Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder CVE-2026-24133, GHSA-95fx-jjr5-f39c | High | 0.6% | 02 Feb, 2026 | npm jspdf |
jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation) CVE-2026-24043, GHSA-vm32-vv63-w422 | Medium | 0.3% | 02 Feb, 2026 | npm jspdf |
jsPDF has Shared State Race Condition in addJS Plugin CVE-2026-24040, GHSA-cjw8-79x6-5cj4 | Medium | 0.3% | 02 Feb, 2026 | npm jspdf |
Signal K set-system-time plugin vulnerable to RCE - Command Injection CVE-2026-23515, GHSA-p8gp-2w28-mhwg | Critical | 4.5% | 02 Feb, 2026 | npm @signalk/set-system-time |
Malicious release: Malicious code in picking-miniapp (npm) GHSA-8fp4-7xff-mpwm, MAL-2026-646 | Malicious | Not scored | 02 Feb, 2026 | npm picking-miniapp |
Malicious release: Malicious code in react-native-expofp (npm) GHSA-326q-pfrf-3f2v, MAL-2026-647 | Malicious | Not scored | 02 Feb, 2026 | npm react-native-expofp |
Malicious release: Malicious code in dise-pkt (npm) GHSA-jgcj-pm32-hmcj, MAL-2026-644 | Malicious | Not scored | 02 Feb, 2026 | npm dise-pkt |
Malicious release: Malicious code in @hemanshu_patil/xcode (npm) GHSA-7jjv-6pgj-6rv7, MAL-2026-642 | Malicious | Not scored | 02 Feb, 2026 | npm @hemanshu_patil/xcode |
Malicious release: Malicious code in @hemanshu_patil/xcode-windows-x64 (npm) GHSA-p6w8-c7rw-69c8, MAL-2026-643 | Malicious | Not scored | 02 Feb, 2026 | npm @hemanshu_patil/xcode-windows-x64 |
Malicious release: Malicious code in yazxzpedia (npm) GHSA-765g-mfj4-v8fw, MAL-2026-648 | Malicious | Not scored | 02 Feb, 2026 | npm yazxzpedia |
Malicious release: Malicious code in libsignal-yazxzpedia (npm) GHSA-vxf9-w3qp-wrwm, MAL-2026-645 | Malicious | Not scored | 02 Feb, 2026 | npm libsignal-yazxzpedia |
Malicious release: Malicious code in idv-script (npm) GHSA-2pq9-mrgm-gmmx, MAL-2026-636 | Malicious | Not scored | 02 Feb, 2026 | npm idv-script |
Malicious release: Malicious code in launchdarkly-cpp-networking (npm) GHSA-6pxm-pv2w-jh33, MAL-2026-637 | Malicious | Not scored | 02 Feb, 2026 | npm launchdarkly-cpp-networking |
Malicious release: Malicious code in solhint-plugin-hyperlane (npm) GHSA-mp62-7w25-x8jm, MAL-2026-638 | Malicious | Not scored | 02 Feb, 2026 | npm solhint-plugin-hyperlane |
Malicious release: Malicious code in eslint-config-minecraft-scripting (npm) GHSA-rh9x-2vc7-83hh, MAL-2026-634 | Malicious | Not scored | 02 Feb, 2026 | npm eslint-config-minecraft-scripting |
Malicious release: Malicious code in @casaverso/frontend-core (npm) GHSA-x9r9-7gv6-vrfh, MAL-2026-628 | Malicious | Not scored | 02 Feb, 2026 | npm @casaverso/frontend-core |
Malicious release: Malicious code in client-desktop-web-installer (npm) MAL-2026-629 | Malicious | Not scored | 02 Feb, 2026 | npm client-desktop-web-installer |
Malicious release: Malicious code in cowsay-allcaps (npm) MAL-2026-630 | Malicious | Not scored | 02 Feb, 2026 | npm cowsay-allcaps |
Malicious release: Malicious code in cowsay-caps (npm) MAL-2026-631 | Malicious | Not scored | 02 Feb, 2026 | npm cowsay-caps |
Malicious release: Malicious code in cowsay-deluxe (npm) MAL-2026-632 | Malicious | Not scored | 02 Feb, 2026 | npm cowsay-deluxe |
Malicious release: Malicious code in cowsay-fancy (npm) MAL-2026-633 | Malicious | Not scored | 02 Feb, 2026 | npm cowsay-fancy |
Malicious release: Malicious code in finnairshop (npm) MAL-2026-635 | Malicious | Not scored | 02 Feb, 2026 | npm finnairshop |
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl CVE-2026-25253, GHSA-g8p2-7wf7-98mq | High | 32.4% | 01 Feb, 2026 | npm clawdbot |
Malicious release: Malicious code in roots-cms-client (npm) GHSA-q57g-x3rh-xj4x, MAL-2026-617 | Malicious | Not scored | 31 Jan, 2026 | npm roots-cms-client |
