Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in cardreadermgmtserv (npm) MAL-2026-2738 | Malicious | Not scored | 16 Apr, 2026 | npm cardreadermgmtserv |
Malicious release: Malicious code in business-data (npm) MAL-2026-2737 | Malicious | Not scored | 16 Apr, 2026 | npm business-data |
Malicious release: Malicious code in buildkite-test-collector-vitest-example (npm) MAL-2026-2736 | Malicious | Not scored | 16 Apr, 2026 | npm buildkite-test-collector-vitest-example |
Malicious release: Malicious code in buildkite-test-collector-playwright-example (npm) MAL-2026-2735 | Malicious | Not scored | 16 Apr, 2026 | npm buildkite-test-collector-playwright-example |
Malicious release: Malicious code in buildkite-test-collector-mocha-example (npm) MAL-2026-2734 | Malicious | Not scored | 16 Apr, 2026 | npm buildkite-test-collector-mocha-example |
Malicious release: Malicious code in buildkite-test-collector-jest-example (npm) MAL-2026-2733 | Malicious | Not scored | 16 Apr, 2026 | npm buildkite-test-collector-jest-example |
Malicious release: Malicious code in buildkite-test-collector-jasmine-example (npm) MAL-2026-2732 | Malicious | Not scored | 16 Apr, 2026 | npm buildkite-test-collector-jasmine-example |
Malicious release: Malicious code in buildkite-test-collector-cypress-example (npm) MAL-2026-2731 | Malicious | Not scored | 16 Apr, 2026 | npm buildkite-test-collector-cypress-example |
Malicious release: Malicious code in browserstack-utils (npm) MAL-2026-2730 | Malicious | Not scored | 16 Apr, 2026 | npm browserstack-utils |
Malicious release: Malicious code in apl-github-test (npm) MAL-2026-2729 | Malicious | Not scored | 16 Apr, 2026 | npm apl-github-test |
Malicious release: Malicious code in apl-announcements (npm) MAL-2026-2728 | Malicious | Not scored | 16 Apr, 2026 | npm apl-announcements |
Malicious release: Malicious code in agent-starter (npm) MAL-2026-2727 | Malicious | Not scored | 16 Apr, 2026 | npm agent-starter |
Malicious release: Malicious code in agent-scheduler (npm) MAL-2026-2726 | Malicious | Not scored | 16 Apr, 2026 | npm agent-scheduler |
Malicious release: Malicious code in agent-framework-web (npm) MAL-2026-2725 | Malicious | Not scored | 16 Apr, 2026 | npm agent-framework-web |
Malicious release: Malicious code in agdebugger-frontend (npm) MAL-2026-2724 | Malicious | Not scored | 16 Apr, 2026 | npm agdebugger-frontend |
Malicious release: Malicious code in actions-label-commenter (npm) MAL-2026-2723 | Malicious | Not scored | 16 Apr, 2026 | npm actions-label-commenter |
Malicious release: Malicious code in action-setup-enos (npm) MAL-2026-2722 | Malicious | Not scored | 16 Apr, 2026 | npm action-setup-enos |
Malicious release: Malicious code in access-worker-test (npm) MAL-2026-2721 | Malicious | Not scored | 16 Apr, 2026 | npm access-worker-test |
Malicious release: Malicious code in aca-review-apps (npm) MAL-2026-2720 | Malicious | Not scored | 16 Apr, 2026 | npm aca-review-apps |
Malicious release: Malicious code in @youcanneverguessthisonereally/test-pkg (npm) MAL-2026-2719 | Malicious | Not scored | 16 Apr, 2026 | npm @youcanneverguessthisonereally/test-pkg |
Malicious release: Malicious code in @the-coca-cola-company/receipt-scanner-admin-lib (npm) MAL-2026-2718 | Malicious | Not scored | 16 Apr, 2026 | npm @the-coca-cola-company/receipt-scanner-admin-lib |
Malicious release: Malicious code in @tax-taxdev/tools-scripts (npm) MAL-2026-2717 | Malicious | Not scored | 16 Apr, 2026 | npm @tax-taxdev/tools-scripts |
Malicious release: Malicious code in @mesh-atoms/typography (npm) MAL-2026-2715 | Malicious | Not scored | 16 Apr, 2026 | npm @mesh-atoms/typography |
Malicious release: Malicious code in @gameforge/http-server (npm) MAL-2026-2714 | Malicious | Not scored | 16 Apr, 2026 | npm @gameforge/http-server |
Malicious release: Malicious code in @fuego-tools/analytics (npm) MAL-2026-2713 | Malicious | Not scored | 16 Apr, 2026 | npm @fuego-tools/analytics |
