Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in gx-npm-lib (npm) GHSA-wcmr-4783-pq3p, MAL-2026-6480 | Malicious | Not scored | 25 Jun, 2026 | npm gx-npm-lib |
Malicious release: Malicious code in gx-npm-ui (npm) GHSA-5jpv-9x2f-72jj, MAL-2026-6481 | Malicious | Not scored | 25 Jun, 2026 | npm gx-npm-ui |
Malicious release: Malicious code in velocityfix (npm) GHSA-2736-v5cj-q9x5, MAL-2026-6487 | Malicious | Not scored | 25 Jun, 2026 | npm velocityfix |
Malicious release: Malicious code in log-update-ts (npm) GHSA-5866-j382-r7g9, MAL-2026-6483 | Malicious | Not scored | 25 Jun, 2026 | npm log-update-ts |
Malicious release: Malicious code in @salem_jalal/osc-components (npm) MAL-2026-6479 | Malicious | Not scored | 25 Jun, 2026 | npm @salem_jalal/osc-components |
Malicious release: Malicious code in unsafe-malicious-package (npm) GHSA-4gj3-wx83-w2hr, MAL-2026-6486 | Malicious | Not scored | 25 Jun, 2026 | npm unsafe-malicious-package |
Malicious release: Malicious code in starship-timeline (npm) GHSA-7c79-95c2-vgwm, MAL-2026-6485 | Malicious | Not scored | 25 Jun, 2026 | npm starship-timeline |
Malicious release: Malicious code in runtimekit (npm) GHSA-v6qq-vq5x-rmxf, MAL-2026-6477 | Malicious | Not scored | 25 Jun, 2026 | npm runtimekit |
Malicious release: Malicious code in ref-slot (npm) GHSA-fm4g-q7h6-hqjw, MAL-2026-6474 | Malicious | Not scored | 25 Jun, 2026 | npm ref-slot |
Malicious release: Malicious code in typedecode (npm) GHSA-wfg2-fj8h-rxj6, MAL-2026-6476 | Malicious | Not scored | 25 Jun, 2026 | npm typedecode |
Malicious release: Malicious code in textshape-css (npm) GHSA-pmmh-8m34-xxwh, MAL-2026-6475 | Malicious | Not scored | 25 Jun, 2026 | npm textshape-css |
Malicious release: Malicious code in colorpicker-ui (npm) MAL-2026-6473 | Malicious | Not scored | 25 Jun, 2026 | npm colorpicker-ui |
Malicious release: Malicious code in tailwind-color-shades (npm) MAL-2026-6471 | Malicious | Not scored | 25 Jun, 2026 | npm tailwind-color-shades |
Malicious release: Malicious code in tailwindcss-effector (npm) GHSA-5xpc-q26w-px3q, MAL-2026-6472 | Malicious | Not scored | 25 Jun, 2026 | npm tailwindcss-effector |
Malicious release: Malicious code in chlklib (npm) GHSA-pw26-7j7h-jhf5, MAL-2026-6470 | Malicious | Not scored | 25 Jun, 2026 | npm chlklib |
pnpm: `stage download` writes outside its destination directory via manifest name/version traversal CVE-2026-55700, GHSA-v23m-ccfg-pq9h | High | 0.4% | 25 Jun, 2026 | npm pnpm |
pnpm: Reserved bin name deletes PNPM_HOME during global remove CVE-2026-55699, GHSA-4gxm-v5v7-fqc4 | Medium | 0.4% | 25 Jun, 2026 | npm pnpm |
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes CVE-2026-55698, GHSA-w466-c33r-3gjp | High | 0.3% | 25 Jun, 2026 | npm pnpm |
pnpm: Repository-controlled configDependencies can select a pacquet native install engine CVE-2026-55697, GHSA-gj8w-mvpf-x27x | High | 0.2% | 25 Jun, 2026 | npm pnpm |
pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle CVE-2026-55487, GHSA-5wx6-mg75-v57r | High | 0.2% | 25 Jun, 2026 | npm pnpm |
pnpm: Repository config can expand victim environment secrets into registry requests before scripts run CVE-2026-55180, GHSA-3qhv-2rgh-x77r | Medium | 0.4% | 25 Jun, 2026 | npm pnpm |
pnpm: Unsafe default behavior breaks integrity check CVE-2026-50573, GHSA-54hh-g5mx-jqcp | High | 0.2% | 25 Jun, 2026 | npm pnpm |
pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field CVE-2026-50021, GHSA-q6j5-fjx5-2mc3 | High | 0.2% | 25 Jun, 2026 | npm pnpm |
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry CVE-2026-50017, GHSA-cjhr-43r9-cfmw | Medium | 0.4% | 25 Jun, 2026 | npm pnpm |
