Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in testing-package-xdsfdsfsc (npm) GHSA-g689-p7j3-98f4, MAL-2026-704 | Malicious | Not scored | 03 Feb, 2026 | npm testing-package-xdsfdsfsc |
Malicious release: Malicious code in @x-clients/features (npm) MAL-2026-703 | Malicious | Not scored | 03 Feb, 2026 | npm @x-clients/features |
Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing CVE-2026-1664, GHSA-r7x9-8ph7-w8cg | Medium | 0.5% | 03 Feb, 2026 | npm agents |
Malicious release: Malicious code in fileupload-util (npm) GHSA-jmrr-h39h-r9g2, MAL-2026-690 | Malicious | Not scored | 03 Feb, 2026 | npm fileupload-util |
Malicious release: Malicious code in tailwindcss-forms-kit (npm) GHSA-pj8r-8q3r-5ph7, MAL-2026-693 | Malicious | Not scored | 03 Feb, 2026 | npm tailwindcss-forms-kit |
Malicious release: Malicious code in eslint-config-nlx (npm) GHSA-454v-pj98-2gmp, MAL-2026-688 | Malicious | Not scored | 03 Feb, 2026 | npm eslint-config-nlx |
Malicious release: Malicious code in fingerprint-stitch (npm) GHSA-6h22-pfff-vf2m, MAL-2026-691 | Malicious | Not scored | 03 Feb, 2026 | npm fingerprint-stitch |
Malicious release: Malicious code in eslint-config-stitch (npm) GHSA-7583-6vm2-9c8v, MAL-2026-689 | Malicious | Not scored | 03 Feb, 2026 | npm eslint-config-stitch |
Malicious release: Malicious code in tsconfig-stitch (npm) GHSA-pfpv-rmhq-q3pm, MAL-2026-695 | Malicious | Not scored | 03 Feb, 2026 | npm tsconfig-stitch |
Malicious release: Malicious code in graphrix (npm) GHSA-257q-hjm7-v3pp, MAL-2026-692 | Malicious | Not scored | 03 Feb, 2026 | npm graphrix |
Malicious release: Malicious code in tarax (npm) GHSA-977v-pjj7-wg54, MAL-2026-694 | Malicious | Not scored | 03 Feb, 2026 | npm tarax |
Malicious release: Malicious code in @uselagoon/ui-library (npm) GHSA-32mg-49pf-3c7v, MAL-2026-687 | Malicious | Not scored | 03 Feb, 2026 | npm @uselagoon/ui-library |
Malicious release: Malicious code in internallib_v782 (npm) GHSA-64mm-mg79-hvm8, MAL-2026-681 | Malicious | Not scored | 03 Feb, 2026 | npm internallib_v782 |
Malicious release: Malicious code in epic-admin-ui (npm) GHSA-28p2-g59r-757w, MAL-2026-679 | Malicious | Not scored | 03 Feb, 2026 | npm epic-admin-ui |
Malicious release: Malicious code in strengthifys (npm) GHSA-5wwj-79v9-g888, MAL-2026-685 | Malicious | Not scored | 03 Feb, 2026 | npm strengthifys |
Malicious release: Malicious code in react-responsive-carousel-v4 (npm) GHSA-qq97-6wv4-mc44, MAL-2026-684 | Malicious | Not scored | 03 Feb, 2026 | npm react-responsive-carousel-v4 |
Malicious release: Malicious code in frontend-js-state-web (npm) GHSA-xj8r-jcfw-rgh6, MAL-2026-680 | Malicious | Not scored | 03 Feb, 2026 | npm frontend-js-state-web |
Malicious release: Malicious code in l2-contracts (npm) GHSA-vpf8-7r9r-xj4q, MAL-2026-683 | Malicious | Not scored | 03 Feb, 2026 | npm l2-contracts |
Malicious release: Malicious code in kwp-analytics (npm) GHSA-5j5h-h973-m92m, MAL-2026-682 | Malicious | Not scored | 03 Feb, 2026 | npm kwp-analytics |
Malicious release: Malicious code in chai-promise-tools (npm) GHSA-2737-5rcq-jwmj, MAL-2026-677 | Malicious | Not scored | 03 Feb, 2026 | npm chai-promise-tools |
Malicious release: Malicious code in cookie-parsers-env (npm) GHSA-6895-8x2m-4vgj, MAL-2026-678 | Malicious | Not scored | 03 Feb, 2026 | npm cookie-parsers-env |
Malicious release: Malicious code in @ikeacnalan/icons (npm) GHSA-4prp-gwjj-hvcx, MAL-2026-676 | Malicious | Not scored | 03 Feb, 2026 | npm @ikeacnalan/icons |
Malicious release: Malicious code in freedom-baileys (npm) GHSA-fxh3-4mx2-wr7c, MAL-2026-674 | Malicious | Not scored | 03 Feb, 2026 | npm freedom-baileys |
Malicious release: Malicious code in baileys-ud (npm) GHSA-x3qj-8mg5-454f, MAL-2026-673 | Malicious | Not scored | 03 Feb, 2026 | npm baileys-ud |
Malicious release: Malicious code in supun-baileys (npm) GHSA-8pm4-268p-f52g, MAL-2026-675 | Malicious | Not scored | 03 Feb, 2026 | npm supun-baileys |
