Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in polymarket-risk-manager (npm) GHSA-jcx2-q527-7qcx, MAL-2026-6712 | Malicious | Not scored | 01 Jul, 2026 | npm polymarket-risk-manager |
Malicious release: Malicious code in ts-clob-math-v2 (npm) MAL-2026-6719 | Malicious | Not scored | 01 Jul, 2026 | npm ts-clob-math-v2 |
Malicious release: Malicious code in ts-elinter (npm) MAL-2026-6720 | Malicious | Not scored | 01 Jul, 2026 | npm ts-elinter |
Malicious release: Malicious code in ts-eslint-helper (npm) GHSA-cr8h-v4vp-m4m8, MAL-2026-6721 | Malicious | Not scored | 01 Jul, 2026 | npm ts-eslint-helper |
sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced CVE-2026-48815, GHSA-52v5-jr5w-gjxr | High | 0.2% | 01 Jul, 2026 | npm sigstore |
sigstore-js has Insufficient Verification of Data Authenticity CVE-2026-48816, GHSA-xgjw-pm74-86q4 | Medium | 0.1% | 01 Jul, 2026 | npm @sigstore/verify |
aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling CVE-2026-13760, GHSA-vcrf-j523-4mrf | High | 1.2% | 01 Jul, 2026 | npm aws-cdk-lib |
Malicious release: Malicious code in vega-lite-next (npm) GHSA-3hv4-8cww-7p9f, MAL-2026-6709 | Malicious | Not scored | 01 Jul, 2026 | npm vega-lite-next |
Malicious release: Malicious code in vitest-agent (npm) GHSA-w2r4-4x6j-3h5x, MAL-2026-6710 | Malicious | Not scored | 01 Jul, 2026 | npm vitest-agent |
repomix: attach_packed_output can bypass file-read secret scanning for supported local files CVE-2026-49988, GHSA-hwpp-h97w-2h3j | Medium | 0.2% | 01 Jul, 2026 | npm repomix |
repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection CVE-2026-49987, GHSA-9mm9-rqhj-j5mx | High | 0.7% | 01 Jul, 2026 | npm repomix |
Malicious release: Malicious code in hardhat-plugin-solidity (npm) MAL-2026-6706 | Malicious | Not scored | 01 Jul, 2026 | npm hardhat-plugin-solidity |
Malicious release: Malicious code in hardhat-compile-ethers (npm) GHSA-rgq3-mp7r-3cq5, MAL-2026-6705 | Malicious | Not scored | 01 Jul, 2026 | npm hardhat-compile-ethers |
Malicious release: Malicious code in zyncmap (npm) MAL-2026-6708 | Malicious | Not scored | 01 Jul, 2026 | npm zyncmap |
Malicious release: Malicious code in svgson-lite (npm) GHSA-g7rx-jhhj-8whr, MAL-2026-6707 | Malicious | Not scored | 01 Jul, 2026 | npm svgson-lite |
Malicious release: Malicious code in base65-85x (npm) GHSA-mv5w-mcrv-wmx9, MAL-2026-6704 | Malicious | Not scored | 01 Jul, 2026 | npm base65-85x |
wetty vulnerable to DOM XSS via file-download filename CVE-2026-49864, GHSA-p26j-h7wj-r568 | High | 0.4% | 01 Jul, 2026 | npm wetty |
auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback CVE-2026-49857, GHSA-pvrj-8cg3-j5f8 | High | 0.5% | 01 Jul, 2026 | npm auth-fetch-mcp |
@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization CVE-2026-49856, GHSA-c5r6-m4mr-8q5j | Medium | 0.3% | 01 Jul, 2026 | npm @jshookmcp/jshook |
Malicious release: Malicious code in @andes-tools/colors (npm) MAL-2026-6703 | Malicious | Not scored | 01 Jul, 2026 | npm @andes-tools/colors |
Malicious release: Malicious code in npm-show-date-proof-strings (npm) MAL-2026-6791 | Malicious | Not scored | 01 Jul, 2026 | npm npm-show-date-proof-strings |
Malicious release: Malicious code in date-fns-lite (npm) MAL-2026-6722 | Malicious | Not scored | 01 Jul, 2026 | npm date-fns-lite |
Malicious release: Malicious code in node-pino (npm) GHSA-w294-7cjj-7mvg, MAL-2026-6762 | Malicious | Not scored | 01 Jul, 2026 | npm node-pino |
electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime` CVE-2026-54673, GHSA-p2f4-r6v6-j797 | High | 0.4% | 30 Jun, 2026 | npm builder-util-runtime |
electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib` CVE-2026-54672, GHSA-7g7r-gx96-252g | High | 0.2% | 30 Jun, 2026 | npm app-builder-lib |
