Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in bitu-staking (npm) MAL-2026-2915 | Malicious | Not scored | 12 Apr, 2026 | npm bitu-staking |
Malicious release: Malicious code in pt-sc-demo-app (npm) GHSA-wxxw-8cpf-6fv5, MAL-2026-2567 | Malicious | Not scored | 12 Apr, 2026 | npm pt-sc-demo-app |
Malicious release: Malicious code in pt-sc-logger (npm) GHSA-c9cq-89w9-78h3, MAL-2026-2568 | Malicious | Not scored | 12 Apr, 2026 | npm pt-sc-logger |
Malicious release: Malicious code in upstart-offer-container (npm) GHSA-232r-w3h2-2hv5, MAL-2026-2613 | Malicious | Not scored | 12 Apr, 2026 | npm upstart-offer-container |
Malicious release: Malicious code in upstartautoretailadmin (npm) GHSA-5vc6-vrhq-w4h9, MAL-2026-2617 | Malicious | Not scored | 12 Apr, 2026 | npm upstartautoretailadmin |
Malicious release: Malicious code in upstartportal (npm) GHSA-q4fh-w299-f753, MAL-2026-2620 | Malicious | Not scored | 12 Apr, 2026 | npm upstartportal |
Malicious release: Malicious code in upstartdr (npm) GHSA-7vv7-22qp-3mj7, MAL-2026-2618 | Malicious | Not scored | 12 Apr, 2026 | npm upstartdr |
Malicious release: Malicious code in upstartadmindashboard- (npm) GHSA-m873-wm98-r6vj, MAL-2026-2615 | Malicious | Not scored | 12 Apr, 2026 | npm upstartadmindashboard- |
Malicious release: Malicious code in upstartloans (npm) GHSA-4jhq-f342-5773, MAL-2026-2619 | Malicious | Not scored | 12 Apr, 2026 | npm upstartloans |
Malicious release: Malicious code in upstart-lending-status (npm) GHSA-w3xp-4hxm-c484, MAL-2026-2611 | Malicious | Not scored | 12 Apr, 2026 | npm upstart-lending-status |
Malicious release: Malicious code in upstartapplicationstatus (npm) GHSA-9hj7-rh99-qm24, MAL-2026-2616 | Malicious | Not scored | 12 Apr, 2026 | npm upstartapplicationstatus |
Malicious release: Malicious code in upstart-loan-status (npm) GHSA-97h2-g27p-2m54, MAL-2026-2612 | Malicious | Not scored | 12 Apr, 2026 | npm upstart-loan-status |
Malicious release: Malicious code in upstart.previewcss (npm) GHSA-g8xh-53qm-mc7m, MAL-2026-2614 | Malicious | Not scored | 12 Apr, 2026 | npm upstart.previewcss |
Malicious release: Malicious code in pinstatsd (npm) GHSA-mwj4-gvm3-8rmh, MAL-2026-2654 | Malicious | Not scored | 12 Apr, 2026 | npm pinstatsd |
Malicious release: Malicious code in pinlogger (npm) GHSA-fw76-452q-hgcm, MAL-2026-2653 | Malicious | Not scored | 12 Apr, 2026 | npm pinlogger |
Malicious release: Malicious code in wm-plugin-visions-recorder (npm) GHSA-x6cr-7xwj-965h, MAL-2026-2566 | Malicious | Not scored | 12 Apr, 2026 | npm wm-plugin-visions-recorder |
Malicious release: Malicious code in gp-auth-lib (npm) GHSA-24hv-mhfh-jc6q, MAL-2026-2564 | Malicious | Not scored | 12 Apr, 2026 | npm gp-auth-lib |
Malicious release: Malicious code in portal-common-ui (npm) GHSA-jfpv-r33m-g47p, MAL-2026-2565 | Malicious | Not scored | 12 Apr, 2026 | npm portal-common-ui |
Malicious release: Malicious code in ts-schema-helpers (npm) MAL-2026-2873 | Malicious | Not scored | 12 Apr, 2026 | npm ts-schema-helpers |
Malicious release: Malicious code in unisys-uka (npm) MAL-2026-2824 | Malicious | Not scored | 11 Apr, 2026 | npm unisys-uka |
Malicious release: Malicious code in unisys-common (npm) MAL-2026-2876 | Malicious | Not scored | 11 Apr, 2026 | npm unisys-common |
Malicious release: Malicious code in unisys-sdk (npm) MAL-2026-2878 | Malicious | Not scored | 11 Apr, 2026 | npm unisys-sdk |
Malicious release: Malicious code in unisys-core (npm) MAL-2026-2877 | Malicious | Not scored | 11 Apr, 2026 | npm unisys-core |
Malicious release: Malicious code in unisys-auth (npm) MAL-2026-2875 | Malicious | Not scored | 11 Apr, 2026 | npm unisys-auth |
Malicious release: Malicious code in unisys-agentic-ai-playground (npm) MAL-2026-2874 | Malicious | Not scored | 11 Apr, 2026 | npm unisys-agentic-ai-playground |
