Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @hrmony/app-gateway-templates (npm) GHSA-52pw-jwv9-q65v, MAL-2026-17251 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/app-gateway-templates |
Malicious release: Malicious code in @hrmony/interfaces (npm) GHSA-h2q3-6wwv-v7c8, MAL-2026-17262 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/interfaces |
Malicious release: Malicious code in @hrmony/benefit-internetzuschuss (npm) GHSA-784r-8wmx-42h3, MAL-2026-17254 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/benefit-internetzuschuss |
Malicious release: Malicious code in @hrmony/cdk-constructs (npm) GHSA-h9qw-wcm3-qrr8, MAL-2026-17258 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/cdk-constructs |
Malicious release: Malicious code in @hrmony/benefit-mobilitaet (npm) GHSA-87h6-fqj7-r5rw, MAL-2026-17255 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/benefit-mobilitaet |
Malicious release: Malicious code in @hrmony/organisationsverwaltung (npm) GHSA-gxrr-r3q5-4429, MAL-2026-17270 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/organisationsverwaltung |
Malicious release: Malicious code in @hrmony/benefit-sachbezug (npm) GHSA-jr8j-48fj-734v, MAL-2026-17256 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/benefit-sachbezug |
Malicious release: Malicious code in @hrmony/benefitverwaltung (npm) GHSA-xvwj-8x3p-gr7w, MAL-2026-17257 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/benefitverwaltung |
Malicious release: Malicious code in @hrmony/pladddform-application (npm) GHSA-wrw4-45wp-75v5, MAL-2026-17271 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/pladddform-application |
Malicious release: Malicious code in @hrmony/middlewares (npm) GHSA-5cwm-5j38-r753, MAL-2026-17269 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/middlewares |
Malicious release: Malicious code in @hrmony/mailer-pladddform (npm) GHSA-75mr-rmf4-wr8j, MAL-2026-17268 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/mailer-pladddform |
Malicious release: Malicious code in @hrmony/component-library (npm) GHSA-cjfr-hq8x-q26q, MAL-2026-17259 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/component-library |
Malicious release: Malicious code in @hrmony/pladddform-codegen (npm) GHSA-4jh6-g3hw-7qjc, MAL-2026-17273 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/pladddform-codegen |
Malicious release: Malicious code in @hrmony/pladddform-config (npm) GHSA-pgw6-px39-j8m8, MAL-2026-17274 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/pladddform-config |
Malicious release: Malicious code in @hrmony/pladddform-cli (npm) GHSA-7j4w-rjm5-96qj, MAL-2026-17272 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/pladddform-cli |
Malicious release: Malicious code in @hrmony/pladddform-shared-infrastructure (npm) GHSA-xvjm-3hmh-7v4h, MAL-2026-17279 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/pladddform-shared-infrastructure |
Malicious release: Malicious code in @hrmony/pladddform-partner-registry (npm) GHSA-757q-42rv-qjcf, MAL-2026-17278 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/pladddform-partner-registry |
Malicious release: Malicious code in @hrmony/pladddform-testing (npm) GHSA-wc37-mwww-8cwr, MAL-2026-17280 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/pladddform-testing |
Malicious release: Malicious code in @hrmony/api-gateway-service-config (npm) GHSA-36rr-7v5c-qjqv, MAL-2026-17250 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/api-gateway-service-config |
Malicious release: Malicious code in @hrmony/valuenet (npm) GHSA-5958-mpfq-wfrj, MAL-2026-17281 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/valuenet |
Malicious release: Malicious code in @hrmony/pladddform-infrastructure (npm) GHSA-rvhw-f5hm-gj2w, MAL-2026-17277 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/pladddform-infrastructure |
Malicious release: Malicious code in @hrmony/belegerfassung-pladddform (npm) GHSA-5hfp-jjv9-69q8, MAL-2026-17252 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/belegerfassung-pladddform |
