Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in chai-as-adapter (npm) GHSA-38vm-pgm6-6g7p, MAL-2026-2885 | Malicious | Not scored | 15 Apr, 2026 | npm chai-as-adapter |
Malicious release: Malicious code in chai-as-type (npm) GHSA-38w3-8j54-936j, MAL-2026-2740 | Malicious | Not scored | 15 Apr, 2026 | npm chai-as-type |
Malicious release: Malicious code in chai-as-mobj (npm) GHSA-3q98-w67h-r2cr, MAL-2026-2893 | Malicious | Not scored | 15 Apr, 2026 | npm chai-as-mobj |
Malicious release: Malicious code in chai-as-inserted (npm) GHSA-472w-9h7g-j276, MAL-2026-2892 | Malicious | Not scored | 15 Apr, 2026 | npm chai-as-inserted |
Malicious release: Malicious code in chai-as-encrypted (npm) GHSA-5m93-37pp-5rc3, MAL-2026-2888 | Malicious | Not scored | 15 Apr, 2026 | npm chai-as-encrypted |
Malicious release: Malicious code in chai-as-stream (npm) GHSA-6xjm-3c84-552p, MAL-2026-2896 | Malicious | Not scored | 15 Apr, 2026 | npm chai-as-stream |
Malicious release: Malicious code in chai-as-evm (npm) GHSA-826h-2vvx-vf77, MAL-2026-2889 | Malicious | Not scored | 15 Apr, 2026 | npm chai-as-evm |
Malicious release: Malicious code in trackora-chain (npm) GHSA-874r-5jxm-vm42, MAL-2026-2903 | Malicious | Not scored | 15 Apr, 2026 | npm trackora-chain |
Malicious release: Malicious code in chai-as-chain-v2 (npm) GHSA-89j2-wcf8-hqm3, MAL-2026-2886 | Malicious | Not scored | 15 Apr, 2026 | npm chai-as-chain-v2 |
Malicious release: Malicious code in trackora-node (npm) GHSA-98cf-4fx3-32vx, MAL-2026-2904 | Malicious | Not scored | 15 Apr, 2026 | npm trackora-node |
Malicious release: Malicious code in chai-beta (npm) GHSA-c6w2-3qw2-g5fm, MAL-2026-2897 | Malicious | Not scored | 15 Apr, 2026 | npm chai-beta |
Malicious release: Malicious code in env_express (npm) GHSA-gw3g-c463-2jw5, MAL-2026-2901 | Malicious | Not scored | 15 Apr, 2026 | npm env_express |
Malicious release: Malicious code in chai-as-elevated (npm) GHSA-p5jq-3963-9qmx, MAL-2026-2887 | Malicious | Not scored | 15 Apr, 2026 | npm chai-as-elevated |
Malicious release: Malicious code in lockedin-chai-chain (npm) GHSA-x4j5-4v2p-qc2g, MAL-2026-2902 | Malicious | Not scored | 15 Apr, 2026 | npm lockedin-chai-chain |
Malicious release: Malicious code in chai-use-chains (npm) GHSA-x74q-vqg8-cc8f, MAL-2026-2899 | Malicious | Not scored | 15 Apr, 2026 | npm chai-use-chains |
Malicious release: Malicious code in chai-as-nobj (npm) MAL-2026-2894 | Malicious | Not scored | 15 Apr, 2026 | npm chai-as-nobj |
Malicious release: Malicious code in dotenv-pack (npm) MAL-2026-2900 | Malicious | Not scored | 15 Apr, 2026 | npm dotenv-pack |
sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements CVE-2026-40186, GHSA-9mrh-v2v3-xpfm | Medium | 0.2% | 15 Apr, 2026 | npm sanitize-html |
ApostropheCMS: Information Disclosure via choices/counts Query Parameters Bypassing publicApiProjection Field Restrictions CVE-2026-39857, GHSA-c276-fj82-f2pq | Medium | 0.4% | 15 Apr, 2026 | npm apostrophe |
Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS CVE-2026-35569, GHSA-855c-r2vq-c292 | High | 0.3% | 15 Apr, 2026 | npm apostrophe |
ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context CVE-2026-33889, GHSA-97v6-998m-fp4g | Medium | 0.2% | 15 Apr, 2026 | npm apostrophe |
ApostropheCMS: publicApiProjection Bypass via project Query Builder in Piece-Type REST API CVE-2026-33888, GHSA-xhq9-58fw-859p | Medium | 0.5% | 15 Apr, 2026 | npm apostrophe |
ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint CVE-2026-33877, GHSA-mj7r-x3h3-7rmr | Low | 0.4% | 15 Apr, 2026 | npm apostrophe |
NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins CVE-2026-40346, GHSA-mvvv-v22x-xqwp | Medium | 0.4% | 15 Apr, 2026 | npm @nocobase/plugin-workflow-request |
Sync-in Server has Username Enumeration via Timing Attack CVE-2026-41161, GHSA-43fj-qp3h-hrh5 | Medium | 0.3% | 15 Apr, 2026 | npm @sync-in/server |
Malicious release: Malicious code in forge-jsx (npm) GHSA-6j9q-8g4r-fm8q, MAL-2026-2884 | Malicious | Not scored | 15 Apr, 2026 | npm forge-jsx |
