Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @entos-ems/xerxes-client-js (npm) MAL-2026-5537 | Malicious | Not scored | 11 Jun, 2026 | npm @entos-ems/xerxes-client-js |
Malicious release: Malicious code in hex-type (npm) GHSA-jc42-pxfc-29x3, MAL-2026-5538 | Malicious | Not scored | 11 Jun, 2026 | npm hex-type |
Malicious release: Malicious code in zer0onedate (npm) MAL-2026-5535 | Malicious | Not scored | 10 Jun, 2026 | npm zer0onedate |
Malicious release: Malicious code in zer0onedatetool (npm) MAL-2026-5536 | Malicious | Not scored | 10 Jun, 2026 | npm zer0onedatetool |
Malicious release: Malicious code in @thomlecter1122/lab-helper-test (npm) GHSA-223m-fcr3-c5gg, MAL-2026-5534 | Malicious | Not scored | 10 Jun, 2026 | npm @thomlecter1122/lab-helper-test |
Malicious release: Malicious code in @coze-common/chat-area (npm) MAL-2026-5533 | Malicious | Not scored | 10 Jun, 2026 | npm @coze-common/chat-area |
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges CVE-2026-50131, GHSA-xw9q-2mv6-9fr8 | High | 0.4% | 10 Jun, 2026 | npm @fedify/fedify npm @fedify/vocab-runtime |
Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload CVE-2026-48063, GHSA-qvv5-jq5g-4cgg | Critical | 0.2% | 10 Jun, 2026 | npm @whiskeysockets/baileys npm baileys |
Malicious release: Malicious code in chai-check-error (npm) MAL-2026-5526 | Malicious | Not scored | 10 Jun, 2026 | npm chai-check-error |
Malicious release: Malicious code in check-error-util (npm) MAL-2026-5527 | Malicious | Not scored | 10 Jun, 2026 | npm check-error-util |
Malicious release: Malicious code in websocket-slot (npm) GHSA-27vg-w6vw-2rq8, MAL-2026-5530 | Malicious | Not scored | 10 Jun, 2026 | npm websocket-slot |
Malicious release: Malicious code in @solana-labs/web3.js (npm) GHSA-v45f-fr53-php7, MAL-2026-5525 | Malicious | Not scored | 10 Jun, 2026 | npm @solana-labs/web3.js |
Malicious release: Malicious code in v018-axios-cdntest (npm) GHSA-cw6g-r53q-23c2, MAL-2026-5529 | Malicious | Not scored | 10 Jun, 2026 | npm v018-axios-cdntest |
Malicious release: Malicious code in @access-risk/browser-remedy-react (npm) MAL-2026-5520 | Malicious | Not scored | 10 Jun, 2026 | npm @access-risk/browser-remedy-react |
Malicious release: Malicious code in @helpcentre/tesco-help (npm) GHSA-5cff-qhhv-cxxw, MAL-2026-5521 | Malicious | Not scored | 10 Jun, 2026 | npm @helpcentre/tesco-help |
Malicious release: Malicious code in @orion-design-system/foundation (npm) MAL-2026-5523 | Malicious | Not scored | 10 Jun, 2026 | npm @orion-design-system/foundation |
Malicious release: Malicious code in @orion-design-system/components (npm) MAL-2026-5522 | Malicious | Not scored | 10 Jun, 2026 | npm @orion-design-system/components |
Malicious release: Malicious code in @orion-design-system/store (npm) MAL-2026-5524 | Malicious | Not scored | 10 Jun, 2026 | npm @orion-design-system/store |
aws-cdk-lib: OS Command Injection in NodejsFunction Bundling CVE-2026-11417, GHSA-999r-qq7v-r334 | High | 1.0% | 10 Jun, 2026 | npm aws-cdk-lib |
Malicious release: Malicious code in events-runtime (npm) MAL-2026-5528 | Malicious | Not scored | 10 Jun, 2026 | npm events-runtime |
Malicious release: Malicious code in firefly-utilities-helper (npm) GHSA-rr4c-xp44-vvf4, MAL-2026-5517 | Malicious | Not scored | 10 Jun, 2026 | npm firefly-utilities-helper |
Malicious release: Malicious code in yelp-react-component-chaos (npm) GHSA-3chg-w9g2-778v, MAL-2026-5515 | Malicious | Not scored | 10 Jun, 2026 | npm yelp-react-component-chaos |
Malicious release: Malicious code in tailwind-animator (npm) GHSA-5hg6-wrf8-9hhr, MAL-2026-5516 | Malicious | Not scored | 10 Jun, 2026 | npm tailwind-animator |
Malicious release: Malicious code in crypto-promise-js (npm) GHSA-qjp2-ccc7-vjv9, MAL-2026-5507 | Malicious | Not scored | 10 Jun, 2026 | npm crypto-promise-js |
Malicious release: Malicious code in anaylze-json (npm) GHSA-wjgw-rm6m-wgr3, MAL-2026-5505 | Malicious | Not scored | 10 Jun, 2026 | npm anaylze-json |
