Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @mastra/loggers (npm) GHSA-f2m2-jq59-rvfm, MAL-2026-6072 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/loggers |
Malicious release: Malicious code in @mastra/redis (npm) GHSA-wg7r-3q89-x9q4, MAL-2026-6074 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/redis |
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent CVE-2026-9697, GHSA-vmh5-mc38-953g | High | 0.5% | 17 Jun, 2026 | npm undici |
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding CVE-2026-9679, GHSA-p88m-4jfj-68fv | Medium | 0.3% | 17 Jun, 2026 | npm undici |
undici vulnerable to cross-user information disclosure via shared cache whitespace bypass CVE-2026-9678, GHSA-pr7r-676h-xcf6 | Medium | 0.4% | 17 Jun, 2026 | npm undici |
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse CVE-2026-6734, GHSA-hm92-r4w5-c3mj | High | 0.3% | 17 Jun, 2026 | npm undici |
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse CVE-2026-6733, GHSA-35p6-xmwp-9g52 | Low | 0.2% | 17 Jun, 2026 | npm undici |
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching CVE-2026-11525, GHSA-g8m3-5g58-fq7m | Low | 0.2% | 17 Jun, 2026 | npm undici |
Malicious release: Malicious code in n8n-nodes-security-test-poc (npm) MAL-2026-6071 | Malicious | Not scored | 17 Jun, 2026 | npm n8n-nodes-security-test-poc |
Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch CVE-2026-54316, GHSA-fg94-h982-f3mm | Medium | 0.5% | 17 Jun, 2026 | npm @anthropic-ai/claude-code |
undici WebSocket client vulnerable to denial of service via cumulative fragment bypass CVE-2026-9675, GHSA-38rv-x7px-6hhq | High | 0.4% | 17 Jun, 2026 | npm undici |
undici WebSocket client vulnerable to denial of service via fragment count bypass CVE-2026-12151, GHSA-vxpw-j846-p89q | High | 0.8% | 17 Jun, 2026 | npm undici |
Malicious release: Malicious code in lab-services (npm) MAL-2026-6065 | Malicious | Not scored | 17 Jun, 2026 | npm lab-services |
Malicious release: Malicious code in scan-only (npm) GHSA-72g3-g9xj-wxp6, MAL-2026-6067 | Malicious | Not scored | 17 Jun, 2026 | npm scan-only |
Malicious release: Malicious code in swift-parse-stream (npm) GHSA-qcr2-hwcg-gf9g, MAL-2026-6068 | Malicious | Not scored | 17 Jun, 2026 | npm swift-parse-stream |
Malicious release: Malicious code in quirky-token (npm) GHSA-8p89-7m4q-45qm, MAL-2026-6066 | Malicious | Not scored | 17 Jun, 2026 | npm quirky-token |
NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint CVE-2026-53931, GHSA-hmcr-rmjq-47qr | Medium | 0.4% | 17 Jun, 2026 | npm nocodb |
NocoDB: Server-Side Request Forgery via Base Migration URL CVE-2026-53930, GHSA-h6vv-pcq8-7xm4 | Medium | 0.4% | 17 Jun, 2026 | npm nocodb |
NocoDB: Stored Cross-Site Scripting via Secure Attachment CVE-2026-53929, GHSA-6mhr-74x2-98v9 | Medium | 0.4% | 17 Jun, 2026 | npm nocodb |
NocoDB: Refresh Tokens Persist Through Password Recovery CVE-2026-53928, GHSA-r989-7g3j-wjhw | Medium | 0.4% | 17 Jun, 2026 | npm nocodb |
NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL CVE-2026-53927, GHSA-gprh-27j3-g5h4 | Medium | 0.4% | 17 Jun, 2026 | npm nocodb |
Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory CVE-2026-53765, GHSA-3pvj-jv98-qhjq | Medium | 0.1% | 17 Jun, 2026 | npm chrome-devtools-mcp |
n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints CVE-2026-56775, GHSA-664h-gpgq-h6xx | Medium | 0.3% | 17 Jun, 2026 | npm n8n |
Pi Agent: Pi loads project-local extensions without approval CVE-2026-54325, GHSA-mqxh-6gq7-558m | Medium | 0.2% | 17 Jun, 2026 | npm @earendil-works/pi-coding-agent |
Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts CVE-2026-54328, GHSA-jfgx-wxx8-mp94 | High | 0.2% | 17 Jun, 2026 | npm @earendil-works/pi-coding-agent npm @mariozechner/pi-coding-agent |
Pi Agent: Race condition in Pi auth.json writes could expose stored credentials CVE-2026-54327, GHSA-r95r-rj6r-c39x | Low | 0.1% | 17 Jun, 2026 | npm @earendil-works/pi-coding-agent npm @mariozechner/pi-coding-agent |