Malicious release: Malicious code in c11dff444 (npm) GHSA-cpcr-74hm-pg3c, MAL-2026-616 | Malicious | Not scored | 31 Jan, 2026 | npm c11dff444 |
Malicious release: Malicious code in teaser-nav (npm) MAL-2026-615 | Malicious | Not scored | 31 Jan, 2026 | npm teaser-nav |
Malicious release: Malicious code in sharedclasses (npm) MAL-2026-612 | Malicious | Not scored | 30 Jan, 2026 | npm sharedclasses |
Malicious release: Malicious code in mbo-letters-cl (npm) MAL-2026-611 | Malicious | Not scored | 30 Jan, 2026 | npm mbo-letters-cl |
@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks CVE-2026-25153, GHSA-6jr7-99pf-8vgf | High | 0.6% | 30 Jan, 2026 | npm @backstage/plugin-techdocs-node |
@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator CVE-2026-25152, GHSA-w669-jj7h-88m9 | Medium | 0.4% | 30 Jan, 2026 | npm @backstage/plugin-techdocs-node |
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments CVE-2026-25141, GHSA-gch2-phqh-fg9q | Critical | 0.7% | 30 Jan, 2026 | npm @orval/core |
LobeHub Vulnerable to Improper Authorization in Presigned Upload CVE-2026-23835, GHSA-wrrr-8jcv-wjf5 | Medium | 0.4% | 30 Jan, 2026 | npm @lobehub/chat |
fast-xml-parser has RangeError DoS Numeric Entities Bug CVE-2026-25128, GHSA-37qj-frw5-hhjh | High | 0.6% | 30 Jan, 2026 | npm fast-xml-parser |
Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy CVE-2026-25050, GHSA-6f65-4fv2-wwch | Low | 0.4% | 30 Jan, 2026 | npm @vendure/core |
Malicious release: Malicious code in euskalplantxa (npm) MAL-2026-609 | Malicious | Not scored | 30 Jan, 2026 | npm euskalplantxa |
Malicious release: Malicious code in ezviz-shop-mall (npm) MAL-2026-608 | Malicious | Not scored | 30 Jan, 2026 | npm ezviz-shop-mall |
Malicious release: Malicious code in banquet-runtime-modules (npm) GHSA-2mrq-r658-h2pp, MAL-2026-607 | Malicious | Not scored | 30 Jan, 2026 | npm banquet-runtime-modules |
deepHas vulnerable to Prototype Pollution via constructor.prototype CVE-2026-25047, GHSA-2733-6c58-pf27 | Critical | 0.8% | 29 Jan, 2026 | npm deephas |
Malicious release: Malicious code in dhgshop (npm) MAL-2026-605 | Malicious | Not scored | 29 Jan, 2026 | npm dhgshop |
Malicious release: Malicious code in researchpoc2 (npm) GHSA-mq4c-jcxh-3w9f, MAL-2026-600 | Malicious | Not scored | 29 Jan, 2026 | npm researchpoc2 |
Malicious release: Malicious code in jwt-pack (npm) GHSA-grxm-6mcc-6f63, MAL-2026-599 | Malicious | Not scored | 29 Jan, 2026 | npm jwt-pack |
Malicious release: Malicious code in n8n-nodes-comfyui-illu (npm) GHSA-h3jq-3362-m28h, MAL-2026-597 | Malicious | Not scored | 29 Jan, 2026 | npm n8n-nodes-comfyui-illu |
Malicious release: Malicious code in wallet-icon-font (npm) GHSA-cf83-6cqr-9pfj, MAL-2026-598 | Malicious | Not scored | 29 Jan, 2026 | npm wallet-icon-font |
Malicious release: Malicious code in turbotax (npm) MAL-2026-596 | Malicious | Not scored | 29 Jan, 2026 | npm turbotax |
Maker.js has Unsafe Property Copying in makerjs.extendObject CVE-2026-24888, GHSA-2cp6-34r9-54xx | Critical | 1.0% | 28 Jan, 2026 | npm makerjs |
NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload CVE-2026-24769, GHSA-q5c6-h22r-qpwr | High | 0.4% | 28 Jan, 2026 | npm nocodb |
NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter CVE-2026-24768, GHSA-3hmw-8mw3-rmpj | Medium | 0.3% | 28 Jan, 2026 | npm nocodb |
NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality CVE-2026-24767, GHSA-xr7v-j379-34v9 | Medium | 0.2% | 28 Jan, 2026 | npm nocodb |
NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS CVE-2026-24766, GHSA-95ff-46g6-6gw9 | Medium | 0.4% | 28 Jan, 2026 | npm nocodb |
Malicious release: Malicious code in epic-asset-uploader (npm) GHSA-ph6h-g4vx-mhcw, MAL-2026-594 | Malicious | Not scored | 28 Jan, 2026 | npm epic-asset-uploader |