Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in sukuna-baileys (npm) GHSA-m5x3-m9w7-v86p, MAL-2026-1133 | Malicious | Not scored | 02 Mar, 2026 | npm sukuna-baileys |
Malicious release: Malicious code in yuji-baileys (npm) GHSA-r56q-r5p2-x734, MAL-2026-1135 | Malicious | Not scored | 02 Mar, 2026 | npm yuji-baileys |
Malicious release: Malicious code in kazumarii (npm) GHSA-2rpw-36c3-xcvm, MAL-2026-1130 | Malicious | Not scored | 02 Mar, 2026 | npm kazumarii |
Malicious release: Malicious code in ts-big-number (npm) GHSA-v4cj-rqxr-fp7c, MAL-2026-1134 | Malicious | Not scored | 02 Mar, 2026 | npm ts-big-number |
Malicious release: Malicious code in npm-doc-builder (npm) GHSA-xmrq-xc4p-4552, MAL-2026-1132 | Malicious | Not scored | 02 Mar, 2026 | npm npm-doc-builder |
Malicious release: Malicious code in @yaoii-bails/libsignal-node (npm) GHSA-8m8v-2xpf-gfwq, MAL-2026-1124 | Malicious | Not scored | 02 Mar, 2026 | npm @yaoii-bails/libsignal-node |
Malicious release: Malicious code in @yaoii-bails/socket (npm) GHSA-cwj6-86q5-p4hm, MAL-2026-1126 | Malicious | Not scored | 02 Mar, 2026 | npm @yaoii-bails/socket |
Malicious release: Malicious code in @yaoii-bails/baileys (npm) GHSA-jgwm-f38r-hqj6, MAL-2026-1123 | Malicious | Not scored | 02 Mar, 2026 | npm @yaoii-bails/baileys |
Malicious release: Malicious code in @yaoii-bails/libsignall-node (npm) GHSA-pj6v-c99q-p649, MAL-2026-1125 | Malicious | Not scored | 02 Mar, 2026 | npm @yaoii-bails/libsignall-node |
Malicious release: Malicious code in @yaoii-bails/yaoii-baileys (npm) GHSA-w4wq-33rw-2mxr, MAL-2026-1127 | Malicious | Not scored | 02 Mar, 2026 | npm @yaoii-bails/yaoii-baileys |
Malicious release: Malicious code in chai-vest (npm) GHSA-j383-j4m3-9c75, MAL-2026-1115 | Malicious | Not scored | 02 Mar, 2026 | npm chai-vest |
Malicious release: Malicious code in js-nodecat (npm) GHSA-m3qj-483q-v65m, MAL-2026-1116 | Malicious | Not scored | 02 Mar, 2026 | npm js-nodecat |
Malicious release: Malicious code in hapi-lint (npm) GHSA-3xx3-79g2-hg8f, MAL-2026-1108 | Malicious | Not scored | 02 Mar, 2026 | npm hapi-lint |
Malicious release: Malicious code in bcryptance (npm) GHSA-ww49-jmx8-mjg8, MAL-2026-1102 | Malicious | Not scored | 02 Mar, 2026 | npm bcryptance |
Malicious release: Malicious code in argonist (npm) GHSA-29c7-mqr6-w382, MAL-2026-1101 | Malicious | Not scored | 02 Mar, 2026 | npm argonist |
Malicious release: Malicious code in typoriem (npm) GHSA-c8hp-3fmr-c3r5, MAL-2026-1113 | Malicious | Not scored | 02 Mar, 2026 | npm typoriem |
Malicious release: Malicious code in vitetest-lint (npm) GHSA-rg84-2gf4-9cj4, MAL-2026-1114 | Malicious | Not scored | 02 Mar, 2026 | npm vitetest-lint |
Malicious release: Malicious code in loadash-lint (npm) GHSA-mq8x-7m3h-wgw6, MAL-2026-1110 | Malicious | Not scored | 02 Mar, 2026 | npm loadash-lint |
Malicious release: Malicious code in expressjs-lint (npm) GHSA-9w37-v3hq-ppfh, MAL-2026-1106 | Malicious | Not scored | 02 Mar, 2026 | npm expressjs-lint |
Malicious release: Malicious code in sequelization (npm) GHSA-fwf9-p2gv-vrvx, MAL-2026-1112 | Malicious | Not scored | 02 Mar, 2026 | npm sequelization |
Malicious release: Malicious code in jsnwebapptoken (npm) GHSA-22m6-pxx8-9vgj, MAL-2026-1109 | Malicious | Not scored | 02 Mar, 2026 | npm jsnwebapptoken |
Malicious release: Malicious code in daytonjs (npm) GHSA-3x7f-5p6c-rx9x, MAL-2026-1105 | Malicious | Not scored | 02 Mar, 2026 | npm daytonjs |
Malicious release: Malicious code in bee-quarl (npm) GHSA-vfq3-hxh4-3m5j, MAL-2026-1103 | Malicious | Not scored | 02 Mar, 2026 | npm bee-quarl |
Malicious release: Malicious code in mqttoken (npm) GHSA-qv65-57f4-3x87, MAL-2026-1111 | Malicious | Not scored | 02 Mar, 2026 | npm mqttoken |
