Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
`nx graph` dev server permissive CORS policy CVE-2026-54753, GHSA-g2r8-wvmj-jf5w | Medium | 1.4% | 26 Jun, 2026 | npm nx |
@sigstore/core has DSSE payloadType type-binding failure CVE-2026-48758, GHSA-jfc7-64v2-mr8c | Medium | 0.2% | 26 Jun, 2026 | npm @sigstore/core |
Malicious release: Malicious code in disksweep (npm) GHSA-257r-h9h2-65xg, MAL-2026-6535 | Malicious | Not scored | 26 Jun, 2026 | npm disksweep |
Malicious release: Malicious code in @appupdate/cdn-sync (npm) MAL-2026-6531 | Malicious | Not scored | 26 Jun, 2026 | npm @appupdate/cdn-sync |
extract-zip unvalidated symlink path traversal CVE-2026-56876, GHSA-jmr9-qjv8-65gv | High | 0.5% | 26 Jun, 2026 | npm extract-zip |
Malicious release: Malicious code in react-dynamic-table-compenent (npm) GHSA-gv99-2c4m-pr2c, MAL-2026-6533 | Malicious | Not scored | 26 Jun, 2026 | npm react-dynamic-table-compenent |
Malicious release: Malicious code in chai-as-assured (npm) GHSA-m282-3m8c-qjwj, MAL-2026-6532 | Malicious | Not scored | 26 Jun, 2026 | npm chai-as-assured |
Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts CVE-2026-11779, GHSA-jg8r-5jh2-v2xj | Medium | 0.4% | 26 Jun, 2026 | npm payload |
Malicious release: Malicious code in xrblocks-remote-control (npm) GHSA-24xr-qqmw-jvvf, MAL-2026-6530 | Malicious | Not scored | 26 Jun, 2026 | npm xrblocks-remote-control |
Malicious release: Malicious code in react-dynammic-table-component (npm) GHSA-rghg-wjq8-jq2g, MAL-2026-6534 | Malicious | Not scored | 26 Jun, 2026 | npm react-dynammic-table-component |
Malicious release: Malicious code in @immobiliarelabs/backstage-plugin-gitlab-backend (npm) MAL-2026-6527 | Malicious | Not scored | 26 Jun, 2026 | npm @immobiliarelabs/backstage-plugin-gitlab-backend |
Malicious release: Malicious code in @immobiliarelabs/backstage-plugin-ldap-auth-backend (npm) MAL-2026-6529 | Malicious | Not scored | 26 Jun, 2026 | npm @immobiliarelabs/backstage-plugin-ldap-auth-backend |
Malicious release: Malicious code in @immobiliarelabs/backstage-plugin-ldap-auth (npm) MAL-2026-6528 | Malicious | Not scored | 26 Jun, 2026 | npm @immobiliarelabs/backstage-plugin-ldap-auth |
Malicious release: Malicious code in @immobiliarelabs/backstage-plugin-gitlab (npm) GHSA-r4r5-rj2h-xfvg, MAL-2026-6526 | Malicious | Not scored | 26 Jun, 2026 | npm @immobiliarelabs/backstage-plugin-gitlab |
Malicious release: Malicious code in @carvana.authentication-flows/shared (npm) MAL-2026-6521 | Malicious | Not scored | 26 Jun, 2026 | npm @carvana.authentication-flows/shared |
Malicious release: Malicious code in express-plugin (npm) MAL-2026-6523 | Malicious | Not scored | 26 Jun, 2026 | npm express-plugin |
Malicious release: Malicious code in ts-einkle (npm) GHSA-mjcv-m7fg-mg8j, MAL-2026-6524 | Malicious | Not scored | 26 Jun, 2026 | npm ts-einkle |
Malicious release: Malicious code in ts-einkle-slot (npm) GHSA-8cxx-rp6g-mcr9, MAL-2026-6525 | Malicious | Not scored | 26 Jun, 2026 | npm ts-einkle-slot |
Malicious release: Malicious code in @epsteinlovekids483/crossmint-wallets-sdk-pentest (npm) GHSA-x7jg-w433-8q2r, MAL-2026-6522 | Malicious | Not scored | 26 Jun, 2026 | npm @epsteinlovekids483/crossmint-wallets-sdk-pentest |
Malicious release: Malicious code in react-icon-svgs (npm) GHSA-3462-7h42-6cvg, MAL-2026-6519 | Malicious | Not scored | 26 Jun, 2026 | npm react-icon-svgs |
Malicious release: Malicious code in rollup-plugin-polyfill-connect (npm) GHSA-97cf-xxww-v429, MAL-2026-6520 | Malicious | Not scored | 26 Jun, 2026 | npm rollup-plugin-polyfill-connect |
Malicious release: Malicious code in ai-node-relay (npm) GHSA-25p7-8xj5-25qp, MAL-2026-6518 | Malicious | Not scored | 26 Jun, 2026 | npm ai-node-relay |
Malicious release: Malicious code in ai-node-agent (npm) GHSA-w537-2cgp-4x64, MAL-2026-6517 | Malicious | Not scored | 26 Jun, 2026 | npm ai-node-agent |
Malicious release: Malicious code in dtxto1ols (npm) MAL-2026-6513 | Malicious | Not scored | 26 Jun, 2026 | npm dtxto1ols |
