Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in ecto-spectral-leak-8d4e2 (npm) GHSA-jmpq-jp85-ggf3, MAL-2026-5690 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-spectral-leak-8d4e2 |
Malicious release: Malicious code in ecto-nightly-spirit (npm) GHSA-qv45-fm3m-pqmr, MAL-2026-5688 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-nightly-spirit |
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g) CVE-2026-49993, GHSA-x6qj-4h56-5rj5 | Medium | 0.3% | 12 Jun, 2026 | npm @nuxt/rspack-builder npm @nuxt/webpack-builder |
Malicious release: Malicious code in coral-wraith (npm) GHSA-f2r7-23p9-8jff, MAL-2026-5682 | Malicious | Not scored | 12 Jun, 2026 | npm coral-wraith |
Malicious release: Malicious code in internallib_v557 (npm) GHSA-945p-4458-jg48, MAL-2026-5678 | Malicious | Not scored | 11 Jun, 2026 | npm internallib_v557 |
OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows CVE-2026-53819, GHSA-8wg3-5mcm-fjq8 | High | 0.3% | 11 Jun, 2026 | npm openclaw |
OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers CVE-2026-53818, GHSA-rj6p-xmxr-qj4h | Medium | 0.1% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Control UI locality spoofing could mint a durable admin device token CVE-2026-53817, GHSA-chr9-m4q2-76hw | High | 0.3% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance CVE-2026-53816, GHSA-3c6j-hq33-3jv4 | High | 0.3% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Message read actions could skip channel allowlist checks CVE-2026-53815, GHSA-q7q8-3mgw-q67r | High | 0.2% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority CVE-2026-53814, GHSA-6fvr-66p3-3qj4 | High | 0.3% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Fake package roots could influence memory-core artifact loading CVE-2026-53813, GHSA-v8cx-933x-r976 | High | 0.1% | 11 Jun, 2026 | npm openclaw |
OpenClaw's browser act interactions could bypass private-network navigation checks CVE-2026-53812, GHSA-2hfg-4fh4-qp7f | Medium | 0.2% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Matrix allowFrom could bind to mutable display names CVE-2026-53811, GHSA-7hxm-f538-3xp6 | High | 0.3% | 11 Jun, 2026 | npm openclaw |
OpenClaw's marketplace runtime extension metadata could point at unscanned payloads CVE-2026-53810, GHSA-v6r2-jh58-xx6w | High | 0.4% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Embedded runner policy could be confused by provider aliases CVE-2026-53809, GHSA-p39j-x9h5-q66m | Medium | 0.1% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Skill Workshop apply flow could override pending approval CVE-2026-53808, GHSA-cqwv-9qjx-vxw2 | Medium | 0.2% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Telegram interactive callbacks could skip commands.allowFrom CVE-2026-53807, GHSA-w5ww-7chg-mxcq | High | 0.3% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Combined POSIX shell options could confuse exec revalidation CVE-2026-53806, GHSA-vxx3-6hc9-7cc3 | High | 0.4% | 11 Jun, 2026 | npm openclaw |
@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch CVE-2026-53782, GHSA-3vx2-vqx8-jxfg | Medium | 0.3% | 11 Jun, 2026 | npm @steipete/summarize |
@steipete/summarize is Vulnerable to Disk Exhaustion via Crafted Media Responses CVE-2026-53781, GHSA-q9xm-f36c-xm3q | Medium | 0.3% | 11 Jun, 2026 | npm @steipete/summarize-core |
Malicious release: Malicious code in worker-build (npm) GHSA-7wpx-89q3-rcf4, MAL-2026-5677 | Malicious | Not scored | 11 Jun, 2026 | npm worker-build |
tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template CVE-2026-49982, GHSA-7c78-jf6q-g5cm | High | 0.5% | 11 Jun, 2026 | npm tmp |
@hapi/inert has a static-file confinement bypass via sibling-prefix path CVE-2026-48049, GHSA-rcvq-m9j9-6f4g | Medium | 0.6% | 11 Jun, 2026 | npm @hapi/inert |
Malicious release: Malicious code in @johntaohunter/forge-jsx (npm) GHSA-v9x2-2qjf-q7qp, MAL-2026-5674 | Malicious | Not scored | 11 Jun, 2026 | npm @johntaohunter/forge-jsx |
Malicious release: Malicious code in ioredis-typed (npm) GHSA-wvg2-6r77-9m78, MAL-2026-5676 | Malicious | Not scored | 11 Jun, 2026 | npm ioredis-typed |