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication CVE-2026-48797, GHSA-f65r-h4g3-3h9h, PYSEC-2026-291 | Critical | 0.3% | 17 Jun, 2026 | PyPI backpropagate npm @mcptoolshop/backpropagate |
Malicious release: Malicious code in sodel-pych (npm) GHSA-4cgm-w872-8q5g, MAL-2026-6062 | Malicious | Not scored | 17 Jun, 2026 | npm sodel-pych |
Malicious release: Malicious code in @ignacionunez91/keccak24 (npm) GHSA-c9fj-mvvf-834r, MAL-2026-6058 | Malicious | Not scored | 17 Jun, 2026 | npm @ignacionunez91/keccak24 |
Malicious release: Malicious code in sort-btree (npm) GHSA-wwvg-mj5j-mqx8, MAL-2026-6063 | Malicious | Not scored | 17 Jun, 2026 | npm sort-btree |
Malicious release: Malicious code in qrcode-express (npm) GHSA-684f-7c48-5hhq, MAL-2026-6060 | Malicious | Not scored | 17 Jun, 2026 | npm qrcode-express |
Malicious release: Malicious code in qrcode-generator-node (npm) GHSA-8856-m673-rcwx, MAL-2026-6061 | Malicious | Not scored | 17 Jun, 2026 | npm qrcode-generator-node |
Malicious release: Malicious code in express-validates (npm) GHSA-qxgr-xx42-5g6p, MAL-2026-6059 | Malicious | Not scored | 17 Jun, 2026 | npm express-validates |
Malicious release: Malicious code in tailwindcss-animates-css (npm) GHSA-xwr3-cg53-gqv5, MAL-2026-6064 | Malicious | Not scored | 17 Jun, 2026 | npm tailwindcss-animates-css |
Malicious release: Malicious code in accordion-animationtiming-authorization (npm) MAL-2026-6145 | Malicious | Not scored | 17 Jun, 2026 | npm accordion-animationtiming-authorization |
Malicious release: Malicious code in actionbars-infinitescroll-searchbar (npm) MAL-2026-6146 | Malicious | Not scored | 17 Jun, 2026 | npm actionbars-infinitescroll-searchbar |
Malicious release: Malicious code in analytics-readability-gestures (npm) MAL-2026-6147 | Malicious | Not scored | 17 Jun, 2026 | npm analytics-readability-gestures |
Malicious release: Malicious code in async-protobuf-av (npm) MAL-2026-6148 | Malicious | Not scored | 17 Jun, 2026 | npm async-protobuf-av |
Malicious release: Malicious code in backgroundprocessing-contextmenus (npm) MAL-2026-6149 | Malicious | Not scored | 17 Jun, 2026 | npm backgroundprocessing-contextmenus |
Malicious release: Malicious code in barcodescanner-reconnect (npm) MAL-2026-6150 | Malicious | Not scored | 17 Jun, 2026 | npm barcodescanner-reconnect |
Malicious release: Malicious code in buildautomation-touch (npm) MAL-2026-6151 | Malicious | Not scored | 17 Jun, 2026 | npm buildautomation-touch |
Malicious release: Malicious code in custom-save-area-block (npm) MAL-2026-6152 | Malicious | Not scored | 17 Jun, 2026 | npm custom-save-area-block |
Malicious release: Malicious code in datapersistence-profiling (npm) MAL-2026-6153 | Malicious | Not scored | 17 Jun, 2026 | npm datapersistence-profiling |
Malicious release: Malicious code in datapersistence-steppers-ai (npm) MAL-2026-6154 | Malicious | Not scored | 17 Jun, 2026 | npm datapersistence-steppers-ai |
Malicious release: Malicious code in designsystem-vector (npm) MAL-2026-6155 | Malicious | Not scored | 17 Jun, 2026 | npm designsystem-vector |
Malicious release: Malicious code in documents-widgets (npm) MAL-2026-6156 | Malicious | Not scored | 17 Jun, 2026 | npm documents-widgets |
Malicious release: Malicious code in dropdown-thread (npm) MAL-2026-6157 | Malicious | Not scored | 17 Jun, 2026 | npm dropdown-thread |
Malicious release: Malicious code in enzyme-optimization-bluetooth (npm) MAL-2026-6158 | Malicious | Not scored | 17 Jun, 2026 | npm enzyme-optimization-bluetooth |
Malicious release: Malicious code in expandingcards-socket-virtualization (npm) MAL-2026-6159 | Malicious | Not scored | 17 Jun, 2026 | npm expandingcards-socket-virtualization |
Malicious release: Malicious code in firebase-readability (npm) MAL-2026-6160 | Malicious | Not scored | 17 Jun, 2026 | npm firebase-readability |