Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @brl-laiwb/ng-laiwb-api (npm) GHSA-9mfj-j283-9f88, MAL-2026-452 | Malicious | Not scored | 22 Jan, 2026 | npm @brl-laiwb/ng-laiwb-api |
Malicious release: Malicious code in @alluxio/common-ui (npm) GHSA-w72q-x24f-3gq9, MAL-2026-451 | Malicious | Not scored | 22 Jan, 2026 | npm @alluxio/common-ui |
Malicious release: Malicious code in csv-parsing-xz (npm) GHSA-42cg-2rj4-8h6f, MAL-2026-458 | Malicious | Not scored | 22 Jan, 2026 | npm csv-parsing-xz |
Malicious release: Malicious code in csv-parsing-xx (npm) GHSA-j64q-7vw7-x9pp, MAL-2026-457 | Malicious | Not scored | 22 Jan, 2026 | npm csv-parsing-xx |
Malicious release: Malicious code in rank253222 (npm) MAL-2026-448 | Malicious | Not scored | 22 Jan, 2026 | npm rank253222 |
Seroval affected by Denial of Service via Deeply Nested Objects CVE-2026-24006, GHSA-3j22-8qj3-26mx | High | 0.4% | 22 Jan, 2026 | npm seroval |
Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow` CVE-2026-24048, GHSA-q2x5-4xjx-c6p9 | Low | 0.2% | 21 Jan, 2026 | npm @backstage/backend-defaults |
@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass CVE-2026-24047, GHSA-2p49-45hj-7mc9 | Medium | 0.5% | 21 Jan, 2026 | npm @backstage/cli-common |
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions CVE-2026-24046, GHSA-rq6q-wr2q-7pgp | High | 0.5% | 21 Jan, 2026 | npm @backstage/backend-defaults npm @backstage/plugin-scaffolder-backend npm @backstage/plugin-scaffolder-node |
Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions CVE-2025-13465, GHSA-xxjr-mmjv-4gpg | Medium | 1.8% | 21 Jan, 2026 | npm lodash npm lodash-amd npm lodash-es npm lodash.omit +1 more |
Seroval affected by Denial of Service via Array serialization CVE-2026-23957, GHSA-66fc-rw6m-c2q6 | High | 0.4% | 21 Jan, 2026 | npm seroval |
seroval affected by Denial of Service via RegExp serialization CVE-2026-23956, GHSA-hx9m-jf43-8ffr | High | 0.5% | 21 Jan, 2026 | npm seroval |
@envelop/graphql-modules has a Race Condition vulnerability GHSA-h3hw-29fv-2x75 | High | Not scored | 21 Jan, 2026 | npm @envelop/graphql-modules |
sm-crypto Affected by Signature Forgery in SM2-DSA CVE-2026-23965, GHSA-hpwg-xg7m-3p6m | High | 0.2% | 21 Jan, 2026 | npm sm-crypto |
sm-crypto Affected by Signature Malleability in SM2-DSA CVE-2026-23967, GHSA-qv7w-v773-3xqm | High | 0.2% | 21 Jan, 2026 | npm sm-crypto |
sm-crypto Affected by Private Key Recovery in SM2-PKE CVE-2026-23966, GHSA-pgx9-497m-6c4v | Critical | 0.2% | 21 Jan, 2026 | npm sm-crypto |
seroval Affected by Remote Code Execution via JSON Deserialization CVE-2026-23737, GHSA-3rxj-6cgf-8cfw | High | 0.6% | 21 Jan, 2026 | npm seroval |
seroval Affected by Prototype Pollution via JSON Deserialization CVE-2026-23736, GHSA-hj76-42vx-jwp4 | Critical | 0.3% | 21 Jan, 2026 | npm seroval |
Malicious release: Malicious code in tv-admin-commons (npm) GHSA-87xf-ghj4-8h7x, MAL-2026-439 | Malicious | Not scored | 21 Jan, 2026 | npm tv-admin-commons |
Malicious release: Malicious code in ts-tweetnacl-utils (npm) GHSA-hp92-6jf4-773f, MAL-2026-438 | Malicious | Not scored | 21 Jan, 2026 | npm ts-tweetnacl-utils |
Malicious release: Malicious code in lumo-api-client (npm) GHSA-vxqc-gmrh-x7m2, MAL-2026-437 | Malicious | Not scored | 21 Jan, 2026 | npm lumo-api-client |
Malicious release: Malicious code in jquery-ajaxchimp (npm) GHSA-xxq4-gc37-grmh, MAL-2026-436 | Malicious | Not scored | 21 Jan, 2026 | npm jquery-ajaxchimp |
Malicious release: Malicious code in aligntype (npm) GHSA-fp6q-w5hw-mvvx, MAL-2026-435 | Malicious | Not scored | 21 Jan, 2026 | npm aligntype |
Malicious release: Malicious code in chai-async-test (npm) GHSA-wjj4-r47f-m9q8, MAL-2026-409 | Malicious | Not scored | 21 Jan, 2026 | npm chai-async-test |
Malicious release: Malicious code in dotenv-expanded (npm) GHSA-94jw-vmxc-vv4v, MAL-2026-415 | Malicious | Not scored | 21 Jan, 2026 | npm dotenv-expanded |
