Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @bmg-web/bmg-button (npm) MAL-2026-2981 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-button |
Malicious release: Malicious code in @bmg-web/bmg-dropdown (npm) MAL-2026-2986 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-dropdown |
Malicious release: Malicious code in @bmg-web/bmg-ajax (npm) MAL-2026-2980 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-ajax |
Malicious release: Malicious code in @bmg-web-features/bmg-user-interaction-tracker (npm) MAL-2026-2989 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web-features/bmg-user-interaction-tracker |
Malicious release: Malicious code in @bmg-web/bmg-card (npm) MAL-2026-2982 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-card |
Malicious release: Malicious code in @bmg-web/bmg-external-link (npm) MAL-2026-2987 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-external-link |
Malicious release: Malicious code in tsdoc-build-rig (npm) MAL-2026-2979 | Malicious | Not scored | 22 Apr, 2026 | npm tsdoc-build-rig |
Malicious release: Malicious code in @oec-settlement/react-router (npm) GHSA-qqc6-xp57-98h7, MAL-2026-2978 | Malicious | Not scored | 22 Apr, 2026 | npm @oec-settlement/react-router |
Malicious release: Malicious code in crypto-keccak-js (npm) GHSA-gqj4-7gpv-6w6w, MAL-2026-2975 | Malicious | Not scored | 22 Apr, 2026 | npm crypto-keccak-js |
Malicious release: Malicious code in gleb-js (npm) GHSA-gxf7-922p-wp6q, MAL-2026-2976 | Malicious | Not scored | 22 Apr, 2026 | npm gleb-js |
Malicious release: Malicious code in ts-utils-dev (npm) GHSA-p95c-73jf-8362, MAL-2026-2977 | Malicious | Not scored | 22 Apr, 2026 | npm ts-utils-dev |
Malicious release: Malicious code in claudcode-mcp (npm) GHSA-5v3x-g9r5-vvhg, MAL-2026-2974 | Malicious | Not scored | 22 Apr, 2026 | npm claudcode-mcp |
Malicious release: Malicious code in claudcode-cli (npm) GHSA-65j6-qgfm-6486, MAL-2026-2973 | Malicious | Not scored | 22 Apr, 2026 | npm claudcode-cli |
Malicious release: Malicious code in @usealloy/component-library (npm) GHSA-4g37-2m9h-2w95, MAL-2026-2970 | Malicious | Not scored | 22 Apr, 2026 | npm @usealloy/component-library |
Malicious release: Malicious code in @usealloy/api-contract (npm) GHSA-733p-5g7w-hh7w, MAL-2026-2969 | Malicious | Not scored | 22 Apr, 2026 | npm @usealloy/api-contract |
Malicious release: Malicious code in @bitunix/test (npm) GHSA-mhwj-ggc3-5228, MAL-2026-2968 | Malicious | Not scored | 22 Apr, 2026 | npm @bitunix/test |
Malicious release: Malicious code in @usealloy/typegen (npm) GHSA-qmfv-9964-cvf2, MAL-2026-2971 | Malicious | Not scored | 22 Apr, 2026 | npm @usealloy/typegen |
Malicious release: Malicious code in aven_types (npm) GHSA-r8xm-rx8q-xmr3, MAL-2026-2972 | Malicious | Not scored | 22 Apr, 2026 | npm aven_types |
Astro: XSS in define:vars via incomplete </script> tag sanitization CVE-2026-41067, GHSA-j687-52p2-xcff | Medium | 0.2% | 21 Apr, 2026 | npm astro |
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability CVE-2026-41264, GHSA-3hjv-c53m-58jj | Critical | 1.8% | 21 Apr, 2026 | npm flowise npm flowise-components |
Malicious release: Malicious code in 6161test1234 (npm) GHSA-r9qx-xcg2-7wcc, MAL-2026-2967 | Malicious | Not scored | 21 Apr, 2026 | npm 6161test1234 |
Malicious release: Malicious code in com.tencent.puerts.agent (npm) GHSA-xjh5-rr2q-3382, MAL-2026-2966 | Malicious | Not scored | 21 Apr, 2026 | npm com.tencent.puerts.agent |
Malicious release: Malicious code in apple-internal-security-poc-frank (npm) GHSA-84p7-7qvg-vhvf, MAL-2026-2961 | Malicious | Not scored | 21 Apr, 2026 | npm apple-internal-security-poc-frank |
Malicious release: Malicious code in apple-auth-internal (npm) GHSA-m39f-fr86-j7f7, MAL-2026-2960 | Malicious | Not scored | 21 Apr, 2026 | npm apple-auth-internal |
Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace CVE-2026-39861, GHSA-vp62-r36r-9xqp | High | 0.7% | 21 Apr, 2026 | npm @anthropic-ai/claude-code |
