Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @43uh3ig43/telemetry-client (npm) GHSA-hqc4-gwfr-49r6, MAL-2026-4252 | Malicious | Not scored | 22 May, 2026 | npm @43uh3ig43/telemetry-client |
Malicious release: Malicious code in bingocode (npm) MAL-2026-4497 | Malicious | Not scored | 22 May, 2026 | npm bingocode |
Malicious release: Malicious code in @druids/ui (npm) MAL-2026-4385 | Malicious | Not scored | 22 May, 2026 | npm @druids/ui |
Malicious release: Malicious code in harmony-enablers-test-2026 (npm) GHSA-ghw7-gg88-gpmr, MAL-2026-4251 | Malicious | Not scored | 22 May, 2026 | npm harmony-enablers-test-2026 |
Malicious release: Malicious code in wrld-dev (npm) MAL-2026-4733 | Malicious | Not scored | 22 May, 2026 | npm wrld-dev |
Malicious release: Malicious code in @shwfed/nuxt (npm) MAL-2026-4444 | Malicious | Not scored | 22 May, 2026 | npm @shwfed/nuxt |
Malicious release: Malicious code in pypi-build-verifier (npm) GHSA-4gg7-p7xj-789q, MAL-2026-4245 | Malicious | Not scored | 22 May, 2026 | npm pypi-build-verifier |
Malicious release: Malicious code in env-security-scanner (npm) GHSA-437g-626p-h8fm, MAL-2026-4238 | Malicious | Not scored | 22 May, 2026 | npm env-security-scanner |
Malicious release: Malicious code in mev-shield (npm) GHSA-5973-qc78-hqxv, MAL-2026-4609 | Malicious | Not scored | 22 May, 2026 | npm mev-shield |
Malicious release: Malicious code in deploy-guard-check (npm) GHSA-wpr6-96j5-4p35, MAL-2026-4237 | Malicious | Not scored | 22 May, 2026 | npm deploy-guard-check |
Malicious release: Malicious code in build-integrity-verify (npm) GHSA-39mh-vrfq-8hx7, MAL-2026-4232 | Malicious | Not scored | 22 May, 2026 | npm build-integrity-verify |
Malicious release: Malicious code in dependency-audit-tool (npm) GHSA-xxq2-p383-26rc, MAL-2026-4236 | Malicious | Not scored | 22 May, 2026 | npm dependency-audit-tool |
Malicious release: Malicious code in python-env-auditor (npm) GHSA-939m-5vr8-382c, MAL-2026-4246 | Malicious | Not scored | 22 May, 2026 | npm python-env-auditor |
Malicious release: Malicious code in credential-verification-cli (npm) GHSA-c7hj-r4xg-q237, MAL-2026-4235 | Malicious | Not scored | 22 May, 2026 | npm credential-verification-cli |
Malicious release: Malicious code in compliance-check-runner (npm) GHSA-9gxp-rrm3-qh48, MAL-2026-4234 | Malicious | Not scored | 22 May, 2026 | npm compliance-check-runner |
Malicious release: Malicious code in internallib_v493 (npm) GHSA-cmv7-95wv-gm8h, MAL-2026-4585 | Malicious | Not scored | 22 May, 2026 | npm internallib_v493 |
Malicious release: Malicious code in audit-logsss (npm) GHSA-gcq4-52q3-v4fm, MAL-2026-4487 | Malicious | Not scored | 22 May, 2026 | npm audit-logsss |
Malicious release: Malicious code in allbridge-example-react (npm) MAL-2026-4477 | Malicious | Not scored | 22 May, 2026 | npm allbridge-example-react |
Malicious release: Malicious code in ignite-market-contracts (npm) MAL-2026-4582 | Malicious | Not scored | 22 May, 2026 | npm ignite-market-contracts |
Malicious release: Malicious code in ignite-market-contractstest (npm) MAL-2026-4583 | Malicious | Not scored | 22 May, 2026 | npm ignite-market-contractstest |
Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret CVE-2026-46701, GHSA-j3vx-cx2r-pvg8 | High | 0.2% | 21 May, 2026 | npm network-ai |
Malicious release: Malicious code in crypt0co-walet-poc (npm) MAL-2026-4540 | Malicious | Not scored | 21 May, 2026 | npm crypt0co-walet-poc |
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host CVE-2026-46703, GHSA-f396-4rp4-7v2j, GO-2026-5344, PYSEC-2026-298, RUSTSEC-2026-0148 | Critical | 0.5% | 21 May, 2026 | Go github.com/boxlite-ai/boxlite/sdks/go PyPI boxlite crates.io boxlite crates.io boxlite-cli +1 more |
BoxLite: Permission Bypass Allows Modification of Read-Only Files CVE-2026-46695, GHSA-g6ww-w5j2-r7x3, GO-2026-5392, PYSEC-2026-299, RUSTSEC-2026-0147 | Critical | 0.3% | 21 May, 2026 | Go github.com/boxlite-ai/boxlite/sdks/go PyPI boxlite crates.io boxlite crates.io boxlite-cli +1 more |