Malicious release: Malicious code in qdrant-js (npm) GHSA-8p85-84qw-3m2v, MAL-2026-426 | Malicious | Not scored | 21 Jan, 2026 | npm qdrant-js |
Malicious release: Malicious code in weaviate-js (npm) GHSA-hwmx-j3gv-65mh, MAL-2026-434 | Malicious | Not scored | 21 Jan, 2026 | npm weaviate-js |
Malicious release: Malicious code in replicate-js (npm) GHSA-qfp4-ffv5-3xrg, MAL-2026-427 | Malicious | Not scored | 21 Jan, 2026 | npm replicate-js |
Malicious release: Malicious code in nanoid-js (npm) GHSA-5fj2-vwp3-544j, MAL-2026-418 | Malicious | Not scored | 21 Jan, 2026 | npm nanoid-js |
Malicious release: Malicious code in storage-types (npm) GHSA-f8wv-3jjp-qw4w, MAL-2026-430 | Malicious | Not scored | 21 Jan, 2026 | npm storage-types |
Malicious release: Malicious code in plugin-vue (npm) GHSA-hxxj-55p6-h93r, MAL-2026-425 | Malicious | Not scored | 21 Jan, 2026 | npm plugin-vue |
Malicious release: Malicious code in babel-js (npm) GHSA-qg2h-qpcj-f7c2, MAL-2026-407 | Malicious | Not scored | 21 Jan, 2026 | npm babel-js |
Malicious release: Malicious code in plugin-react-swc (npm) GHSA-w743-w2hh-6f23, MAL-2026-424 | Malicious | Not scored | 21 Jan, 2026 | npm plugin-react-swc |
Malicious release: Malicious code in aws-crt-nodejs (npm) GHSA-jpvg-2xxh-xxvh, MAL-2026-406 | Malicious | Not scored | 21 Jan, 2026 | npm aws-crt-nodejs |
Malicious release: Malicious code in debox-rn (npm) GHSA-87pg-vff6-6494, MAL-2026-414 | Malicious | Not scored | 21 Jan, 2026 | npm debox-rn |
Malicious release: Malicious code in testpkg-yilider690 (npm) GHSA-m3mx-92hq-fgm8, MAL-2026-431 | Malicious | Not scored | 21 Jan, 2026 | npm testpkg-yilider690 |
Malicious release: Malicious code in connect-web (npm) GHSA-2wv3-j8p3-gcmm, MAL-2026-412 | Malicious | Not scored | 21 Jan, 2026 | npm connect-web |
Malicious release: Malicious code in oce-icons (npm) GHSA-72g5-9m6h-j5f9, MAL-2026-422 | Malicious | Not scored | 21 Jan, 2026 | npm oce-icons |
Malicious release: Malicious code in oce-components (npm) GHSA-9h78-r65j-hjrj, MAL-2026-420 | Malicious | Not scored | 21 Jan, 2026 | npm oce-components |
Malicious release: Malicious code in oce-collaborate (npm) GHSA-9vff-q7rf-xvxw, MAL-2026-419 | Malicious | Not scored | 21 Jan, 2026 | npm oce-collaborate |
Malicious release: Malicious code in collaborate (npm) GHSA-g57h-gf4v-9mvh, MAL-2026-411 | Malicious | Not scored | 21 Jan, 2026 | npm collaborate |
Malicious release: Malicious code in oce-validate (npm) GHSA-h69m-f63v-crpg, MAL-2026-423 | Malicious | Not scored | 21 Jan, 2026 | npm oce-validate |
Malicious release: Malicious code in oce-freecoin (npm) GHSA-mc7q-fxfg-4c65, MAL-2026-421 | Malicious | Not scored | 21 Jan, 2026 | npm oce-freecoin |
Malicious release: Malicious code in shroom-kit (npm) GHSA-rhcw-7jjc-v2rq, MAL-2026-428 | Malicious | Not scored | 21 Jan, 2026 | npm shroom-kit |
Malicious release: Malicious code in clerk-js (npm) GHSA-vr7m-h7j3-rxq6, MAL-2026-410 | Malicious | Not scored | 21 Jan, 2026 | npm clerk-js |
Malicious release: Malicious code in kanban-webcomponent (npm) GHSA-9934-hp5h-qv2g, MAL-2026-417 | Malicious | Not scored | 21 Jan, 2026 | npm kanban-webcomponent |
Malicious release: Malicious code in bitbot (npm) GHSA-hg44-4gm2-crmv, MAL-2026-408 | Malicious | Not scored | 21 Jan, 2026 | npm bitbot |
Malicious release: Malicious code in coopshares-webcomponent (npm) GHSA-pv7x-9f66-mjm7, MAL-2026-413 | Malicious | Not scored | 21 Jan, 2026 | npm coopshares-webcomponent |
Malicious release: Malicious code in wallet-adapter-react (npm) GHSA-wpmx-5pw3-796j, MAL-2026-433 | Malicious | Not scored | 21 Jan, 2026 | npm wallet-adapter-react |
Malicious release: Malicious code in hw-app-eth (npm) GHSA-8frc-jmg6-9xvq, MAL-2026-416 | Malicious | Not scored | 21 Jan, 2026 | npm hw-app-eth |