Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in pdf-linker (npm) GHSA-mwqh-c7j6-f7p2, MAL-2026-2677 | Malicious | Not scored | 15 Apr, 2026 | npm pdf-linker |
Malicious release: Malicious code in snitz-chief-cloud-config (npm) GHSA-vc4x-mvfp-p8c8, MAL-2026-2679 | Malicious | Not scored | 15 Apr, 2026 | npm snitz-chief-cloud-config |
Malicious release: Malicious code in mongoose-stamps (npm) GHSA-4cvv-673v-3gjj, MAL-2026-2675 | Malicious | Not scored | 15 Apr, 2026 | npm mongoose-stamps |
Malicious release: Malicious code in ahmed_salem_ph (npm) GHSA-cjwg-37rq-9xwf, MAL-2026-2672 | Malicious | Not scored | 15 Apr, 2026 | npm ahmed_salem_ph |
Novu has a XSS sanitization bypass GHSA-26wg-9xf2-q495 | High | Not scored | 14 Apr, 2026 | npm novu/api |
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection GHSA-4x48-cgf9-q33f | High | Not scored | 14 Apr, 2026 | npm @novu/api |
@vendure/core has a SQL Injection vulnerability CVE-2026-40887, GHSA-9pp3-53p2-ww9v | Critical | 1.8% | 14 Apr, 2026 | npm @vendure/core |
MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting CVE-2026-39884, GHSA-4xqg-gf5c-ghwq | High | 0.3% | 14 Apr, 2026 | npm mcp-server-kubernetes |
@adonisjs/http-server has an Open Redirect vulnerability CVE-2026-40255, GHSA-6qvv-pj99-48qm | Medium | 0.2% | 14 Apr, 2026 | npm @adonisjs/core npm @adonisjs/http-server |
Malicious release: Malicious code in pnpm-workspaces (npm) MAL-2026-2668 | Malicious | Not scored | 14 Apr, 2026 | npm pnpm-workspaces |
Malicious release: Malicious code in ckeditor5-minimap (npm) MAL-2026-2667 | Malicious | Not scored | 14 Apr, 2026 | npm ckeditor5-minimap |
OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files CVE-2025-61260, GHSA-xrxf-jgv3-qmrm | Critical | 6.7% | 14 Apr, 2026 | npm @openai/codex |
Malicious release: Malicious code in tether-wrk-base (npm) GHSA-wvh9-3hgj-7f22, MAL-2026-2663 | Malicious | Not scored | 14 Apr, 2026 | npm tether-wrk-base |
Malicious release: Malicious code in @automation-toolchain/f5-cloud-libs (npm) MAL-2026-2662 | Malicious | Not scored | 14 Apr, 2026 | npm @automation-toolchain/f5-cloud-libs |
Malicious release: Malicious code in ts-lint-builds (npm) GHSA-rhr9-fqxc-vwqq, MAL-2026-2883 | Malicious | Not scored | 14 Apr, 2026 | npm ts-lint-builds |
Malicious release: Malicious code in cjs-biginteger (npm) GHSA-65gr-98mv-9rj5, MAL-2026-2882 | Malicious | Not scored | 14 Apr, 2026 | npm cjs-biginteger |
Malicious release: Malicious code in bjs-lint-builders (npm) GHSA-cv9f-3jc4-hxhv, MAL-2026-2881 | Malicious | Not scored | 14 Apr, 2026 | npm bjs-lint-builders |
Malicious release: Malicious code in bjs-lint-builder (npm) GHSA-m374-prpv-rf26, MAL-2026-2880 | Malicious | Not scored | 14 Apr, 2026 | npm bjs-lint-builder |
Malicious release: Malicious code in bjs-biginteger (npm) GHSA-jjf3-wfhw-qhx4, MAL-2026-2879 | Malicious | Not scored | 14 Apr, 2026 | npm bjs-biginteger |
Malicious release: Malicious code in tailwindcss-style-typography (npm) GHSA-frf3-5rj5-86gh, MAL-2026-2658 | Malicious | Not scored | 14 Apr, 2026 | npm tailwindcss-style-typography |
Malicious release: Malicious code in tailwind-typ (npm) GHSA-6x9q-58gm-32xp, MAL-2026-2657 | Malicious | Not scored | 14 Apr, 2026 | npm tailwind-typ |
Malicious release: Malicious code in tailwind-stylecss-typography (npm) GHSA-mcwq-8vxc-g64c, MAL-2026-2656 | Malicious | Not scored | 14 Apr, 2026 | npm tailwind-stylecss-typography |
Malicious release: Malicious code in chai-as-refined (npm) GHSA-4jgh-4hh7-rpfj, MAL-2026-2641 | Malicious | Not scored | 14 Apr, 2026 | npm chai-as-refined |
Malicious release: Malicious code in node-unpnotifyserv (npm) GHSA-5vp6-xcq2-35fw, MAL-2026-2644 | Malicious | Not scored | 14 Apr, 2026 | npm node-unpnotifyserv |
Malicious release: Malicious code in ui-utils-udhay-alerts (npm) GHSA-w45r-3r6c-6755, MAL-2026-2659 | Malicious | Not scored | 14 Apr, 2026 | npm ui-utils-udhay-alerts |
