Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @gm-rvg/root-config (npm) GHSA-9crf-2vxq-9j4r, MAL-2026-6624 | Malicious | Not scored | 29 Jun, 2026 | npm @gm-rvg/root-config |
Malicious release: Malicious code in ltididp1 (npm) GHSA-9h22-6cpc-frhc, MAL-2026-6665 | Malicious | Not scored | 29 Jun, 2026 | npm ltididp1 |
Malicious release: Malicious code in @huobi-ui/activity-components (npm) GHSA-h7hg-5749-jc66, MAL-2026-6627 | Malicious | Not scored | 29 Jun, 2026 | npm @huobi-ui/activity-components |
Malicious release: Malicious code in @finantix/webcomponents (npm) GHSA-hf7q-222g-654m, MAL-2026-6620 | Malicious | Not scored | 29 Jun, 2026 | npm @finantix/webcomponents |
Malicious release: Malicious code in alpine-csp (npm) GHSA-pxvr-mwhw-mp36, MAL-2026-6653 | Malicious | Not scored | 29 Jun, 2026 | npm alpine-csp |
Malicious release: Malicious code in @lexisnexisrisk/insider-threat-platform (npm) GHSA-q77j-rhqv-28m6, MAL-2026-6629 | Malicious | Not scored | 29 Jun, 2026 | npm @lexisnexisrisk/insider-threat-platform |
Malicious release: Malicious code in @experian-shared/services (npm) GHSA-vhf7-5xf6-3fwr, MAL-2026-6618 | Malicious | Not scored | 29 Jun, 2026 | npm @experian-shared/services |
Malicious release: Malicious code in @anna-money/anna-web-lib (npm) GHSA-f2cq-vvgf-2rrx, MAL-2026-6600 | Malicious | Not scored | 29 Jun, 2026 | npm @anna-money/anna-web-lib |
Malicious release: Malicious code in gel-bootstrap (npm) GHSA-mpx3-rr48-f744, MAL-2026-6663 | Malicious | Not scored | 29 Jun, 2026 | npm gel-bootstrap |
Malicious release: Malicious code in @sumoinc/trashpanda (npm) GHSA-278w-vxfg-j6q2, MAL-2026-6650 | Malicious | Not scored | 29 Jun, 2026 | npm @sumoinc/trashpanda |
Malicious release: Malicious code in player-core-ui (npm) GHSA-6x4r-gq74-hx6w, MAL-2026-6667 | Malicious | Not scored | 29 Jun, 2026 | npm player-core-ui |
Malicious release: Malicious code in magwien.sys (npm) GHSA-7rgq-99ww-vfgr, MAL-2026-6666 | Malicious | Not scored | 29 Jun, 2026 | npm magwien.sys |
Malicious release: Malicious code in @grappi/automations (npm) GHSA-85ph-rvjg-3hmr, MAL-2026-6625 | Malicious | Not scored | 29 Jun, 2026 | npm @grappi/automations |
Malicious release: Malicious code in cdocs-markdoc (npm) GHSA-8g7g-fgv9-26pp, MAL-2026-6660 | Malicious | Not scored | 29 Jun, 2026 | npm cdocs-markdoc |
Malicious release: Malicious code in @gartnerx/gx-npm-messenger-util (npm) GHSA-9vfc-98mc-g3p5, MAL-2026-6623 | Malicious | Not scored | 29 Jun, 2026 | npm @gartnerx/gx-npm-messenger-util |
Malicious release: Malicious code in @shopbop/api-models (npm) GHSA-g6vr-6p3c-gj3x, MAL-2026-6648 | Malicious | Not scored | 29 Jun, 2026 | npm @shopbop/api-models |
Malicious release: Malicious code in wac-atl-context (npm) GHSA-hx4g-w4gr-x32f, MAL-2026-6671 | Malicious | Not scored | 29 Jun, 2026 | npm wac-atl-context |
Malicious release: Malicious code in player-theming (npm) GHSA-j229-wx6p-5j43, MAL-2026-6668 | Malicious | Not scored | 29 Jun, 2026 | npm player-theming |
Malicious release: Malicious code in cdocs-data (npm) GHSA-p3xv-2mwp-fx36, MAL-2026-6659 | Malicious | Not scored | 29 Jun, 2026 | npm cdocs-data |
Malicious release: Malicious code in @bapiweb-ux/bapi-header (npm) GHSA-q8qh-2q32-qvc7, MAL-2026-6602 | Malicious | Not scored | 29 Jun, 2026 | npm @bapiweb-ux/bapi-header |
Malicious release: Malicious code in cmp-api-stub (npm) GHSA-q9xg-g7r9-mqrx, MAL-2026-6662 | Malicious | Not scored | 29 Jun, 2026 | npm cmp-api-stub |
Malicious release: Malicious code in app-hotmart-blog-headless (npm) GHSA-vq57-p4j4-v553, MAL-2026-6654 | Malicious | Not scored | 29 Jun, 2026 | npm app-hotmart-blog-headless |
Malicious release: Malicious code in rc-icon (npm) GHSA-vr47-669q-c6p5, MAL-2026-6670 | Malicious | Not scored | 29 Jun, 2026 | npm rc-icon |
Malicious release: Malicious code in @mcconnect/mcc-common-lib (npm) GHSA-xpr4-wg5r-33c8, MAL-2026-6631 | Malicious | Not scored | 29 Jun, 2026 | npm @mcconnect/mcc-common-lib |
