Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in esm-dotenv (npm) MAL-2026-17305 | Malicious | Not scored | 30 Sep, 2026 | npm esm-dotenv |
Malicious release: Malicious code in stestenv (npm) MAL-2026-17309 | Malicious | Not scored | 30 Sep, 2026 | npm stestenv |
Malicious release: Malicious code in tailwind-forms-kit (npm) MAL-2026-17310 | Malicious | Not scored | 30 Sep, 2026 | npm tailwind-forms-kit |
Malicious release: Malicious code in fabric-mod-utils (npm) MAL-2026-17307 | Malicious | Not scored | 30 Sep, 2026 | npm fabric-mod-utils |
Malicious release: Malicious code in mfahelper (npm) GHSA-9f55-6cf9-3pgw, MAL-2026-17308 | Malicious | Not scored | 30 Sep, 2026 | npm mfahelper |
Malicious release: Malicious code in solidity-lock (npm) MAL-2026-17302 | Malicious | Not scored | 30 Sep, 2026 | npm solidity-lock |
Malicious release: Malicious code in web-vitals-polyfill-core-v1 (npm) GHSA-h475-44q2-vfjx, MAL-2026-17303 | Malicious | Not scored | 30 Sep, 2026 | npm web-vitals-polyfill-core-v1 |
Malicious release: Malicious code in future-scripts (npm) MAL-2026-17418 | Malicious | Not scored | 30 Sep, 2026 | npm future-scripts |
Socket.IO: Engine.IO Protocol Revision Mismatch DoS CVE-2026-102599, GHSA-2gc4-cqfq-p2gv | High | 0.6% | 29 Sep, 2026 | npm engine.io |
Malicious release: Malicious code in fs-commons (npm) MAL-2026-17301 | Malicious | Not scored | 29 Sep, 2026 | npm fs-commons |
Malicious release: Malicious code in common-fs (npm) MAL-2026-17300 | Malicious | Not scored | 29 Sep, 2026 | npm common-fs |
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content CVE-2026-114104, GHSA-p634-w6r4-rjp2 | High | 0.3% | 29 Sep, 2026 | npm adm-zip |
adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path CVE-2026-114103, GHSA-c6fg-446q-cg94 | Medium | 0.4% | 29 Sep, 2026 | npm adm-zip |
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS) CVE-2026-114102, GHSA-8238-w5pm-2374 | High | 0.5% | 29 Sep, 2026 | npm adm-zip |
Malicious release: Malicious code in test-agency-assignment-01 (npm) MAL-2026-17296 | Malicious | Not scored | 29 Sep, 2026 | npm test-agency-assignment-01 |
Malicious release: Malicious code in test-agency-assignment-02 (npm) MAL-2026-17297 | Malicious | Not scored | 29 Sep, 2026 | npm test-agency-assignment-02 |
Malicious release: Malicious code in test-agency-assign (npm) MAL-2026-17295 | Malicious | Not scored | 29 Sep, 2026 | npm test-agency-assign |
Malicious release: Malicious code in testosu8887 (npm) MAL-2026-17299 | Malicious | Not scored | 29 Sep, 2026 | npm testosu8887 |
Malicious release: Malicious code in testosu888 (npm) MAL-2026-17298 | Malicious | Not scored | 29 Sep, 2026 | npm testosu888 |
Malicious release: Malicious code in @selfpentest/eslint-pentest-plugin (npm) MAL-2026-17293 | Malicious | Not scored | 29 Sep, 2026 | npm @selfpentest/eslint-pentest-plugin |
Malicious release: Malicious code in @selfpentest/bin-confusion (npm) MAL-2026-17292 | Malicious | Not scored | 29 Sep, 2026 | npm @selfpentest/bin-confusion |
Malicious release: Malicious code in @rutxploit-sec/waves-icons (npm) MAL-2026-17291 | Malicious | Not scored | 29 Sep, 2026 | npm @rutxploit-sec/waves-icons |
Malicious release: Malicious code in @rutxploit-sec/subsplash-google-tag-manager (npm) MAL-2026-17289 | Malicious | Not scored | 29 Sep, 2026 | npm @rutxploit-sec/subsplash-google-tag-manager |
Malicious release: Malicious code in @rutxploit-sec/subsplash-canny (npm) MAL-2026-17288 | Malicious | Not scored | 29 Sep, 2026 | npm @rutxploit-sec/subsplash-canny |
Malicious release: Malicious code in @rutxploit-sec/waves-button-poc (npm) MAL-2026-17290 | Malicious | Not scored | 29 Sep, 2026 | npm @rutxploit-sec/waves-button-poc |
