Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in lvldragdrop (npm) GHSA-4mpr-9v4m-36mr, MAL-2026-592 | Malicious | Not scored | 28 Jan, 2026 | npm lvldragdrop |
Malicious release: Malicious code in kol7a (npm) GHSA-gjfm-7vq2-6xxm, MAL-2026-591 | Malicious | Not scored | 28 Jan, 2026 | npm kol7a |
JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js CVE-2025-61140, GHSA-6c59-mwgh-r2x6 | Critical | 0.5% | 28 Jan, 2026 | npm jsonpath |
BrowserStack Local vulnerable to Command Injection through logfile variable CVE-2025-57283, GHSA-g4w6-c99w-4wh7 | High | 0.8% | 28 Jan, 2026 | npm browserstack-local |
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components GHSA-h25m-26qc-wcjf | High | Not scored | 28 Jan, 2026 | npm next |
Malicious release: Malicious code in chai-as-extended (npm) GHSA-f2gq-x6pw-gx86, MAL-2026-584 | Malicious | Not scored | 28 Jan, 2026 | npm chai-as-extended |
Malicious release: Malicious code in chai-async-tests (npm) GHSA-7rw2-vmhh-r49r, MAL-2026-585 | Malicious | Not scored | 28 Jan, 2026 | npm chai-async-tests |
Malicious release: Malicious code in dotenv-embed (npm) GHSA-g7gf-xv5g-23vj, MAL-2026-589 | Malicious | Not scored | 28 Jan, 2026 | npm dotenv-embed |
Malicious release: Malicious code in chai-sub (npm) GHSA-jqjg-xrc8-j5wp, MAL-2026-588 | Malicious | Not scored | 28 Jan, 2026 | npm chai-sub |
Malicious release: Malicious code in chai-px (npm) GHSA-pxqc-p784-gwcv, MAL-2026-587 | Malicious | Not scored | 28 Jan, 2026 | npm chai-px |
Malicious release: Malicious code in chai-chains-async (npm) GHSA-2jj5-mpwm-2r3q, MAL-2026-586 | Malicious | Not scored | 28 Jan, 2026 | npm chai-chains-async |
Malicious release: Malicious code in vuejavascript (npm) GHSA-343p-7f7g-4fc5, MAL-2026-583 | Malicious | Not scored | 28 Jan, 2026 | npm vuejavascript |
Malicious release: Malicious code in skndkjasndkjan (npm) GHSA-4wq8-r5qp-h22x, MAL-2026-579 | Malicious | Not scored | 28 Jan, 2026 | npm skndkjasndkjan |
Malicious release: Malicious code in somesomesome (npm) GHSA-4x3j-x4rf-gpwm, MAL-2026-580 | Malicious | Not scored | 28 Jan, 2026 | npm somesomesome |
Malicious release: Malicious code in somesomesomesome (npm) GHSA-fvr5-73f4-24ff, MAL-2026-581 | Malicious | Not scored | 28 Jan, 2026 | npm somesomesomesome |
Malicious release: Malicious code in somsodamsd (npm) GHSA-gf2v-h9fx-4c26, MAL-2026-582 | Malicious | Not scored | 28 Jan, 2026 | npm somsodamsd |
Malicious release: Malicious code in @pukpuk1/somsodamsd (npm) GHSA-gh8h-whjm-r7xr, MAL-2026-578 | Malicious | Not scored | 28 Jan, 2026 | npm @pukpuk1/somsodamsd |
Malicious release: Malicious code in react-toast-cold (npm) GHSA-p975-whf2-4298, MAL-2026-626 | Malicious | Not scored | 28 Jan, 2026 | npm react-toast-cold |
Malicious release: Malicious code in lyatly-utils (npm) GHSA-q5j5-vc8g-m882, MAL-2026-570 | Malicious | Not scored | 28 Jan, 2026 | npm lyatly-utils |
Malicious release: Malicious code in okijuh (npm) GHSA-hwjx-5cwx-rh26, MAL-2026-571 | Malicious | Not scored | 28 Jan, 2026 | npm okijuh |
Malicious release: Malicious code in chai-as-hashed (npm) GHSA-xq26-9mh8-r598, MAL-2026-564 | Malicious | Not scored | 28 Jan, 2026 | npm chai-as-hashed |
Malicious release: Malicious code in converse-rn-lib (npm) GHSA-fj2c-wgqv-w8v4, MAL-2026-565 | Malicious | Not scored | 28 Jan, 2026 | npm converse-rn-lib |
Malicious release: Malicious code in teslaone (npm) GHSA-2q8p-9v46-43cq, MAL-2026-576 | Malicious | Not scored | 28 Jan, 2026 | npm teslaone |
Malicious release: Malicious code in ern-picking2-api (npm) GHSA-3783-qwgq-rp7r, MAL-2026-569 | Malicious | Not scored | 28 Jan, 2026 | npm ern-picking2-api |
Malicious release: Malicious code in syntax-flow (npm) GHSA-jmgr-j34v-w55f, MAL-2026-574 | Malicious | Not scored | 28 Jan, 2026 | npm syntax-flow |
