Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in n8n-nodes-flowstats (npm) MAL-2026-17175 | Malicious | Not scored | 25 Sep, 2026 | npm n8n-nodes-flowstats |
Malicious release: Malicious code in wallet-connect-adapter (npm) MAL-2026-17179 | Malicious | Not scored | 25 Sep, 2026 | npm wallet-connect-adapter |
Malicious release: Malicious code in agency-testts (npm) MAL-2026-17171 | Malicious | Not scored | 25 Sep, 2026 | npm agency-testts |
Malicious release: Malicious code in secure-env3 (npm) MAL-2026-17178 | Malicious | Not scored | 25 Sep, 2026 | npm secure-env3 |
Malicious release: Malicious code in agency-test-exercise (npm) MAL-2026-17170 | Malicious | Not scored | 25 Sep, 2026 | npm agency-test-exercise |
Malicious release: Malicious code in better-dotenv3 (npm) MAL-2026-17172 | Malicious | Not scored | 25 Sep, 2026 | npm better-dotenv3 |
Malicious release: Malicious code in chromatitle-js (npm) MAL-2026-17174 | Malicious | Not scored | 25 Sep, 2026 | npm chromatitle-js |
Malicious release: Malicious code in chromatitle (npm) MAL-2026-17173 | Malicious | Not scored | 25 Sep, 2026 | npm chromatitle |
@bytebase/dbhub's read-only mode does not prevent database writes CVE-2026-61788, GHSA-mwwr-p57h-56pf | High | 0.4% | 24 Sep, 2026 | npm @bytebase/dbhub |
xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS CVE-2026-61784, GHSA-j8r4-32c5-33rc | Medium | 0.2% | 24 Sep, 2026 | npm xhtml-purifier |
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata CVE-2026-61782, GHSA-jmg2-rcxh-w8q3 | High | 0.4% | 24 Sep, 2026 | npm @rsdoctor/rspack-plugin |
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution CVE-2026-61742, GHSA-fm8p-53ww-hf6w | Critical | 0.2% | 24 Sep, 2026 | npm @bytebase/dbhub |
`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction CVE-2026-56744, GHSA-36f9-7rg5-cpf8 | High | 0.4% | 24 Sep, 2026 | npm @bsv/wallet-toolbox npm @bsv/wallet-toolbox-client npm @bsv/wallet-toolbox-mobile |
Malicious release: Malicious code in analytics-widget (npm) GHSA-548g-r2c9-6chm, MAL-2026-17163 | Malicious | Not scored | 24 Sep, 2026 | npm analytics-widget |
Malicious release: Malicious code in building-build (npm) GHSA-2fq4-2r26-qr64, MAL-2026-17164 | Malicious | Not scored | 24 Sep, 2026 | npm building-build |
Malicious release: Malicious code in cache-swipper (npm) MAL-2026-17166 | Malicious | Not scored | 24 Sep, 2026 | npm cache-swipper |
Malicious release: Malicious code in c2-client (npm) MAL-2026-17165 | Malicious | Not scored | 24 Sep, 2026 | npm c2-client |
Malicious release: Malicious code in simple-date-formatter-new-16 (npm) MAL-2026-17162 | Malicious | Not scored | 24 Sep, 2026 | npm simple-date-formatter-new-16 |
Malicious release: Malicious code in eslint-config-compact-base (npm) GHSA-gx7g-jjf6-c7jg, MAL-2026-17157 | Malicious | Not scored | 24 Sep, 2026 | npm eslint-config-compact-base |
Malicious release: Malicious code in simple-date-formatter-new-14 (npm) MAL-2026-17160 | Malicious | Not scored | 24 Sep, 2026 | npm simple-date-formatter-new-14 |
Malicious release: Malicious code in simple-date-formatter-new-13 (npm) MAL-2026-17159 | Malicious | Not scored | 24 Sep, 2026 | npm simple-date-formatter-new-13 |
Malicious release: Malicious code in aliftech-ui (npm) MAL-2026-17156 | Malicious | Not scored | 24 Sep, 2026 | npm aliftech-ui |
Malicious release: Malicious code in @osl-design/react (npm) MAL-2026-17155 | Malicious | Not scored | 24 Sep, 2026 | npm @osl-design/react |
Malicious release: Malicious code in simple-date-formatter-new-15 (npm) MAL-2026-17161 | Malicious | Not scored | 24 Sep, 2026 | npm simple-date-formatter-new-15 |
Malicious release: Malicious code in simple-date-formatter-new-11 (npm) MAL-2026-17158 | Malicious | Not scored | 24 Sep, 2026 | npm simple-date-formatter-new-11 |