Malicious release: Malicious code in claude-content-writer (npm) MAL-2026-4524 | Malicious | Not scored | 21 May, 2026 | npm claude-content-writer |
@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty CVE-2026-46681, GHSA-x7j8-49r8-mr43 | High | 0.4% | 21 May, 2026 | npm @nevware21/ts-utils |
js-libp2p: Memory DoS via subscription flood of unique topics CVE-2026-46679, GHSA-4f8r-922h-2vgv | High | 0.3% | 21 May, 2026 | npm @libp2p/gossipsub |
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection CVE-2026-46625, GHSA-qjx8-664m-686j | High | 0.9% | 21 May, 2026 | npm js-cookie |
Malicious release: Malicious code in search-connector-template (npm) MAL-2026-4664 | Malicious | Not scored | 21 May, 2026 | npm search-connector-template |
@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails CVE-2026-82855, GHSA-59f3-7227-wmh4 | Critical | 0.6% | 21 May, 2026 | npm @hulumi/policies |
@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators CVE-2026-82856, GHSA-q2f7-m237-v562 | Critical | 0.5% | 21 May, 2026 | npm @hulumi/policies |
@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies CVE-2026-82860, GHSA-4xrh-5m3m-328w | Critical | 0.5% | 21 May, 2026 | npm @hulumi/policies |
@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass CVE-2026-82861, GHSA-g43v-9x7q-83pq | High | 0.4% | 21 May, 2026 | npm @hulumi/policies |
@hulumi/drift: Orphan reconciler accepted externally supplied execute plans CVE-2026-82858, GHSA-2ffm-hxrq-qqmm | Critical | 0.3% | 21 May, 2026 | npm @hulumi/drift |
@hulumi/baseline: CloudTrail selector tampering events were not fully detected CVE-2026-82863, GHSA-gfp8-mp24-5vxg | High | 0.2% | 21 May, 2026 | npm @hulumi/baseline |
Malicious release: Malicious code in configcat-trello-powerup (npm) MAL-2026-4535 | Malicious | Not scored | 21 May, 2026 | npm configcat-trello-powerup |
Malicious release: Malicious code in @remitee-money-transfer/rmt-base (npm) MAL-2026-4424 | Malicious | Not scored | 21 May, 2026 | npm @remitee-money-transfer/rmt-base |
NocoDB: Stale Auth Cache After API Token Deletion CVE-2026-46554, GHSA-f76x-f9vj-92jv | Low | 0.3% | 21 May, 2026 | npm nocodb |
NocoDB: Attachment Size Limit Bypass via Upload-by-URL CVE-2026-46553, GHSA-8rwr-f68v-cvw6 | Low | 0.4% | 21 May, 2026 | npm nocodb |
NocoDB: Shared-base link access can invite arbitrary users as persistent base members CVE-2026-46552, GHSA-chqv-vrj7-qffp | Medium | 0.3% | 21 May, 2026 | npm nocodb |
NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion CVE-2026-46551, GHSA-99vc-2jx2-688p | Medium | 0.4% | 21 May, 2026 | npm nocodb |
NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags CVE-2026-46550, GHSA-f74w-272x-mqcv | Medium | 0.2% | 21 May, 2026 | npm nocodb |
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation CVE-2026-46549, GHSA-m5qg-rvjq-727p | Low | 0.2% | 21 May, 2026 | npm nocodb |
NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams) CVE-2026-46548, GHSA-2c5x-4jgf-88mj | Medium | 0.3% | 21 May, 2026 | npm nocodb |
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL CVE-2026-46547, GHSA-9qgr-6vpg-9gh9 | Medium | 0.3% | 21 May, 2026 | npm nocodb |
MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement CVE-2026-46519, GHSA-cr22-wjx7-2w6m | High | 0.5% | 21 May, 2026 | npm mcp-server-kubernetes |
Malicious release: Malicious code in cryptoco-auth (npm) MAL-2026-4230 | Malicious | Not scored | 21 May, 2026 | npm cryptoco-auth |
Malicious release: Malicious code in cloudsmith-vsc (npm) MAL-2026-4530 | Malicious | Not scored | 21 May, 2026 | npm cloudsmith-vsc |
Malicious release: Malicious code in fnd-stores (npm) GHSA-wx9h-pmqq-rcgg, MAL-2026-4565 | Malicious | Not scored | 21 May, 2026 | npm fnd-stores |
Malicious release: Malicious code in pubnub-moderation-tool (npm) MAL-2026-4650 | Malicious | Not scored | 21 May, 2026 | npm pubnub-moderation-tool |