Malicious release: Malicious code in bfx-hf-strategy-perf (npm) MAL-2026-2696 | Malicious | Not scored | 15 Apr, 2026 | npm bfx-hf-strategy-perf |
Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution CVE-2026-5758, GHSA-j452-xhg8-qg39 | Medium | 0.5% | 15 Apr, 2026 | npm protocol-buffers-schema |
Malicious release: Malicious code in vs-supplier-portal-web (npm) GHSA-c7cf-pp98-5r8p, MAL-2026-2693 | Malicious | Not scored | 15 Apr, 2026 | npm vs-supplier-portal-web |
Malicious release: Malicious code in fusion-events (npm) GHSA-qg2w-933f-v9hx, MAL-2026-2692 | Malicious | Not scored | 15 Apr, 2026 | npm fusion-events |
Malicious release: Malicious code in base-counter-web (npm) GHSA-v6g6-6wv3-vv4r, MAL-2026-2691 | Malicious | Not scored | 15 Apr, 2026 | npm base-counter-web |
Malicious release: Malicious code in @pnc-cib/cib-core-lib (npm) GHSA-3f99-p7c4-qvhm, MAL-2026-2688 | Malicious | Not scored | 15 Apr, 2026 | npm @pnc-cib/cib-core-lib |
Malicious release: Malicious code in @pnc-ref/harmony-core-v18 (npm) GHSA-886p-c4rr-2269, MAL-2026-2689 | Malicious | Not scored | 15 Apr, 2026 | npm @pnc-ref/harmony-core-v18 |
Malicious release: Malicious code in @pnc-ref/harmony-support-v18 (npm) GHSA-rwxj-hrxv-283c, MAL-2026-2690 | Malicious | Not scored | 15 Apr, 2026 | npm @pnc-ref/harmony-support-v18 |
Malicious release: Malicious code in com.baogong.app_push_permission (npm) GHSA-pxg6-jw7c-gfmg, MAL-2026-2687 | Malicious | Not scored | 15 Apr, 2026 | npm com.baogong.app_push_permission |
Malicious release: Malicious code in react-dom-19 (npm) MAL-2026-2685 | Malicious | Not scored | 15 Apr, 2026 | npm react-dom-19 |
Fastify's connection header abuse enables stripping of proxy-added headers CVE-2026-33805, GHSA-gwhp-pf74-vj37 | Critical | 0.4% | 15 Apr, 2026 | npm @fastify/http-proxy npm @fastify/reply-from |
Malicious release: Malicious code in tensorzero-node (npm) GHSA-g3vv-q9j6-pw39, MAL-2026-2684 | Malicious | Not scored | 15 Apr, 2026 | npm tensorzero-node |
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons) CVE-2026-33808, GHSA-6hw5-45gm-fj88 | Critical | 0.5% | 15 Apr, 2026 | npm @fastify/express |
@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes CVE-2026-33807, GHSA-hrwm-hgmj-7p9c | Critical | 0.4% | 15 Apr, 2026 | npm @fastify/express |
Malicious release: Malicious code in @athena-ui-components/axios (npm) MAL-2026-2683 | Malicious | Not scored | 15 Apr, 2026 | npm @athena-ui-components/axios |
Malicious release: Malicious code in @athena-ui-components/dashboard-widget (npm) MAL-2026-2681 | Malicious | Not scored | 15 Apr, 2026 | npm @athena-ui-components/dashboard-widget |
Malicious release: Malicious code in @athena-ui-components/deeplink (npm) MAL-2026-2682 | Malicious | Not scored | 15 Apr, 2026 | npm @athena-ui-components/deeplink |
Malicious release: Malicious code in @jesusvizcaino2021/com.baogong.app-push-permission (npm) MAL-2026-2916 | Malicious | Not scored | 15 Apr, 2026 | npm @jesusvizcaino2021/com.baogong.app-push-permission |
Malicious release: Malicious code in js-logger-pack (npm) GHSA-mj89-jrhm-qxhc, MAL-2026-2827 | Malicious | Not scored | 15 Apr, 2026 | npm js-logger-pack |
Malicious release: Malicious code in @veygo/component-library (npm) MAL-2026-2680 | Malicious | Not scored | 15 Apr, 2026 | npm @veygo/component-library |
Malicious release: Malicious code in chief-proxy-out (npm) GHSA-86cf-7fc5-p98v, MAL-2026-2674 | Malicious | Not scored | 15 Apr, 2026 | npm chief-proxy-out |
Malicious release: Malicious code in chief-documentation (npm) GHSA-8r2m-gvh8-jfqm, MAL-2026-2673 | Malicious | Not scored | 15 Apr, 2026 | npm chief-documentation |
Malicious release: Malicious code in moscova-plural-json-parser (npm) GHSA-gr87-65fp-9qwv, MAL-2026-2676 | Malicious | Not scored | 15 Apr, 2026 | npm moscova-plural-json-parser |
Malicious release: Malicious code in snitz-chief-cloud (npm) GHSA-mqcw-j566-9hqh, MAL-2026-2678 | Malicious | Not scored | 15 Apr, 2026 | npm snitz-chief-cloud |