Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in figlet-chalk-render (npm) MAL-2026-17226 | Malicious | Not scored | 28 Sep, 2026 | npm figlet-chalk-render |
Malicious release: Malicious code in chalk-figlet (npm) MAL-2026-17223 | Malicious | Not scored | 28 Sep, 2026 | npm chalk-figlet |
Malicious release: Malicious code in nebula-llm (npm) MAL-2026-17227 | Malicious | Not scored | 28 Sep, 2026 | npm nebula-llm |
Malicious release: Malicious code in fabric-render-bridge (npm) MAL-2026-17225 | Malicious | Not scored | 28 Sep, 2026 | npm fabric-render-bridge |
@xhmikosr/decompress: Path traversal via symlink chain CVE-2026-101894, GHSA-hrh2-vp3x-79xf | Critical | 0.8% | 28 Sep, 2026 | npm @xhmikosr/decompress npm decompress |
Malicious release: Malicious code in fabric-asset-pipeline (npm) MAL-2026-17224 | Malicious | Not scored | 28 Sep, 2026 | npm fabric-asset-pipeline |
Malicious release: Malicious code in img-to-native (npm) GHSA-pv7p-ghgv-268x, MAL-2026-17216 | Malicious | Not scored | 28 Sep, 2026 | npm img-to-native |
Malicious release: Malicious code in native-runner (npm) GHSA-jxw5-69p3-hpm4, MAL-2026-17218 | Malicious | Not scored | 28 Sep, 2026 | npm native-runner |
Malicious release: Malicious code in nebulajs-api (npm) GHSA-2gr6-gxvx-3594, MAL-2026-17220 | Malicious | Not scored | 28 Sep, 2026 | npm nebulajs-api |
Malicious release: Malicious code in nebula-sdk (npm) GHSA-fm5g-6rr8-p9vq, MAL-2026-17219 | Malicious | Not scored | 28 Sep, 2026 | npm nebula-sdk |
Malicious release: Malicious code in vite-plugin-crypto (npm) GHSA-mh9w-qr45-6wrq, MAL-2026-17222 | Malicious | Not scored | 28 Sep, 2026 | npm vite-plugin-crypto |
Malicious release: Malicious code in tailwindcss-form-kit (npm) GHSA-cxrh-669r-w2g9, MAL-2026-17221 | Malicious | Not scored | 28 Sep, 2026 | npm tailwindcss-form-kit |
Malicious release: Malicious code in my-skibidi (npm) GHSA-w4g6-rgx4-2wjf, MAL-2026-17217 | Malicious | Not scored | 28 Sep, 2026 | npm my-skibidi |
Malicious release: Malicious code in eslint-plugin-skywagon-web (npm) MAL-2026-17215 | Malicious | Not scored | 28 Sep, 2026 | npm eslint-plugin-skywagon-web |
Malicious release: Malicious code in git-en-boite-logging (npm) MAL-2026-17214 | Malicious | Not scored | 28 Sep, 2026 | npm git-en-boite-logging |
code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78) GHSA-456v-xq2p-r4cj | High | Not scored | 28 Sep, 2026 | npm code-ollama |
Malicious release: Malicious code in godsplan (npm) MAL-2026-17315 | Malicious | Not scored | 28 Sep, 2026 | npm godsplan |
Malicious release: Malicious code in wbnr-probe-visible-check (npm) GHSA-65gf-jmp3-4wrc, MAL-2026-17212 | Malicious | Not scored | 28 Sep, 2026 | npm wbnr-probe-visible-check |
Malicious release: Malicious code in @wbnr/design-kit (npm) GHSA-865f-pwj5-p2c5, MAL-2026-17204 | Malicious | Not scored | 28 Sep, 2026 | npm @wbnr/design-kit |
Malicious release: Malicious code in @wbnr/lottiefiles-loader (npm) GHSA-94r6-cxjq-fq4r, MAL-2026-17205 | Malicious | Not scored | 28 Sep, 2026 | npm @wbnr/lottiefiles-loader |
Malicious release: Malicious code in kalasnik-npm-simple-test (npm) GHSA-pm4h-xrhq-vh62, MAL-2026-17206 | Malicious | Not scored | 28 Sep, 2026 | npm kalasnik-npm-simple-test |
Malicious release: Malicious code in kjj81 (npm) GHSA-9f7c-6fp7-9g6x, MAL-2026-17207 | Malicious | Not scored | 28 Sep, 2026 | npm kjj81 |
Malicious release: Malicious code in uuid-date (npm) GHSA-pqvc-prrc-mv45, MAL-2026-17210 | Malicious | Not scored | 28 Sep, 2026 | npm uuid-date |
Malicious release: Malicious code in riot-private (npm) GHSA-qgpm-ggcf-4fqm, MAL-2026-17208 | Malicious | Not scored | 28 Sep, 2026 | npm riot-private |
Malicious release: Malicious code in vinzzsync-wacli (npm) GHSA-rmcq-f7vh-v86v, MAL-2026-17211 | Malicious | Not scored | 28 Sep, 2026 | npm vinzzsync-wacli |
