Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas CVE-2026-48038, GHSA-q7cg-457f-vx79 | Medium | 0.5% | 11 Jun, 2026 | npm joi |
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri CVE-2026-48054, GHSA-4x76-22x2-rx8v | High | 0.6% | 11 Jun, 2026 | npm @openzeppelin/wizard |
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects CVE-2026-48022, GHSA-x426-x7cc-3fpc | Medium | 0.2% | 11 Jun, 2026 | npm @hapi/wreck |
Element Call reports full URLs of visited pages to analytics server CVE-2026-48007, GHSA-6vhh-4xw6-h2h2 | High | 0.3% | 11 Jun, 2026 | npm @element-hq/element-call-embedded |
Malicious release: Malicious code in unified-ui-components-library (npm) GHSA-5vx8-w45q-gf69, MAL-2026-5648 | Malicious | Not scored | 11 Jun, 2026 | npm unified-ui-components-library |
Malicious release: Malicious code in ts-ecro (npm) GHSA-cwjv-7gg4-fp86, MAL-2026-5647 | Malicious | Not scored | 11 Jun, 2026 | npm ts-ecro |
Malicious release: Malicious code in optional-cpu-features (npm) GHSA-pwmh-97g7-2r34, MAL-2026-5642 | Malicious | Not scored | 11 Jun, 2026 | npm optional-cpu-features |
Malicious release: Malicious code in self-certificate (npm) MAL-2026-5644 | Malicious | Not scored | 11 Jun, 2026 | npm self-certificate |
Malicious release: Malicious code in goreleaser-run (npm) MAL-2026-5641 | Malicious | Not scored | 11 Jun, 2026 | npm goreleaser-run |
Malicious release: Malicious code in parket-slot (npm) GHSA-65jm-q492-j57q, MAL-2026-5643 | Malicious | Not scored | 11 Jun, 2026 | npm parket-slot |
Malicious release: Malicious code in ecto-corsair-whisper-6f3b9 (npm) GHSA-5wjv-qgmc-8w9m, MAL-2026-5640 | Malicious | Not scored | 11 Jun, 2026 | npm ecto-corsair-whisper-6f3b9 |
Malicious release: Malicious code in ozonex-sdk (npm) GHSA-v2hc-cmv5-999p, MAL-2026-5651 | Malicious | Not scored | 11 Jun, 2026 | npm ozonex-sdk |
Malicious release: Malicious code in sn-internal-test (npm) GHSA-v675-j7jw-p6rm, MAL-2026-5645 | Malicious | Not scored | 11 Jun, 2026 | npm sn-internal-test |
Malicious release: Malicious code in sn-internal-testjgsakjdkjadkjahsdkjad (npm) GHSA-cxhc-w3f2-3fx4, MAL-2026-5646 | Malicious | Not scored | 11 Jun, 2026 | npm sn-internal-testjgsakjdkjadkjahsdkjad |
Malicious release: Malicious code in ozone-sdk (npm) GHSA-3qc2-qc6w-c8xm, MAL-2026-5650 | Malicious | Not scored | 11 Jun, 2026 | npm ozone-sdk |
Malicious release: Malicious code in theta-sdk (npm) GHSA-x7m6-5hw9-gj7f, MAL-2026-5652 | Malicious | Not scored | 11 Jun, 2026 | npm theta-sdk |
Malicious release: Malicious code in @tt-aem-tt4a/shared-components (npm) MAL-2026-5639 | Malicious | Not scored | 11 Jun, 2026 | npm @tt-aem-tt4a/shared-components |
Malicious release: Malicious code in swagger-express-routes (npm) GHSA-49jc-pgvv-m729, MAL-2026-5636 | Malicious | Not scored | 11 Jun, 2026 | npm swagger-express-routes |
Malicious release: Malicious code in routing-controls (npm) GHSA-jmhh-mvpj-27qq, MAL-2026-5635 | Malicious | Not scored | 11 Jun, 2026 | npm routing-controls |
Malicious release: Malicious code in tw-fluid-type (npm) GHSA-53h7-3qgm-jr76, MAL-2026-5638 | Malicious | Not scored | 11 Jun, 2026 | npm tw-fluid-type |
Malicious release: Malicious code in tailwindcss-animotion (npm) GHSA-9rjg-7m93-mq7w, MAL-2026-5637 | Malicious | Not scored | 11 Jun, 2026 | npm tailwindcss-animotion |
Malicious release: Malicious code in react-photo-views (npm) GHSA-f2m2-w8gp-rjgq, MAL-2026-5634 | Malicious | Not scored | 11 Jun, 2026 | npm react-photo-views |
Malicious release: Malicious code in clsx-tailwind (npm) GHSA-373j-j35f-q4gx, MAL-2026-5625 | Malicious | Not scored | 11 Jun, 2026 | npm clsx-tailwind |
Malicious release: Malicious code in typeorm-encrypt (npm) GHSA-f7h6-4xj8-8qh7, MAL-2026-5633 | Malicious | Not scored | 11 Jun, 2026 | npm typeorm-encrypt |