Malicious release: Malicious code in nw-demo-utils (npm) GHSA-q849-7xxq-hh4g, MAL-2026-5511 | Malicious | Not scored | 10 Jun, 2026 | npm nw-demo-utils |
image-size: ICNS parser allows denial of service through an infinite loop CVE-2025-71330, GHSA-w3rx-r6r6-pgpr | High | 0.4% | 10 Jun, 2026 | npm image-size |
image-size: JXL and HEIF parsers allow denial of service through infinite loops CVE-2025-71329, GHSA-5p2g-fcmc-qvqq | High | 0.4% | 10 Jun, 2026 | npm image-size |
Malicious release: Malicious code in @easytipsportal/pos-adapters (npm) GHSA-8qfp-2r92-r39w, MAL-2026-5504 | Malicious | Not scored | 10 Jun, 2026 | npm @easytipsportal/pos-adapters |
Malicious release: Malicious code in argoncrypt (npm) GHSA-h3m2-g8jh-9p37, MAL-2026-5506 | Malicious | Not scored | 10 Jun, 2026 | npm argoncrypt |
Malicious release: Malicious code in martinez-polygon-clipping-simul-dalton (npm) GHSA-ggqm-v4hp-cw69, MAL-2026-5508 | Malicious | Not scored | 10 Jun, 2026 | npm martinez-polygon-clipping-simul-dalton |
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system CVE-2026-48051, GHSA-5g86-85rp-f9hx | Low | 0.3% | 10 Jun, 2026 | npm @papra/webhooks |
@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture CVE-2026-48037, GHSA-cj8g-prcm-mfg5 | Medium | 0.5% | 10 Jun, 2026 | npm @hulumi/baseline |
@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts CVE-2026-48036, GHSA-32g3-35g9-wc9g | High | 0.5% | 10 Jun, 2026 | npm @hulumi/drift |
@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened CVE-2026-48035, GHSA-2mxr-p26x-mj73 | High | 0.5% | 10 Jun, 2026 | npm @hulumi/baseline |
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket CVE-2026-48034, GHSA-9vc9-4jv3-rf86 | High | 0.4% | 10 Jun, 2026 | npm @hulumi/policies |
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name CVE-2026-48033, GHSA-rhgj-6g2c-frmm | High | 0.5% | 10 Jun, 2026 | npm @hulumi/policies |
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers CVE-2026-48032, GHSA-g759-4pxw-6692 | High | 0.5% | 10 Jun, 2026 | npm @hulumi/policies |
Malicious release: Malicious code in solc-compiler (npm) GHSA-3gmv-4hp4-87jq, MAL-2026-5513 | Malicious | Not scored | 10 Jun, 2026 | npm solc-compiler |
Malicious release: Malicious code in npmjs_web3-common (npm) GHSA-56rf-jfpx-gqf8, MAL-2026-5510 | Malicious | Not scored | 10 Jun, 2026 | npm npmjs_web3-common |
Malicious release: Malicious code in solc-abi (npm) GHSA-5rjr-r82r-343m, MAL-2026-5512 | Malicious | Not scored | 10 Jun, 2026 | npm solc-abi |
Malicious release: Malicious code in npmjs_truffle-helper (npm) GHSA-6qhx-9853-hxm6, MAL-2026-5509 | Malicious | Not scored | 10 Jun, 2026 | npm npmjs_truffle-helper |
Malicious release: Malicious code in solidity-abi (npm) GHSA-4pr4-9j3x-h243, MAL-2026-5514 | Malicious | Not scored | 10 Jun, 2026 | npm solidity-abi |
Malicious release: Malicious code in plugin-fastify (npm) GHSA-3g8q-cxq6-9f6c, MAL-2026-5503 | Malicious | Not scored | 10 Jun, 2026 | npm plugin-fastify |
Malicious release: Malicious code in graphbase-js (npm) GHSA-29w9-hfv4-jjxh, MAL-2026-5502 | Malicious | Not scored | 10 Jun, 2026 | npm graphbase-js |
Malicious release: Malicious code in @validate-ethereum-address/core (npm) GHSA-c29q-842f-rcjc, MAL-2026-5496 | Malicious | Not scored | 10 Jun, 2026 | npm @validate-ethereum-address/core |
Malicious release: Malicious code in @validator-sdk/pubkey (npm) GHSA-w9ch-gj3p-2cj9, MAL-2026-5498 | Malicious | Not scored | 10 Jun, 2026 | npm @validator-sdk/pubkey |
Malicious release: Malicious code in @solana-launchpad/sdk (npm) GHSA-364r-rq62-6gx5, MAL-2026-5495 | Malicious | Not scored | 10 Jun, 2026 | npm @solana-launchpad/sdk |
Malicious release: Malicious code in @meme-sdk/trade (npm) GHSA-4c2m-9v9c-75xv, MAL-2026-5494 | Malicious | Not scored | 10 Jun, 2026 | npm @meme-sdk/trade |
Malicious release: Malicious code in @validate-sdk/v2 (npm) GHSA-vqg9-785x-8j39, MAL-2026-5497 | Malicious | Not scored | 10 Jun, 2026 | npm @validate-sdk/v2 |