Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @activation_code/error (npm) GHSA-hrpv-vm88-vgfx, MAL-2026-3107 | Malicious | Not scored | 27 Apr, 2026 | npm @activation_code/error |
Malicious release: Malicious code in @apple-pay-trust/finish (npm) GHSA-45wm-8rff-vxfr, MAL-2026-3114 | Malicious | Not scored | 27 Apr, 2026 | npm @apple-pay-trust/finish |
Malicious release: Malicious code in @apple-pay-trust/check-apple-pay-result (npm) GHSA-rcv5-83j3-954q, MAL-2026-3113 | Malicious | Not scored | 27 Apr, 2026 | npm @apple-pay-trust/check-apple-pay-result |
Malicious release: Malicious code in @apiary-annex/title (npm) GHSA-mw85-996v-w3pc, MAL-2026-3110 | Malicious | Not scored | 27 Apr, 2026 | npm @apiary-annex/title |
Malicious release: Malicious code in apple-internal-dev-check (npm) GHSA-p9p8-h8cq-mhq7, MAL-2026-3124 | Malicious | Not scored | 27 Apr, 2026 | npm apple-internal-dev-check |
Malicious release: Malicious code in shopify-app-extension-template (npm) MAL-2026-3051 | Malicious | Not scored | 26 Apr, 2026 | npm shopify-app-extension-template |
Malicious release: Malicious code in frank-research-poc-apple (npm) GHSA-78hq-gp8w-grwp, MAL-2026-3081 | Malicious | Not scored | 26 Apr, 2026 | npm frank-research-poc-apple |
Malicious release: Malicious code in @clearpool/streaming (npm) GHSA-m2h2-p59r-798j, MAL-2026-3057 | Malicious | Not scored | 26 Apr, 2026 | npm @clearpool/streaming |
Malicious release: Malicious code in @clearpool/table (npm) GHSA-vxmm-j4j5-8q23, MAL-2026-3058 | Malicious | Not scored | 26 Apr, 2026 | npm @clearpool/table |
Malicious release: Malicious code in @clearpool/comms (npm) GHSA-fr5f-hf7f-p9w9, MAL-2026-3056 | Malicious | Not scored | 26 Apr, 2026 | npm @clearpool/comms |
Malicious release: Malicious code in @clearpool/utils (npm) MAL-2026-3059 | Malicious | Not scored | 26 Apr, 2026 | npm @clearpool/utils |
Malicious release: Malicious code in classlink (npm) MAL-2026-3049 | Malicious | Not scored | 26 Apr, 2026 | npm classlink |
Malicious release: Malicious code in frank-bot-gogle-cloning (npm) GHSA-52j3-fx2q-cqm9, MAL-2026-3080 | Malicious | Not scored | 26 Apr, 2026 | npm frank-bot-gogle-cloning |
Malicious release: Malicious code in @tw-marionette/clipboard (npm) GHSA-64qv-3564-73rg, MAL-2026-3070 | Malicious | Not scored | 26 Apr, 2026 | npm @tw-marionette/clipboard |
Malicious release: Malicious code in @ozon-complt/antibot-handler (npm) GHSA-m2jf-j5v5-wwx9, MAL-2026-3066 | Malicious | Not scored | 26 Apr, 2026 | npm @ozon-complt/antibot-handler |
Malicious release: Malicious code in @ozon-complt/split (npm) GHSA-cvr6-x554-xx2x, MAL-2026-3067 | Malicious | Not scored | 26 Apr, 2026 | npm @ozon-complt/split |
OpenClaw: Agent gateway config mutations could change protected operator settings CVE-2026-45001, GHSA-7jm2-g593-4qrc | Medium | 0.2% | 25 Apr, 2026 | npm openclaw |
OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy CVE-2026-44998, GHSA-qrp5-gfw2-gxv4 | Medium | 0.7% | 25 Apr, 2026 | npm openclaw |
OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests CVE-2026-44992, GHSA-h2vw-ph2c-jvwf | Medium | 0.1% | 25 Apr, 2026 | npm openclaw |
OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks CVE-2026-45000, GHSA-j4c5-89f5-f3pm | Low | 0.2% | 25 Apr, 2026 | npm openclaw |
OpenClaw: QQBot direct media upload skipped URL SSRF validation CVE-2026-44117, GHSA-c4qg-j8jg-42q5 | Medium | 0.2% | 25 Apr, 2026 | npm openclaw |
OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config CVE-2026-44995, GHSA-mj59-h3q9-ghfh | Medium | 0.1% | 25 Apr, 2026 | npm openclaw |
OpenClaw: Isolated cron awareness events were recorded as trusted system events CVE-2026-44999, GHSA-57r2-h2wj-g887 | Medium | 0.2% | 25 Apr, 2026 | npm openclaw |
OpenClaw: Workspace dotenv could override runtime-control environment variables CVE-2026-44114, GHSA-hxvm-xjvf-93f3 | High | 0.1% | 25 Apr, 2026 | npm openclaw |
OpenClaw: Feishu card actions could misclassify DMs and skip dmPolicy CVE-2026-44993, GHSA-72q8-jcmc-97wx | Medium | 0.3% | 25 Apr, 2026 | npm openclaw |