Malicious release: Malicious code in rate-limits-flexible (npm) GHSA-hg8j-2wmv-w4v6, MAL-2026-5627 | Malicious | Not scored | 11 Jun, 2026 | npm rate-limits-flexible |
Malicious release: Malicious code in tailwindcss-merge (npm) GHSA-m2xh-rw7p-69rx, MAL-2026-5632 | Malicious | Not scored | 11 Jun, 2026 | npm tailwindcss-merge |
Malicious release: Malicious code in sass-format (npm) GHSA-m8x4-pc4m-p5gv, MAL-2026-5628 | Malicious | Not scored | 11 Jun, 2026 | npm sass-format |
Malicious release: Malicious code in tailwindcss-animatics (npm) GHSA-mp9h-24x9-xc7r, MAL-2026-5631 | Malicious | Not scored | 11 Jun, 2026 | npm tailwindcss-animatics |
Malicious release: Malicious code in sass-formats (npm) GHSA-pvrm-39m5-j3c4, MAL-2026-5629 | Malicious | Not scored | 11 Jun, 2026 | npm sass-formats |
Malicious release: Malicious code in tailwindcss-animates-kit (npm) GHSA-v4xp-qgj3-gphm, MAL-2026-5630 | Malicious | Not scored | 11 Jun, 2026 | npm tailwindcss-animates-kit |
Malicious release: Malicious code in rate-limit-flexible (npm) GHSA-v7vx-48xw-jwm8, MAL-2026-5626 | Malicious | Not scored | 11 Jun, 2026 | npm rate-limit-flexible |
Malicious release: Malicious code in @whatnot-web/www-legacy (npm) MAL-2026-5622 | Malicious | Not scored | 11 Jun, 2026 | npm @whatnot-web/www-legacy |
Malicious release: Malicious code in edu-npm-dependency-chain-demo (npm) GHSA-cqgx-r84j-px55, MAL-2026-5623 | Malicious | Not scored | 11 Jun, 2026 | npm edu-npm-dependency-chain-demo |
Malicious release: Malicious code in edu-npm-postinstall-demo2 (npm) GHSA-gqxv-6fpm-5xwx, MAL-2026-5624 | Malicious | Not scored | 11 Jun, 2026 | npm edu-npm-postinstall-demo2 |
Malicious release: Malicious code in chai-net-test (npm) MAL-2026-5607 | Malicious | Not scored | 11 Jun, 2026 | npm chai-net-test |
Malicious release: Malicious code in tailwind-animator-scroll (npm) GHSA-mx93-wj6x-87wp, MAL-2026-5618 | Malicious | Not scored | 11 Jun, 2026 | npm tailwind-animator-scroll |
Malicious release: Malicious code in tailwind-typography-plus (npm) GHSA-j9jx-c8pr-c3gr, MAL-2026-5619 | Malicious | Not scored | 11 Jun, 2026 | npm tailwind-typography-plus |
Malicious release: Malicious code in claimora (npm) MAL-2026-5608 | Malicious | Not scored | 11 Jun, 2026 | npm claimora |
Malicious release: Malicious code in janus-erc20 (npm) GHSA-w6mr-3c22-93v5, MAL-2026-5614 | Malicious | Not scored | 11 Jun, 2026 | npm janus-erc20 |
Malicious release: Malicious code in cache-section-helper (npm) GHSA-wg39-m2jm-wxhp, MAL-2026-5604 | Malicious | Not scored | 11 Jun, 2026 | npm cache-section-helper |
Malicious release: Malicious code in datetime-toolkit (npm) GHSA-hjx5-46c8-fm8p, MAL-2026-5611 | Malicious | Not scored | 11 Jun, 2026 | npm datetime-toolkit |
Malicious release: Malicious code in internallib_v346 (npm) GHSA-qcg5-4gpc-33h2, MAL-2026-5613 | Malicious | Not scored | 11 Jun, 2026 | npm internallib_v346 |
Malicious release: Malicious code in chai-as-victimed (npm) MAL-2026-5605 | Malicious | Not scored | 11 Jun, 2026 | npm chai-as-victimed |
Malicious release: Malicious code in chai-dec (npm) GHSA-782j-c8c3-2j5w, MAL-2026-5606 | Malicious | Not scored | 11 Jun, 2026 | npm chai-dec |
Malicious release: Malicious code in backup-my-data (npm) MAL-2026-5603 | Malicious | Not scored | 11 Jun, 2026 | npm backup-my-data |
Malicious release: Malicious code in clean-my-pc (npm) MAL-2026-5609 | Malicious | Not scored | 11 Jun, 2026 | npm clean-my-pc |
Malicious release: Malicious code in sysbu (npm) MAL-2026-5616 | Malicious | Not scored | 11 Jun, 2026 | npm sysbu |
Malicious release: Malicious code in sysau (npm) MAL-2026-5615 | Malicious | Not scored | 11 Jun, 2026 | npm sysau |
Malicious release: Malicious code in sysnu (npm) MAL-2026-5617 | Malicious | Not scored | 11 Jun, 2026 | npm sysnu |
Malicious release: Malicious code in coderzero (npm) MAL-2026-5610 | Malicious | Not scored | 11 Jun, 2026 | npm coderzero |