Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in chai-chain-argon (npm) MAL-2026-2340 | Malicious | Not scored | 24 Mar, 2026 | npm chai-chain-argon |
Malicious release: Malicious code in chai-as-chains (npm) GHSA-8f77-86rh-3hvj, MAL-2026-2339 | Malicious | Not scored | 24 Mar, 2026 | npm chai-as-chains |
Malicious release: Malicious code in chai-as-attached (npm) MAL-2026-2338 | Malicious | Not scored | 24 Mar, 2026 | npm chai-as-attached |
Malicious release: Malicious code in chai-as-aligned (npm) MAL-2026-2337 | Malicious | Not scored | 24 Mar, 2026 | npm chai-as-aligned |
Malicious release: Malicious code in cdnjavacss (npm) MAL-2026-2336 | Malicious | Not scored | 24 Mar, 2026 | npm cdnjavacss |
Malicious release: Malicious code in azurestack-common (npm) MAL-2026-2335 | Malicious | Not scored | 24 Mar, 2026 | npm azurestack-common |
Malicious release: Malicious code in argon-node (npm) MAL-2026-2334 | Malicious | Not scored | 24 Mar, 2026 | npm argon-node |
Malicious release: Malicious code in @pansycareful/github-helper (npm) MAL-2026-2333 | Malicious | Not scored | 24 Mar, 2026 | npm @pansycareful/github-helper |
Malicious release: Malicious code in @hsbc-mfe/host (npm) MAL-2026-2332 | Malicious | Not scored | 24 Mar, 2026 | npm @hsbc-mfe/host |
Malicious release: Malicious code in @girirajravichandran/corp-build-utils-poc (npm) MAL-2026-2331 | Malicious | Not scored | 24 Mar, 2026 | npm @girirajravichandran/corp-build-utils-poc |
Malicious release: Malicious code in @fyxer-ai/shared (npm) MAL-2026-2330 | Malicious | Not scored | 24 Mar, 2026 | npm @fyxer-ai/shared |
Malicious release: Malicious code in @abi-labs-frontend/standards (npm) GHSA-hqxv-wmmr-v5h3, MAL-2026-2329 | Malicious | Not scored | 24 Mar, 2026 | npm @abi-labs-frontend/standards |
Malicious release: Malicious code in @one-site/europcar (npm) MAL-2026-2137 | Malicious | Not scored | 24 Mar, 2026 | npm @one-site/europcar |
Malicious release: Malicious code in express-session-validator (npm) GHSA-52hw-wvx9-x8pq, MAL-2026-2129 | Malicious | Not scored | 24 Mar, 2026 | npm express-session-validator |
Malicious release: Malicious code in express-session-vailidator (npm) GHSA-hqj8-x2vp-mrp9, MAL-2026-2128 | Malicious | Not scored | 24 Mar, 2026 | npm express-session-vailidator |
Malicious release: Malicious code in sbx-mask (npm) GHSA-r934-qgg3-v7fg, MAL-2026-2132 | Malicious | Not scored | 24 Mar, 2026 | npm sbx-mask |
Malicious release: Malicious code in fancode-web-app (npm) GHSA-f6pq-884h-rjxq, MAL-2026-2130 | Malicious | Not scored | 24 Mar, 2026 | npm fancode-web-app |
Malicious release: Malicious code in agoda-test-poc (npm) GHSA-hfhc-gmgj-9v7v, MAL-2026-2127 | Malicious | Not scored | 24 Mar, 2026 | npm agoda-test-poc |
Malicious release: Malicious code in agoda-dep-confusion (npm) GHSA-px82-m72x-rpj7, MAL-2026-2126 | Malicious | Not scored | 24 Mar, 2026 | npm agoda-dep-confusion |
Malicious release: Malicious code in yelp-react-component-rating (npm) GHSA-xqxf-c9jr-8wx6, MAL-2026-2136 | Malicious | Not scored | 24 Mar, 2026 | npm yelp-react-component-rating |
Malicious release: Malicious code in yelp-react-component-photo-upload (npm) GHSA-7v3c-wxfg-x5fg, MAL-2026-2135 | Malicious | Not scored | 24 Mar, 2026 | npm yelp-react-component-photo-upload |
Malicious release: Malicious code in yelp-biz-action-constants-js-generated (npm) GHSA-mg5x-ww4x-j322, MAL-2026-2134 | Malicious | Not scored | 24 Mar, 2026 | npm yelp-biz-action-constants-js-generated |
Malicious release: Malicious code in server-fpti (npm) GHSA-8w5j-p4jv-8rmq, MAL-2026-2133 | Malicious | Not scored | 24 Mar, 2026 | npm server-fpti |
Malicious release: Malicious code in nemo-fpti (npm) GHSA-hmv2-22ff-cxh8, MAL-2026-2131 | Malicious | Not scored | 24 Mar, 2026 | npm nemo-fpti |
Malicious release: Malicious code in customerdigital-ui-components-lib (npm) GHSA-3m3c-wc3h-m5mr, MAL-2026-2125 | Malicious | Not scored | 24 Mar, 2026 | npm customerdigital-ui-components-lib |