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement CVE-2026-50016, GHSA-hwx4-2j3j-g496 | High | 0.5% | 25 Jun, 2026 | npm pnpm |
pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) CVE-2026-50015, GHSA-rxhj-4m44-96r4 | High | 0.4% | 25 Jun, 2026 | npm pnpm |
pnpm: Git Fetch Argument Injection via Lockfile resolution.commit CVE-2026-50014, GHSA-p4xf-rf54-rj3x | High | 0.3% | 25 Jun, 2026 | npm pnpm |
pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile CVE-2026-48995, GHSA-hg3w-7f8c-63hp | Medium | 0.2% | 25 Jun, 2026 | npm pnpm |
Malicious release: Malicious code in ts-precision (npm) GHSA-g38h-2r6h-pwr8, MAL-2026-6469 | Malicious | Not scored | 25 Jun, 2026 | npm ts-precision |
Malicious release: Malicious code in ts-opus (npm) GHSA-xr76-fgrm-h52p, MAL-2026-6468 | Malicious | Not scored | 25 Jun, 2026 | npm ts-opus |
neotoma has tenant isolation gap in relationship query endpoints GHSA-wrr4-782v-jhwh | Low | Not scored | 25 Jun, 2026 | npm neotoma |
Malicious release: Malicious code in @vpms/design-system (npm) GHSA-43r2-9cx9-pv7f, MAL-2026-6467 | Malicious | Not scored | 25 Jun, 2026 | npm @vpms/design-system |
Malicious release: Malicious code in chai-as-built (npm) MAL-2026-6465 | Malicious | Not scored | 25 Jun, 2026 | npm chai-as-built |
Malicious release: Malicious code in gx-npm-feature-flags (npm) GHSA-hhw7-23r7-qwj7, MAL-2026-6466 | Malicious | Not scored | 25 Jun, 2026 | npm gx-npm-feature-flags |
Malicious release: Malicious code in @colibri-event-types/megamarket-ru-web (npm) MAL-2026-6464 | Malicious | Not scored | 25 Jun, 2026 | npm @colibri-event-types/megamarket-ru-web |
@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write CVE-2026-46406, GHSA-4vp2-6q8c-pvq2 | Medium | 0.2% | 25 Jun, 2026 | npm @anthropic-ai/claude-code |
Malicious release: Malicious code in abu-common-components (npm) MAL-2026-6463 | Malicious | Not scored | 25 Jun, 2026 | npm abu-common-components |
Malicious release: Malicious code in dttsdee (npm) MAL-2026-6462 | Malicious | Not scored | 25 Jun, 2026 | npm dttsdee |
Malicious release: Malicious code in easy-string-kit232 (npm) MAL-2026-6461 | Malicious | Not scored | 25 Jun, 2026 | npm easy-string-kit232 |
Malicious release: Malicious code in dddooo (npm) MAL-2026-6460 | Malicious | Not scored | 25 Jun, 2026 | npm dddooo |
Malicious release: Malicious code in easy-string-kit (npm) MAL-2026-6459 | Malicious | Not scored | 25 Jun, 2026 | npm easy-string-kit |
Malicious release: Malicious code in wp-codebox-workspace (npm) MAL-2026-6458 | Malicious | Not scored | 25 Jun, 2026 | npm wp-codebox-workspace |
Malicious release: Malicious code in simple-node-calc-c (npm) MAL-2026-6454 | Malicious | Not scored | 25 Jun, 2026 | npm simple-node-calc-c |
Malicious release: Malicious code in simple-node-calc-a (npm) MAL-2026-6451 | Malicious | Not scored | 25 Jun, 2026 | npm simple-node-calc-a |
Malicious release: Malicious code in simple-node-calc-b (npm) MAL-2026-6453 | Malicious | Not scored | 25 Jun, 2026 | npm simple-node-calc-b |
Malicious release: Malicious code in simple-node-calc-aa (npm) MAL-2026-6452 | Malicious | Not scored | 25 Jun, 2026 | npm simple-node-calc-aa |
Malicious release: Malicious code in simple-node-calc-ccc (npm) MAL-2026-6455 | Malicious | Not scored | 25 Jun, 2026 | npm simple-node-calc-ccc |
Malicious release: Malicious code in subsearch (npm) GHSA-45mm-476v-v2pf, MAL-2026-6457 | Malicious | Not scored | 25 Jun, 2026 | npm subsearch |
Malicious release: Malicious code in stitch-design (npm) MAL-2026-6456 | Malicious | Not scored | 25 Jun, 2026 | npm stitch-design |
Malicious release: Malicious code in based-32 (npm) MAL-2026-6447 | Malicious | Not scored | 25 Jun, 2026 | npm based-32 |