Malicious release: Malicious code in @chatunity/baileys (npm) GHSA-2vxg-pmhf-2c8r, MAL-2026-17287 | Malicious | Not scored | 29 Sep, 2026 | npm @chatunity/baileys |
Malicious release: Malicious code in @akapaki/baileys (npm) GHSA-gxxr-g857-qmrh, MAL-2026-17285 | Malicious | Not scored | 29 Sep, 2026 | npm @akapaki/baileys |
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection CVE-2026-102829, GHSA-v5rq-49vh-5v5c | Critical | 0.3% | 29 Sep, 2026 | npm @simple-git/argv-parser |
simple-git unsafe-operation guard does not block trailer command configuration CVE-2026-102828, GHSA-x6jw-m9v5-85vh | Critical | 0.4% | 29 Sep, 2026 | npm simple-git |
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) CVE-2026-102827, GHSA-858h-whjf-mvg5 | Critical | 0.6% | 29 Sep, 2026 | npm simple-git |
simple-git allows command execution through unblocked Git configuration includes CVE-2026-102826, GHSA-g4wm-2vf7-vfgr | High | 0.5% | 29 Sep, 2026 | npm simple-git |
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation CVE-2026-102282, GHSA-j5f4-cc29-5x44 | High | 0.2% | 29 Sep, 2026 | npm adm-zip |
Electron: Local race condition in Squirrel.Mac update installation on macOS CVE-2026-102672, GHSA-vv43-5jgx-7qv8 | Medium | 0.1% | 29 Sep, 2026 | npm electron |
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer CVE-2026-102677, GHSA-qmv3-fv6v-rmhq | High | 0.1% | 29 Sep, 2026 | npm electron |
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds GHSA-253c-mchw-3w2r | Medium | Not scored | 29 Sep, 2026 | npm markdown-it |
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources GHSA-r3ph-w7gj-g6xm | Medium | Not scored | 29 Sep, 2026 | npm js-yaml |
Malicious release: Malicious code in fabric-loader-core (npm) MAL-2026-17306 | Malicious | Not scored | 29 Sep, 2026 | npm fabric-loader-core |
Malicious release: Malicious code in sk-lib-enc (npm) GHSA-jcvm-p983-rr37, MAL-2026-17284 | Malicious | Not scored | 29 Sep, 2026 | npm sk-lib-enc |
Malicious release: Malicious code in @xoxo-momo/kit (npm) GHSA-668x-2p2f-6963, MAL-2026-17283 | Malicious | Not scored | 29 Sep, 2026 | npm @xoxo-momo/kit |
Malicious release: Malicious code in @hrmony/hyper-json-builder (npm) GHSA-r476-wfgx-8rc7, MAL-2026-17282 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/hyper-json-builder |
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions CVE-2026-102676, GHSA-9qh4-3jw8-366w | Critical | 0.5% | 29 Sep, 2026 | npm electron |
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled CVE-2026-102675, GHSA-j84w-jfhq-vhvj | High | 0.2% | 29 Sep, 2026 | npm electron |
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions CVE-2026-102674, GHSA-gr2m-v5gq-v685 | High | 0.2% | 29 Sep, 2026 | npm electron |
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab CVE-2026-102673, GHSA-hq2x-r82h-9wj4 | High | 0.1% | 29 Sep, 2026 | npm electron |
Malicious release: Malicious code in @hrmony/kit-1 (npm) MAL-2026-17264 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/kit-1 |
Malicious release: Malicious code in @hrmony/kit (npm) MAL-2026-17263 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/kit |
Malicious release: Malicious code in @hrmony/kit-4 (npm) MAL-2026-17265 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/kit-4 |
Malicious release: Malicious code in @hrmony/kit-5 (npm) GHSA-96c4-q73c-c32q, MAL-2026-17266 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/kit-5 |
Malicious release: Malicious code in @hrmony/benefit-essenszuschuss (npm) GHSA-2c72-pm8g-m65j, MAL-2026-17253 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/benefit-essenszuschuss |
Malicious release: Malicious code in @hrmony/account-management (npm) GHSA-ppvh-5qcf-3gvr, MAL-2026-17249 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/account-management |