Malicious release: Malicious code in transform-vue-jsx (npm) GHSA-rcwh-hv2v-4qph, MAL-2026-577 | Malicious | Not scored | 28 Jan, 2026 | npm transform-vue-jsx |
Malicious release: Malicious code in syntax-jsx (npm) GHSA-x6qc-f5wc-vg8v, MAL-2026-575 | Malicious | Not scored | 28 Jan, 2026 | npm syntax-jsx |
Malicious release: Malicious code in equimper (npm) GHSA-26g8-qc5w-6c85, MAL-2026-568 | Malicious | Not scored | 28 Jan, 2026 | npm equimper |
Malicious release: Malicious code in pino-debugger (npm) GHSA-567m-jw3g-vq3f, MAL-2026-572 | Malicious | Not scored | 28 Jan, 2026 | npm pino-debugger |
Malicious release: Malicious code in debug-glitz (npm) GHSA-hp56-hf27-83mh, MAL-2026-567 | Malicious | Not scored | 28 Jan, 2026 | npm debug-glitz |
Malicious release: Malicious code in debug-fmt (npm) GHSA-hvhh-9q7c-6g8m, MAL-2026-566 | Malicious | Not scored | 28 Jan, 2026 | npm debug-fmt |
Malicious release: Malicious code in @nayzak51/primebeem-db (npm) GHSA-frcp-w72c-22w9, MAL-2026-563 | Malicious | Not scored | 28 Jan, 2026 | npm @nayzak51/primebeem-db |
Malicious release: Malicious code in primebeem-db (npm) GHSA-h78x-qfxq-8h87, MAL-2026-573 | Malicious | Not scored | 28 Jan, 2026 | npm primebeem-db |
Malicious release: Malicious code in acuitymobileapp (npm) GHSA-hmgh-7h9h-prmj, MAL-2026-555 | Malicious | Not scored | 28 Jan, 2026 | npm acuitymobileapp |
Malicious release: Malicious code in n8n-nodes-zalo-fevox (npm) GHSA-v6q8-mf3h-4655, MAL-2026-557 | Malicious | Not scored | 28 Jan, 2026 | npm n8n-nodes-zalo-fevox |
Malicious release: Malicious code in n8n-zalo-fevox (npm) GHSA-xxpx-q438-f7hp, MAL-2026-558 | Malicious | Not scored | 28 Jan, 2026 | npm n8n-zalo-fevox |
Malicious release: Malicious code in digital-music-dynmsg-ribbon (npm) GHSA-3qx7-2mxx-7vvc, MAL-2026-556 | Malicious | Not scored | 28 Jan, 2026 | npm digital-music-dynmsg-ribbon |
Malicious release: Malicious code in transform-async-to-generator (npm) GHSA-cxhp-v2gh-3v7f, MAL-2026-560 | Malicious | Not scored | 28 Jan, 2026 | npm transform-async-to-generator |
Malicious release: Malicious code in transform-regenerator (npm) GHSA-gc7v-2qjx-vwwp, MAL-2026-561 | Malicious | Not scored | 28 Jan, 2026 | npm transform-regenerator |
Malicious release: Malicious code in syntax-async-functions (npm) GHSA-vw4x-22x4-cvmw, MAL-2026-559 | Malicious | Not scored | 28 Jan, 2026 | npm syntax-async-functions |
Malicious release: Malicious code in express-lists-routes (npm) GHSA-qg82-jrgh-rv25, MAL-2026-551 | Malicious | Not scored | 28 Jan, 2026 | npm express-lists-routes |
Malicious release: Malicious code in json-mapping-web (npm) GHSA-m3jp-4w2p-gm5f, MAL-2026-552 | Malicious | Not scored | 28 Jan, 2026 | npm json-mapping-web |
Malicious release: Malicious code in cdnhost (npm) GHSA-wh7m-vhx9-f4qq, MAL-2026-550 | Malicious | Not scored | 28 Jan, 2026 | npm cdnhost |
Malicious release: Malicious code in blockchain-helper-lib (npm) GHSA-3rcr-854m-q7w4, MAL-2026-549 | Malicious | Not scored | 28 Jan, 2026 | npm blockchain-helper-lib |
billboard.js is vulnerable to XSS during chart option binding CVE-2026-1513, GHSA-rpc5-pm7q-hjmp | High | 0.2% | 28 Jan, 2026 | npm billboard.js |
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal CVE-2026-24842, GHSA-34x7-hfp2-rc4v | High | 0.6% | 28 Jan, 2026 | npm tar |
vlt Mishandles Path Sanitization for tar CVE-2026-24909, GHSA-gf2c-jwcj-x929 | Medium | 0.2% | 27 Jan, 2026 | npm @vltpkg/tar |
Ghost vulnerable to XSS via malicious Portal preview links BIT-ghost-2026-24778, CVE-2026-24778, GHSA-gv6q-2m97-882h | High | 0.3% | 27 Jan, 2026 | npm @tryghost/portal npm ghost |
StudioCMS has Authorization Bypass Through User-Controlled Key CVE-2026-24134, GHSA-8cw6-53m5-4932 | Medium | 0.3% | 27 Jan, 2026 | npm studiocms |
Hono vulnerable to XSS through ErrorBoundary component CVE-2026-24771, GHSA-9r54-q6cx-xmh5 | Medium | 0.4% | 27 Jan, 2026 | npm hono |