Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in json-mapping-sources (npm) GHSA-vphr-h9xh-66ff, MAL-2026-819 | Malicious | Not scored | 09 Feb, 2026 | npm json-mapping-sources |
Malicious release: Malicious code in react-svg-handler (npm) GHSA-qjpf-p69c-m582, MAL-2026-822 | Malicious | Not scored | 09 Feb, 2026 | npm react-svg-handler |
Malicious release: Malicious code in @skyeng/libs (npm) GHSA-97cm-4mhj-hmf7, MAL-2026-816 | Malicious | Not scored | 09 Feb, 2026 | npm @skyeng/libs |
jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions CVE-2026-1615, GHSA-87r5-mp6g-5w5j | High | 1.1% | 09 Feb, 2026 | npm jsonpath |
xcode-mcp-server vulnerable to Command Injection CVE-2026-2178, GHSA-84fx-pwf3-7777 | Low | 3.7% | 08 Feb, 2026 | npm xcode-mcp-server |
mcp-maigret vulnerable to command injection CVE-2026-2130, GHSA-2g7v-hghf-grg4 | Medium | 2.0% | 08 Feb, 2026 | npm mcp-maigret |
AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection CVE-2026-25762, GHSA-xx9g-fh25-4q64 | High | 0.5% | 06 Feb, 2026 | npm @adonisjs/bodyparser |
AdonisJS multipart body parsing has Prototype Pollution issue CVE-2026-25754, GHSA-f5x2-vj4h-vg4c | High | 0.4% | 06 Feb, 2026 | npm @adonisjs/bodyparser |
client-certificate-auth Vulnerable to Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect CVE-2026-25651, GHSA-m4w9-gch5-c2g4 | Medium | 0.2% | 06 Feb, 2026 | npm client-certificate-auth |
SCEditor has DOM XSS via emoticon URL/HTML injection CVE-2026-25581, GHSA-25fq-6qgg-qpj8 | Medium | 0.2% | 06 Feb, 2026 | npm sceditor |
Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json CVE-2026-25725, GHSA-ff64-7w26-62rf | High | 0.5% | 06 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code has Permission Deny Bypass Through Symbolic Links CVE-2026-25724, GHSA-4q92-rfm6-2cqx | Low | 0.5% | 06 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions CVE-2026-25723, GHSA-mhg7-666j-cqg4 | High | 0.4% | 06 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection CVE-2026-25722, GHSA-66q4-vfjg-2qhh | High | 0.5% | 06 Feb, 2026 | npm @anthropic-ai/claude-code |
Malicious release: Malicious code in web3-sinon (npm) GHSA-24w6-mgww-45jc, MAL-2026-807 | Malicious | Not scored | 06 Feb, 2026 | npm web3-sinon |
Malicious release: Malicious code in web3-chain-sinon (npm) GHSA-jq52-9634-mx8p, MAL-2026-806 | Malicious | Not scored | 06 Feb, 2026 | npm web3-chain-sinon |
Malicious release: Malicious code in aligned-arrays (npm) GHSA-vw8w-h7g2-48g9, MAL-2026-805 | Malicious | Not scored | 06 Feb, 2026 | npm aligned-arrays |
Malicious release: Malicious code in breadcrumb-service (npm) MAL-2026-804 | Malicious | Not scored | 06 Feb, 2026 | npm breadcrumb-service |
Malicious release: Malicious code in @rsgweb/utils (npm) GHSA-2q2j-g79q-g7h3, MAL-2026-801 | Malicious | Not scored | 06 Feb, 2026 | npm @rsgweb/utils |
Malicious release: Malicious code in @rsgweb/tina (npm) GHSA-78qc-m7fr-qq7g, MAL-2026-800 | Malicious | Not scored | 06 Feb, 2026 | npm @rsgweb/tina |
Malicious release: Malicious code in @rsgweb/modules-core-feedback (npm) GHSA-93fm-3r2f-cf76, MAL-2026-797 | Malicious | Not scored | 06 Feb, 2026 | npm @rsgweb/modules-core-feedback |
Malicious release: Malicious code in @rdxportal/ui-components (npm) GHSA-m52r-4c3v-2f62, MAL-2026-796 | Malicious | Not scored | 06 Feb, 2026 | npm @rdxportal/ui-components |
Malicious release: Malicious code in @sbseg-plugin/qbo-web-app-ui (npm) GHSA-m67c-8w34-xpjg, MAL-2026-802 | Malicious | Not scored | 06 Feb, 2026 | npm @sbseg-plugin/qbo-web-app-ui |
Malicious release: Malicious code in @rsgweb/rockstar-account (npm) GHSA-m9hg-mwfh-rcp3, MAL-2026-799 | Malicious | Not scored | 06 Feb, 2026 | npm @rsgweb/rockstar-account |
Malicious release: Malicious code in @rsgweb/modules-core-www-page (npm) GHSA-rqwj-m2m4-crj4, MAL-2026-798 | Malicious | Not scored | 06 Feb, 2026 | npm @rsgweb/modules-core-www-page |
