Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in json-lucide (npm) GHSA-7x8p-2g3v-pwqp, MAL-2026-2200 | Malicious | Not scored | 25 Mar, 2026 | npm json-lucide |
thumbler allows OS Command Injection CVE-2026-26833, GHSA-mvhf-547c-h55r | Critical | 2.4% | 25 Mar, 2026 | npm thumbler |
node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter CVE-2026-26832, GHSA-8j44-735h-w4w2 | Critical | 1.7% | 25 Mar, 2026 | npm node-tesseract-ocr |
textract is vulnerable to OS Command Injection CVE-2026-26831, GHSA-9pcj-m5rr-p28g | Critical | 2.5% | 25 Mar, 2026 | npm textract |
pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter CVE-2026-26830, GHSA-q5mh-72xg-628w | Critical | 2.5% | 25 Mar, 2026 | npm pdf-image |
Malicious release: Malicious code in omicnavigatorwebapp (npm) GHSA-7r3j-rgcw-3jgq, MAL-2026-2199 | Malicious | Not scored | 25 Mar, 2026 | npm omicnavigatorwebapp |
Malicious release: Malicious code in omaronsec (npm) GHSA-9wmg-m3mr-xx93, MAL-2026-2198 | Malicious | Not scored | 25 Mar, 2026 | npm omaronsec |
Malicious release: Malicious code in tailwind-compile (npm) GHSA-5w5v-cvxh-55vq, MAL-2026-2196 | Malicious | Not scored | 25 Mar, 2026 | npm tailwind-compile |
Malicious release: Malicious code in @sixcore/baileys (npm) GHSA-347h-frw7-j9f5, MAL-2026-2193 | Malicious | Not scored | 25 Mar, 2026 | npm @sixcore/baileys |
Malicious release: Malicious code in super-alias (npm) GHSA-5w92-jfv8-ppvx, MAL-2026-2195 | Malicious | Not scored | 25 Mar, 2026 | npm super-alias |
Malicious release: Malicious code in ffsixx (npm) GHSA-r8j3-m86x-q66x, MAL-2026-2194 | Malicious | Not scored | 25 Mar, 2026 | npm ffsixx |
Malicious release: Malicious code in changelog-utils-wrapper (npm) GHSA-6jcw-rcqg-wmmf, MAL-2026-2192 | Malicious | Not scored | 25 Mar, 2026 | npm changelog-utils-wrapper |
Malicious release: Malicious code in changelog-utils-logger (npm) GHSA-7g9x-834j-4788, MAL-2026-2191 | Malicious | Not scored | 25 Mar, 2026 | npm changelog-utils-logger |
Malicious release: Malicious code in ts-bign (npm) GHSA-r54j-4cj8-jf2v, MAL-2026-2190 | Malicious | Not scored | 25 Mar, 2026 | npm ts-bign |
Malicious release: Malicious code in levex-refa (npm) GHSA-w977-mj56-jpc7, MAL-2026-2188 | Malicious | Not scored | 25 Mar, 2026 | npm levex-refa |
Malicious release: Malicious code in simple-util-kit (npm) GHSA-rjc8-xw63-3j4j, MAL-2026-2189 | Malicious | Not scored | 25 Mar, 2026 | npm simple-util-kit |
Malicious release: Malicious code in @shennmine/libsignal-node (npm) GHSA-6w26-75vp-gf97, MAL-2026-2167 | Malicious | Not scored | 25 Mar, 2026 | npm @shennmine/libsignal-node |
Malicious release: Malicious code in @shennmine/baileys (npm) GHSA-p4gv-m838-2xq9, MAL-2026-2166 | Malicious | Not scored | 25 Mar, 2026 | npm @shennmine/baileys |
Malicious release: Malicious code in allergan (npm) GHSA-pjwm-q9hh-23wj, MAL-2026-2197 | Malicious | Not scored | 25 Mar, 2026 | npm allergan |
Malicious release: Malicious code in console-loggers (npm) GHSA-ppr8-pvc2-8f99, MAL-2026-2169 | Malicious | Not scored | 25 Mar, 2026 | npm console-loggers |
Malicious release: Malicious code in chai-patch (npm) GHSA-h2h6-q29m-3mm3, MAL-2026-2168 | Malicious | Not scored | 25 Mar, 2026 | npm chai-patch |
Malicious release: Malicious code in @rexxtheproject/keyed-db (npm) GHSA-38c4-cmg5-vpvc, MAL-2026-2165 | Malicious | Not scored | 25 Mar, 2026 | npm @rexxtheproject/keyed-db |
Malicious release: Malicious code in @rexxtheproject/elaina-libsignal (npm) GHSA-3qf5-vfww-7p7g, MAL-2026-2164 | Malicious | Not scored | 25 Mar, 2026 | npm @rexxtheproject/elaina-libsignal |
Malicious release: Malicious code in @rexxtheproject/elaina-baileys (npm) GHSA-pjxj-7mxh-9348, MAL-2026-2163 | Malicious | Not scored | 25 Mar, 2026 | npm @rexxtheproject/elaina-baileys |
Malicious release: Malicious code in chai-as-chain (npm) GHSA-8cpf-9rj8-q68m, MAL-2026-2160 | Malicious | Not scored | 25 Mar, 2026 | npm chai-as-chain |