Malicious release: Malicious code in @nf-addons/am-global-header (npm) MAL-2026-17154 | Malicious | Not scored | 24 Sep, 2026 | npm @nf-addons/am-global-header |
Malicious release: Malicious code in @birbalo/aliftech-ui (npm) MAL-2026-17153 | Malicious | Not scored | 24 Sep, 2026 | npm @birbalo/aliftech-ui |
Malicious release: Malicious code in @baanx/domain (npm) GHSA-qhfc-6rp6-pwv6, MAL-2026-16486 | Malicious | Not scored | 24 Sep, 2026 | npm @baanx/domain |
Malicious release: Malicious code in @baanx/common (npm) GHSA-27jh-hjhg-vg2p, MAL-2026-16485 | Malicious | Not scored | 24 Sep, 2026 | npm @baanx/common |
Malicious release: Malicious code in @rixxcodex/baileys (npm) MAL-2026-16483 | Malicious | Not scored | 23 Sep, 2026 | npm @rixxcodex/baileys |
Malicious release: Malicious code in pino-testkit (npm) GHSA-9q39-547h-rfpc, MAL-2026-16484 | Malicious | Not scored | 23 Sep, 2026 | npm pino-testkit |
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget CVE-2026-77394, GHSA-gvf2-2rh5-mpgf | High | 0.4% | 23 Sep, 2026 | npm @openc3/vue-common |
Malicious release: Malicious code in internallib_v657 (npm) MAL-2026-16482 | Malicious | Not scored | 23 Sep, 2026 | npm internallib_v657 |
Malicious release: Malicious code in internallib_v463 (npm) MAL-2026-16481 | Malicious | Not scored | 23 Sep, 2026 | npm internallib_v463 |
Malicious release: Malicious code in a-onesite (npm) MAL-2026-16480 | Malicious | Not scored | 23 Sep, 2026 | npm a-onesite |
scim-patch: Mutation of Inherited Built-in Method Objects CVE-2026-61834, GHSA-2mhw-wcx5-v3xj | Medium | 0.4% | 23 Sep, 2026 | npm scim-patch |
SunEditor: Critical XSS vulnerability - sanitizer bypass CVE-2026-59167, GHSA-6rf4-v2fh-m6p4 | Critical | 0.5% | 23 Sep, 2026 | npm suneditor |
Malicious release: Malicious code in event-hunter (npm) MAL-2026-16478 | Malicious | Not scored | 23 Sep, 2026 | npm event-hunter |
Malicious release: Malicious code in simplenewnpmpackage (npm) MAL-2026-16479 | Malicious | Not scored | 23 Sep, 2026 | npm simplenewnpmpackage |
Malicious release: Malicious code in com.apple.unityplugin.storekit (npm) GHSA-xcvv-h724-8jw8, MAL-2026-16477 | Malicious | Not scored | 23 Sep, 2026 | npm com.apple.unityplugin.storekit |
Malicious release: Malicious code in sea-baileys (npm) MAL-2026-16473 | Malicious | Not scored | 23 Sep, 2026 | npm sea-baileys |
Malicious release: Malicious code in vite-dev-launcher (npm) MAL-2026-16474 | Malicious | Not scored | 23 Sep, 2026 | npm vite-dev-launcher |
Malicious release: Malicious code in @test1230504/probe-7f3k2m-utils (npm) GHSA-3qx9-8g8p-4mcj, MAL-2026-16467 | Malicious | Not scored | 23 Sep, 2026 | npm @test1230504/probe-7f3k2m-utils |
Malicious release: Malicious code in @test1230504/string-format-helper (npm) GHSA-9572-4cpv-x2hp, MAL-2026-16468 | Malicious | Not scored | 23 Sep, 2026 | npm @test1230504/string-format-helper |
Malicious release: Malicious code in @test1230504/test-publish-verify (npm) GHSA-7m76-mq85-8c7w, MAL-2026-16469 | Malicious | Not scored | 23 Sep, 2026 | npm @test1230504/test-publish-verify |
Malicious release: Malicious code in z-deno-truth-va499w (npm) GHSA-76wq-hx78-mw6x, MAL-2026-16471 | Malicious | Not scored | 23 Sep, 2026 | npm z-deno-truth-va499w |
Malicious release: Malicious code in z-deno-truth-ya1t4m (npm) GHSA-qff9-mw3p-hg4c, MAL-2026-16472 | Malicious | Not scored | 23 Sep, 2026 | npm z-deno-truth-ya1t4m |
Malicious release: Malicious code in z-deno-truth-bwhlsz (npm) GHSA-f8xr-gjfq-xfcp, MAL-2026-16470 | Malicious | Not scored | 23 Sep, 2026 | npm z-deno-truth-bwhlsz |
Malicious release: Malicious code in hachutis (npm) MAL-2026-16464 | Malicious | Not scored | 23 Sep, 2026 | npm hachutis |
Malicious release: Malicious code in helpersutils-dev-tools (npm) GHSA-w2cw-5p4p-mc64, MAL-2026-16465 | Malicious | Not scored | 23 Sep, 2026 | npm helpersutils-dev-tools |