Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @asavie/i18n (npm) MAL-2026-4265 | Malicious | Not scored | 23 May, 2026 | npm @asavie/i18n |
Malicious release: Malicious code in lhisp-logger (npm) MAL-2026-4598 | Malicious | Not scored | 23 May, 2026 | npm lhisp-logger |
Malicious release: Malicious code in cloudpivot (npm) MAL-2026-4529 | Malicious | Not scored | 23 May, 2026 | npm cloudpivot |
Malicious release: Malicious code in secdriven (npm) MAL-2026-4263 | Malicious | Not scored | 23 May, 2026 | npm secdriven |
Malicious release: Malicious code in dds-js-idl-types (npm) GHSA-c7hc-8fj8-hjr6, MAL-2026-4548 | Malicious | Not scored | 23 May, 2026 | npm dds-js-idl-types |
Malicious release: Malicious code in dds-js-idl (npm) MAL-2026-4264 | Malicious | Not scored | 23 May, 2026 | npm dds-js-idl |
Malicious release: Malicious code in loading-session (npm) GHSA-7vwr-8v2c-gjvr, MAL-2026-4600 | Malicious | Not scored | 23 May, 2026 | npm loading-session |
Parse Server: Pre-authentication denial of service via client version header regex backtracking BIT-parse-2026-47138, CVE-2026-47138, GHSA-38m6-82c8-4xfm | High | 0.6% | 23 May, 2026 | npm parse-server |
Malicious release: Malicious code in prompt-engineering-toolkit (npm) GHSA-5frg-fmcq-p9cg, MAL-2026-4282 | Malicious | Not scored | 23 May, 2026 | npm prompt-engineering-toolkit |
Malicious release: Malicious code in llm-context-compressor (npm) GHSA-65j3-6fx4-8q2j, MAL-2026-4278 | Malicious | Not scored | 23 May, 2026 | npm llm-context-compressor |
Malicious release: Malicious code in token-usage-tracker (npm) GHSA-6fxh-5965-3xf4, MAL-2026-4283 | Malicious | Not scored | 23 May, 2026 | npm token-usage-tracker |
Malicious release: Malicious code in project-init-tools (npm) GHSA-95m4-gh9m-px5h, MAL-2026-4281 | Malicious | Not scored | 23 May, 2026 | npm project-init-tools |
Malicious release: Malicious code in build-scripts-utils (npm) GHSA-fxc5-vwp2-3c24, MAL-2026-4276 | Malicious | Not scored | 23 May, 2026 | npm build-scripts-utils |
Malicious release: Malicious code in dev-env-bootstrapper (npm) GHSA-gc4v-cqp6-5672, MAL-2026-4277 | Malicious | Not scored | 23 May, 2026 | npm dev-env-bootstrapper |
Malicious release: Malicious code in async-pipeline-builder (npm) GHSA-hgq8-x9x4-jfpr, MAL-2026-4275 | Malicious | Not scored | 23 May, 2026 | npm async-pipeline-builder |
Malicious release: Malicious code in workspace-config-loader (npm) GHSA-p8hf-5qq9-8g8h, MAL-2026-4284 | Malicious | Not scored | 23 May, 2026 | npm workspace-config-loader |
Malicious release: Malicious code in model-switch-router (npm) GHSA-vvr8-673r-w4j2, MAL-2026-4279 | Malicious | Not scored | 23 May, 2026 | npm model-switch-router |
Malicious release: Malicious code in node-setup-helpers (npm) GHSA-vxfv-w8fq-239r, MAL-2026-4280 | Malicious | Not scored | 23 May, 2026 | npm node-setup-helpers |
Malicious release: Malicious code in chai-as-repaired (npm) GHSA-fpr5-4jhx-2qw9, MAL-2026-4512 | Malicious | Not scored | 22 May, 2026 | npm chai-as-repaired |
Malicious release: Malicious code in clickpy (npm) MAL-2026-4270 | Malicious | Not scored | 22 May, 2026 | npm clickpy |
Malicious release: Malicious code in @engagehub/core (npm) GHSA-5hgc-pmxv-3xh7, MAL-2026-4258 | Malicious | Not scored | 22 May, 2026 | npm @engagehub/core |
Malicious release: Malicious code in pg-expense-example (npm) MAL-2026-4639 | Malicious | Not scored | 22 May, 2026 | npm pg-expense-example |
Malicious release: Malicious code in orca-website (npm) MAL-2026-4632 | Malicious | Not scored | 22 May, 2026 | npm orca-website |
Malicious release: Malicious code in tailwind-style-typography (npm) GHSA-pv74-wmjg-4gp8, MAL-2026-4680 | Malicious | Not scored | 22 May, 2026 | npm tailwind-style-typography |
