Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel CVE-2026-82865, GHSA-xgx4-2wgv-4jhm | Medium | 0.2% | 20 Mar, 2026 | npm @pdfme/schemas |
PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS CVE-2026-82864, GHSA-vrqm-gvq7-rrwh | High | 0.4% | 20 Mar, 2026 | npm @pdfme/pdf-lib |
Parse Server's LiveQuery bypasses CLP pointer permission enforcement BIT-parse-2026-33421, CVE-2026-33421, GHSA-fph2-r4qg-9576 | High | 0.4% | 20 Mar, 2026 | npm parse-server |
SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize() CVE-2026-33418, GHSA-7j2x-32w6-p43p | High | 0.4% | 20 Mar, 2026 | npm @dicebear/converter |
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC CVE-2026-32887, GHSA-38f7-945m-qr2g | High | 0.3% | 20 Mar, 2026 | npm effect |
oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify CVE-2026-33331, GHSA-7f6v-3gx7-27q8 | High | 0.3% | 20 Mar, 2026 | npm @orpc/openapi |
Malicious release: Malicious code in shakti-strings (npm) MAL-2026-2003 | Malicious | Not scored | 20 Mar, 2026 | npm shakti-strings |
Malicious release: Malicious code in nflx-cmisc (npm) MAL-2026-2002 | Malicious | Not scored | 20 Mar, 2026 | npm nflx-cmisc |
Malicious release: Malicious code in laserlogsink (npm) GHSA-g52g-7jj2-8phv, MAL-2026-2001 | Malicious | Not scored | 20 Mar, 2026 | npm laserlogsink |
Malicious release: Malicious code in delphoi (npm) MAL-2026-1998 | Malicious | Not scored | 20 Mar, 2026 | npm delphoi |
Malicious release: Malicious code in bic-seo (npm) MAL-2026-1995 | Malicious | Not scored | 20 Mar, 2026 | npm bic-seo |
Malicious release: Malicious code in puzzle-gateway (npm) MAL-2026-1996 | Malicious | Not scored | 20 Mar, 2026 | npm puzzle-gateway |
Malicious release: Malicious code in ty-web-session (npm) MAL-2026-1997 | Malicious | Not scored | 20 Mar, 2026 | npm ty-web-session |
Qwik City has array method pollution in FormData processing allows type confusion and DoS CVE-2026-32701, GHSA-whhv-gg5v-864r | High | 0.5% | 20 Mar, 2026 | npm @builder.io/qwik-city |
Malicious release: Malicious code in uipathisfun (npm) GHSA-9674-vwjj-qxjp, MAL-2026-1983 | Malicious | Not scored | 20 Mar, 2026 | npm uipathisfun |
Malicious release: Malicious code in chai-as-chayn (npm) GHSA-9mp5-2jp4-wmww, MAL-2026-1975 | Malicious | Not scored | 20 Mar, 2026 | npm chai-as-chayn |
Malicious release: Malicious code in innocent-pkg (npm) GHSA-6vcv-6xjg-jm7w, MAL-2026-1976 | Malicious | Not scored | 20 Mar, 2026 | npm innocent-pkg |
Malicious release: Malicious code in @fr3newera/baileys (npm) GHSA-5g2c-h3r8-6w3g, MAL-2026-1974 | Malicious | Not scored | 20 Mar, 2026 | npm @fr3newera/baileys |
Malicious release: Malicious code in xyztttxyz (npm) GHSA-p427-hrfp-pc52, MAL-2026-1982 | Malicious | Not scored | 20 Mar, 2026 | npm xyztttxyz |
Malicious release: Malicious code in xyzttt (npm) GHSA-q46m-r8wj-v4p9, MAL-2026-1981 | Malicious | Not scored | 20 Mar, 2026 | npm xyzttt |
Malicious release: Malicious code in svg-content-validation (npm) GHSA-f46r-3xg5-w2wm, MAL-2026-1980 | Malicious | Not scored | 20 Mar, 2026 | npm svg-content-validation |
Malicious release: Malicious code in json-bundling (npm) GHSA-58m2-f8rc-wwq2, MAL-2026-1977 | Malicious | Not scored | 20 Mar, 2026 | npm json-bundling |
Malicious release: Malicious code in json-specular (npm) GHSA-gmvg-736c-7g9f, MAL-2026-1978 | Malicious | Not scored | 20 Mar, 2026 | npm json-specular |
Malicious release: Malicious code in rollup-plugin-polyfill-utils (npm) GHSA-74r2-ggvc-h778, MAL-2026-1979 | Malicious | Not scored | 20 Mar, 2026 | npm rollup-plugin-polyfill-utils |
Malicious release: Malicious code in novi-cli (npm) GHSA-36wg-c889-h26j, MAL-2026-1961 | Malicious | Not scored | 20 Mar, 2026 | npm novi-cli |
Malicious release: Malicious code in couplus-cli (npm) GHSA-fp44-gpc5-cc43, MAL-2026-1944 | Malicious | Not scored | 20 Mar, 2026 | npm couplus-cli |
