Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading CVE-2026-28393, GHSA-7xhj-55q9-pc3m | High | 0.5% | 03 Mar, 2026 | npm openclaw |
OpenClaw has command injection via Windows shell fallback in Lobster tool execution CVE-2026-32000, GHSA-7fcc-cw49-xm78 | High | 0.7% | 03 Mar, 2026 | npm openclaw |
OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection GHSA-qj22-xqjr-v83v | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw has allowlist exec-guard bypass via env -S CVE-2026-31992, GHSA-48wf-g7cp-gr3m | High | 0.4% | 03 Mar, 2026 | npm openclaw |
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack CVE-2026-27601, GHSA-qpx9-hpmf-5gmw | High | 1.1% | 03 Mar, 2026 | npm underscore |
Malicious release: Malicious code in corp-build-utils-poc (npm) GHSA-788f-4r73-p46j, MAL-2026-1220 | Malicious | Not scored | 03 Mar, 2026 | npm corp-build-utils-poc |
Malicious release: Malicious code in xrpl-dev-portal (npm) GHSA-j96c-7pv4-pj3m, MAL-2026-1221 | Malicious | Not scored | 03 Mar, 2026 | npm xrpl-dev-portal |
Malicious release: Malicious code in demo-pipelinetest (npm) GHSA-m44x-4wqj-wpvf, MAL-2026-1219 | Malicious | Not scored | 03 Mar, 2026 | npm demo-pipelinetest |
Malicious release: Malicious code in @vk-cloud-billing/common (npm) GHSA-r3mx-c972-cmjg, MAL-2026-1217 | Malicious | Not scored | 03 Mar, 2026 | npm @vk-cloud-billing/common |
Malicious release: Malicious code in chai-as-confirmed (npm) GHSA-w36w-mf9p-w4r9, MAL-2026-1218 | Malicious | Not scored | 03 Mar, 2026 | npm chai-as-confirmed |
Malicious release: Malicious code in gaia-marionette (npm) MAL-2026-1227 | Malicious | Not scored | 03 Mar, 2026 | npm gaia-marionette |
Malicious release: Malicious code in pdfjs-dist-v5 (npm) MAL-2026-1216 | Malicious | Not scored | 03 Mar, 2026 | npm pdfjs-dist-v5 |
Malicious release: Malicious code in polymarket-trade-bot-api (npm) GHSA-66ch-w669-vp22, MAL-2026-1206 | Malicious | Not scored | 03 Mar, 2026 | npm polymarket-trade-bot-api |
Malicious release: Malicious code in polmarket (npm) GHSA-8qhc-629g-gmwr, MAL-2026-1203 | Malicious | Not scored | 03 Mar, 2026 | npm polmarket |
Malicious release: Malicious code in whop-sdk (npm) GHSA-jvvr-2542-jh22, MAL-2026-1215 | Malicious | Not scored | 03 Mar, 2026 | npm whop-sdk |
Malicious release: Malicious code in chai-as-proofed (npm) GHSA-8g87-54x4-gfx2, MAL-2026-1192 | Malicious | Not scored | 03 Mar, 2026 | npm chai-as-proofed |
Malicious release: Malicious code in chai-as-mock (npm) GHSA-vp25-hhqc-cx25, MAL-2026-1191 | Malicious | Not scored | 03 Mar, 2026 | npm chai-as-mock |
Malicious release: Malicious code in cmc-client (npm) GHSA-ffqq-2q7r-p599, MAL-2026-1194 | Malicious | Not scored | 03 Mar, 2026 | npm cmc-client |
Malicious release: Malicious code in polymarket-provider (npm) GHSA-g254-h8vh-66j7, MAL-2026-1205 | Malicious | Not scored | 03 Mar, 2026 | npm polymarket-provider |
Malicious release: Malicious code in mvn-runtime (npm) GHSA-5937-7cj9-h84g, MAL-2026-1202 | Malicious | Not scored | 03 Mar, 2026 | npm mvn-runtime |
Malicious release: Malicious code in alpha-replicator (npm) GHSA-93qm-662c-9rp8, MAL-2026-1188 | Malicious | Not scored | 03 Mar, 2026 | npm alpha-replicator |
Malicious release: Malicious code in tailwindcss-form-bundler (npm) GHSA-rc4v-mwgh-rq6w, MAL-2026-1209 | Malicious | Not scored | 03 Mar, 2026 | npm tailwindcss-form-bundler |
Malicious release: Malicious code in tailwindcss-fonts-bundler (npm) GHSA-wjf6-j74r-vpqg, MAL-2026-1208 | Malicious | Not scored | 03 Mar, 2026 | npm tailwindcss-fonts-bundler |
Malicious release: Malicious code in polygon-bitquery-api (npm) GHSA-3rf2-3wr3-9mh6, MAL-2026-1204 | Malicious | Not scored | 03 Mar, 2026 | npm polygon-bitquery-api |
Malicious release: Malicious code in mongos-api (npm) GHSA-7w62-875h-3rvj, MAL-2026-1201 | Malicious | Not scored | 03 Mar, 2026 | npm mongos-api |
