Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in code-tool-langfuse (npm) MAL-2026-4532 | Malicious | Not scored | 20 May, 2026 | npm code-tool-langfuse |
Malicious release: Malicious code in hpsetup (npm) MAL-2026-4579 | Malicious | Not scored | 20 May, 2026 | npm hpsetup |
Malicious release: Malicious code in etherjs-utils (npm) GHSA-3c7w-4xp2-7963, MAL-2026-4239 | Malicious | Not scored | 20 May, 2026 | npm etherjs-utils |
Malicious release: Malicious code in jsonbson (npm) GHSA-44rg-m26f-r36f, MAL-2026-4591 | Malicious | Not scored | 20 May, 2026 | npm jsonbson |
Malicious release: Malicious code in hardhat-gas-profiler-plugin (npm) GHSA-w4rg-p3x5-fv42, MAL-2026-4244 | Malicious | Not scored | 20 May, 2026 | npm hardhat-gas-profiler-plugin |
Malicious release: Malicious code in chainlink-price-feed-aggregator (npm) GHSA-88p4-x24p-x2j9, MAL-2026-4233 | Malicious | Not scored | 20 May, 2026 | npm chainlink-price-feed-aggregator |
Malicious release: Malicious code in @rocketreach/rr-components (npm) GHSA-7v8q-r297-95jx, MAL-2026-4427 | Malicious | Not scored | 20 May, 2026 | npm @rocketreach/rr-components |
Malicious release: Malicious code in crypto-javascript (npm) GHSA-v8fq-265h-rcw5, MAL-2026-4542 | Malicious | Not scored | 20 May, 2026 | npm crypto-javascript |
Malicious release: Malicious code in ganache-cli-provider (npm) GHSA-hfp4-5fx7-5mwm, MAL-2026-4243 | Malicious | Not scored | 20 May, 2026 | npm ganache-cli-provider |
Malicious release: Malicious code in solna-web3 (npm) GHSA-39j5-93x5-73hc, MAL-2026-4248 | Malicious | Not scored | 20 May, 2026 | npm solna-web3 |
Malicious release: Malicious code in solana-pda-helper (npm) GHSA-jrx8-mvj8-9gq2, MAL-2026-4247 | Malicious | Not scored | 20 May, 2026 | npm solana-pda-helper |
Malicious release: Malicious code in foundry-deploy-helper (npm) GHSA-xhp8-r3hh-j47p, MAL-2026-4241 | Malicious | Not scored | 20 May, 2026 | npm foundry-deploy-helper |
Malicious release: Malicious code in ethers-multicall-utils (npm) GHSA-r83q-qx5h-cjqm, MAL-2026-4240 | Malicious | Not scored | 20 May, 2026 | npm ethers-multicall-utils |
Malicious release: Malicious code in to-cms (npm) GHSA-789x-j439-qx3f, MAL-2026-4693 | Malicious | Not scored | 19 May, 2026 | npm to-cms |
Malicious release: Malicious code in martinez-polygon-clipping-tony (npm) GHSA-64jc-f3r5-gp74, MAL-2026-4606 | Malicious | Not scored | 19 May, 2026 | npm martinez-polygon-clipping-tony |
Malicious release: Malicious code in did-0091 (npm) MAL-2026-4177 | Malicious | Not scored | 19 May, 2026 | npm did-0091 |
@angular/platform-server: SSRF via Hostname Hijacking CVE-2026-46417, GHSA-rfh7-fxqc-q52v | High | 0.4% | 19 May, 2026 | npm @angular/platform-server |
Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm CVE-2026-46412, GHSA-6xwp-cp5h-q856 | Critical | 0.8% | 19 May, 2026 | npm @beproduct/nestjs-auth |
CamoFox MCP: Unauthenticated HTTP MCP browser-control surface GHSA-7hgr-7h44-33w2 | High | Not scored | 19 May, 2026 | npm camofox-mcp |
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl CVE-2026-46372, GHSA-qg89-qwwh-5f3j | High | 0.9% | 19 May, 2026 | npm sillytavern |
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes CVE-2026-45783, GHSA-32mq-hpph-xfvr | High | 0.4% | 19 May, 2026 | npm @libp2p/kad-dht |
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning CVE-2026-46342, GHSA-g8wj-3cr3-6w7v | Low | 0.1% | 19 May, 2026 | npm @nuxt/nitro-server npm nuxt |
PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE CVE-2026-45805, GHSA-22qr-rp27-j9wm | High | 0.4% | 19 May, 2026 | npm @penpot/mcp |
Malicious release: Malicious code in zod-to-js (npm) GHSA-8cm2-vv7w-4c27, MAL-2026-4740 | Malicious | Not scored | 19 May, 2026 | npm zod-to-js |
HAX CMS: Denial of Service using Malicious Import Request CVE-2026-46357, GHSA-9r33-xhw8-4qqp | Medium | 0.2% | 19 May, 2026 | npm @haxtheweb/haxcms-nodejs |