Malicious release: Malicious code in @evoja-web/redaction (npm) MAL-2026-2712 | Malicious | Not scored | 16 Apr, 2026 | npm @evoja-web/redaction |
Malicious release: Malicious code in @evoja-web/react-login (npm) MAL-2026-2711 | Malicious | Not scored | 16 Apr, 2026 | npm @evoja-web/react-login |
Malicious release: Malicious code in @evoja-web/create-react-project (npm) MAL-2026-2710 | Malicious | Not scored | 16 Apr, 2026 | npm @evoja-web/create-react-project |
Malicious release: Malicious code in @appleseed-apple/ac-sass-kit (npm) MAL-2026-2709 | Malicious | Not scored | 16 Apr, 2026 | npm @appleseed-apple/ac-sass-kit |
Malicious release: Malicious code in @3stripes/toolkit (npm) GHSA-pfgm-5fhw-w44m, MAL-2026-2708 | Malicious | Not scored | 16 Apr, 2026 | npm @3stripes/toolkit |
Malicious release: Malicious code in @3stripes/shared (npm) GHSA-wq4q-g6ff-rpgf, MAL-2026-2707 | Malicious | Not scored | 16 Apr, 2026 | npm @3stripes/shared |
Malicious release: Malicious code in @3stripes/sdk (npm) GHSA-37c3-3hx2-jvj5, MAL-2026-2706 | Malicious | Not scored | 16 Apr, 2026 | npm @3stripes/sdk |
Malicious release: Malicious code in @3stripes/config (npm) GHSA-53jj-98mm-ggjc, MAL-2026-2704 | Malicious | Not scored | 16 Apr, 2026 | npm @3stripes/config |
Malicious release: Malicious code in @3stripes/core (npm) GHSA-jqxm-c3m7-98wm, MAL-2026-2705 | Malicious | Not scored | 16 Apr, 2026 | npm @3stripes/core |
Malicious release: Malicious code in @3stripes/components (npm) GHSA-7rxq-pj4x-c3gv, MAL-2026-2703 | Malicious | Not scored | 16 Apr, 2026 | npm @3stripes/components |
Malicious release: Malicious code in nj-logger (npm) MAL-2026-2907 | Malicious | Not scored | 16 Apr, 2026 | npm nj-logger |
Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance CVE-2026-76226, GHSA-5vjq-5jmg-39xq | Medium | 0.3% | 16 Apr, 2026 | npm renovate |
Malicious release: Malicious code in pretty-logger-js (npm) GHSA-qfx3-7369-9f9v, MAL-2026-2908 | Malicious | Not scored | 16 Apr, 2026 | npm pretty-logger-js |
Malicious release: Malicious code in vite-plugin-compress-plus (npm) MAL-2026-2913 | Malicious | Not scored | 16 Apr, 2026 | npm vite-plugin-compress-plus |
LangSmith SDK: Streaming token events bypass output redaction CVE-2026-41182, GHSA-rr7j-v2q5-chgv, PYSEC-2026-2583 | Medium | 0.2% | 16 Apr, 2026 | PyPI langsmith npm langsmith |
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME CVE-2026-41211, GHSA-33r3-4whc-44c2 | High | 0.3% | 16 Apr, 2026 | npm vite-plus |
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR CVE-2026-56761, GHSA-458j-xx4x-4375 | Medium | 0.3% | 16 Apr, 2026 | npm hono |
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation CVE-2026-65903, GHSA-39q2-94rc-95cp | Medium | 0.3% | 16 Apr, 2026 | npm dompurify |
Malicious release: Malicious code in terminal-formatter (npm) MAL-2026-2911 | Malicious | Not scored | 16 Apr, 2026 | npm terminal-formatter |
Malicious release: Malicious code in tailwind-typography-cssstyle (npm) GHSA-p4c4-cvj7-95pp, MAL-2026-2909 | Malicious | Not scored | 15 Apr, 2026 | npm tailwind-typography-cssstyle |
Malicious release: Malicious code in tailwindthml-flips (npm) GHSA-wqqm-f8q9-pgmm, MAL-2026-2910 | Malicious | Not scored | 15 Apr, 2026 | npm tailwindthml-flips |
Malicious release: Malicious code in trgrip (npm) MAL-2026-2912 | Malicious | Not scored | 15 Apr, 2026 | npm trgrip |
Malicious release: Malicious code in simple-auth-basic (npm) GHSA-4v3c-c5pj-m2qq, MAL-2026-2905 | Malicious | Not scored | 15 Apr, 2026 | npm simple-auth-basic |
Malicious release: Malicious code in swplayer-react-sl (npm) GHSA-959p-q4g9-cc8r, MAL-2026-2906 | Malicious | Not scored | 15 Apr, 2026 | npm swplayer-react-sl |
Malicious release: Malicious code in chai-str (npm) GHSA-286p-r2qw-c6p5, MAL-2026-2898 | Malicious | Not scored | 15 Apr, 2026 | npm chai-str |