Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in es1int-config (npm) GHSA-r6q4-75xr-48pp, MAL-2026-1015 | Malicious | Not scored | 24 Feb, 2026 | npm es1int-config |
Malicious release: Malicious code in chai-tools (npm) GHSA-xp8h-j8vg-rffx, MAL-2026-1006 | Malicious | Not scored | 24 Feb, 2026 | npm chai-tools |
Malicious release: Malicious code in node-argon (npm) GHSA-67jr-g8v2-qg88, MAL-2026-1011 | Malicious | Not scored | 24 Feb, 2026 | npm node-argon |
Malicious release: Malicious code in argon-web3-chain (npm) GHSA-xcr9-755c-623c, MAL-2026-1005 | Malicious | Not scored | 24 Feb, 2026 | npm argon-web3-chain |
Malicious release: Malicious code in dotenvx-ext (npm) GHSA-rggj-8jcg-33c7, MAL-2026-1007 | Malicious | Not scored | 24 Feb, 2026 | npm dotenvx-ext |
Malicious release: Malicious code in modify-setting (npm) GHSA-p88w-8j5m-hjw2, MAL-2026-1010 | Malicious | Not scored | 24 Feb, 2026 | npm modify-setting |
Malicious release: Malicious code in es1int-re1ease (npm) GHSA-6hqv-jvhr-wvcc, MAL-2026-1008 | Malicious | Not scored | 24 Feb, 2026 | npm es1int-re1ease |
Malicious release: Malicious code in ultimates-express (npm) GHSA-mgfx-pg8p-7m76, MAL-2026-1012 | Malicious | Not scored | 24 Feb, 2026 | npm ultimates-express |
Malicious release: Malicious code in express-soaps (npm) GHSA-p445-jp29-c22j, MAL-2026-1009 | Malicious | Not scored | 24 Feb, 2026 | npm express-soaps |
Astro has memory exhaustion DoS due to missing request body size limit in Server Actions CVE-2026-27729, GHSA-jm64-8m5q-4qh8 | High | 0.5% | 24 Feb, 2026 | npm @astrojs/node |
Malicious release: Malicious code in react-markdown-canvas (npm) MAL-2026-1040 | Malicious | Not scored | 23 Feb, 2026 | npm react-markdown-canvas |
Astro has Full-Read SSRF in error rendering via Host: header injection CVE-2026-25545, GHSA-qq67-mvv5-fw3g | Medium | 1.9% | 23 Feb, 2026 | npm @astrojs/node |
yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent CVE-2025-70058, GHSA-663h-2vr3-ghrj | High | 0.2% | 23 Feb, 2026 | npm yapi-vendor |
Malicious release: Malicious code in secure-monkey (npm) MAL-2026-1041 | Malicious | Not scored | 23 Feb, 2026 | npm secure-monkey |
Malicious release: Malicious code in react-dropzone-truffle (npm) GHSA-h362-pxfp-fmhj, MAL-2026-999 | Malicious | Not scored | 23 Feb, 2026 | npm react-dropzone-truffle |
Malicious release: Malicious code in npm-security-testing (npm) GHSA-mfx5-vj54-ccc2, MAL-2026-997 | Malicious | Not scored | 23 Feb, 2026 | npm npm-security-testing |
Malicious release: Malicious code in rbxm-tools (npm) GHSA-qjfg-ppv8-33mh, MAL-2026-998 | Malicious | Not scored | 23 Feb, 2026 | npm rbxm-tools |
Malicious release: Malicious code in en-thrift-internal (npm) GHSA-r6q9-qcrw-mc6m, MAL-2026-986 | Malicious | Not scored | 22 Feb, 2026 | npm en-thrift-internal |
Malicious release: Malicious code in conduit-utils (npm) MAL-2026-985 | Malicious | Not scored | 22 Feb, 2026 | npm conduit-utils |
Malicious release: Malicious code in vl-ui-code-preview (npm) MAL-2026-994 | Malicious | Not scored | 22 Feb, 2026 | npm vl-ui-code-preview |
Malicious release: Malicious code in vl-ui-contact-card (npm) MAL-2026-995 | Malicious | Not scored | 22 Feb, 2026 | npm vl-ui-contact-card |
Malicious release: Malicious code in vl-ui-action-group (npm) MAL-2026-988 | Malicious | Not scored | 22 Feb, 2026 | npm vl-ui-action-group |
Malicious release: Malicious code in vl-ui-button (npm) MAL-2026-992 | Malicious | Not scored | 22 Feb, 2026 | npm vl-ui-button |
Malicious release: Malicious code in vl-ui-body (npm) MAL-2026-990 | Malicious | Not scored | 22 Feb, 2026 | npm vl-ui-body |
