Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in date-format-helper2 (npm) GHSA-j29f-62x7-hj66, MAL-2026-6301 | Malicious | Not scored | 23 Jun, 2026 | npm date-format-helper2 |
Malicious release: Malicious code in react-simple-utils-kit (npm) GHSA-9p56-xfq3-77x5, MAL-2026-6303 | Malicious | Not scored | 23 Jun, 2026 | npm react-simple-utils-kit |
Malicious release: Malicious code in @outmarket/utils (npm) GHSA-7f28-77wf-r7r3, MAL-2026-6292 | Malicious | Not scored | 23 Jun, 2026 | npm @outmarket/utils |
Malicious release: Malicious code in @outmarket/ui (npm) MAL-2026-6291 | Malicious | Not scored | 23 Jun, 2026 | npm @outmarket/ui |
Malicious release: Malicious code in airbnb-airlock (npm) GHSA-mx2w-2q79-99vv, MAL-2026-6293 | Malicious | Not scored | 23 Jun, 2026 | npm airbnb-airlock |
Malicious release: Malicious code in ttal2ttml (npm) GHSA-w5q2-92ww-m4jv, MAL-2026-6298 | Malicious | Not scored | 23 Jun, 2026 | npm ttal2ttml |
Malicious release: Malicious code in kdrive-utils (npm) GHSA-v9x6-7mvw-mf22, MAL-2026-6295 | Malicious | Not scored | 23 Jun, 2026 | npm kdrive-utils |
Malicious release: Malicious code in cue-mcp (npm) MAL-2026-6294 | Malicious | Not scored | 23 Jun, 2026 | npm cue-mcp |
Malicious release: Malicious code in tree-sitter-forth (npm) MAL-2026-6297 | Malicious | Not scored | 23 Jun, 2026 | npm tree-sitter-forth |
Malicious release: Malicious code in myebaynode (npm) GHSA-8wcq-62gv-fp9f, MAL-2026-6296 | Malicious | Not scored | 23 Jun, 2026 | npm myebaynode |
Malicious release: Malicious code in new-helper (npm) GHSA-26mv-fx88-4qj7, MAL-2026-6284 | Malicious | Not scored | 23 Jun, 2026 | npm new-helper |
Malicious release: Malicious code in new-ecro-helper (npm) GHSA-85xv-pw78-4hqp, MAL-2026-6283 | Malicious | Not scored | 23 Jun, 2026 | npm new-ecro-helper |
Malicious release: Malicious code in new-solt-1 (npm) GHSA-9jrq-rph3-6qqm, MAL-2026-6286 | Malicious | Not scored | 23 Jun, 2026 | npm new-solt-1 |
Malicious release: Malicious code in poly-utils (npm) GHSA-ffmg-f668-6cj8, MAL-2026-6287 | Malicious | Not scored | 23 Jun, 2026 | npm poly-utils |
Malicious release: Malicious code in new-solt (npm) GHSA-mvjp-c9p2-37jx, MAL-2026-6285 | Malicious | Not scored | 23 Jun, 2026 | npm new-solt |
Malicious release: Malicious code in ts-numbering (npm) GHSA-fvpj-9j2j-grmr, MAL-2026-6288 | Malicious | Not scored | 23 Jun, 2026 | npm ts-numbering |
Malicious release: Malicious code in local-ip-helper (npm) GHSA-xg4m-w887-cp89, MAL-2026-6282 | Malicious | Not scored | 23 Jun, 2026 | npm local-ip-helper |
Malicious release: Malicious code in libsignal-node-travatiger (npm) GHSA-j2x4-j4hc-mvcv, MAL-2026-6281 | Malicious | Not scored | 23 Jun, 2026 | npm libsignal-node-travatiger |
Malicious release: Malicious code in ts-wross (npm) GHSA-53h7-mc3v-w73c, MAL-2026-6278 | Malicious | Not scored | 23 Jun, 2026 | npm ts-wross |
Malicious release: Malicious code in node-core-libs (npm) GHSA-6vr2-5hpq-589c, MAL-2026-6276 | Malicious | Not scored | 23 Jun, 2026 | npm node-core-libs |
Malicious release: Malicious code in search-from-search (npm) GHSA-fgqv-2jmm-2p39, MAL-2026-6277 | Malicious | Not scored | 23 Jun, 2026 | npm search-from-search |
expr-eval vulnerable to Code Execution CVE-2026-12866, GHSA-q9v2-7m5w-4693 | Critical | 0.9% | 23 Jun, 2026 | Maven org.webjars.npm:expr-eval npm expr-eval |
Malicious release: Malicious code in @ts-apis/ts-utils (npm) GHSA-3xmx-2xxv-rpfq, MAL-2026-6275 | Malicious | Not scored | 23 Jun, 2026 | npm @ts-apis/ts-utils |
@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields CVE-2026-50179, GHSA-xqjm-27pc-rvwm | Medium | 0.3% | 22 Jun, 2026 | npm @actual-app/web |
@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation CVE-2026-54353, GHSA-gfq7-5x4g-3xhf | High | 0.2% | 22 Jun, 2026 | npm @budibase/backend-core |
Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload CVE-2026-54352, GHSA-w7mq-r738-x278 | Critical | 0.5% | 22 Jun, 2026 | npm @budibase/server |
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override CVE-2026-54351, GHSA-rgvg-3wpc-h44p | Critical | 0.5% | 22 Jun, 2026 | npm @budibase/server |
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens CVE-2026-49229, GHSA-cq9c-6w48-qmfg | High | 0.3% | 22 Jun, 2026 | npm @actual-app/sync-server |
Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials CVE-2026-50137, GHSA-35c4-rvc8-frhm | High | 0.4% | 22 Jun, 2026 | npm @budibase/server |
Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials CVE-2026-50136, GHSA-jj36-r9w3-3pfh | High | 0.3% | 22 Jun, 2026 | npm @budibase/server |
Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF CVE-2026-50132, GHSA-v7j5-vc4m-723w | High | 0.2% | 22 Jun, 2026 | npm @budibase/server |
devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs GHSA-hvqh-jw65-wcpq | Medium | Not scored | 22 Jun, 2026 | npm devbridge-autocomplete |
scimPatch vulnerable to prototype pollution via unfiltered keys in patch CVE-2026-48170, GHSA-9m6g-wc8r-q59c | Critical | 0.4% | 22 Jun, 2026 | npm scim-patch |
Malicious release: Malicious code in web3-token-helper (npm) GHSA-3w2v-mxgh-g2fw, MAL-2026-6274 | Malicious | Not scored | 22 Jun, 2026 | npm web3-token-helper |
Malicious release: Malicious code in zod-pino (npm) GHSA-q52v-x293-p999, MAL-2026-6273 | Malicious | Not scored | 22 Jun, 2026 | npm zod-pino |
@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets CVE-2026-46700, GHSA-3f62-qv96-4p78 | Medium | 0.3% | 22 Jun, 2026 | npm @actual-app/sync-server |
@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper CVE-2026-46672, GHSA-7gh7-258j-4mpq | Medium | 0.2% | 22 Jun, 2026 | npm @actual-app/cli |
Malicious release: Malicious code in @variational/common-ui (npm) MAL-2026-6272 | Malicious | Not scored | 22 Jun, 2026 | npm @variational/common-ui |
Malicious release: Malicious code in node-fetch-utils (npm) GHSA-4jfq-h5q8-g7hm, MAL-2026-6271 | Malicious | Not scored | 22 Jun, 2026 | npm node-fetch-utils |
Malicious release: Malicious code in vitest-cli (npm) GHSA-c35r-fwrq-cgq9, MAL-2026-6267 | Malicious | Not scored | 22 Jun, 2026 | npm vitest-cli |
Malicious release: Malicious code in zomato-espresso (npm) MAL-2026-6269 | Malicious | Not scored | 22 Jun, 2026 | npm zomato-espresso |
Malicious release: Malicious code in zomato-mcp (npm) MAL-2026-6270 | Malicious | Not scored | 22 Jun, 2026 | npm zomato-mcp |
Malicious release: Malicious code in zomato-core (npm) MAL-2026-6268 | Malicious | Not scored | 22 Jun, 2026 | npm zomato-core |
Malicious release: Malicious code in sn-internal-testjgsakjdkjadkjah (npm) MAL-2026-6265 | Malicious | Not scored | 22 Jun, 2026 | npm sn-internal-testjgsakjdkjadkjah |
Malicious release: Malicious code in test-package-sajsdkashdj (npm) MAL-2026-6266 | Malicious | Not scored | 22 Jun, 2026 | npm test-package-sajsdkashdj |
Malicious release: Malicious code in search-from-feed (npm) MAL-2026-6264 | Malicious | Not scored | 22 Jun, 2026 | npm search-from-feed |
Malicious release: Malicious code in gd-auth-client (npm) MAL-2026-6263 | Malicious | Not scored | 22 Jun, 2026 | npm gd-auth-client |
Malicious release: Malicious code in crud-respect (npm) GHSA-4p36-4jp8-8rx5, MAL-2026-6257 | Malicious | Not scored | 22 Jun, 2026 | npm crud-respect |
Malicious release: Malicious code in respects-switch (npm) GHSA-4xcj-2v9f-vmqv, MAL-2026-6259 | Malicious | Not scored | 22 Jun, 2026 | npm respects-switch |
Malicious release: Malicious code in onboarding-respects-modal (npm) GHSA-7mh9-j98m-ccvj, MAL-2026-6258 | Malicious | Not scored | 22 Jun, 2026 | npm onboarding-respects-modal |