Malicious release: Malicious code in okxglobal (npm) GHSA-633r-f3rq-76g4, MAL-2026-2649 | Malicious | Not scored | 14 Apr, 2026 | npm okxglobal |
Malicious release: Malicious code in okfe-serverless-conf (npm) GHSA-974m-p83h-567h, MAL-2026-2646 | Malicious | Not scored | 14 Apr, 2026 | npm okfe-serverless-conf |
Malicious release: Malicious code in chatbotloader (npm) GHSA-g7q7-rf3f-vw4h, MAL-2026-2642 | Malicious | Not scored | 14 Apr, 2026 | npm chatbotloader |
Malicious release: Malicious code in okx-nav (npm) GHSA-qgr4-v84c-p4g7, MAL-2026-2648 | Malicious | Not scored | 14 Apr, 2026 | npm okx-nav |
Malicious release: Malicious code in okassistant (npm) GHSA-vcqm-4m6v-428j, MAL-2026-2645 | Malicious | Not scored | 14 Apr, 2026 | npm okassistant |
Malicious release: Malicious code in okx-data (npm) GHSA-whfj-85gw-8h4c, MAL-2026-2647 | Malicious | Not scored | 14 Apr, 2026 | npm okx-data |
Malicious release: Malicious code in apmfe (npm) GHSA-ww7x-jqhv-gqqj, MAL-2026-2637 | Malicious | Not scored | 14 Apr, 2026 | npm apmfe |
Malicious release: Malicious code in billing-paywidget (npm) GHSA-3cww-22qr-fgwc, MAL-2026-2638 | Malicious | Not scored | 14 Apr, 2026 | npm billing-paywidget |
Malicious release: Malicious code in ms-affiliate-links (npm) GHSA-44p5-8q53-5vm5, MAL-2026-2643 | Malicious | Not scored | 14 Apr, 2026 | npm ms-affiliate-links |
Malicious release: Malicious code in onewin-landing (npm) GHSA-6xf2-88r3-x5gr, MAL-2026-2652 | Malicious | Not scored | 14 Apr, 2026 | npm onewin-landing |
Malicious release: Malicious code in vip-landing (npm) GHSA-ggp2-gm9g-8q8q, MAL-2026-2661 | Malicious | Not scored | 14 Apr, 2026 | npm vip-landing |
Malicious release: Malicious code in bytefrontier (npm) GHSA-h4w8-m8m7-x8r8, MAL-2026-2639 | Malicious | Not scored | 14 Apr, 2026 | npm bytefrontier |
Malicious release: Malicious code in use-feature-flags-plugin (npm) GHSA-jccf-63c2-rpf3, MAL-2026-2660 | Malicious | Not scored | 14 Apr, 2026 | npm use-feature-flags-plugin |
Malicious release: Malicious code in bytefrontier-core (npm) GHSA-jq5f-344f-grch, MAL-2026-2640 | Malicious | Not scored | 14 Apr, 2026 | npm bytefrontier-core |
Malicious release: Malicious code in one-sdui (npm) GHSA-p4xf-jh26-qq5c, MAL-2026-2650 | Malicious | Not scored | 14 Apr, 2026 | npm one-sdui |
Malicious release: Malicious code in one-translations (npm) GHSA-98c8-24hp-26m9, MAL-2026-2651 | Malicious | Not scored | 14 Apr, 2026 | npm one-translations |
Malicious release: Malicious code in tailwind-lines-clamp (npm) GHSA-5f6w-9x4v-m9gw, MAL-2026-2655 | Malicious | Not scored | 14 Apr, 2026 | npm tailwind-lines-clamp |
Malicious release: Malicious code in percy-cake-docker (npm) GHSA-5wj3-w66f-5wcx, MAL-2026-2634 | Malicious | Not scored | 14 Apr, 2026 | npm percy-cake-docker |
MCPHub has an authentication bypass CVE-2025-13822, GHSA-9vq7-9h42-j88h | Medium | 0.4% | 14 Apr, 2026 | npm @samanhappy/mcphub |
Malicious release: Malicious code in path-internal (npm) GHSA-55cg-pqmh-hh6w, MAL-2026-2930 | Malicious | Not scored | 14 Apr, 2026 | npm path-internal |
Malicious release: Malicious code in buffer-util-extend (npm) GHSA-g44v-3gq3-j8p6, MAL-2026-2920 | Malicious | Not scored | 14 Apr, 2026 | npm buffer-util-extend |
Malicious release: Malicious code in path-extend (npm) GHSA-qvmc-2hcj-8h4f, MAL-2026-2929 | Malicious | Not scored | 14 Apr, 2026 | npm path-extend |
Malicious release: Malicious code in centralogger (npm) GHSA-wpw7-2rgx-4cfm, MAL-2026-2825 | Malicious | Not scored | 14 Apr, 2026 | npm centralogger |
Malicious release: Malicious code in dom-utils-lite (npm) GHSA-v6fr-pvhf-6rh5, MAL-2026-2826 | Malicious | Not scored | 14 Apr, 2026 | npm dom-utils-lite |
Malicious release: Malicious code in stacks-editor (npm) MAL-2026-2629 | Malicious | Not scored | 14 Apr, 2026 | npm stacks-editor |