Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @antv/gi-mock-data (npm) MAL-2026-4013 | Malicious | Not scored | 19 May, 2026 | npm @antv/gi-mock-data |
Malicious release: Malicious code in @antv/gi-public-data (npm) MAL-2026-4014 | Malicious | Not scored | 19 May, 2026 | npm @antv/gi-public-data |
Malicious release: Malicious code in @antv/gi-sdk (npm) MAL-2026-4015 | Malicious | Not scored | 19 May, 2026 | npm @antv/gi-sdk |
Malicious release: Malicious code in @antv/gi-sdk-app (npm) MAL-2026-4016 | Malicious | Not scored | 19 May, 2026 | npm @antv/gi-sdk-app |
Malicious release: Malicious code in @antv/gi-theme-antd (npm) MAL-2026-4017 | Malicious | Not scored | 19 May, 2026 | npm @antv/gi-theme-antd |
Malicious release: Malicious code in @antv/github-config-cli (npm) MAL-2026-4018 | Malicious | Not scored | 19 May, 2026 | npm @antv/github-config-cli |
Malicious release: Malicious code in @antv/hierarchy (npm) MAL-2026-4027 | Malicious | Not scored | 19 May, 2026 | npm @antv/hierarchy |
Malicious release: Malicious code in @antv/interaction (npm) MAL-2026-4030 | Malicious | Not scored | 19 May, 2026 | npm @antv/interaction |
Malicious release: Malicious code in @antv/l7-editor (npm) MAL-2026-4039 | Malicious | Not scored | 19 May, 2026 | npm @antv/l7-editor |
Malicious release: Malicious code in @antv/l7-extension-g-layer (npm) MAL-2026-4040 | Malicious | Not scored | 19 May, 2026 | npm @antv/l7-extension-g-layer |
Malicious release: Malicious code in @antv/l7-map (npm) MAL-2026-4043 | Malicious | Not scored | 19 May, 2026 | npm @antv/l7-map |
Malicious release: Malicious code in @antv/l7-mapkit (npm) MAL-2026-4044 | Malicious | Not scored | 19 May, 2026 | npm @antv/l7-mapkit |
Malicious release: Malicious code in @antv/l7-mini (npm) MAL-2026-4046 | Malicious | Not scored | 19 May, 2026 | npm @antv/l7-mini |
Malicious release: Malicious code in @antv/l7-pass (npm) MAL-2026-4047 | Malicious | Not scored | 19 May, 2026 | npm @antv/l7-pass |
Malicious release: Malicious code in @antv/l7-scene (npm) MAL-2026-4050 | Malicious | Not scored | 19 May, 2026 | npm @antv/l7-scene |
Malicious release: Malicious code in @antv/l7-three (npm) MAL-2026-4052 | Malicious | Not scored | 19 May, 2026 | npm @antv/l7-three |
Malicious release: Malicious code in @antv/li-aiearth-assets (npm) MAL-2026-4059 | Malicious | Not scored | 19 May, 2026 | npm @antv/li-aiearth-assets |
Malicious release: Malicious code in @antv/li-editor (npm) MAL-2026-4062 | Malicious | Not scored | 19 May, 2026 | npm @antv/li-editor |
Malicious release: Malicious code in @antv/matrix-util (npm) MAL-2026-4067 | Malicious | Not scored | 19 May, 2026 | npm @antv/matrix-util |
Malicious release: Malicious code in @antv/mcp-server-antv (npm) MAL-2026-4068 | Malicious | Not scored | 19 May, 2026 | npm @antv/mcp-server-antv |
Malicious release: Malicious code in @antv/my-f2-pc (npm) MAL-2026-4071 | Malicious | Not scored | 19 May, 2026 | npm @antv/my-f2-pc |
Malicious release: Malicious code in @antv/narrative-text-editor (npm) MAL-2026-4072 | Malicious | Not scored | 19 May, 2026 | npm @antv/narrative-text-editor |
Malicious release: Malicious code in @antv/react-g (npm) MAL-2026-4076 | Malicious | Not scored | 19 May, 2026 | npm @antv/react-g |
Malicious release: Malicious code in @antv/s2-react-components (npm) MAL-2026-4079 | Malicious | Not scored | 19 May, 2026 | npm @antv/s2-react-components |
Malicious release: Malicious code in @antv/scale (npm) MAL-2026-4083 | Malicious | Not scored | 19 May, 2026 | npm @antv/scale |