Malicious release: Malicious code in woltpickerapp (npm) GHSA-cp44-cvhx-wf33, MAL-2026-1973 | Malicious | Not scored | 20 Mar, 2026 | npm woltpickerapp |
Malicious release: Malicious code in cryptopapi (npm) GHSA-3qf9-476p-8j7f, MAL-2026-1945 | Malicious | Not scored | 20 Mar, 2026 | npm cryptopapi |
Malicious release: Malicious code in kyxserver-everything (npm) GHSA-2273-pvh3-9x6j, MAL-2026-1955 | Malicious | Not scored | 20 Mar, 2026 | npm kyxserver-everything |
Malicious release: Malicious code in kyxhiagent123 (npm) GHSA-h29v-mffh-vf54, MAL-2026-1954 | Malicious | Not scored | 20 Mar, 2026 | npm kyxhiagent123 |
Malicious release: Malicious code in hiagenttest (npm) GHSA-j4p4-x5rc-96xx, MAL-2026-1950 | Malicious | Not scored | 20 Mar, 2026 | npm hiagenttest |
Malicious release: Malicious code in kyxhiagent (npm) GHSA-r23r-8c7q-wm92, MAL-2026-1953 | Malicious | Not scored | 20 Mar, 2026 | npm kyxhiagent |
Malicious release: Malicious code in fadlsjf (npm) GHSA-34h2-gr5g-vc3j, MAL-2026-1948 | Malicious | Not scored | 20 Mar, 2026 | npm fadlsjf |
Malicious release: Malicious code in el-icon (npm) GHSA-gfm3-3p4f-m57w, MAL-2026-1947 | Malicious | Not scored | 20 Mar, 2026 | npm el-icon |
Malicious release: Malicious code in mtpmysql (npm) GHSA-7xpm-vmrr-4rrv, MAL-2026-1958 | Malicious | Not scored | 20 Mar, 2026 | npm mtpmysql |
Malicious release: Malicious code in mtpdb (npm) GHSA-8g7v-w2f5-7gw2, MAL-2026-1957 | Malicious | Not scored | 20 Mar, 2026 | npm mtpdb |
Malicious release: Malicious code in parsejson-pro (npm) GHSA-cv8h-5j9m-x3rc, MAL-2026-1962 | Malicious | Not scored | 20 Mar, 2026 | npm parsejson-pro |
Malicious release: Malicious code in safe-json-parsex (npm) GHSA-f6jh-hc8p-xpfx, MAL-2026-1968 | Malicious | Not scored | 20 Mar, 2026 | npm safe-json-parsex |
Malicious release: Malicious code in nodex-db (npm) GHSA-28w8-cpp5-g448, MAL-2026-1960 | Malicious | Not scored | 20 Mar, 2026 | npm nodex-db |
Malicious release: Malicious code in node-business (npm) GHSA-2prc-m9c3-jgwp, MAL-2026-1959 | Malicious | Not scored | 20 Mar, 2026 | npm node-business |
Malicious release: Malicious code in rollup-plugin-polyfill-build (npm) GHSA-49jr-xf59-c296, MAL-2026-1967 | Malicious | Not scored | 20 Mar, 2026 | npm rollup-plugin-polyfill-build |
Malicious release: Malicious code in hackerhacker (npm) GHSA-69jj-c93h-67p2, MAL-2026-1949 | Malicious | Not scored | 20 Mar, 2026 | npm hackerhacker |
Malicious release: Malicious code in trex-proxy-browser-extension-sdk (npm) GHSA-9m98-jvf5-jxx5, MAL-2026-1971 | Malicious | Not scored | 20 Mar, 2026 | npm trex-proxy-browser-extension-sdk |
Malicious release: Malicious code in spstargm (npm) GHSA-x24f-q36q-6pcj, MAL-2026-1969 | Malicious | Not scored | 20 Mar, 2026 | npm spstargm |
Malicious release: Malicious code in llmstash (npm) GHSA-p7pv-mfpq-4rfg, MAL-2026-1956 | Malicious | Not scored | 20 Mar, 2026 | npm llmstash |
Malicious release: Malicious code in @metaplex-foundations/umi-public-keys (npm) GHSA-2rjv-fxjc-xwmv, MAL-2026-1938 | Malicious | Not scored | 20 Mar, 2026 | npm @metaplex-foundations/umi-public-keys |
Malicious release: Malicious code in pretty-loggers (npm) GHSA-6mrh-fqgr-9x68, MAL-2026-1964 | Malicious | Not scored | 20 Mar, 2026 | npm pretty-loggers |
Malicious release: Malicious code in @validates-sdk/v3 (npm) GHSA-6rj6-xwm6-v698, MAL-2026-1940 | Malicious | Not scored | 20 Mar, 2026 | npm @validates-sdk/v3 |
Malicious release: Malicious code in decode-sdk (npm) GHSA-95h8-q9jh-jjwf, MAL-2026-1946 | Malicious | Not scored | 20 Mar, 2026 | npm decode-sdk |
Malicious release: Malicious code in clob-client-sdks (npm) GHSA-9cwp-m29q-hmgr, MAL-2026-1942 | Malicious | Not scored | 20 Mar, 2026 | npm clob-client-sdks |