Malicious release: Malicious code in dtxtools (npm) MAL-2026-6514 | Malicious | Not scored | 26 Jun, 2026 | npm dtxtools |
Malicious release: Malicious code in @merceas/cross-fetch (npm) MAL-2026-6510 | Malicious | Not scored | 26 Jun, 2026 | npm @merceas/cross-fetch |
Malicious release: Malicious code in @merceas/anchor (npm) MAL-2026-6509 | Malicious | Not scored | 26 Jun, 2026 | npm @merceas/anchor |
Malicious release: Malicious code in react-context-form-tdsss (npm) GHSA-pg33-6m24-4p63, MAL-2026-6512 | Malicious | Not scored | 26 Jun, 2026 | npm react-context-form-tdsss |
Malicious release: Malicious code in tw-style-utils (npm) GHSA-75cr-ggc5-8h7g, MAL-2026-6508 | Malicious | Not scored | 26 Jun, 2026 | npm tw-style-utils |
Malicious release: Malicious code in pump-stream-logger (npm) GHSA-64m4-w85f-wrjj, MAL-2026-6507 | Malicious | Not scored | 26 Jun, 2026 | npm pump-stream-logger |
Malicious release: Malicious code in pump-laserstream-parser (npm) GHSA-cwr6-c222-8hwf, MAL-2026-6506 | Malicious | Not scored | 26 Jun, 2026 | npm pump-laserstream-parser |
Malicious release: Malicious code in pino-zod (npm) GHSA-j7hj-qc4f-x92f, MAL-2026-6505 | Malicious | Not scored | 26 Jun, 2026 | npm pino-zod |
Malicious release: Malicious code in hydanlabs (npm) MAL-2026-6511 | Malicious | Not scored | 26 Jun, 2026 | npm hydanlabs |
Malicious release: Malicious code in js-price-client-node (npm) MAL-2026-6503 | Malicious | Not scored | 26 Jun, 2026 | npm js-price-client-node |
Malicious release: Malicious code in js-client-node (npm) GHSA-x7hp-6x9v-c662, MAL-2026-6502 | Malicious | Not scored | 26 Jun, 2026 | npm js-client-node |
Malicious release: Malicious code in dttfdsdee (npm) MAL-2026-6498 | Malicious | Not scored | 26 Jun, 2026 | npm dttfdsdee |
Malicious release: Malicious code in chai-as-synced (npm) GHSA-3m37-26mh-fj77, MAL-2026-6497 | Malicious | Not scored | 26 Jun, 2026 | npm chai-as-synced |
Malicious release: Malicious code in set-cookie-ease (npm) MAL-2026-6500 | Malicious | Not scored | 26 Jun, 2026 | npm set-cookie-ease |
Malicious release: Malicious code in mongoose-json-format (npm) GHSA-8fxp-pghh-7w6w, MAL-2026-6499 | Malicious | Not scored | 26 Jun, 2026 | npm mongoose-json-format |
Malicious release: Malicious code in @dervix/ws (npm) GHSA-4mc4-4rf2-2cm6, MAL-2026-6496 | Malicious | Not scored | 26 Jun, 2026 | npm @dervix/ws |
Malicious release: Malicious code in wellnpm (npm) GHSA-2gh4-jhh2-625m, MAL-2026-6501 | Malicious | Not scored | 26 Jun, 2026 | npm wellnpm |
Malicious release: Malicious code in animatecss-postcss-plugin (npm) GHSA-p6ch-cw7w-ff5c, MAL-2026-6495 | Malicious | Not scored | 26 Jun, 2026 | npm animatecss-postcss-plugin |
Malicious release: Malicious code in @help-forms/application-aff (npm) MAL-2026-6494 | Malicious | Not scored | 26 Jun, 2026 | npm @help-forms/application-aff |
Malicious release: Malicious code in data-parser-utils (npm) GHSA-vw6q-xg53-fpxh, MAL-2026-6490 | Malicious | Not scored | 26 Jun, 2026 | npm data-parser-utils |
Malicious release: Malicious code in prism-silq (npm) GHSA-6hp6-2792-v6q5, MAL-2026-6493 | Malicious | Not scored | 26 Jun, 2026 | npm prism-silq |
Malicious release: Malicious code in hexo-shoka-swiper (npm) GHSA-vwrj-pprq-gjvq, MAL-2026-6492 | Malicious | Not scored | 26 Jun, 2026 | npm hexo-shoka-swiper |
Malicious release: Malicious code in hexo-deployer-wrangler (npm) GHSA-vx8x-rr42-fwhx, MAL-2026-6491 | Malicious | Not scored | 26 Jun, 2026 | npm hexo-deployer-wrangler |
Malicious release: Malicious code in random-string-64 (npm) GHSA-jp8q-gmj4-fx77, MAL-2026-6484 | Malicious | Not scored | 25 Jun, 2026 | npm random-string-64 |
Malicious release: Malicious code in kelly-stake (npm) GHSA-9x8c-c54x-vgrv, MAL-2026-6482 | Malicious | Not scored | 25 Jun, 2026 | npm kelly-stake |
Malicious release: Malicious code in gx-npm-lib (npm) GHSA-wcmr-4783-pq3p, MAL-2026-6480 | Malicious | Not scored | 25 Jun, 2026 | npm gx-npm-lib |