Malicious release: Malicious code in @hrmony/devtool-configuration (npm) GHSA-qh4w-rc3m-9898, MAL-2026-17260 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/devtool-configuration |
Malicious release: Malicious code in @hrmony/lohndateien (npm) GHSA-xq9r-4rp7-86c2, MAL-2026-17267 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/lohndateien |
Malicious release: Malicious code in @hrmony/pladddform-frontend (npm) GHSA-53w6-j9gv-cv5w, MAL-2026-17276 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/pladddform-frontend |
Malicious release: Malicious code in @hrmony/pladddform-core (npm) GHSA-qgqg-65m8-gvwg, MAL-2026-17275 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/pladddform-core |
Malicious release: Malicious code in @hrmony/gutscheinverwaltung (npm) GHSA-g4hp-22g7-9hf5, MAL-2026-17261 | Malicious | Not scored | 29 Sep, 2026 | npm @hrmony/gutscheinverwaltung |
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies CVE-2026-97711, GHSA-gfhx-hw2g-v5hg | Low | 0.3% | 29 Sep, 2026 | npm serialize-javascript |
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup CVE-2026-102600, GHSA-wfpm-5gcm-94cg | High | 0.4% | 29 Sep, 2026 | npm @socket.io/cluster-engine |
Malicious release: Malicious code in dotenv-precheck (npm) MAL-2026-17304 | Malicious | Not scored | 29 Sep, 2026 | npm dotenv-precheck |
Malicious release: Malicious code in dotenv-preflight (npm) MAL-2026-17324 | Malicious | Not scored | 29 Sep, 2026 | npm dotenv-preflight |
Malicious release: Malicious code in exprdd (npm) MAL-2026-17241 | Malicious | Not scored | 29 Sep, 2026 | npm exprdd |
Malicious release: Malicious code in express-javascript (npm) MAL-2026-17242 | Malicious | Not scored | 29 Sep, 2026 | npm express-javascript |
Malicious release: Malicious code in express-nodejs (npm) MAL-2026-17243 | Malicious | Not scored | 29 Sep, 2026 | npm express-nodejs |
Malicious release: Malicious code in exprrdd (npm) MAL-2026-17244 | Malicious | Not scored | 29 Sep, 2026 | npm exprrdd |
Malicious release: Malicious code in exptrdd (npm) MAL-2026-17245 | Malicious | Not scored | 29 Sep, 2026 | npm exptrdd |
Malicious release: Malicious code in exptred (npm) MAL-2026-17246 | Malicious | Not scored | 29 Sep, 2026 | npm exptred |
Malicious release: Malicious code in exptredd (npm) MAL-2026-17247 | Malicious | Not scored | 29 Sep, 2026 | npm exptredd |
Malicious release: Malicious code in xeprews (npm) MAL-2026-17248 | Malicious | Not scored | 29 Sep, 2026 | npm xeprews |
Malicious release: Malicious code in react-nodejs (npm) MAL-2026-17294 | Malicious | Not scored | 29 Sep, 2026 | npm react-nodejs |
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token CVE-2026-102422, GHSA-pqg4-j6r4-53mv | Critical | 0.4% | 29 Sep, 2026 | npm shell-quote |
pbkdf2 rehashes long passwords on every iteration, enabling denial of service CVE-2026-102414, GHSA-477h-4r7f-fvrx | Medium | 0.3% | 29 Sep, 2026 | npm pbkdf2 |
Nest: Remote process termination via a deeply nested microservice message pattern CVE-2026-102281, GHSA-m8vh-jmq9-5rjg | High | 0.6% | 28 Sep, 2026 | npm @nestjs/microservices |
Malicious release: Malicious code in rai6jaisahthaghee5ou-loader-package (npm) MAL-2026-17238 | Malicious | Not scored | 28 Sep, 2026 | npm rai6jaisahthaghee5ou-loader-package |
Malicious release: Malicious code in hardhat-zet (npm) GHSA-mw8r-6m3f-qmg8, MAL-2026-17234 | Malicious | Not scored | 28 Sep, 2026 | npm hardhat-zet |
Malicious release: Malicious code in hardhat-lock (npm) MAL-2026-17233 | Malicious | Not scored | 28 Sep, 2026 | npm hardhat-lock |
Malicious release: Malicious code in mini-hardhat (npm) MAL-2026-17236 | Malicious | Not scored | 28 Sep, 2026 | npm mini-hardhat |
Malicious release: Malicious code in native-env (npm) MAL-2026-17237 | Malicious | Not scored | 28 Sep, 2026 | npm native-env |
Malicious release: Malicious code in dotenv-native (npm) MAL-2026-17231 | Malicious | Not scored | 28 Sep, 2026 | npm dotenv-native |
Malicious release: Malicious code in fabric-native-loader (npm) MAL-2026-17232 | Malicious | Not scored | 28 Sep, 2026 | npm fabric-native-loader |