Malicious release: Malicious code in ecto-corsair-flag-7kq3mz (npm) MAL-2026-6699 | Malicious | Not scored | 30 Jun, 2026 | npm ecto-corsair-flag-7kq3mz |
Malicious release: Malicious code in module-index-cache (npm) MAL-2026-6700 | Malicious | Not scored | 30 Jun, 2026 | npm module-index-cache |
Malicious release: Malicious code in ripshakti (npm) MAL-2026-6701 | Malicious | Not scored | 30 Jun, 2026 | npm ripshakti |
Malicious release: Malicious code in @sudoughnym/enviro-demo (npm) GHSA-77gf-97j3-jv6p, MAL-2026-6697 | Malicious | Not scored | 30 Jun, 2026 | npm @sudoughnym/enviro-demo |
Malicious release: Malicious code in @businessapp-microsites/apis (npm) GHSA-5x2m-5wc4-5j3c, MAL-2026-6696 | Malicious | Not scored | 30 Jun, 2026 | npm @businessapp-microsites/apis |
Malicious release: Malicious code in cursed-modules (npm) MAL-2026-6698 | Malicious | Not scored | 30 Jun, 2026 | npm cursed-modules |
@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754 CVE-2026-48795, GHSA-qcm7-3vpr-hj5h | High | 0.5% | 30 Jun, 2026 | npm @adonisjs/bodyparser |
@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation CVE-2026-49473, GHSA-g4w6-vmgf-xqvx | High | 0.5% | 30 Jun, 2026 | npm @cedar-policy/authorization-for-expressjs |
Malicious release: Malicious code in procwire (npm) GHSA-5r42-357x-f2mx, MAL-2026-6687 | Malicious | Not scored | 30 Jun, 2026 | npm procwire |
Malicious release: Malicious code in brock-react-alerts (npm) GHSA-gh2m-x2qr-m2cm, MAL-2026-6681 | Malicious | Not scored | 30 Jun, 2026 | npm brock-react-alerts |
Malicious release: Malicious code in brock-loader (npm) GHSA-gwv3-x257-r43c, MAL-2026-6680 | Malicious | Not scored | 30 Jun, 2026 | npm brock-loader |
Malicious release: Malicious code in quoting (npm) GHSA-x8q6-66jr-wmp3, MAL-2026-6685 | Malicious | Not scored | 30 Jun, 2026 | npm quoting |
Malicious release: Malicious code in setup-cicd (npm) GHSA-5rc3-r829-w347, MAL-2026-6686 | Malicious | Not scored | 30 Jun, 2026 | npm setup-cicd |
Malicious release: Malicious code in postcss-property-rollup (npm) GHSA-6g2x-2f5c-wp9w, MAL-2026-6684 | Malicious | Not scored | 30 Jun, 2026 | npm postcss-property-rollup |
Malicious release: Malicious code in nbmolviz-js (npm) GHSA-fc4r-p4fh-6h4p, MAL-2026-6683 | Malicious | Not scored | 30 Jun, 2026 | npm nbmolviz-js |
Malicious release: Malicious code in confluent-kafka-javascript (npm) GHSA-j28m-58xp-3wgh, MAL-2026-6682 | Malicious | Not scored | 30 Jun, 2026 | npm confluent-kafka-javascript |
Malicious release: Malicious code in agent-starter-pack (npm) GHSA-x676-qqgj-qfgg, MAL-2026-6679 | Malicious | Not scored | 30 Jun, 2026 | npm agent-starter-pack |
Malicious release: Malicious code in ts-linting-builder (npm) GHSA-8mpj-272v-jhv7, MAL-2026-6678 | Malicious | Not scored | 30 Jun, 2026 | npm ts-linting-builder |
Malicious release: Malicious code in ts-lint-builders-v2.1 (npm) GHSA-vjgf-xg3j-g9c5, MAL-2026-6677 | Malicious | Not scored | 30 Jun, 2026 | npm ts-lint-builders-v2.1 |
Malicious release: Malicious code in rs-biginteger (npm) GHSA-xm5w-w96q-42f3, MAL-2026-6675 | Malicious | Not scored | 30 Jun, 2026 | npm rs-biginteger |
Malicious release: Malicious code in terminal-prettier (npm) GHSA-m8cr-hv9p-pg3f, MAL-2026-6676 | Malicious | Not scored | 30 Jun, 2026 | npm terminal-prettier |
Malicious release: Malicious code in vue-demi-fix (npm) GHSA-p53q-mf26-4h26, MAL-2026-6702 | Malicious | Not scored | 30 Jun, 2026 | npm vue-demi-fix |
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | High | 0.4% | 30 Jun, 2026 | npm brace-expansion |
Malicious release: Malicious code in ripshakti1 (npm) MAL-2026-6674 | Malicious | Not scored | 30 Jun, 2026 | npm ripshakti1 |
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input CVE-2026-45822, GHSA-vcc3-ghjq-m6fr | Medium | 0.5% | 30 Jun, 2026 | npm decode-uri-component |