Malicious release: Malicious code in bubble-core (npm) GHSA-8vf5-3mff-8gfp, MAL-2026-1104 | Malicious | Not scored | 02 Mar, 2026 | npm bubble-core |
Malicious release: Malicious code in formmiderable (npm) GHSA-frrp-vmmx-gr3c, MAL-2026-1107 | Malicious | Not scored | 02 Mar, 2026 | npm formmiderable |
Malicious release: Malicious code in ng-vzbootstrap (npm) GHSA-25jj-4j8c-cgrq, MAL-2026-1100 | Malicious | Not scored | 01 Mar, 2026 | npm ng-vzbootstrap |
Malicious release: Malicious code in sketch-measure (npm) MAL-2026-1096 | Malicious | Not scored | 01 Mar, 2026 | npm sketch-measure |
Malicious release: Malicious code in jquery-display (npm) MAL-2026-1095 | Malicious | Not scored | 01 Mar, 2026 | npm jquery-display |
Malicious release: Malicious code in dc-web-app (npm) GHSA-29rq-p698-29cj, MAL-2026-1094 | Malicious | Not scored | 01 Mar, 2026 | npm dc-web-app |
Malicious release: Malicious code in naughty-package (npm) MAL-2026-1093 | Malicious | Not scored | 01 Mar, 2026 | npm naughty-package |
Malicious release: Malicious code in bps-design-system (npm) MAL-2026-1087 | Malicious | Not scored | 28 Feb, 2026 | npm bps-design-system |
Malicious release: Malicious code in dc-mobx (npm) GHSA-rm4v-p5gj-p92w, MAL-2026-1083 | Malicious | Not scored | 28 Feb, 2026 | npm dc-mobx |
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() GHSA-5c6j-r48x-rmvq | High | Not scored | 28 Feb, 2026 | npm serialize-javascript |
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only) CVE-2026-82259, GHSA-fpg4-jhqr-589c | High | 0.5% | 28 Feb, 2026 | npm @sveltejs/kit |
OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata CVE-2026-32898, GHSA-7jx5-9fjg-hp4m | Medium | 0.3% | 27 Feb, 2026 | npm openclaw |
OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth) CVE-2026-4039, GHSA-82g8-464f-2mv7 | Medium | 0.4% | 27 Feb, 2026 | npm openclaw |
Malicious release: Malicious code in marionette-react-view (npm) GHSA-xqmc-68vr-gq64, MAL-2026-1081 | Malicious | Not scored | 27 Feb, 2026 | npm marionette-react-view |
@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware CVE-2026-2880, GHSA-8p85-9qpw-fwgw | High | 0.4% | 27 Feb, 2026 | npm @fastify/middie |
CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage CVE-2026-26862, GHSA-jfrq-hj9f-c8qx | High | 0.4% | 27 Feb, 2026 | npm clevertap-web-sdk |
CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function CVE-2026-26861, GHSA-j5mf-6rh3-rhgg | High | 0.2% | 27 Feb, 2026 | npm clevertap-web-sdk |
Nest has a Fastify URL Encoding Middleware Bypass CVE-2026-2293, GHSA-r4wm-x892-vjmx | High | 0.8% | 27 Feb, 2026 | npm @nestjs/platform-fastify |
Malicious release: Malicious code in @dgxeon/libsignal-node (npm) GHSA-34p6-99h9-93p8, MAL-2026-1072 | Malicious | Not scored | 27 Feb, 2026 | npm @dgxeon/libsignal-node |
Malicious release: Malicious code in socket-dgxeon (npm) GHSA-rjr7-mc49-vw8f, MAL-2026-1078 | Malicious | Not scored | 27 Feb, 2026 | npm socket-dgxeon |
Malicious release: Malicious code in sokettry (npm) GHSA-69j8-jrgj-x492, MAL-2026-1079 | Malicious | Not scored | 27 Feb, 2026 | npm sokettry |
Malicious release: Malicious code in dgxeon-soket (npm) GHSA-838q-63vp-c27h, MAL-2026-1074 | Malicious | Not scored | 27 Feb, 2026 | npm dgxeon-soket |
Malicious release: Malicious code in dgxeon-soket3 (npm) GHSA-8766-24pj-cr9x, MAL-2026-1076 | Malicious | Not scored | 27 Feb, 2026 | npm dgxeon-soket3 |
Malicious release: Malicious code in dgxeon-soket4 (npm) GHSA-9rff-9hmx-c2wr, MAL-2026-1077 | Malicious | Not scored | 27 Feb, 2026 | npm dgxeon-soket4 |
Malicious release: Malicious code in baileys-xeonbot (npm) GHSA-g44v-v77q-7jpq, MAL-2026-1073 | Malicious | Not scored | 27 Feb, 2026 | npm baileys-xeonbot |
Malicious release: Malicious code in dgxeon-soket2 (npm) GHSA-r65g-wqxj-p5pp, MAL-2026-1075 | Malicious | Not scored | 27 Feb, 2026 | npm dgxeon-soket2 |