OpenClaw: Hook mapping templates could bypass hook session-key opt-in CVE-2026-45002, GHSA-2xcp-x87w-q377 | Medium | 0.3% | 25 Apr, 2026 | npm openclaw |
n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode CVE-2026-42282, GHSA-wg4g-395p-mqv3 | Medium | 0.3% | 25 Apr, 2026 | npm n8n-mcp |
Malicious release: Malicious code in @apple-pay-trust/merchant-session (npm) GHSA-28hg-c8r7-mcvq, MAL-2026-3053 | Malicious | Not scored | 25 Apr, 2026 | npm @apple-pay-trust/merchant-session |
Malicious release: Malicious code in @google-pay-trust/cancelled (npm) GHSA-468m-q27w-9r8c, MAL-2026-3062 | Malicious | Not scored | 25 Apr, 2026 | npm @google-pay-trust/cancelled |
Malicious release: Malicious code in @google-pay-trust/authorize-payment (npm) GHSA-rpp8-r54f-pm33, MAL-2026-3061 | Malicious | Not scored | 25 Apr, 2026 | npm @google-pay-trust/authorize-payment |
Malicious release: Malicious code in @apple-pay-trust/start (npm) GHSA-crv2-p353-52gh, MAL-2026-3054 | Malicious | Not scored | 25 Apr, 2026 | npm @apple-pay-trust/start |
Malicious release: Malicious code in @google-pay-trust/init-google-pay (npm) GHSA-772p-cqpx-g783, MAL-2026-3064 | Malicious | Not scored | 25 Apr, 2026 | npm @google-pay-trust/init-google-pay |
Malicious release: Malicious code in @google-pay-trust/finish (npm) GHSA-g326-rcxw-2m3g, MAL-2026-3063 | Malicious | Not scored | 25 Apr, 2026 | npm @google-pay-trust/finish |
Malicious release: Malicious code in @apple-pay-trust/validate-merchant (npm) GHSA-wqf2-mrc2-r8j3, MAL-2026-3055 | Malicious | Not scored | 25 Apr, 2026 | npm @apple-pay-trust/validate-merchant |
Malicious release: Malicious code in apollo-vertex (npm) GHSA-ch5h-3gj9-4r8q, MAL-2026-3040 | Malicious | Not scored | 25 Apr, 2026 | npm apollo-vertex |
Malicious release: Malicious code in apollo-landing (npm) GHSA-9qp9-qwfr-p72c, MAL-2026-3038 | Malicious | Not scored | 25 Apr, 2026 | npm apollo-landing |
Malicious release: Malicious code in process-app-task (npm) GHSA-388h-jcvw-5634, MAL-2026-3039 | Malicious | Not scored | 25 Apr, 2026 | npm process-app-task |
Malicious release: Malicious code in @tw-models/storage (npm) GHSA-qr4v-hj88-g7j6, MAL-2026-3072 | Malicious | Not scored | 25 Apr, 2026 | npm @tw-models/storage |
Malicious release: Malicious code in @tw-marionette/input (npm) GHSA-584r-4qf7-jqf3, MAL-2026-3071 | Malicious | Not scored | 25 Apr, 2026 | npm @tw-marionette/input |
Malicious release: Malicious code in @tw-utils/static (npm) GHSA-v3mw-r645-qc2r, MAL-2026-3073 | Malicious | Not scored | 25 Apr, 2026 | npm @tw-utils/static |
Malicious release: Malicious code in standalone-apps (npm) GHSA-9whf-2j26-8mhh, MAL-2026-3037 | Malicious | Not scored | 25 Apr, 2026 | npm standalone-apps |
Malicious release: Malicious code in uipath-ui-widgets (npm) GHSA-x45w-938v-6p65, MAL-2026-3036 | Malicious | Not scored | 25 Apr, 2026 | npm uipath-ui-widgets |
Malicious release: Malicious code in kl-b2c-ui-kit (npm) GHSA-jwhp-97gv-chg5, MAL-2026-3082 | Malicious | Not scored | 25 Apr, 2026 | npm kl-b2c-ui-kit |
Malicious release: Malicious code in @sbt_gitverse/analytics-client (npm) GHSA-q9xj-mpqj-qpcc, MAL-2026-3068 | Malicious | Not scored | 25 Apr, 2026 | npm @sbt_gitverse/analytics-client |
Malicious release: Malicious code in tether-base (npm) GHSA-gwg8-p6mg-cp7g, MAL-2026-3033 | Malicious | Not scored | 25 Apr, 2026 | npm tether-base |
Malicious release: Malicious code in axis-ui-generator (npm) MAL-2026-3079 | Malicious | Not scored | 25 Apr, 2026 | npm axis-ui-generator |
Malicious release: Malicious code in axis-abc-search-address (npm) GHSA-r78p-pprh-8hvp, MAL-2026-3076 | Malicious | Not scored | 25 Apr, 2026 | npm axis-abc-search-address |
Malicious release: Malicious code in axis-abc-portal-menu (npm) MAL-2026-3074 | Malicious | Not scored | 25 Apr, 2026 | npm axis-abc-portal-menu |
Malicious release: Malicious code in axis-abc-search-account (npm) GHSA-q53f-j5w8-x7vh, MAL-2026-3075 | Malicious | Not scored | 25 Apr, 2026 | npm axis-abc-search-account |
Malicious release: Malicious code in axis-notification (npm) GHSA-2fp7-j74x-chvv, MAL-2026-3078 | Malicious | Not scored | 25 Apr, 2026 | npm axis-notification |