Malicious release: Malicious code in tanksync (npm) GHSA-47j4-w95p-wjp7, MAL-2026-17209 | Malicious | Not scored | 28 Sep, 2026 | npm tanksync |
Malicious release: Malicious code in @consts/links (npm) GHSA-5rp9-7r4x-3fqp, MAL-2026-17202 | Malicious | Not scored | 28 Sep, 2026 | npm @consts/links |
Malicious release: Malicious code in @digi-kernel/digi-kernel-constrains (npm) GHSA-h37m-2c3q-82j8, MAL-2026-17203 | Malicious | Not scored | 28 Sep, 2026 | npm @digi-kernel/digi-kernel-constrains |
Malicious release: Malicious code in @bb1ptest23/test-paket (npm) MAL-2026-17201 | Malicious | Not scored | 28 Sep, 2026 | npm @bb1ptest23/test-paket |
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary CVE-2026-100723, GHSA-489w-w794-jq94 | Medium | 0.4% | 27 Sep, 2026 | npm vm2 |
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process CVE-2026-100722, GHSA-2v2p-6j97-cjg9 | High | 0.3% | 27 Sep, 2026 | npm vm2 |
vm2: NodeVM custom resolution bypasses external path boundaries CVE-2026-100721, GHSA-5h3f-q97h-ccvc | Critical | 0.6% | 27 Sep, 2026 | npm vm2 |
Malicious release: Malicious code in chai-as-relay (npm) MAL-2026-17189 | Malicious | Not scored | 26 Sep, 2026 | npm chai-as-relay |
Malicious release: Malicious code in cma-self-hosted-sandbox-cf (npm) MAL-2026-17190 | Malicious | Not scored | 26 Sep, 2026 | npm cma-self-hosted-sandbox-cf |
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS CVE-2026-100702, GHSA-8vvx-rff5-p5rq | High | 0.3% | 26 Sep, 2026 | npm nodemailer |
Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure CVE-2026-100701, GHSA-6vj9-mwq6-2f5v | Medium | 0.1% | 26 Sep, 2026 | npm nodemailer |
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service CVE-2026-100700, GHSA-v53p-9fqp-m79j | High | 0.3% | 26 Sep, 2026 | npm nodemailer |
Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing CVE-2026-100699, GHSA-g57g-f23g-4646 | Medium | 0.2% | 26 Sep, 2026 | npm nodemailer |
OpenClaw: Channel read actions could skip target allowlists CVE-2026-100582, GHSA-g7fw-3gjp-g5hf | High | 0.2% | 26 Sep, 2026 | npm @openclaw/feishu npm @openclaw/googlechat npm @openclaw/matrix npm @openclaw/msteams |
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token CVE-2026-57449, GHSA-m62c-5q34-f3cf | High | 0.3% | 25 Sep, 2026 | npm @actual-app/sync-server |
OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet GHSA-29h2-jr22-frmh | High | Not scored | 25 Sep, 2026 | npm @openzeppelin/confidential-contracts |
Malicious release: Malicious code in @digift/cli (npm) GHSA-xp76-38xh-m8wc, MAL-2026-17187 | Malicious | Not scored | 25 Sep, 2026 | npm @digift/cli |
Malicious release: Malicious code in @nubjs/types (npm) GHSA-7qx8-98q7-66p4, MAL-2026-17186 | Malicious | Not scored | 25 Sep, 2026 | npm @nubjs/types |
Malicious release: Malicious code in @zeronexcode/baileys (npm) GHSA-cghr-f3w3-qh2h, MAL-2026-17326 | Malicious | Not scored | 25 Sep, 2026 | npm @zeronexcode/baileys |
Malicious release: Malicious code in @airbnb-extended/typescript-config (npm) GHSA-4jfx-2j46-9rqq, MAL-2026-17184 | Malicious | Not scored | 25 Sep, 2026 | npm @airbnb-extended/typescript-config |
Malicious release: Malicious code in shoplist-app (npm) MAL-2026-17185 | Malicious | Not scored | 25 Sep, 2026 | npm shoplist-app |
Malicious release: Malicious code in app-sca-info-banking (npm) GHSA-v2r2-pcp9-6mxr, MAL-2026-17182 | Malicious | Not scored | 25 Sep, 2026 | npm app-sca-info-banking |
Malicious release: Malicious code in @alphaspace/core (npm) MAL-2026-17169 | Malicious | Not scored | 25 Sep, 2026 | npm @alphaspace/core |
Malicious release: Malicious code in n8n-nodes-moonlet-helpers (npm) MAL-2026-17176 | Malicious | Not scored | 25 Sep, 2026 | npm n8n-nodes-moonlet-helpers |
Malicious release: Malicious code in n8n-nodes-moonlet-utils (npm) MAL-2026-17177 | Malicious | Not scored | 25 Sep, 2026 | npm n8n-nodes-moonlet-utils |