Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets CVE-2026-33245, GHSA-8646-j5j9-6r62 | High | 0.2% | 02 Jun, 2026 | npm react-router |
Malicious release: Malicious code in fundraiserserv (npm) GHSA-r4jv-gh5g-mhgg, MAL-2026-5172 | Malicious | Not scored | 02 Jun, 2026 | npm fundraiserserv |
React Router has stored XSS via unescaped Location header in prerendered redirect HTML CVE-2026-33244, GHSA-f22v-gfqf-p8f3 | Medium | 0.1% | 02 Jun, 2026 | npm react-router |
Malicious release: Malicious code in vg-interaction-model (npm) MAL-2026-5168 | Malicious | Not scored | 02 Jun, 2026 | npm vg-interaction-model |
Malicious release: Malicious code in chai-parse (npm) GHSA-f528-hm3f-2jx6, MAL-2026-5169 | Malicious | Not scored | 02 Jun, 2026 | npm chai-parse |
Malicious release: Malicious code in sourceflow-tracker (npm) GHSA-c75m-7mcf-hwrg, MAL-2026-5166 | Malicious | Not scored | 02 Jun, 2026 | npm sourceflow-tracker |
Malicious release: Malicious code in page-info-service (npm) GHSA-67v8-5gw6-m65g, MAL-2026-5158 | Malicious | Not scored | 02 Jun, 2026 | npm page-info-service |
Malicious release: Malicious code in po-ops-local-dev (npm) GHSA-r7j7-4gwg-rg72, MAL-2026-5159 | Malicious | Not scored | 02 Jun, 2026 | npm po-ops-local-dev |
Malicious release: Malicious code in @att-ebiz/abs-components-bc (npm) GHSA-6mgp-q6qp-ffj2, MAL-2026-5153 | Malicious | Not scored | 02 Jun, 2026 | npm @att-ebiz/abs-components-bc |
Malicious release: Malicious code in @aonunited/angular (npm) GHSA-xm5f-7c4r-7wgx, MAL-2026-5150 | Malicious | Not scored | 02 Jun, 2026 | npm @aonunited/angular |
Claw Orchestrator has inefficient regular expression complexity via validateRegex() CVE-2026-10291, GHSA-95f6-rfpg-c3w8 | Medium | 0.4% | 01 Jun, 2026 | npm @enderfga/claw-orchestrator |
Malicious release: Malicious code in rookie-security-test-pkg (npm) MAL-2026-5132 | Malicious | Not scored | 01 Jun, 2026 | npm rookie-security-test-pkg |
Claw Orchestrator is missing authentication for the component API Endpoint CVE-2026-10281, GHSA-q6qc-xp4q-rjq5 | Medium | 0.4% | 01 Jun, 2026 | npm @enderfga/claw-orchestrator |
launch-editor vulnerable to command injection via the crafted request on Windows CVE-2024-52011, GHSA-c27g-q93r-2cwf | High | 0.5% | 01 Jun, 2026 | npm launch-editor npm vite |
Malicious release: Malicious code in picnic-react-mise-en-place (npm) MAL-2026-5122 | Malicious | Not scored | 01 Jun, 2026 | npm picnic-react-mise-en-place |
Malicious release: Malicious code in @chat-template/auth (npm) GHSA-5jx8-qv7v-hv32, MAL-2026-5124 | Malicious | Not scored | 01 Jun, 2026 | npm @chat-template/auth |
Malicious release: Malicious code in nepsnowplow (npm) MAL-2026-5121 | Malicious | Not scored | 01 Jun, 2026 | npm nepsnowplow |
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script CVE-2026-47428, GHSA-2h32-95rg-cppp | Critical | 0.6% | 01 Jun, 2026 | npm @vitest/browser |
When Vitest UI server is listening, arbitrary file can be read and executed CVE-2026-47429, GHSA-5xrq-8626-4rwp | Critical | 1.0% | 01 Jun, 2026 | npm vitest |
DOMPurify XSS via selectedcontent re-clone CVE-2026-47423, GHSA-87xg-pxx2-7hvx | High | 0.4% | 01 Jun, 2026 | npm dompurify |
@agenticmail/mcp Missing Authentication for Critical Function CVE-2026-50287, GHSA-63gr-g7jc-v8rg | High | 0.4% | 01 Jun, 2026 | npm @agenticmail/mcp |
Malicious release: Malicious code in jingmeideshishi (npm) GHSA-pc3j-w4f9-94hj, MAL-2026-5110 | Malicious | Not scored | 01 Jun, 2026 | npm jingmeideshishi |
Malicious release: Malicious code in @ewfewfewf/testhackerrr (npm) GHSA-p4gj-2hmg-hj4f, MAL-2026-5102 | Malicious | Not scored | 01 Jun, 2026 | npm @ewfewfewf/testhackerrr |
Malicious release: Malicious code in @osamdefeirrighs/testhackfrrferrr (npm) GHSA-rrrc-gchv-j329, MAL-2026-5103 | Malicious | Not scored | 01 Jun, 2026 | npm @osamdefeirrighs/testhackfrrferrr |
Malicious release: Malicious code in @pcldpvkoewpogw/testhacker (npm) GHSA-xjcm-hjvm-fmhp, MAL-2026-5104 | Malicious | Not scored | 01 Jun, 2026 | npm @pcldpvkoewpogw/testhacker |
Malicious release: Malicious code in cms-github (npm) GHSA-3r39-h7xh-jg85, MAL-2026-5107 | Malicious | Not scored | 01 Jun, 2026 | npm cms-github |
Malicious release: Malicious code in shopifyto-cms (npm) GHSA-92q8-c63v-g77x, MAL-2026-5109 | Malicious | Not scored | 01 Jun, 2026 | npm shopifyto-cms |