Malicious release: Malicious code in tailwindcss-forms-animation (npm) GHSA-j98w-v7mh-wx8v, MAL-2026-1210 | Malicious | Not scored | 03 Mar, 2026 | npm tailwindcss-forms-animation |
Malicious release: Malicious code in mongoose-apis (npm) GHSA-m4gq-cqjp-prx9, MAL-2026-1200 | Malicious | Not scored | 03 Mar, 2026 | npm mongoose-apis |
Malicious release: Malicious code in cloud-apis (npm) GHSA-v37x-qc88-g574, MAL-2026-1193 | Malicious | Not scored | 03 Mar, 2026 | npm cloud-apis |
Malicious release: Malicious code in turbo-json-parser (npm) GHSA-q8qv-x9hx-52j4, MAL-2026-1213 | Malicious | Not scored | 03 Mar, 2026 | npm turbo-json-parser |
Malicious release: Malicious code in tailwindcss-forms-component (npm) GHSA-7xp9-q2rw-phjf, MAL-2026-1211 | Malicious | Not scored | 03 Mar, 2026 | npm tailwindcss-forms-component |
Malicious release: Malicious code in tailwindcss-forms-componentes (npm) GHSA-9gm2-p7c8-23pr, MAL-2026-1212 | Malicious | Not scored | 03 Mar, 2026 | npm tailwindcss-forms-componentes |
Malicious release: Malicious code in typescript-constructors (npm) GHSA-p8f2-q3f3-448f, MAL-2026-1214 | Malicious | Not scored | 03 Mar, 2026 | npm typescript-constructors |
Malicious release: Malicious code in bubblemap-bypass-sdk (npm) GHSA-v36r-mccr-r29h, MAL-2026-1190 | Malicious | Not scored | 03 Mar, 2026 | npm bubblemap-bypass-sdk |
Malicious release: Malicious code in selfbot-lofy (npm) GHSA-2j24-mx5f-f97c, MAL-2026-1207 | Malicious | Not scored | 03 Mar, 2026 | npm selfbot-lofy |
Malicious release: Malicious code in consolelofy (npm) GHSA-8946-7776-j566, MAL-2026-1195 | Malicious | Not scored | 03 Mar, 2026 | npm consolelofy |
Malicious release: Malicious code in bmath (npm) GHSA-wh7p-86wf-rwvg, MAL-2026-1189 | Malicious | Not scored | 03 Mar, 2026 | npm bmath |
Malicious release: Malicious code in @powpegtest/powpeg (npm) GHSA-2pvv-3j7g-78cv, MAL-2026-1186 | Malicious | Not scored | 03 Mar, 2026 | npm @powpegtest/powpeg |
Malicious release: Malicious code in demo-ip-package (npm) GHSA-f9r2-36vp-352g, MAL-2026-1196 | Malicious | Not scored | 03 Mar, 2026 | npm demo-ip-package |
Malicious release: Malicious code in demo-ip-package-cm (npm) GHSA-qcqp-vg8x-vrq6, MAL-2026-1197 | Malicious | Not scored | 03 Mar, 2026 | npm demo-ip-package-cm |
Malicious release: Malicious code in flycord (npm) GHSA-cmr9-xfh6-fffv, MAL-2026-1198 | Malicious | Not scored | 03 Mar, 2026 | npm flycord |
Malicious release: Malicious code in fps-logger (npm) GHSA-67vf-65vj-4ggg, MAL-2026-1199 | Malicious | Not scored | 03 Mar, 2026 | npm fps-logger |
Malicious release: Malicious code in @bookings.microsoft.com/s (npm) GHSA-7mjg-pxp5-4xmw, MAL-2026-1185 | Malicious | Not scored | 03 Mar, 2026 | npm @bookings.microsoft.com/s |
Malicious release: Malicious code in @twilio-client/twilio-client (npm) GHSA-xvg5-299p-j75r, MAL-2026-1187 | Malicious | Not scored | 03 Mar, 2026 | npm @twilio-client/twilio-client |
Malicious release: Malicious code in rbxm-utils (npm) GHSA-q5r5-vcwj-vxj6, MAL-2026-1183 | Malicious | Not scored | 03 Mar, 2026 | npm rbxm-utils |
Malicious release: Malicious code in web-prompt (npm) GHSA-rrw9-99f7-5654, MAL-2026-1184 | Malicious | Not scored | 03 Mar, 2026 | npm web-prompt |
Malicious release: Malicious code in bigmathutils-v2 (npm) GHSA-3rcr-3v9x-79r6, MAL-2026-1182 | Malicious | Not scored | 03 Mar, 2026 | npm bigmathutils-v2 |
Malicious release: Malicious code in webnochs (npm) GHSA-ccvh-6226-jf5g, MAL-2026-1181 | Malicious | Not scored | 03 Mar, 2026 | npm webnochs |
Malicious release: Malicious code in ethersnode (npm) GHSA-g45j-72gf-5658, MAL-2026-1174 | Malicious | Not scored | 03 Mar, 2026 | npm ethersnode |
Malicious release: Malicious code in webnoch (npm) GHSA-gp8w-96qw-8c33, MAL-2026-1180 | Malicious | Not scored | 03 Mar, 2026 | npm webnoch |
Malicious release: Malicious code in ethersnog (npm) GHSA-p22r-9fgj-8q7f, MAL-2026-1175 | Malicious | Not scored | 03 Mar, 2026 | npm ethersnog |