Malicious release: Malicious code in express-enrouten-async (npm) GHSA-25jv-xr7c-mx67, MAL-2026-4556 | Malicious | Not scored | 22 May, 2026 | npm express-enrouten-async |
Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers CVE-2026-39964, GHSA-hqmv-v56g-4m47 | Medium | 0.2% | 22 May, 2026 | npm @typebot.io/js |
Malicious release: Malicious code in mmt-static (npm) GHSA-3c6q-cfmj-gmcf, MAL-2026-4612 | Malicious | Not scored | 22 May, 2026 | npm mmt-static |
Malicious release: Malicious code in openmct-couch-plugin (npm) MAL-2026-4629 | Malicious | Not scored | 22 May, 2026 | npm openmct-couch-plugin |
Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview CVE-2026-28445, GHSA-6m7c-xfhp-p9fh | High | 0.3% | 22 May, 2026 | npm @typebot.io/js |
Malicious release: Malicious code in events-router (npm) MAL-2026-4555 | Malicious | Not scored | 22 May, 2026 | npm events-router |
Malicious release: Malicious code in rapyd-client (npm) MAL-2026-4658 | Malicious | Not scored | 22 May, 2026 | npm rapyd-client |
Malicious release: Malicious code in thevoid (npm) MAL-2026-4692 | Malicious | Not scored | 22 May, 2026 | npm thevoid |
Malicious release: Malicious code in cdk-insights (npm) MAL-2026-4508 | Malicious | Not scored | 22 May, 2026 | npm cdk-insights |
Malicious release: Malicious code in midcorp (npm) MAL-2026-4610 | Malicious | Not scored | 22 May, 2026 | npm midcorp |
Malicious release: Malicious code in @gbrlxvii/ts-form-utils (npm) GHSA-362c-qm74-42gg, MAL-2026-4298 | Malicious | Not scored | 22 May, 2026 | npm @gbrlxvii/ts-form-utils |
Malicious release: Malicious code in eo-terminal (npm) GHSA-29rh-48q6-xhpc, MAL-2026-4345 | Malicious | Not scored | 22 May, 2026 | npm eo-terminal |
shell-quote quote() does not escape newlines in object .op values CVE-2026-9277, GHSA-w7jw-789q-3m8p | Critical | 0.8% | 22 May, 2026 | npm shell-quote |
Malicious release: Malicious code in osep-react-antd (npm) MAL-2026-4634 | Malicious | Not scored | 22 May, 2026 | npm osep-react-antd |
Malicious release: Malicious code in osep-api-hub-service-client-v1 (npm) MAL-2026-4633 | Malicious | Not scored | 22 May, 2026 | npm osep-api-hub-service-client-v1 |
Malicious release: Malicious code in swift-optimizer (npm) GHSA-7vv3-8cx6-w4g3, MAL-2026-4677 | Malicious | Not scored | 22 May, 2026 | npm swift-optimizer |
Malicious release: Malicious code in @cloudways-lab/unified-design-system (npm) GHSA-rj2r-p6fv-4vx4, MAL-2026-4257 | Malicious | Not scored | 22 May, 2026 | npm @cloudways-lab/unified-design-system |
Malicious release: Malicious code in @citi-icg-171632/citicms-repo-component (npm) GHSA-prgj-vfx3-5cqv, MAL-2026-4256 | Malicious | Not scored | 22 May, 2026 | npm @citi-icg-171632/citicms-repo-component |
Malicious release: Malicious code in cdk-sagemaker-notebook-workflow (npm) MAL-2026-4255 | Malicious | Not scored | 22 May, 2026 | npm cdk-sagemaker-notebook-workflow |
Malicious release: Malicious code in codebuff-cli (npm) MAL-2026-4533 | Malicious | Not scored | 22 May, 2026 | npm codebuff-cli |
Malicious release: Malicious code in finkrouter (npm) MAL-2026-4563 | Malicious | Not scored | 22 May, 2026 | npm finkrouter |
Malicious release: Malicious code in logger-draft (npm) MAL-2026-4346 | Malicious | Not scored | 22 May, 2026 | npm logger-draft |
Malicious release: Malicious code in reactive-cdk-app (npm) GHSA-ppjp-2h29-66pv, MAL-2026-4254 | Malicious | Not scored | 22 May, 2026 | npm reactive-cdk-app |
Malicious release: Malicious code in get-package-lint (npm) MAL-2026-4572 | Malicious | Not scored | 22 May, 2026 | npm get-package-lint |
Malicious release: Malicious code in lynx-keeper-cli (npm) GHSA-3p5r-gmr8-v7mr, MAL-2026-4604 | Malicious | Not scored | 22 May, 2026 | npm lynx-keeper-cli |
Malicious release: Malicious code in xy-ai-chat (npm) MAL-2026-4735 | Malicious | Not scored | 22 May, 2026 | npm xy-ai-chat |