2026-10236 | Malicious | Not scored | 06 Jul, 2026 | npm tme-xca |
Malicious release: Malicious code in gen-ai-opt-in (npm) GHSA-jwrj-q2c7-8g47, MAL-2026-6761 | Malicious | Not scored | 05 Jul, 2026 | npm gen-ai-opt-in |
Malicious release: Malicious code in wsh4-nmp (npm) GHSA-3wv5-4p57-2v5q, MAL-2026-6792 | Malicious | Not scored | 05 Jul, 2026 | npm wsh4-nmp |
Malicious release: Malicious code in @adobesign/as-dev-tools (npm) MAL-2026-6760 | Malicious | Not scored | 05 Jul, 2026 | npm @adobesign/as-dev-tools |
TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution CVE-2026-14722, GHSA-9hc2-hjx8-q6pv | Critical | 0.5% | 05 Jul, 2026 | npm tidgi |
Malicious release: Malicious code in fmt-date-lite (npm) MAL-2026-10115 | Malicious | Not scored | 05 Jul, 2026 | npm fmt-date-lite |
Malicious release: Malicious code in logger-daemon-regex (npm) MAL-2026-7017 | Malicious | Not scored | 05 Jul, 2026 | npm logger-daemon-regex |
Malicious release: Malicious code in vps-maintenance (npm) GHSA-qc5h-v3rf-5x95, MAL-2026-6756 | Malicious | Not scored | 04 Jul, 2026 | npm vps-maintenance |
Malicious release: Malicious code in vps-maintenance-paperclip-adapter (npm) GHSA-p3g7-2j36-j99x, MAL-2026-6757 | Malicious | Not scored | 04 Jul, 2026 | npm vps-maintenance-paperclip-adapter |
Malicious release: Malicious code in paperclip2 (npm) GHSA-27r8-2rjc-75rv, MAL-2026-6755 | Malicious | Not scored | 04 Jul, 2026 | npm paperclip2 |
Malicious release: Malicious code in datefmt-helper (npm) GHSA-ch48-496p-pfv8, MAL-2026-6788 | Malicious | Not scored | 04 Jul, 2026 | npm datefmt-helper |
Malicious release: Malicious code in debugcli (npm) GHSA-86fh-6m37-f9v4, MAL-2026-6790 | Malicious | Not scored | 03 Jul, 2026 | npm debugcli |
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header CVE-2026-14631, GHSA-m28w-2pqf-7qgj | Medium | 0.5% | 03 Jul, 2026 | npm webpack-dev-server |
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints CVE-2026-14620, GHSA-f5vj-f2hx-8m93 | Medium | 0.5% | 03 Jul, 2026 | npm webpack-dev-server |
Malicious release: Malicious code in typescript-util-core (npm) GHSA-84mg-p866-528x, MAL-2026-6746 | Malicious | Not scored | 03 Jul, 2026 | npm typescript-util-core |
Malicious release: Malicious code in web-api-node (npm) GHSA-j69c-7q52-h87f, MAL-2026-6747 | Malicious | Not scored | 03 Jul, 2026 | npm web-api-node |
Malicious release: Malicious code in ts-node-utils (npm) GHSA-mjvg-2r5j-mg76, MAL-2026-6745 | Malicious | Not scored | 03 Jul, 2026 | npm ts-node-utils |
Malicious release: Malicious code in api-ts-utils (npm) GHSA-3w2r-9f5g-prj8, MAL-2026-6744 | Malicious | Not scored | 03 Jul, 2026 | npm api-ts-utils |
Malicious release: Malicious code in api-node-utils (npm) GHSA-wj6w-3grq-735j, MAL-2026-6743 | Malicious | Not scored | 03 Jul, 2026 | npm api-node-utils |
Malicious release: Malicious code in alder_morrgan (npm) GHSA-j23f-jg9h-gjmc, MAL-2026-6742 | Malicious | Not scored | 03 Jul, 2026 | npm alder_morrgan |
Malicious release: Malicious code in @node-cloud/create (npm) GHSA-558p-3gxf-hm84, MAL-2026-6741 | Malicious | Not scored | 03 Jul, 2026 | npm @node-cloud/create |
Malicious release: Malicious code in @lodash-en/lodash-en (npm) GHSA-37qp-frv4-562v, MAL-2026-6739 | Malicious | Not scored | 03 Jul, 2026 | npm @lodash-en/lodash-en |
Malicious release: Malicious code in decode-sdks (npm) GHSA-gv37-287r-g9vx, MAL-2026-6740 | Malicious | Not scored | 03 Jul, 2026 | npm decode-sdks |
Malicious release: Malicious code in @jacobtan/decode-sdk (npm) GHSA-3mg6-vg6x-m62v, MAL-2026-6738 | Malicious | Not scored | 03 Jul, 2026 | npm @jacobtan/decode-sdk |
Malicious release: Malicious code in epic-internal-tools (npm) GHSA-wx8q-h5p5-9hcf, MAL-2026-6737 | Malicious | Not scored | 02 Jul, 2026 | npm epic-internal-tools |
Malicious release: Malicious code in ue-automation-scripts (npm) GHSA-g68g-mm68-67f5, MAL-2026-6730 | Malicious | Not scored | 02 Jul, 2026 | npm ue-automation-scripts |
9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING CVE-2026-49353, GHSA-6g2f-w7g3-77vf | High | 0.3% | 02 Jul, 2026 | npm 9router |
Malicious release: Malicious code in robomerge (npm) GHSA-x22f-73cv-vccx, MAL-2026-6729 | Malicious | Not scored | 02 Jul, 2026 | npm robomerge |
Malicious release: Malicious code in unreal-horde-dashboard (npm) GHSA-vwh3-m8vq-24r2, MAL-2026-6732 | Malicious | Not scored | 02 Jul, 2026 | npm unreal-horde-dashboard |
Malicious release: Malicious code in ue-jenkins-buildkite (npm) GHSA-8gxq-wrp7-qqv8, MAL-2026-6731 | Malicious | Not scored | 02 Jul, 2026 | npm ue-jenkins-buildkite |
9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass CVE-2026-49352, GHSA-jphh-m39h-6gwx | Critical | 0.6% | 02 Jul, 2026 | npm 9router |
Malicious release: Malicious code in @checkrhq/adjudication-api-client (npm) MAL-2026-6789 | Malicious | Not scored | 02 Jul, 2026 | npm @checkrhq/adjudication-api-client |
@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation GHSA-x4hg-hfwf-p9mw | Medium | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/nogginlessdom |
@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write GHSA-322x-v876-g883 | High | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/nogginlessdom |
9router: Missing Authorization and OS Command Injection CVE-2026-59800, GHSA-g6g7-pvmx-m74p | Critical | 2.1% | 02 Jul, 2026 | npm 9router |
@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration GHSA-gj2h-2fpw-fhv9 | Medium | Not scored | 02 Jul, 2026 | npm @nuxt/ui |
jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion CVE-2026-52746, GHSA-86vw-mfpg-wwv9 | High | 0.7% | 02 Jul, 2026 | npm jsonata |
Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR) GHSA-f9ff-5x35-7gfw | High | Not scored | 02 Jul, 2026 | npm @grackle-ai/auth npm @grackle-ai/mcp npm @grackle-ai/plugin-core |
electerm has Command Injection in File System Operations (rmrf, mv, cp) CVE-2026-49255, GHSA-v5ff-xmfp-p245 | High | 0.8% | 02 Jul, 2026 | npm electerm |