Malicious release: Malicious code in path-external (npm) GHSA-3j5q-xvjq-rqxq, MAL-2026-2161 | Malicious | Not scored | 25 Mar, 2026 | npm path-external |
Malicious release: Malicious code in @eric-orderbuddyinfo/react-noval (npm) GHSA-82fx-cjgq-fc8v, MAL-2026-2159 | Malicious | Not scored | 25 Mar, 2026 | npm @eric-orderbuddyinfo/react-noval |
Malicious release: Malicious code in svg-sizer-responsive (npm) GHSA-7qgj-3cfq-g4g4, MAL-2026-2162 | Malicious | Not scored | 25 Mar, 2026 | npm svg-sizer-responsive |
Malicious release: Malicious code in chai-as-emitted (npm) GHSA-jffg-8cwf-786h, MAL-2026-2154 | Malicious | Not scored | 25 Mar, 2026 | npm chai-as-emitted |
Malicious release: Malicious code in pino-pretty-log (npm) GHSA-p885-4m86-h35r, MAL-2026-2155 | Malicious | Not scored | 25 Mar, 2026 | npm pino-pretty-log |
Malicious release: Malicious code in tailwind-animationbasis (npm) GHSA-x2c8-m9xp-3qmv, MAL-2026-2156 | Malicious | Not scored | 25 Mar, 2026 | npm tailwind-animationbasis |
Malicious release: Malicious code in transitive_lib (npm) GHSA-76ph-2x99-486x, MAL-2026-2157 | Malicious | Not scored | 25 Mar, 2026 | npm transitive_lib |
Malicious release: Malicious code in @xvortexsockets/baileys (npm) GHSA-p5gg-75q6-vp64, MAL-2026-2153 | Malicious | Not scored | 25 Mar, 2026 | npm @xvortexsockets/baileys |
Astro: Remote allowlist bypass via unanchored matchPathname wildcard CVE-2026-33769, GHSA-g735-7g2w-hh3f | Low | 0.3% | 24 Mar, 2026 | npm astro |
Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` CVE-2026-33768, GHSA-mr6q-rp88-fx84 | Critical | 0.3% | 24 Mar, 2026 | npm @astrojs/vercel |
Parse Server exposes auth data via /users/me endpoint BIT-parse-2026-33627, CVE-2026-33627, GHSA-37mj-c2wf-cx96 | High | 0.4% | 24 Mar, 2026 | npm parse-server |
Parse Server: MFA recovery code single-use bypass via concurrent requests BIT-parse-2026-33624, CVE-2026-33624, GHSA-2299-ghjr-6vjp | Low | 0.2% | 24 Mar, 2026 | npm parse-server |
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands CVE-2026-29772, GHSA-3rmj-9m5h-8fpv | High | 0.4% | 24 Mar, 2026 | npm @astrojs/node |
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter BIT-parse-2026-33539, CVE-2026-33539, GHSA-p2w6-rmh7-w8q3 | High | 0.5% | 24 Mar, 2026 | npm parse-server |
Parse Server: Denial of Service via unindexed database query for unconfigured auth providers BIT-parse-2026-33538, CVE-2026-33538, GHSA-g4cf-xj29-wqqr | High | 0.4% | 24 Mar, 2026 | npm parse-server |
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing GHSA-g3qj-j598-cxmq | High | Not scored | 24 Mar, 2026 | npm fido2-lib |
Parse Server's Session Update endpoint allows overwriting server-generated session fields BIT-parse-2026-33527, CVE-2026-33527, GHSA-jc39-686j-wp6q | Medium | 0.3% | 24 Mar, 2026 | npm parse-server |
Malicious release: Malicious code in xrpl-hooks-ide (npm) MAL-2026-2398 | Malicious | Not scored | 24 Mar, 2026 | npm xrpl-hooks-ide |
Malicious release: Malicious code in wraith-module (npm) MAL-2026-2397 | Malicious | Not scored | 24 Mar, 2026 | npm wraith-module |
Malicious release: Malicious code in voodoo-internal-api (npm) MAL-2026-2396 | Malicious | Not scored | 24 Mar, 2026 | npm voodoo-internal-api |
Malicious release: Malicious code in uuidvalidatorarabis (npm) MAL-2026-2395 | Malicious | Not scored | 24 Mar, 2026 | npm uuidvalidatorarabis |
Malicious release: Malicious code in typescript-mock-data (npm) MAL-2026-2394 | Malicious | Not scored | 24 Mar, 2026 | npm typescript-mock-data |
Malicious release: Malicious code in this-is-my-test-package (npm) MAL-2026-2393 | Malicious | Not scored | 24 Mar, 2026 | npm this-is-my-test-package |
Malicious release: Malicious code in stormbreaker-shade (npm) MAL-2026-2392 | Malicious | Not scored | 24 Mar, 2026 | npm stormbreaker-shade |
Malicious release: Malicious code in ssr-catalogue-sfcc (npm) MAL-2026-2391 | Malicious | Not scored | 24 Mar, 2026 | npm ssr-catalogue-sfcc |