Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in npm-sandbox-research-g3h4 (npm) GHSA-p2j4-q5x6-2gc4, MAL-2026-5763 | Malicious | Not scored | 14 Jun, 2026 | npm npm-sandbox-research-g3h4 |
Malicious release: Malicious code in npm-sandbox-research-9c4e (npm) GHSA-rfp8-4gmx-2fhj, MAL-2026-5759 | Malicious | Not scored | 14 Jun, 2026 | npm npm-sandbox-research-9c4e |
Malicious release: Malicious code in sys-info-cli-app (npm) MAL-2026-5764 | Malicious | Not scored | 14 Jun, 2026 | npm sys-info-cli-app |
Malicious release: Malicious code in @gbrlxvi/ts-form-utils (npm) GHSA-587p-qfc4-5c3c, MAL-2026-5753 | Malicious | Not scored | 13 Jun, 2026 | npm @gbrlxvi/ts-form-utils |
Malicious release: Malicious code in patientdocuments (npm) GHSA-28q9-vg2f-r5m7, MAL-2026-5752 | Malicious | Not scored | 13 Jun, 2026 | npm patientdocuments |
Malicious release: Malicious code in mailconfirmer (npm) GHSA-4rw6-v77j-67gx, MAL-2026-5750 | Malicious | Not scored | 13 Jun, 2026 | npm mailconfirmer |
Malicious release: Malicious code in @giftyhq/widget-components (npm) MAL-2026-5747 | Malicious | Not scored | 13 Jun, 2026 | npm @giftyhq/widget-components |
Malicious release: Malicious code in oh-my-ashclaw (npm) MAL-2026-5751 | Malicious | Not scored | 13 Jun, 2026 | npm oh-my-ashclaw |
Malicious release: Malicious code in chai-utils-test (npm) MAL-2026-5748 | Malicious | Not scored | 13 Jun, 2026 | npm chai-utils-test |
Malicious release: Malicious code in @achuthvp/postinstall-poc (npm) GHSA-rpc3-vhwp-44cv, MAL-2026-5741 | Malicious | Not scored | 13 Jun, 2026 | npm @achuthvp/postinstall-poc |
Malicious release: Malicious code in 2fa-exe (npm) MAL-2026-5740 | Malicious | Not scored | 13 Jun, 2026 | npm 2fa-exe |
Malicious release: Malicious code in environment-gate (npm) GHSA-7h69-vjfv-w92w, MAL-2026-5743 | Malicious | Not scored | 13 Jun, 2026 | npm environment-gate |
Malicious release: Malicious code in oa-crm-webapi (npm) MAL-2026-5745 | Malicious | Not scored | 13 Jun, 2026 | npm oa-crm-webapi |
Malicious release: Malicious code in axl-ui (npm) GHSA-f4w9-3fvx-q5xw, MAL-2026-5742 | Malicious | Not scored | 13 Jun, 2026 | npm axl-ui |
Malicious release: Malicious code in xy-shared (npm) MAL-2026-5746 | Malicious | Not scored | 13 Jun, 2026 | npm xy-shared |
Malicious release: Malicious code in loadninja-shared (npm) GHSA-q764-9h8c-8jfr, MAL-2026-5744 | Malicious | Not scored | 13 Jun, 2026 | npm loadninja-shared |
Malicious release: Malicious code in easy-time666 (npm) GHSA-wfff-g64j-qx73, MAL-2026-5749 | Malicious | Not scored | 13 Jun, 2026 | npm easy-time666 |
Malicious release: Malicious code in sheratan_haha (npm) MAL-2026-5739 | Malicious | Not scored | 13 Jun, 2026 | npm sheratan_haha |
Malicious release: Malicious code in postcss-minify-selector-parser (npm) GHSA-3m8w-m4vc-8f58, MAL-2026-5737 | Malicious | Not scored | 13 Jun, 2026 | npm postcss-minify-selector-parser |
Malicious release: Malicious code in postinstall-logger-7x9z (npm) GHSA-j5hw-j4vj-f38v, MAL-2026-5738 | Malicious | Not scored | 13 Jun, 2026 | npm postinstall-logger-7x9z |
Malicious release: Malicious code in class-synth (npm) GHSA-c6cg-h94m-mv67, MAL-2026-5730 | Malicious | Not scored | 13 Jun, 2026 | npm class-synth |
Malicious release: Malicious code in node-multi-downloader (npm) GHSA-hmxh-99g9-4v4j, MAL-2026-5735 | Malicious | Not scored | 13 Jun, 2026 | npm node-multi-downloader |
Malicious release: Malicious code in node-denv (npm) GHSA-8mfj-gmpr-xqqr, MAL-2026-5734 | Malicious | Not scored | 13 Jun, 2026 | npm node-denv |
Malicious release: Malicious code in node-stack-frames (npm) MAL-2026-5736 | Malicious | Not scored | 13 Jun, 2026 | npm node-stack-frames |