Malicious release: Malicious code in arlo-meeting-assistant-rtms (npm) MAL-2026-2869 | Malicious | Not scored | 11 Apr, 2026 | npm arlo-meeting-assistant-rtms |
Malicious release: Malicious code in arlo-meeting-assistant-frontend (npm) MAL-2026-2868 | Malicious | Not scored | 11 Apr, 2026 | npm arlo-meeting-assistant-frontend |
Malicious release: Malicious code in arlo-meeting-assistant-backend (npm) MAL-2026-2867 | Malicious | Not scored | 11 Apr, 2026 | npm arlo-meeting-assistant-backend |
Malicious release: Malicious code in @b2b-portal/uch (npm) GHSA-86jx-983h-h77x, MAL-2026-2560 | Malicious | Not scored | 11 Apr, 2026 | npm @b2b-portal/uch |
Malicious release: Malicious code in ts-form-helpers (npm) MAL-2026-2872 | Malicious | Not scored | 11 Apr, 2026 | npm ts-form-helpers |
Malicious release: Malicious code in paysafe-card-payments (npm) GHSA-9c83-p69j-8r99, MAL-2026-2551 | Malicious | Not scored | 11 Apr, 2026 | npm paysafe-card-payments |
Malicious release: Malicious code in paysafe-apple-pay (npm) GHSA-8h4g-8hgw-x4gw, MAL-2026-2550 | Malicious | Not scored | 11 Apr, 2026 | npm paysafe-apple-pay |
Malicious release: Malicious code in paysafe-google-pay (npm) GHSA-v6gg-22rj-hjmc, MAL-2026-2552 | Malicious | Not scored | 11 Apr, 2026 | npm paysafe-google-pay |
Malicious release: Malicious code in paysafe-venmo (npm) GHSA-5rh7-2mgf-g569, MAL-2026-2554 | Malicious | Not scored | 11 Apr, 2026 | npm paysafe-venmo |
Malicious release: Malicious code in paysafe-payments-sdk-common (npm) GHSA-x8ch-r2x5-mwmh, MAL-2026-2553 | Malicious | Not scored | 11 Apr, 2026 | npm paysafe-payments-sdk-common |
Malicious release: Malicious code in @sap-px/pxapi (npm) GHSA-h45p-wmcx-qr4h, MAL-2026-2545 | Malicious | Not scored | 11 Apr, 2026 | npm @sap-px/pxapi |
mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes CVE-2026-41139, GHSA-5v89-rwgr-qj6g, GHSA-jvff-x2qm-6286 | High | 0.6% | 10 Apr, 2026 | npm mathjs |
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation GHSA-x7mm-9vvv-64w8 | Low | Not scored | 10 Apr, 2026 | npm unhead |
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass CVE-2026-41679, GHSA-68qg-g8mg-6pr7 | Critical | 31.7% | 10 Apr, 2026 | npm @paperclipai/server npm paperclipai |
next-intl has an open redirect vulnerability CVE-2026-40299, GHSA-8f24-v5vv-gm5j | Medium | 0.3% | 10 Apr, 2026 | npm next-intl |
n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport GHSA-75hx-xj24-mqrw | High | Not scored | 10 Apr, 2026 | npm n8n-mcp |
basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands GHSA-6v7q-wjvx-w8wg | High | Not scored | 10 Apr, 2026 | npm basic-ftp |
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()` CVE-2026-40190, GHSA-fw9q-39r9-c252 | Critical | 0.3% | 10 Apr, 2026 | npm langsmith |
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain CVE-2026-40175, GHSA-fvcv-3m26-pcqx | Medium | 1.9% | 10 Apr, 2026 | npm axios |
@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler GHSA-59xv-588h-2vmm | Low | Not scored | 10 Apr, 2026 | npm @saltcorn/data |
Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read CVE-2026-40163, GHSA-32pv-mpqg-h292 | High | 0.3% | 10 Apr, 2026 | npm @saltcorn/server |
@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service CVE-2026-40074, GHSA-3f6h-2hrp-w5wx | Medium | 0.4% | 10 Apr, 2026 | npm @sveltejs/kit |
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass CVE-2026-40073, GHSA-2crg-3p73-43xp | High | 0.5% | 10 Apr, 2026 | npm @sveltejs/kit |
Malicious release: Malicious code in @b2b-portal/form (npm) GHSA-7rrw-hm44-329g, MAL-2026-2537 | Malicious | Not scored | 10 Apr, 2026 | npm @b2b-portal/form |
@vitejs/plugin-rsc has a Denial of Service with React Server Components GHSA-v457-wxvj-p9w9 | High | Not scored | 10 Apr, 2026 | npm @vitejs/plugin-rsc |