Malicious release: Malicious code in cms-helpgit (npm) GHSA-hjw8-jc8q-mvwj, MAL-2026-5108 | Malicious | Not scored | 01 Jun, 2026 | npm cms-helpgit |
Malicious release: Malicious code in chai-as-minted (npm) GHSA-85px-g4cg-g2g3, MAL-2026-5106 | Malicious | Not scored | 01 Jun, 2026 | npm chai-as-minted |
Malicious release: Malicious code in @tmecontinue/cli (npm) GHSA-jq5f-g7j2-8f9g, MAL-2026-5105 | Malicious | Not scored | 01 Jun, 2026 | npm @tmecontinue/cli |
Malicious release: Malicious code in @antoncallahan/aws-user-helper (npm) GHSA-v2cq-j5gf-pf5g, MAL-2026-5101 | Malicious | Not scored | 01 Jun, 2026 | npm @antoncallahan/aws-user-helper |
Malicious release: Malicious code in @customer-threesixty/assets (npm) MAL-2026-5154 | Malicious | Not scored | 01 Jun, 2026 | npm @customer-threesixty/assets |
Malicious release: Malicious code in @ownit/core (npm) MAL-2026-5155 | Malicious | Not scored | 01 Jun, 2026 | npm @ownit/core |
Malicious release: Malicious code in @telenor-se/core (npm) MAL-2026-5156 | Malicious | Not scored | 01 Jun, 2026 | npm @telenor-se/core |
Malicious release: Malicious code in @tse-digital/core (npm) MAL-2026-5157 | Malicious | Not scored | 01 Jun, 2026 | npm @tse-digital/core |
Malicious release: Malicious code in @emcd-vue/loans (npm) GHSA-q777-mww2-r86p, MAL-2026-5165 | Malicious | Not scored | 01 Jun, 2026 | npm @emcd-vue/loans |
Malicious release: Malicious code in @emcd-vue/auth (npm) GHSA-gj65-7753-2q9f, MAL-2026-5163 | Malicious | Not scored | 01 Jun, 2026 | npm @emcd-vue/auth |
Malicious release: Malicious code in @emcd-vue/b2b-pay-form (npm) GHSA-xqjh-fp6w-54g6, MAL-2026-5164 | Malicious | Not scored | 01 Jun, 2026 | npm @emcd-vue/b2b-pay-form |
Malicious release: Malicious code in @redhat-cloud-services/entitlements-client (npm) GHSA-28hc-2275-h287, MAL-2026-5125 | Malicious | Not scored | 01 Jun, 2026 | npm @redhat-cloud-services/entitlements-client |
Malicious release: Malicious code in @redhat-cloud-services/rbac-client (npm) GHSA-2p99-xvqh-j893, MAL-2026-5116 | Malicious | Not scored | 01 Jun, 2026 | npm @redhat-cloud-services/rbac-client |
Malicious release: Malicious code in @redhat-cloud-services/host-inventory-client (npm) GHSA-4hcm-2c2r-2rhm, MAL-2026-5141 | Malicious | Not scored | 01 Jun, 2026 | npm @redhat-cloud-services/host-inventory-client |
Malicious release: Malicious code in @redhat-cloud-services/tsc-transform-imports (npm) GHSA-4p47-xv4r-786w, GHSA-8gf7-gc4w-pwh7, MAL-2026-5147 | Malicious | Not scored | 01 Jun, 2026 | npm @redhat-cloud-services/tsc-transform-imports |
Malicious release: Malicious code in @redhat-cloud-services/types (npm) GHSA-4qj4-x996-qvgw, GHSA-8xj2-9c64-m64h, MAL-2026-5119 | Malicious | Not scored | 01 Jun, 2026 | npm @redhat-cloud-services/types |
Malicious release: Malicious code in @redhat-cloud-services/frontend-components-remediations (npm) GHSA-4rjr-7qhx-vjwg, MAL-2026-5127 | Malicious | Not scored | 01 Jun, 2026 | npm @redhat-cloud-services/frontend-components-remediations |
Malicious release: Malicious code in @redhat-cloud-services/frontend-components-advisor-components (npm) GHSA-873j-vjwp-88w8, MAL-2026-5135 | Malicious | Not scored | 01 Jun, 2026 | npm @redhat-cloud-services/frontend-components-advisor-components |
Malicious release: Malicious code in @redhat-cloud-services/integrations-client (npm) GHSA-8x4g-q845-wpfc, MAL-2026-5130 | Malicious | Not scored | 01 Jun, 2026 | npm @redhat-cloud-services/integrations-client |
Malicious release: Malicious code in @redhat-cloud-services/chrome (npm) GHSA-942v-f47r-w9c3, MAL-2026-5111 | Malicious | Not scored | 01 Jun, 2026 | npm @redhat-cloud-services/chrome |
Malicious release: Malicious code in @redhat-cloud-services/topological-inventory-client (npm) GHSA-9wp8-557p-2hvf, MAL-2026-5118 | Malicious | Not scored | 01 Jun, 2026 | npm @redhat-cloud-services/topological-inventory-client |
Malicious release: Malicious code in @redhat-cloud-services/eslint-config-redhat-cloud-services (npm) GHSA-c3mv-fjj4-2542, MAL-2026-5112 | Malicious | Not scored | 01 Jun, 2026 | npm @redhat-cloud-services/eslint-config-redhat-cloud-services |
Malicious release: Malicious code in @redhat-cloud-services/rule-components (npm) GHSA-c4gm-6fh3-76v9, MAL-2026-5117 | Malicious | Not scored | 01 Jun, 2026 | npm @redhat-cloud-services/rule-components |