Malicious release: Malicious code in baileys-dtz (npm) GHSA-cj3x-rfp6-hvpq, MAL-2026-672 | Malicious | Not scored | 03 Feb, 2026 | npm baileys-dtz |
Malicious release: Malicious code in cheerio-core (npm) GHSA-cf89-f5f4-vjmf, MAL-2026-671 | Malicious | Not scored | 03 Feb, 2026 | npm cheerio-core |
Malicious release: Malicious code in aligned-array (npm) GHSA-j7qj-j3fg-5xc8, MAL-2026-670 | Malicious | Not scored | 03 Feb, 2026 | npm aligned-array |
Malicious release: Malicious code in transform-exponentiation-operator (npm) GHSA-9wj6-743f-j243, MAL-2026-665 | Malicious | Not scored | 03 Feb, 2026 | npm transform-exponentiation-operator |
Malicious release: Malicious code in transform-es2015-modules-amd (npm) GHSA-c3j3-4q92-2fmj, MAL-2026-664 | Malicious | Not scored | 03 Feb, 2026 | npm transform-es2015-modules-amd |
Malicious release: Malicious code in transform-async-generator-functions (npm) GHSA-c676-937q-qchw, MAL-2026-663 | Malicious | Not scored | 03 Feb, 2026 | npm transform-async-generator-functions |
Malicious release: Malicious code in typed-document-node (npm) GHSA-g72g-cjcm-9rqx, MAL-2026-667 | Malicious | Not scored | 03 Feb, 2026 | npm typed-document-node |
Malicious release: Malicious code in transform-react-display-name (npm) GHSA-q5v2-pv3p-r942, MAL-2026-666 | Malicious | Not scored | 03 Feb, 2026 | npm transform-react-display-name |
Malicious release: Malicious code in typescript-react-apollo (npm) GHSA-r75h-h4r8-v8mp, MAL-2026-668 | Malicious | Not scored | 03 Feb, 2026 | npm typescript-react-apollo |
Malicious release: Malicious code in netlify-project-helper (npm) GHSA-c7jj-qv39-h43c, MAL-2026-661 | Malicious | Not scored | 03 Feb, 2026 | npm netlify-project-helper |
Malicious release: Malicious code in dns-troubleshoot-toolkit-xyz123 (npm) GHSA-fr66-mh5r-h32m, MAL-2026-660 | Malicious | Not scored | 03 Feb, 2026 | npm dns-troubleshoot-toolkit-xyz123 |
Malicious release: Malicious code in vite-ui-components (npm) GHSA-ghx7-rp3h-537v, MAL-2026-669 | Malicious | Not scored | 03 Feb, 2026 | npm vite-ui-components |
Malicious release: Malicious code in ansi-universal-ui (npm) GHSA-j2cw-hc39-qrw9, MAL-2026-658 | Malicious | Not scored | 03 Feb, 2026 | npm ansi-universal-ui |
Malicious release: Malicious code in atg-atgse (npm) GHSA-xfh5-c4pm-5p96, MAL-2026-659 | Malicious | Not scored | 03 Feb, 2026 | npm atg-atgse |
Malicious release: Malicious code in researchpoc (npm) GHSA-pvcf-c7x9-273f, MAL-2026-662 | Malicious | Not scored | 03 Feb, 2026 | npm researchpoc |
Malicious release: Malicious code in react-dnd-legacy-html5-backend (npm) GHSA-3g83-5rw5-fhpw, MAL-2026-657 | Malicious | Not scored | 03 Feb, 2026 | npm react-dnd-legacy-html5-backend |
Malicious release: Malicious code in jshint-groups (npm) GHSA-f2cq-h2rx-cjw6, MAL-2026-656 | Malicious | Not scored | 03 Feb, 2026 | npm jshint-groups |
OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand CVE-2026-25157, GHSA-q284-4pvr-m585 | High | 1.1% | 02 Feb, 2026 | npm clawdbot |
OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable CVE-2026-24763, GHSA-mc68-q9jw-2h3v | High | 5.2% | 02 Feb, 2026 | npm clawdbot |
SignalK Server has Path Traversal leading to information disclosure CVE-2026-25228, GHSA-vrhw-v2hw-jffx | Medium | 0.4% | 02 Feb, 2026 | npm signalk-server |
Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream CVE-2026-25224, GHSA-mrq3-vjjr-p77c | Low | 0.5% | 02 Feb, 2026 | npm fastify |
Fastify's Content-Type header tab character allows body validation bypass CVE-2026-25223, GHSA-jx2c-rxcm-jvmq | High | 0.9% | 02 Feb, 2026 | npm fastify |
locutus is vulnerable to Prototype Pollution CVE-2026-25521, GHSA-rxrv-835q-v5mh | Critical | 0.3% | 02 Feb, 2026 | npm locutus |
SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE CVE-2026-25142, GHSA-9p4w-fq8m-2hp7 | Critical | 1.2% | 02 Feb, 2026 | npm @nyariv/sandboxjs |
jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution CVE-2026-24737, GHSA-pqxr-3g65-p328 | High | 0.6% | 02 Feb, 2026 | npm jspdf |