Malicious release: Malicious code in @meli-lint/eslint-config-base (npm) GHSA-3hr9-qjx2-7xvf, MAL-2026-792 | Malicious | Not scored | 06 Feb, 2026 | npm @meli-lint/eslint-config-base |
Malicious release: Malicious code in @opposhop/nuxt-ssr-cache (npm) GHSA-48f8-cj2c-h5ph, MAL-2026-795 | Malicious | Not scored | 06 Feb, 2026 | npm @opposhop/nuxt-ssr-cache |
Malicious release: Malicious code in @meli-lint/eslint-config-base-ts (npm) GHSA-hc82-h5cp-3cmr, MAL-2026-793 | Malicious | Not scored | 06 Feb, 2026 | npm @meli-lint/eslint-config-base-ts |
Malicious release: Malicious code in @hashicorp-internal/vault-reporting (npm) GHSA-hcfh-22r5-mc4r, MAL-2026-791 | Malicious | Not scored | 06 Feb, 2026 | npm @hashicorp-internal/vault-reporting |
Malicious release: Malicious code in @meli-lint/eslint-config-tests-jest (npm) GHSA-jjwg-57v8-4486, MAL-2026-794 | Malicious | Not scored | 06 Feb, 2026 | npm @meli-lint/eslint-config-tests-jest |
Malicious release: Malicious code in syf-typings (npm) GHSA-9wwg-6qj9-823h, MAL-2026-789 | Malicious | Not scored | 06 Feb, 2026 | npm syf-typings |
Malicious release: Malicious code in @sporting-life/sportinglife-be (npm) GHSA-gw69-p5jg-cx4f, MAL-2026-787 | Malicious | Not scored | 06 Feb, 2026 | npm @sporting-life/sportinglife-be |
Malicious release: Malicious code in @sporting-life/sportinglife-betslip-sdk (npm) GHSA-h4pp-8q2m-94jf, MAL-2026-788 | Malicious | Not scored | 06 Feb, 2026 | npm @sporting-life/sportinglife-betslip-sdk |
Malicious release: Malicious code in @rsgweb/locale-tools (npm) GHSA-45p4-h5vh-f9rw, MAL-2026-786 | Malicious | Not scored | 06 Feb, 2026 | npm @rsgweb/locale-tools |
Malicious release: Malicious code in ac-element-engagement (npm) GHSA-3r8h-4c8r-pmq7, MAL-2026-780 | Malicious | Not scored | 06 Feb, 2026 | npm ac-element-engagement |
Malicious release: Malicious code in monkey-tags (npm) GHSA-cv2m-pr93-h35c, MAL-2026-784 | Malicious | Not scored | 06 Feb, 2026 | npm monkey-tags |
Malicious release: Malicious code in ac-array (npm) MAL-2026-775 | Malicious | Not scored | 06 Feb, 2026 | npm ac-array |
Malicious release: Malicious code in ac-checksum (npm) MAL-2026-776 | Malicious | Not scored | 06 Feb, 2026 | npm ac-checksum |
Malicious release: Malicious code in ac-dom-events (npm) MAL-2026-777 | Malicious | Not scored | 06 Feb, 2026 | npm ac-dom-events |
Malicious release: Malicious code in ac-dom-nodes (npm) MAL-2026-778 | Malicious | Not scored | 06 Feb, 2026 | npm ac-dom-nodes |
Malicious release: Malicious code in ac-dom-styles (npm) MAL-2026-779 | Malicious | Not scored | 06 Feb, 2026 | npm ac-dom-styles |
Malicious release: Malicious code in ac-feature (npm) MAL-2026-781 | Malicious | Not scored | 06 Feb, 2026 | npm ac-feature |
Malicious release: Malicious code in ac-polyfills (npm) MAL-2026-782 | Malicious | Not scored | 06 Feb, 2026 | npm ac-polyfills |
Malicious release: Malicious code in adobe_pipeline_test (npm) MAL-2026-783 | Malicious | Not scored | 06 Feb, 2026 | npm adobe_pipeline_test |
Malicious release: Malicious code in ppe-test (npm) MAL-2026-785 | Malicious | Not scored | 06 Feb, 2026 | npm ppe-test |
@nyariv/sandboxjs vulnerable to sandbox escape via TOCTOU bug on keys in property accesses CVE-2026-25641, GHSA-7x3h-rm86-3342 | Critical | 0.5% | 05 Feb, 2026 | npm @nyariv/sandboxjs |
Malicious release: Malicious code in ethers-lint (npm) MAL-2026-773 | Malicious | Not scored | 05 Feb, 2026 | npm ethers-lint |
@nyariv/sandboxjs has a Sandbox Escape vulnerability CVE-2026-25587, GHSA-66h4-qj4x-38xp | Critical | 0.7% | 05 Feb, 2026 | npm @nyariv/sandboxjs |
@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution CVE-2026-25586, GHSA-jjpw-65fv-8g48 | Critical | 0.7% | 05 Feb, 2026 | npm @nyariv/sandboxjs |
payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) CVE-2026-25574, GHSA-jq29-r496-r955 | Medium | 0.2% | 05 Feb, 2026 | npm payload |