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths CVE-2026-39320, GHSA-7gcj-phff-2884 | High | 0.4% | 21 Apr, 2026 | npm signalk-server |
OpenClaude: Sandbox Bypass via Early-Exit Logic Flaw Allows Path Traversal CVE-2026-35570, GHSA-m6rx-7pvw-2f73 | High | 0.2% | 21 Apr, 2026 | npm @gitlawb/openclaude |
Malicious release: Malicious code in @serasa/core (npm) GHSA-w2qv-ff75-53mf, MAL-2026-2956 | Malicious | Not scored | 20 Apr, 2026 | npm @serasa/core |
Malicious release: Malicious code in @settle-sea/supporting-documents (npm) GHSA-f375-927m-428g, MAL-2026-2952 | Malicious | Not scored | 20 Apr, 2026 | npm @settle-sea/supporting-documents |
Malicious release: Malicious code in bmg-web-features (npm) MAL-2026-2954 | Malicious | Not scored | 20 Apr, 2026 | npm bmg-web-features |
Malicious release: Malicious code in bmg-web (npm) MAL-2026-2953 | Malicious | Not scored | 20 Apr, 2026 | npm bmg-web |
Malicious release: Malicious code in megabank-worklist (npm) MAL-2026-2955 | Malicious | Not scored | 20 Apr, 2026 | npm megabank-worklist |
Malicious release: Malicious code in internal_insights_enabled (npm) GHSA-7xx2-cw9j-xjgc, MAL-2026-2959 | Malicious | Not scored | 20 Apr, 2026 | npm internal_insights_enabled |
Malicious release: Malicious code in hifromhere1 (npm) MAL-2026-2951 | Malicious | Not scored | 20 Apr, 2026 | npm hifromhere1 |
Malicious release: Malicious code in tailwind-text-fill (npm) GHSA-xxgm-722g-xhwg, MAL-2026-2950 | Malicious | Not scored | 20 Apr, 2026 | npm tailwind-text-fill |
Malicious release: Malicious code in npm-doc-deploy (npm) GHSA-3h77-7q59-chhp, MAL-2026-2941 | Malicious | Not scored | 20 Apr, 2026 | npm npm-doc-deploy |
Malicious release: Malicious code in bignum-ts-v2 (npm) GHSA-m7pg-7qqx-66f5, MAL-2026-2938 | Malicious | Not scored | 20 Apr, 2026 | npm bignum-ts-v2 |
Malicious release: Malicious code in @tushar-br/editing-pack (npm) GHSA-7wjj-mwx4-cxx5, MAL-2026-2936 | Malicious | Not scored | 20 Apr, 2026 | npm @tushar-br/editing-pack |
Malicious release: Malicious code in @tushar-br/desktop (npm) GHSA-crxh-425q-78hj, MAL-2026-2935 | Malicious | Not scored | 20 Apr, 2026 | npm @tushar-br/desktop |
Malicious release: Malicious code in @tushar-br/file11 (npm) GHSA-mxxq-gg42-8p97, MAL-2026-2937 | Malicious | Not scored | 20 Apr, 2026 | npm @tushar-br/file11 |
Malicious release: Malicious code in krdfonts (npm) GHSA-vj4v-6qjg-33v7, MAL-2026-2939 | Malicious | Not scored | 20 Apr, 2026 | npm krdfonts |
Malicious release: Malicious code in @otaxayuns/baileys (npm) GHSA-4vx6-qhj8-f6cr, MAL-2026-2934 | Malicious | Not scored | 20 Apr, 2026 | npm @otaxayuns/baileys |
Malicious release: Malicious code in turbo-he (npm) GHSA-6xh4-h79w-9w2q, MAL-2026-2943 | Malicious | Not scored | 20 Apr, 2026 | npm turbo-he |
Malicious release: Malicious code in optimized-fastest-levenshtein (npm) GHSA-cwvx-mmxj-v8ww, MAL-2026-2942 | Malicious | Not scored | 20 Apr, 2026 | npm optimized-fastest-levenshtein |
Malicious release: Malicious code in mailcraftjs (npm) GHSA-vq82-2629-gfqq, MAL-2026-2940 | Malicious | Not scored | 20 Apr, 2026 | npm mailcraftjs |
Malicious release: Malicious code in turbo-leven (npm) GHSA-w2j4-whh4-rr63, MAL-2026-2944 | Malicious | Not scored | 20 Apr, 2026 | npm turbo-leven |
Malicious release: Malicious code in @kjma/mailcraft (npm) GHSA-xf6v-jvfc-m994, MAL-2026-2933 | Malicious | Not scored | 20 Apr, 2026 | npm @kjma/mailcraft |
Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization CVE-2026-6594, GHSA-3jc6-6r48-v6qf | Medium | 0.3% | 20 Apr, 2026 | npm @brikcss/merge |
Malicious release: Malicious code in chandan-module-test (npm) MAL-2026-2921 | Malicious | Not scored | 19 Apr, 2026 | npm chandan-module-test |
Malicious release: Malicious code in pa-marked-internal (npm) MAL-2026-2928 | Malicious | Not scored | 19 Apr, 2026 | npm pa-marked-internal |