Malicious release: Malicious code in ioredis-orm (npm) GHSA-x3wj-647m-wx5c, MAL-2026-5675 | Malicious | Not scored | 11 Jun, 2026 | npm ioredis-orm |
Malicious release: Malicious code in vqlxjmpr (npm) GHSA-4mx5-f4mw-64v7, MAL-2026-5672 | Malicious | Not scored | 11 Jun, 2026 | npm vqlxjmpr |
Malicious release: Malicious code in zatzdbai (npm) GHSA-c389-4m23-j8gj, MAL-2026-5673 | Malicious | Not scored | 11 Jun, 2026 | npm zatzdbai |
Malicious release: Malicious code in downlynpm (npm) GHSA-vq59-5vfc-9rh5, MAL-2026-5666 | Malicious | Not scored | 11 Jun, 2026 | npm downlynpm |
Malicious release: Malicious code in @hatcha-captcha/core (npm) GHSA-2v2g-hp62-vhwj, MAL-2026-5655 | Malicious | Not scored | 11 Jun, 2026 | npm @hatcha-captcha/core |
Malicious release: Malicious code in @tenforce/toolbox-fontmap (npm) GHSA-4pgr-qgvj-c2wh, MAL-2026-5663 | Malicious | Not scored | 11 Jun, 2026 | npm @tenforce/toolbox-fontmap |
Malicious release: Malicious code in @marketplace-shared/components (npm) GHSA-5cx4-3w47-xm4h, MAL-2026-5658 | Malicious | Not scored | 11 Jun, 2026 | npm @marketplace-shared/components |
Malicious release: Malicious code in @sazka/web (npm) GHSA-5pm3-rqcf-522w, MAL-2026-5661 | Malicious | Not scored | 11 Jun, 2026 | npm @sazka/web |
Malicious release: Malicious code in @tribe-digital/shopify-starter-theme (npm) GHSA-6cc8-4vwg-c56v, MAL-2026-5664 | Malicious | Not scored | 11 Jun, 2026 | npm @tribe-digital/shopify-starter-theme |
Malicious release: Malicious code in @snowsight/debug-tooling (npm) GHSA-c33m-qf7q-vg8q, MAL-2026-5662 | Malicious | Not scored | 11 Jun, 2026 | npm @snowsight/debug-tooling |
Malicious release: Malicious code in @iobeya/spa-auth (npm) GHSA-qjh8-96ph-q57w, MAL-2026-5657 | Malicious | Not scored | 11 Jun, 2026 | npm @iobeya/spa-auth |
Malicious release: Malicious code in @visma-net-platform/module-navigator (npm) GHSA-r344-wgf5-fqf4, MAL-2026-5665 | Malicious | Not scored | 11 Jun, 2026 | npm @visma-net-platform/module-navigator |
Malicious release: Malicious code in @ntnx/nx-react-components (npm) GHSA-rxf2-69g9-4hpq, MAL-2026-5660 | Malicious | Not scored | 11 Jun, 2026 | npm @ntnx/nx-react-components |
Malicious release: Malicious code in @coterie-baby/common (npm) GHSA-wfq6-44px-2h89, MAL-2026-5654 | Malicious | Not scored | 11 Jun, 2026 | npm @coterie-baby/common |
Malicious release: Malicious code in @integrations-center/utils (npm) GHSA-wrxv-8jhh-m4x2, MAL-2026-5656 | Malicious | Not scored | 11 Jun, 2026 | npm @integrations-center/utils |
Malicious release: Malicious code in @ngt-frontend/widgets-core (npm) GHSA-x2r7-fmjp-vqq2, MAL-2026-5659 | Malicious | Not scored | 11 Jun, 2026 | npm @ngt-frontend/widgets-core |
Malicious release: Malicious code in pui-diagnostics (npm) GHSA-96f9-39p2-gjwm, MAL-2026-5670 | Malicious | Not scored | 11 Jun, 2026 | npm pui-diagnostics |
Malicious release: Malicious code in fed-callnative (npm) GHSA-hwp4-g2h4-2v7r, MAL-2026-5668 | Malicious | Not scored | 11 Jun, 2026 | npm fed-callnative |
Malicious release: Malicious code in sitecore-mm-component-style (npm) GHSA-mp9q-fvp5-ww2c, MAL-2026-5671 | Malicious | Not scored | 11 Jun, 2026 | npm sitecore-mm-component-style |
Malicious release: Malicious code in experian-analytics-components (npm) GHSA-wg43-49xc-v68q, MAL-2026-5667 | Malicious | Not scored | 11 Jun, 2026 | npm experian-analytics-components |
Malicious release: Malicious code in mm-ts-utils-client (npm) GHSA-x6pw-87r3-jc97, MAL-2026-5669 | Malicious | Not scored | 11 Jun, 2026 | npm mm-ts-utils-client |
Malicious release: Malicious code in pc-optimizer (npm) MAL-2026-5653 | Malicious | Not scored | 11 Jun, 2026 | npm pc-optimizer |
@grpc/grpc-js: A malformed request can cause a server crash CVE-2026-48068, GHSA-5375-pq7m-f5r2 | High | 0.9% | 11 Jun, 2026 | npm @grpc/grpc-js |
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash CVE-2026-48069, GHSA-99f4-grh7-6pcq | High | 0.9% | 11 Jun, 2026 | npm @grpc/grpc-js |