Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields CVE-2026-33128, GHSA-22cc-p3c6-wpvm | Critical | 0.6% | 18 Mar, 2026 | npm h3 |
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas CVE-2026-82868, GHSA-87v3-4cfp-cm76 | Medium | 0.3% | 18 Mar, 2026 | npm @pdfme/schemas |
Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas CVE-2026-82867, GHSA-qq9g-96v4-m3cj | Medium | 0.3% | 18 Mar, 2026 | npm @pdfme/schemas |
Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing) CVE-2026-56236, GHSA-8mpm-q7mh-8fvh | High | 0.2% | 18 Mar, 2026 | npm @capgo/cli |
Malicious release: Malicious code in zip.js-2.8.2 (npm) MAL-2026-1881 | Malicious | Not scored | 18 Mar, 2026 | npm zip.js-2.8.2 |
Malicious release: Malicious code in zero-develop-component-library (npm) MAL-2026-1880 | Malicious | Not scored | 18 Mar, 2026 | npm zero-develop-component-library |
Malicious release: Malicious code in yahoo-commerce (npm) MAL-2026-1879 | Malicious | Not scored | 18 Mar, 2026 | npm yahoo-commerce |
Malicious release: Malicious code in wpt-client (npm) MAL-2026-1878 | Malicious | Not scored | 18 Mar, 2026 | npm wpt-client |
Malicious release: Malicious code in wiz-redirects (npm) MAL-2026-1877 | Malicious | Not scored | 18 Mar, 2026 | npm wiz-redirects |
Malicious release: Malicious code in wiz-production (npm) MAL-2026-1876 | Malicious | Not scored | 18 Mar, 2026 | npm wiz-production |
Malicious release: Malicious code in wiz-prod (npm) MAL-2026-1875 | Malicious | Not scored | 18 Mar, 2026 | npm wiz-prod |
Malicious release: Malicious code in wiz-dev (npm) MAL-2026-1874 | Malicious | Not scored | 18 Mar, 2026 | npm wiz-dev |
Malicious release: Malicious code in vvvv4234 (npm) MAL-2026-1873 | Malicious | Not scored | 18 Mar, 2026 | npm vvvv4234 |
Malicious release: Malicious code in user_migration (npm) MAL-2026-1872 | Malicious | Not scored | 18 Mar, 2026 | npm user_migration |
Malicious release: Malicious code in urti (npm) MAL-2026-1871 | Malicious | Not scored | 18 Mar, 2026 | npm urti |
Malicious release: Malicious code in ui-core_mal (npm) MAL-2026-1870 | Malicious | Not scored | 18 Mar, 2026 | npm ui-core_mal |
Malicious release: Malicious code in tss12111 (npm) MAL-2026-1869 | Malicious | Not scored | 18 Mar, 2026 | npm tss12111 |
Malicious release: Malicious code in tscom-geo (npm) MAL-2026-1868 | Malicious | Not scored | 18 Mar, 2026 | npm tscom-geo |
Malicious release: Malicious code in thread_ppe-test (npm) MAL-2026-1867 | Malicious | Not scored | 18 Mar, 2026 | npm thread_ppe-test |
Malicious release: Malicious code in testctfproject3 (npm) MAL-2026-1866 | Malicious | Not scored | 18 Mar, 2026 | npm testctfproject3 |
Malicious release: Malicious code in testctfproject2 (npm) MAL-2026-1865 | Malicious | Not scored | 18 Mar, 2026 | npm testctfproject2 |
Malicious release: Malicious code in testctfproject1 (npm) MAL-2026-1864 | Malicious | Not scored | 18 Mar, 2026 | npm testctfproject1 |
Malicious release: Malicious code in test-bugbounty-package-6 (npm) MAL-2026-1862 | Malicious | Not scored | 18 Mar, 2026 | npm test-bugbounty-package-6 |
Malicious release: Malicious code in test-bugbounty-package-9 (npm) MAL-2026-1863 | Malicious | Not scored | 18 Mar, 2026 | npm test-bugbounty-package-9 |
Malicious release: Malicious code in technical-assignment (npm) MAL-2026-1861 | Malicious | Not scored | 18 Mar, 2026 | npm technical-assignment |