Malicious release: Malicious code in @antv/semantic-release-pnpm (npm) MAL-2026-4084 | Malicious | Not scored | 19 May, 2026 | npm @antv/semantic-release-pnpm |
Malicious release: Malicious code in @antv/stat (npm) MAL-2026-4086 | Malicious | Not scored | 19 May, 2026 | npm @antv/stat |
Malicious release: Malicious code in @antv/webgpu-graph (npm) MAL-2026-4095 | Malicious | Not scored | 19 May, 2026 | npm @antv/webgpu-graph |
Malicious release: Malicious code in @antv/word-scale-chart (npm) MAL-2026-4096 | Malicious | Not scored | 19 May, 2026 | npm @antv/word-scale-chart |
Malicious release: Malicious code in @antv/x6-angular-shape (npm) MAL-2026-4098 | Malicious | Not scored | 19 May, 2026 | npm @antv/x6-angular-shape |
Malicious release: Malicious code in @antv/x6-components (npm) MAL-2026-4100 | Malicious | Not scored | 19 May, 2026 | npm @antv/x6-components |
Malicious release: Malicious code in @antv/x6-react (npm) MAL-2026-4112 | Malicious | Not scored | 19 May, 2026 | npm @antv/x6-react |
Malicious release: Malicious code in @antv/x6-vector (npm) MAL-2026-4115 | Malicious | Not scored | 19 May, 2026 | npm @antv/x6-vector |
Malicious release: Malicious code in @antv/xflow-core (npm) MAL-2026-4119 | Malicious | Not scored | 19 May, 2026 | npm @antv/xflow-core |
Malicious release: Malicious code in @antv/xflow-diff (npm) MAL-2026-4120 | Malicious | Not scored | 19 May, 2026 | npm @antv/xflow-diff |
Malicious release: Malicious code in ai-figure (npm) MAL-2026-4126 | Malicious | Not scored | 19 May, 2026 | npm ai-figure |
Malicious release: Malicious code in amapcn (npm) MAL-2026-4127 | Malicious | Not scored | 19 May, 2026 | npm amapcn |
Malicious release: Malicious code in boring-avatars-vanilla (npm) MAL-2026-4130 | Malicious | Not scored | 19 May, 2026 | npm boring-avatars-vanilla |
Malicious release: Malicious code in gantt-for-react (npm) MAL-2026-4135 | Malicious | Not scored | 19 May, 2026 | npm gantt-for-react |
Malicious release: Malicious code in jest-canvas-mock (npm) MAL-2026-4136 | Malicious | Not scored | 19 May, 2026 | npm jest-canvas-mock |
Malicious release: Malicious code in mcp-echarts (npm) MAL-2026-4146 | Malicious | Not scored | 19 May, 2026 | npm mcp-echarts |
Malicious release: Malicious code in mcp-mermaid (npm) MAL-2026-4147 | Malicious | Not scored | 19 May, 2026 | npm mcp-mermaid |
Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links CVE-2026-45245, GHSA-2r69-qgv3-hr65 | Medium | 0.3% | 18 May, 2026 | npm @steipete/summarize |
Summarize contains a missing authorization vulnerability CVE-2026-45244, GHSA-67gq-6q8c-qqh6 | Low | 0.2% | 18 May, 2026 | npm @steipete/summarize |
Summarize contains a missing authorization vulnerability CVE-2026-45243, GHSA-5624-2pmv-jx46 | Medium | 0.2% | 18 May, 2026 | npm @steipete/summarize |
Summarize contains a path traversal vulnerability CVE-2026-45242, GHSA-8jr4-6r33-phwm | High | 0.4% | 18 May, 2026 | npm @steipete/summarize |
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp GHSA-jgg6-4rpr-wfh7 | Low | Not scored | 18 May, 2026 | npm @mistralai/mistralai npm @mistralai/mistralai-azure npm @mistralai/mistralai-gcp |
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API CVE-2026-45719, GHSA-363w-hvwh-w7m6 | Medium | 0.3% | 18 May, 2026 | npm @budibase/server |
Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows CVE-2026-45718, GHSA-3263-v5v9-xq8q | Medium | 0.1% | 18 May, 2026 | npm budibase |
Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration CVE-2026-45716, GHSA-c54j-xp92-wh28 | High | 0.3% | 18 May, 2026 | npm @budibase/worker |