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes CVE-2026-46339, GHSA-fhh6-4qxv-rpqj | Critical | 2.8% | 19 May, 2026 | npm 9router |
Malicious release: Malicious code in collected-forms-embed-js (npm) GHSA-9j37-8wjm-pcxq, MAL-2026-4175 | Malicious | Not scored | 19 May, 2026 | npm collected-forms-embed-js |
Malicious release: Malicious code in clsx-js (npm) GHSA-8jmh-pvvx-wjrf, MAL-2026-4531 | Malicious | Not scored | 19 May, 2026 | npm clsx-js |
Malicious release: Malicious code in btd-smart (npm) GHSA-m4m6-q4p8-3vjv, MAL-2026-4501 | Malicious | Not scored | 19 May, 2026 | npm btd-smart |
Malicious release: Malicious code in crypto-hash-sdk (npm) GHSA-hr6r-2xx8-mrh9, MAL-2026-4541 | Malicious | Not scored | 19 May, 2026 | npm crypto-hash-sdk |
Malicious release: Malicious code in xorma-js (npm) GHSA-h7mc-23rp-vpj6, MAL-2026-4734 | Malicious | Not scored | 19 May, 2026 | npm xorma-js |
Malicious release: Malicious code in qr-code-styling-temp (npm) GHSA-m7q2-jqhj-4f3q, GHSA-pp2c-4x5r-7h8j, MAL-2026-4655, SNYK-JS-QRCODESTYLINGTEMP-19161484 | Malicious | Not scored | 19 May, 2026 | npm qr-code-styling-temp |
Malicious release: Malicious code in whiteboard-agent (npm) MAL-2026-4729 | Malicious | Not scored | 19 May, 2026 | npm whiteboard-agent |
Malicious release: Malicious code in claude-all-config (npm) MAL-2026-4522 | Malicious | Not scored | 19 May, 2026 | npm claude-all-config |
Malicious release: Malicious code in corelia (npm) GHSA-fg63-2vqh-93xf, MAL-2026-4536 | Malicious | Not scored | 19 May, 2026 | npm corelia |
Malicious release: Malicious code in superacli (npm) MAL-2026-4674 | Malicious | Not scored | 19 May, 2026 | npm superacli |
Malicious release: Malicious code in prettier-sdk (npm) GHSA-hwr7-qq29-qrf2, MAL-2026-4645 | Malicious | Not scored | 19 May, 2026 | npm prettier-sdk |
Malicious release: Malicious code in cheaty-sync-bot (npm) MAL-2026-4518 | Malicious | Not scored | 19 May, 2026 | npm cheaty-sync-bot |
Malicious release: Malicious code in bytecore (npm) GHSA-x73m-hgh7-64q2, MAL-2026-4503 | Malicious | Not scored | 19 May, 2026 | npm bytecore |
Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching CVE-2026-46341, GHSA-jwp7-wg77-3w9v | Medium | 0.2% | 19 May, 2026 | npm @apify/actors-mcp-server |
Budibase: Unrestricted Upload of File with Dangerous Type CVE-2026-46426, GHSA-82rc-gxrg-v4gf | High | 0.2% | 19 May, 2026 | npm budibase |
Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour CVE-2026-46424, GHSA-6vp2-6r7m-2jvx | Medium | 0.2% | 19 May, 2026 | npm @budibase/backend-core |
n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass CVE-2026-56348, GHSA-3875-8gcx-7v46 | Medium | 0.5% | 19 May, 2026 | npm n8n |
Malicious release: Malicious code in @mc-xp/mc-monolith-js-src-package (npm) GHSA-58vg-vvv2-vr42, MAL-2026-4171 | Malicious | Not scored | 19 May, 2026 | npm @mc-xp/mc-monolith-js-src-package |
n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions CVE-2026-56352, GHSA-2vx9-7wpg-88jq | Medium | 0.3% | 19 May, 2026 | npm n8n |
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) CVE-2026-45670, GHSA-6m52-m754-pw2g | Medium | 0.2% | 19 May, 2026 | npm @nuxt/rspack-builder npm @nuxt/webpack-builder |
Nuxt: Reflected XSS in `navigateTo()` external redirect CVE-2026-45669, GHSA-fx6j-w5w5-h468 | Medium | 0.2% | 19 May, 2026 | npm nuxt |
auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs GHSA-hv85-774v-26fg | High | Not scored | 19 May, 2026 | npm auth-fetch-mcp |
Malicious release: Malicious code in @piewasm/pie-web-npm-package (npm) GHSA-jvrm-qr5x-5wfx, MAL-2026-4172 | Malicious | Not scored | 19 May, 2026 | npm @piewasm/pie-web-npm-package |
Malicious release: Malicious code in is-really-odd (npm) GHSA-jjv2-fjq3-2ggj, MAL-2026-4173 | Malicious | Not scored | 19 May, 2026 | npm is-really-odd |