Malicious release: Malicious code in node-app-doctor (npm) MAL-2026-5733 | Malicious | Not scored | 13 Jun, 2026 | npm node-app-doctor |
Malicious release: Malicious code in houzidawang807 (npm) GHSA-f2g2-48mf-957v, MAL-2026-5731 | Malicious | Not scored | 13 Jun, 2026 | npm houzidawang807 |
Malicious release: Malicious code in houzidawang808 (npm) GHSA-4qvg-392x-j32q, MAL-2026-5732 | Malicious | Not scored | 13 Jun, 2026 | npm houzidawang808 |
Malicious release: Malicious code in houzidawang806 (npm) GHSA-7gf8-h22p-4qr4, MAL-2026-5729 | Malicious | Not scored | 13 Jun, 2026 | npm houzidawang806 |
Malicious release: Malicious code in ecto_module (npm) GHSA-qj3m-j6gv-53pg, MAL-2026-5726 | Malicious | Not scored | 13 Jun, 2026 | npm ecto_module |
Malicious release: Malicious code in vite-config-react (npm) GHSA-9j99-p89c-pjwq, MAL-2026-5728 | Malicious | Not scored | 13 Jun, 2026 | npm vite-config-react |
Malicious release: Malicious code in vite-config-optimizer (npm) GHSA-5rwj-cgwr-q954, MAL-2026-5727 | Malicious | Not scored | 13 Jun, 2026 | npm vite-config-optimizer |
Malicious release: Malicious code in @ci-lifecycle-test/postinstall-ping (npm) GHSA-q86v-7cxj-6979, MAL-2026-5723 | Malicious | Not scored | 13 Jun, 2026 | npm @ci-lifecycle-test/postinstall-ping |
Malicious release: Malicious code in warp-dependency (npm) GHSA-gxc9-xrxm-w788, MAL-2026-5724 | Malicious | Not scored | 13 Jun, 2026 | npm warp-dependency |
OpenClaw: Trusted retry endpoint checks could match hostname prefixes CVE-2026-53839, GHSA-77q5-rr5v-x43q | High | 0.3% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Node pairing reconnection could confuse approval scope state CVE-2026-53838, GHSA-83w9-h5wv-j9xm | Medium | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Mattermost handlers could fall open when channel type was missing CVE-2026-53837, GHSA-gp79-m99v-gjmh | Medium | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks CVE-2026-53836, GHSA-j472-gf56-x589 | High | 0.5% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement CVE-2026-53835, GHSA-3wqp-prf6-2m72 | Low | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks CVE-2026-53834, GHSA-77pv-3w4q-vrj5 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: QQBot streaming command could mutate config without explicit allowFrom CVE-2026-53833, GHSA-jvm4-4j77-39p6 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers CVE-2026-53832, GHSA-rggc-m335-3wvj | High | 0.1% | 12 Jun, 2026 | npm openclaw |
OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion CVE-2026-53831, GHSA-mhq8-78pj-5j79 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload CVE-2026-53830, GHSA-275c-xpvc-jgfw | Medium | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Exec approval display truncation could hide the command being approved CVE-2026-53829, GHSA-xww8-gqvh-92x9 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Native command authorization could skip owner-command enforcement CVE-2026-53828, GHSA-p73f-w79w-jqr5 | High | 0.3% | 12 Jun, 2026 | npm openclaw |
OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs CVE-2026-53827, GHSA-grc3-2j34-p6gm | Medium | 0.3% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts CVE-2026-53826, GHSA-6c4r-g249-wv3c | Medium | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: memory-wiki ingest could read local files with operator.write scope CVE-2026-53825, GHSA-p2fh-f5fc-44hr | High | 0.4% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Mattermost slash token revocation could lag until monitor refresh CVE-2026-53824, GHSA-4m3v-q747-pc6h | Medium | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Slack allowFrom could bind to mutable display names CVE-2026-53823, GHSA-c29c-2q9c-pc86 | High | 0.2% | 12 Jun, 2026 | npm openclaw |