Malicious release: Malicious code in @wame/ngx-frf-utilities (npm) MAL-2026-2412 | Malicious | Not scored | 24 Mar, 2026 | npm @wame/ngx-frf-utilities |
Malicious release: Malicious code in @wame/ngx-adfs (npm) MAL-2026-2411 | Malicious | Not scored | 24 Mar, 2026 | npm @wame/ngx-adfs |
Malicious release: Malicious code in tombac-chronos (npm) MAL-2026-2418 | Malicious | Not scored | 24 Mar, 2026 | npm tombac-chronos |
Malicious release: Malicious code in @the-coca-cola-company/ngps-global-common-utils (npm) MAL-2026-2410 | Malicious | Not scored | 24 Mar, 2026 | npm @the-coca-cola-company/ngps-global-common-utils |
Malicious release: Malicious code in @phonos/types (npm) MAL-2026-2409 | Malicious | Not scored | 24 Mar, 2026 | npm @phonos/types |
Malicious release: Malicious code in oc-navbar-module-client (npm) MAL-2026-2417 | Malicious | Not scored | 24 Mar, 2026 | npm oc-navbar-module-client |
Malicious release: Malicious code in oc-ccp-module-client (npm) MAL-2026-2416 | Malicious | Not scored | 24 Mar, 2026 | npm oc-ccp-module-client |
Malicious release: Malicious code in oc-aa-module-client (npm) MAL-2026-2415 | Malicious | Not scored | 24 Mar, 2026 | npm oc-aa-module-client |
Malicious release: Malicious code in ftapi-core (npm) MAL-2026-2414 | Malicious | Not scored | 24 Mar, 2026 | npm ftapi-core |
Malicious release: Malicious code in cr-static-shared-components (npm) GHSA-c39r-4xjc-wrcv, MAL-2026-2223 | Malicious | Not scored | 24 Mar, 2026 | npm cr-static-shared-components |
Malicious release: Malicious code in @cloudsop/hmoment (npm) MAL-2026-2408 | Malicious | Not scored | 24 Mar, 2026 | npm @cloudsop/hmoment |
Malicious release: Malicious code in @ceeferenderer/itg-renderer-sdk (npm) GHSA-3v4h-w4g3-h6r2, MAL-2026-2407 | Malicious | Not scored | 24 Mar, 2026 | npm @ceeferenderer/itg-renderer-sdk |
Malicious release: Malicious code in @ceeferenderer/fe-renderer-sdk (npm) GHSA-mw7m-6vvq-q69p, MAL-2026-2406 | Malicious | Not scored | 24 Mar, 2026 | npm @ceeferenderer/fe-renderer-sdk |
Malicious release: Malicious code in cclr-component-resources (npm) MAL-2026-2413 | Malicious | Not scored | 24 Mar, 2026 | npm cclr-component-resources |
Malicious release: Malicious code in yelp-mobile-site-common (npm) GHSA-xmfj-5j3f-gx7x, MAL-2026-2123 | Malicious | Not scored | 24 Mar, 2026 | npm yelp-mobile-site-common |
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation CVE-2026-86205, GHSA-fp4x-ggrf-wmc6 | Medium | 0.3% | 23 Mar, 2026 | npm h3 |
H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service CVE-2026-86250, GHSA-q5pr-72pq-83v3 | High | 0.5% | 23 Mar, 2026 | npm h3 |
Malicious release: Malicious code in tailwind-font-inter (npm) GHSA-cxvr-pcxc-6r58, MAL-2026-2111 | Malicious | Not scored | 23 Mar, 2026 | npm tailwind-font-inter |
Malicious release: Malicious code in react-tailwindcss-style (npm) GHSA-hqvw-49vr-fpw3, MAL-2026-2110 | Malicious | Not scored | 23 Mar, 2026 | npm react-tailwindcss-style |
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections CVE-2026-3635, GHSA-444r-cwp2-x5xf | Medium | 0.2% | 23 Mar, 2026 | npm fastify |
Malicious release: Malicious code in in-app-marketing (npm) GHSA-2rj8-6crh-98qq, MAL-2026-2087 | Malicious | Not scored | 23 Mar, 2026 | npm in-app-marketing |
Malicious release: Malicious code in pulse-scroll-triggered-list-items (npm) GHSA-3qmv-2h4m-5qg9, MAL-2026-2094 | Malicious | Not scored | 23 Mar, 2026 | npm pulse-scroll-triggered-list-items |
Malicious release: Malicious code in pulse-shop-section (npm) GHSA-9php-8vxv-7gmx, MAL-2026-2095 | Malicious | Not scored | 23 Mar, 2026 | npm pulse-shop-section |
Malicious release: Malicious code in ty-search-suggestion (npm) GHSA-f8cx-966c-8x2h, MAL-2026-2105 | Malicious | Not scored | 23 Mar, 2026 | npm ty-search-suggestion |
Malicious release: Malicious code in sidebar-basket (npm) GHSA-fppj-8rcf-8fpp, MAL-2026-2101 | Malicious | Not scored | 23 Mar, 2026 | npm sidebar-basket |