Malicious release: Malicious code in vl-ui-breadcrumb (npm) MAL-2026-991 | Malicious | Not scored | 22 Feb, 2026 | npm vl-ui-breadcrumb |
Malicious release: Malicious code in vl-ui-checkbox (npm) MAL-2026-993 | Malicious | Not scored | 22 Feb, 2026 | npm vl-ui-checkbox |
Malicious release: Malicious code in vl-ui-accessibility (npm) MAL-2026-987 | Malicious | Not scored | 22 Feb, 2026 | npm vl-ui-accessibility |
Malicious release: Malicious code in vl-ui-alert (npm) MAL-2026-989 | Malicious | Not scored | 22 Feb, 2026 | npm vl-ui-alert |
Malicious release: Malicious code in dt-fe-t2d-marketplace (npm) MAL-2026-981 | Malicious | Not scored | 22 Feb, 2026 | npm dt-fe-t2d-marketplace |
Malicious release: Malicious code in the-storyverse (npm) MAL-2026-980 | Malicious | Not scored | 22 Feb, 2026 | npm the-storyverse |
Malicious release: Malicious code in microsoft-cms-client (npm) GHSA-xcqv-f95p-vrc9, MAL-2026-978 | Malicious | Not scored | 21 Feb, 2026 | npm microsoft-cms-client |
OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE CVE-2026-27574, GHSA-v264-xqh4-9xmm | Critical | 0.6% | 21 Feb, 2026 | npm @oneuptime/common |
OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs CVE-2026-27576, GHSA-cxpw-2g23-2vgw | Medium | 0.2% | 20 Feb, 2026 | npm openclaw |
Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused CVE-2026-27492, GHSA-49pc-8936-wvfp | Medium | 0.2% | 20 Feb, 2026 | npm lettermint |
OpenClaw hardened cron webhook delivery against SSRF CVE-2026-27488, GHSA-w45g-5746-x9fp | Medium | 0.4% | 20 Feb, 2026 | npm openclaw |
OpenClaw: Reject symlinks in local skill packaging script CVE-2026-27485, GHSA-r6h2-5gqq-v5v6 | Medium | 0.2% | 20 Feb, 2026 | npm openclaw |
OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows CVE-2026-27484, GHSA-wh94-p5m6-mr7j | Low | 0.2% | 20 Feb, 2026 | npm openclaw |
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVE-2026-25896, GHSA-m7jm-9gc2-mpf2 | Critical | 0.5% | 20 Feb, 2026 | npm fast-xml-parser |
Malicious release: Malicious code in azure-postgresql-auth (npm) MAL-2026-975 | Malicious | Not scored | 20 Feb, 2026 | npm azure-postgresql-auth |
Malicious release: Malicious code in rollup-plugin-polyfill-swc (npm) GHSA-93mq-v792-4x85, MAL-2026-976 | Malicious | Not scored | 20 Feb, 2026 | npm rollup-plugin-polyfill-swc |
Malicious release: Malicious code in parse-compat (npm) GHSA-g2x2-r9hh-73f2, MAL-2026-967 | Malicious | Not scored | 20 Feb, 2026 | npm parse-compat |
Malicious release: Malicious code in crypto-locale (npm) GHSA-55c2-6c39-jrrp, MAL-2026-955 | Malicious | Not scored | 20 Feb, 2026 | npm crypto-locale |
Malicious release: Malicious code in detect-cache (npm) GHSA-87gx-xxm8-25x2, MAL-2026-957 | Malicious | Not scored | 20 Feb, 2026 | npm detect-cache |
Malicious release: Malicious code in naniod (npm) GHSA-p4cj-w7xw-88p3, MAL-2026-964 | Malicious | Not scored | 20 Feb, 2026 | npm naniod |
Malicious release: Malicious code in locale-loader-pro (npm) GHSA-v45c-qjqp-mw3q, MAL-2026-963 | Malicious | Not scored | 20 Feb, 2026 | npm locale-loader-pro |
Malicious release: Malicious code in scan-store (npm) GHSA-v858-hgfg-q94p, MAL-2026-969 | Malicious | Not scored | 20 Feb, 2026 | npm scan-store |
Malicious release: Malicious code in uudi (npm) GHSA-w9hv-7gxr-9f8f, MAL-2026-972 | Malicious | Not scored | 20 Feb, 2026 | npm uudi |
Malicious release: Malicious code in ethres (npm) GHSA-56j5-62q9-cj2c, MAL-2026-958 | Malicious | Not scored | 20 Feb, 2026 | npm ethres |
Malicious release: Malicious code in veim (npm) GHSA-99w5-2gw8-7w8c, MAL-2026-973 | Malicious | Not scored | 20 Feb, 2026 | npm veim |
Malicious release: Malicious code in yarsg (npm) GHSA-xw78-h8vv-phcj, MAL-2026-974 | Malicious | Not scored | 20 Feb, 2026 | npm yarsg |