Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in eth-wallet-sentinel (npm) GHSA-7r6r-hqg7-f6mq, MAL-2026-4207 | Malicious | Not scored | 21 May, 2026 | npm eth-wallet-sentinel |
Malicious release: Malicious code in mnemonic-safety-check (npm) GHSA-8cjc-h554-gxp5, MAL-2026-4208 | Malicious | Not scored | 21 May, 2026 | npm mnemonic-safety-check |
Malicious release: Malicious code in polymarket-copy-trading (npm) GHSA-9jh7-4779-9m8r, MAL-2026-4213 | Malicious | Not scored | 21 May, 2026 | npm polymarket-copy-trading |
Malicious release: Malicious code in crypto-credential-scanner (npm) GHSA-9vgj-5wvq-cwp6, MAL-2026-4203 | Malicious | Not scored | 21 May, 2026 | npm crypto-credential-scanner |
Malicious release: Malicious code in polymarket-bot (npm) GHSA-9x4c-gq65-ggmc, MAL-2026-4211 | Malicious | Not scored | 21 May, 2026 | npm polymarket-bot |
Malicious release: Malicious code in polymarket-claude-code (npm) GHSA-hqrj-3257-4cwr, MAL-2026-4212 | Malicious | Not scored | 21 May, 2026 | npm polymarket-claude-code |
Malicious release: Malicious code in polymarket-trader (npm) GHSA-jgmf-qv79-wc9f, MAL-2026-4216 | Malicious | Not scored | 21 May, 2026 | npm polymarket-trader |
Malicious release: Malicious code in polymarket-terminal (npm) GHSA-mhqj-q9r5-99vg, MAL-2026-4214 | Malicious | Not scored | 21 May, 2026 | npm polymarket-terminal |
Malicious release: Malicious code in polymarket-ai-agent (npm) GHSA-pm36-9m37-g548, MAL-2026-4209 | Malicious | Not scored | 21 May, 2026 | npm polymarket-ai-agent |
Malicious release: Malicious code in polymarket-trading-cli (npm) GHSA-q888-mwhg-ccmp, MAL-2026-4217 | Malicious | Not scored | 21 May, 2026 | npm polymarket-trading-cli |
Malicious release: Malicious code in defi-threat-scanner (npm) GHSA-q896-rx3q-5794, MAL-2026-4205 | Malicious | Not scored | 21 May, 2026 | npm defi-threat-scanner |
Malicious release: Malicious code in chain-key-validator (npm) GHSA-vpcq-rhwg-qph4, MAL-2026-4202 | Malicious | Not scored | 21 May, 2026 | npm chain-key-validator |
Malicious release: Malicious code in claude-internal-utils (npm) GHSA-jxg3-fwfv-fjwf, MAL-2026-4525 | Malicious | Not scored | 20 May, 2026 | npm claude-internal-utils |
Malicious release: Malicious code in deployment-key-auditor (npm) GHSA-m69v-rchm-xjjp, MAL-2026-4206 | Malicious | Not scored | 20 May, 2026 | npm deployment-key-auditor |
Malicious release: Malicious code in defi-env-auditor (npm) GHSA-3wcx-fvrv-6w6w, MAL-2026-4204 | Malicious | Not scored | 20 May, 2026 | npm defi-env-auditor |
Malicious release: Malicious code in solidity-deploy-guard (npm) GHSA-3r5j-pgc5-q23x, MAL-2026-4218 | Malicious | Not scored | 20 May, 2026 | npm solidity-deploy-guard |
Malicious release: Malicious code in supership-scan (npm) MAL-2026-4675 | Malicious | Not scored | 20 May, 2026 | npm supership-scan |
Malicious release: Malicious code in create-kachow (npm) MAL-2026-4539 | Malicious | Not scored | 20 May, 2026 | npm create-kachow |
Malicious release: Malicious code in chain-async-test (npm) MAL-2026-4516 | Malicious | Not scored | 20 May, 2026 | npm chain-async-test |
Malicious release: Malicious code in vite-json-config (npm) MAL-2026-4705 | Malicious | Not scored | 20 May, 2026 | npm vite-json-config |
CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS CVE-2026-26028, GHSA-g2g4-47gv-p72v | Medium | 0.2% | 20 May, 2026 | npm cryptpad |
Malicious release: Malicious code in bolt-delivery-menu-app (npm) GHSA-75c2-fw59-mg5f, GHSA-pfrq-994m-rxrr, MAL-2026-4499 | Malicious | Not scored | 20 May, 2026 | npm bolt-delivery-menu-app |
Malicious release: Malicious code in @vivaux/telemetry (npm) GHSA-hq2r-xw8m-v4q8, MAL-2026-4463 | Malicious | Not scored | 20 May, 2026 | npm @vivaux/telemetry |
Malicious release: Malicious code in cb-wallet-http (npm) GHSA-mv3f-92cr-83h7, MAL-2026-4507 | Malicious | Not scored | 20 May, 2026 | npm cb-wallet-http |
Malicious release: Malicious code in ethers-wallet-package (npm) GHSA-7pvf-g7jg-rxpj, MAL-2026-4553 | Malicious | Not scored | 20 May, 2026 | npm ethers-wallet-package |
@cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode CVE-2026-30691, GHSA-fvhg-p4hf-79x3 | Medium | 0.3% | 20 May, 2026 | npm @cyntler/react-doc-viewer |
Malicious release: Malicious code in private-next-pages (npm) MAL-2026-4193 | Malicious | Not scored | 20 May, 2026 | npm private-next-pages |
Malicious release: Malicious code in iv-stubborn (npm) GHSA-g54w-82gq-9mwp, MAL-2026-4192 | Malicious | Not scored | 20 May, 2026 | npm iv-stubborn |
Malicious release: Malicious code in @doctolib-apps/native-personalized-services (npm) GHSA-hgpx-hj7x-3cx9, MAL-2026-4186 | Malicious | Not scored | 20 May, 2026 | npm @doctolib-apps/native-personalized-services |
Malicious release: Malicious code in iv-bloomfilter (npm) GHSA-wxq4-7mxh-8jpq, MAL-2026-4191 | Malicious | Not scored | 20 May, 2026 | npm iv-bloomfilter |
Malicious release: Malicious code in uolcs-host-uol-anuncios-fe (npm) GHSA-p4vr-mx6g-r574, MAL-2026-4185 | Malicious | Not scored | 20 May, 2026 | npm uolcs-host-uol-anuncios-fe |
Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows CVE-2026-56268, GHSA-c2c9-mfw7-p8hw | Medium | 0.4% | 20 May, 2026 | npm flowise |
Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification CVE-2026-56276, GHSA-59fh-9f3p-7m39 | Medium | 0.4% | 20 May, 2026 | npm flowise |
Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage CVE-2026-56277, GHSA-m837-xvxr-vqwg | Medium | 0.2% | 20 May, 2026 | npm flowise |
Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service) CVE-2026-46421, GHSA-pvw4-cvr4-97p8 | Critical | 0.5% | 20 May, 2026 | npm @cap-js/db-service npm @cap-js/postgres npm @cap-js/sqlite |
Malicious release: Malicious code in stripe-internal-utils (npm) MAL-2026-4184 | Malicious | Not scored | 20 May, 2026 | npm stripe-internal-utils |
Malicious release: Malicious code in @limebike/frontend-core-api (npm) GHSA-89wg-7gqg-72xf, MAL-2026-4187 | Malicious | Not scored | 20 May, 2026 | npm @limebike/frontend-core-api |
Malicious release: Malicious code in mamadoos-test (npm) GHSA-qwhw-2wfv-rv3r, MAL-2026-4605 | Malicious | Not scored | 20 May, 2026 | npm mamadoos-test |
Malicious release: Malicious code in randomlogs (npm) GHSA-6x8j-5cx8-5qv6, MAL-2026-4657 | Malicious | Not scored | 20 May, 2026 | npm randomlogs |
Malicious release: Malicious code in @limebike/supreme-data-grid (npm) GHSA-5jxw-6cjm-j5cf, MAL-2026-4189 | Malicious | Not scored | 20 May, 2026 | npm @limebike/supreme-data-grid |
Malicious release: Malicious code in gator-client (npm) GHSA-jrf3-vfx4-8vqh, GHSA-r569-8mc4-rfp6, MAL-2026-4569 | Malicious | Not scored | 20 May, 2026 | npm gator-client |
Malicious release: Malicious code in rendezvous-js (npm) GHSA-cj5p-rpr4-5cvh, GHSA-q26f-8xxj-pwwf, MAL-2026-4662 | Malicious | Not scored | 20 May, 2026 | npm rendezvous-js |
Malicious release: Malicious code in banana-stand (npm) GHSA-m27g-5q57-x86r, GHSA-x4gx-rrjg-5rrh, MAL-2026-4495 | Malicious | Not scored | 20 May, 2026 | npm banana-stand |
Malicious release: Malicious code in @limebike/supreme-date-pickers (npm) GHSA-9r56-r4mm-h4p3, MAL-2026-4190 | Malicious | Not scored | 20 May, 2026 | npm @limebike/supreme-date-pickers |
Malicious release: Malicious code in lynx-keeper (npm) GHSA-x7hr-g7qr-7j7p, MAL-2026-4603 | Malicious | Not scored | 20 May, 2026 | npm lynx-keeper |
Malicious release: Malicious code in @limebike/supreme (npm) GHSA-9x95-pwr5-8g32, MAL-2026-4188 | Malicious | Not scored | 20 May, 2026 | npm @limebike/supreme |
Malicious release: Malicious code in web3-secrets-detector (npm) GHSA-qc99-w9r4-jrg5, MAL-2026-4220 | Malicious | Not scored | 20 May, 2026 | npm web3-secrets-detector |
Malicious release: Malicious code in wallet-backup-verifier (npm) GHSA-jq6x-r6vm-vwrx, MAL-2026-4250 | Malicious | Not scored | 20 May, 2026 | npm wallet-backup-verifier |
Malicious release: Malicious code in encrata-cli (npm) MAL-2026-4551 | Malicious | Not scored | 20 May, 2026 | npm encrata-cli |
Malicious release: Malicious code in bitrix24-tasks-mcp-server (npm) MAL-2026-4498 | Malicious | Not scored | 20 May, 2026 | npm bitrix24-tasks-mcp-server |