Malicious release: Malicious code in pvd3 (npm) GHSA-4m95-g5w6-4x4w, MAL-2026-6669 | Malicious | Not scored | 29 Jun, 2026 | npm pvd3 |
Malicious release: Malicious code in hrb-cas-auth-js (npm) GHSA-fvhw-928m-gxmw, MAL-2026-6664 | Malicious | Not scored | 29 Jun, 2026 | npm hrb-cas-auth-js |
Malicious release: Malicious code in @flipbit2-bb/scope-test (npm) GHSA-5782-j92p-q2m3, MAL-2026-6621 | Malicious | Not scored | 29 Jun, 2026 | npm @flipbit2-bb/scope-test |
Malicious release: Malicious code in clx-cookieparser (npm) GHSA-jpg2-3r22-63v7, MAL-2026-6661 | Malicious | Not scored | 29 Jun, 2026 | npm clx-cookieparser |
Malicious release: Malicious code in bundrix (npm) GHSA-vrw9-m2mj-2fp9, MAL-2026-6658 | Malicious | Not scored | 29 Jun, 2026 | npm bundrix |
Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution CVE-2026-55607, GHSA-7835-87q9-rgvv | High | 0.7% | 29 Jun, 2026 | npm @anthropic-ai/claude-code |
fast-uri vulnerable to host confusion via failed IDN canonicalization CVE-2026-13676, GHSA-4c8g-83qw-93j6 | High | 0.7% | 29 Jun, 2026 | npm fast-uri |
Malicious release: Malicious code in auth-state-service (npm) GHSA-53ph-27qg-w52c, MAL-2026-6655 | Malicious | Not scored | 29 Jun, 2026 | npm auth-state-service |
Malicious release: Malicious code in authsessionbridge (npm) GHSA-m936-8h93-fqm9, MAL-2026-6657 | Malicious | Not scored | 29 Jun, 2026 | npm authsessionbridge |
Malicious release: Malicious code in authmatrix (npm) GHSA-qr38-fjw7-r54v, MAL-2026-6656 | Malicious | Not scored | 29 Jun, 2026 | npm authmatrix |
Malicious release: Malicious code in vkzmn (npm) GHSA-96mc-pfwc-4h47, MAL-2026-6594 | Malicious | Not scored | 29 Jun, 2026 | npm vkzmn |
Malicious release: Malicious code in maplibre-gl-vue3 (npm) MAL-2026-6592 | Malicious | Not scored | 29 Jun, 2026 | npm maplibre-gl-vue3 |
Malicious release: Malicious code in endpointmap (npm) GHSA-p3qr-5g48-8w89, MAL-2026-6588 | Malicious | Not scored | 29 Jun, 2026 | npm endpointmap |
Malicious release: Malicious code in envfile-sync (npm) MAL-2026-6589 | Malicious | Not scored | 29 Jun, 2026 | npm envfile-sync |
Malicious release: Malicious code in envfile-sync-cli (npm) GHSA-7f8c-p7q8-mw86, MAL-2026-6590 | Malicious | Not scored | 29 Jun, 2026 | npm envfile-sync-cli |
Malicious release: Malicious code in clob-client-math (npm) MAL-2026-6587 | Malicious | Not scored | 29 Jun, 2026 | npm clob-client-math |
Malicious release: Malicious code in ledgerflow-deploy-utils (npm) MAL-2026-6591 | Malicious | Not scored | 29 Jun, 2026 | npm ledgerflow-deploy-utils |
Malicious release: Malicious code in loadutils (npm) GHSA-mvpj-6xxg-pjm9, MAL-2026-6580 | Malicious | Not scored | 29 Jun, 2026 | npm loadutils |
Malicious release: Malicious code in layerd-unit-codec-parser (npm) GHSA-3h97-jj75-q7j4, MAL-2026-6578 | Malicious | Not scored | 29 Jun, 2026 | npm layerd-unit-codec-parser |
Malicious release: Malicious code in pino-debugging (npm) GHSA-jwq5-g2xm-r48w, MAL-2026-6583 | Malicious | Not scored | 29 Jun, 2026 | npm pino-debugging |
Malicious release: Malicious code in openai-agents-helpers (npm) GHSA-3mxc-g5f6-qr8c, MAL-2026-6582 | Malicious | Not scored | 29 Jun, 2026 | npm openai-agents-helpers |
Malicious release: Malicious code in poly-kelly (npm) GHSA-c37j-v3j2-6gf8, MAL-2026-6584 | Malicious | Not scored | 29 Jun, 2026 | npm poly-kelly |
Malicious release: Malicious code in checkmarx-claude-cache (npm) MAL-2026-6576 | Malicious | Not scored | 29 Jun, 2026 | npm checkmarx-claude-cache |
Malicious release: Malicious code in ollama-helpers (npm) GHSA-73pg-hv45-6r54, MAL-2026-6581 | Malicious | Not scored | 29 Jun, 2026 | npm ollama-helpers |
Malicious release: Malicious code in int_sezzle_sfra (npm) MAL-2026-6577 | Malicious | Not scored | 29 Jun, 2026 | npm int_sezzle_sfra |
Malicious release: Malicious code in stake-math (npm) GHSA-qcc9-j6wh-4h9h, MAL-2026-6585 | Malicious | Not scored | 29 Jun, 2026 | npm stake-math |