Malicious release: Malicious code in tdangularjs (npm) MAL-2026-1860 | Malicious | Not scored | 18 Mar, 2026 | npm tdangularjs |
Malicious release: Malicious code in stylelint-preference (npm) MAL-2026-1859 | Malicious | Not scored | 18 Mar, 2026 | npm stylelint-preference |
Malicious release: Malicious code in stnsxmp3 (npm) MAL-2026-1858 | Malicious | Not scored | 18 Mar, 2026 | npm stnsxmp3 |
Malicious release: Malicious code in stnsxmp (npm) MAL-2026-1857 | Malicious | Not scored | 18 Mar, 2026 | npm stnsxmp |
Malicious release: Malicious code in static-content-cannabis (npm) MAL-2026-1856 | Malicious | Not scored | 18 Mar, 2026 | npm static-content-cannabis |
Malicious release: Malicious code in ssf-desktop-api-specification (npm) MAL-2026-1855 | Malicious | Not scored | 18 Mar, 2026 | npm ssf-desktop-api-specification |
Malicious release: Malicious code in ssf-desktop-api-electron (npm) MAL-2026-1854 | Malicious | Not scored | 18 Mar, 2026 | npm ssf-desktop-api-electron |
Malicious release: Malicious code in solana-gateway-contracts-private (npm) MAL-2026-1853 | Malicious | Not scored | 18 Mar, 2026 | npm solana-gateway-contracts-private |
Malicious release: Malicious code in soft-nav (npm) MAL-2026-1852 | Malicious | Not scored | 18 Mar, 2026 | npm soft-nav |
Malicious release: Malicious code in snort-security-tool (npm) MAL-2026-1851 | Malicious | Not scored | 18 Mar, 2026 | npm snort-security-tool |
Malicious release: Malicious code in smm-yt (npm) MAL-2026-1850 | Malicious | Not scored | 18 Mar, 2026 | npm smm-yt |
Malicious release: Malicious code in skyoauth2 (npm) MAL-2026-1849 | Malicious | Not scored | 18 Mar, 2026 | npm skyoauth2 |
Malicious release: Malicious code in sky-enablement (npm) MAL-2026-1848 | Malicious | Not scored | 18 Mar, 2026 | npm sky-enablement |
Malicious release: Malicious code in signer-app (npm) MAL-2026-1847 | Malicious | Not scored | 18 Mar, 2026 | npm signer-app |
Malicious release: Malicious code in signalk-poc-bug (npm) MAL-2026-1846 | Malicious | Not scored | 18 Mar, 2026 | npm signalk-poc-bug |
Malicious release: Malicious code in signalk-bug-poc (npm) MAL-2026-1845 | Malicious | Not scored | 18 Mar, 2026 | npm signalk-bug-poc |
Malicious release: Malicious code in shopify-ping-web (npm) MAL-2026-1844 | Malicious | Not scored | 18 Mar, 2026 | npm shopify-ping-web |
Malicious release: Malicious code in shopify-admin-web (npm) MAL-2026-1843 | Malicious | Not scored | 18 Mar, 2026 | npm shopify-admin-web |
Malicious release: Malicious code in sheinx (npm) MAL-2026-1842 | Malicious | Not scored | 18 Mar, 2026 | npm sheinx |
Malicious release: Malicious code in safeness-sb-new (npm) MAL-2026-1841 | Malicious | Not scored | 18 Mar, 2026 | npm safeness-sb-new |
Malicious release: Malicious code in ref-selector (npm) MAL-2026-1840 | Malicious | Not scored | 18 Mar, 2026 | npm ref-selector |
Malicious release: Malicious code in react-router-on-navigation (npm) MAL-2026-1838 | Malicious | Not scored | 18 Mar, 2026 | npm react-router-on-navigation |
Malicious release: Malicious code in react-state-optimizer-core (npm) MAL-2026-1839 | Malicious | Not scored | 18 Mar, 2026 | npm react-state-optimizer-core |
Malicious release: Malicious code in react-query-core-utils (npm) MAL-2026-1837 | Malicious | Not scored | 18 Mar, 2026 | npm react-query-core-utils |
Malicious release: Malicious code in react-performance-suite (npm) MAL-2026-1836 | Malicious | Not scored | 18 Mar, 2026 | npm react-performance-suite |