Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in chai-bin (npm) GHSA-j2jh-fj26-q47j, MAL-2026-357 | Malicious | Not scored | 20 Jan, 2026 | npm chai-bin |
Malicious release: Malicious code in health-check-node (npm) GHSA-rvgr-g3cf-g8jh, MAL-2026-362 | Malicious | Not scored | 20 Jan, 2026 | npm health-check-node |
Malicious release: Malicious code in dot-env-buffer (npm) GHSA-qh4x-mq28-mhqh, MAL-2026-358 | Malicious | Not scored | 20 Jan, 2026 | npm dot-env-buffer |
Malicious release: Malicious code in advanced-svg-fetcher (npm) GHSA-qr98-w5xw-vjrx, MAL-2026-353 | Malicious | Not scored | 20 Jan, 2026 | npm advanced-svg-fetcher |
Malicious release: Malicious code in dux-portal (npm) GHSA-5hr4-9hqr-m4wv, MAL-2026-354 | Malicious | Not scored | 20 Jan, 2026 | npm dux-portal |
Malicious release: Malicious code in dux-portal-privacy (npm) GHSA-f3fp-v63j-533v, MAL-2026-355 | Malicious | Not scored | 20 Jan, 2026 | npm dux-portal-privacy |
Malicious release: Malicious code in react-server-dom-unbundled (npm) GHSA-mq7q-f9vp-f9qx, MAL-2026-356 | Malicious | Not scored | 20 Jan, 2026 | npm react-server-dom-unbundled |
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS CVE-2026-23950, GHSA-r6q2-hw4h-h46w | High | 0.3% | 20 Jan, 2026 | npm tar |
Orval has a code injection via unsanitized x-enum-descriptions in enum generation CVE-2026-23947, GHSA-h526-wf6g-67jv | Critical | 0.8% | 20 Jan, 2026 | npm @orval/core |
Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion CVE-2026-23522, GHSA-j7xp-4mg9-x28r | Low | 0.2% | 19 Jan, 2026 | npm @lobehub/chat |
@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding) CVE-2026-22037, GHSA-g6q3-96cp-5r5m | High | 0.3% | 19 Jan, 2026 | npm @fastify/express |
Fastify Middie Middleware Path Bypass CVE-2026-22031, GHSA-cxrg-g7r8-w69p | High | 0.5% | 19 Jan, 2026 | npm @fastify/middie |
Malicious release: Malicious code in tutor_table (npm) GHSA-hfhc-f96x-2fm6, MAL-2026-349 | Malicious | Not scored | 19 Jan, 2026 | npm tutor_table |
Malicious release: Malicious code in react-native-webview-forked (npm) GHSA-gfr9-mcfv-qqvc, MAL-2026-348 | Malicious | Not scored | 19 Jan, 2026 | npm react-native-webview-forked |
Malicious release: Malicious code in @bingads-webui-theme-2018/theme-fluent (npm) GHSA-xxhf-h8wv-fvxf, MAL-2026-347 | Malicious | Not scored | 19 Jan, 2026 | npm @bingads-webui-theme-2018/theme-fluent |
Malicious release: Malicious code in internallib_v355 (npm) GHSA-w4wq-pc2v-rw4r, MAL-2026-339 | Malicious | Not scored | 19 Jan, 2026 | npm internallib_v355 |
Malicious release: Malicious code in ofjaaah-auth-module (npm) GHSA-58p8-pqhg-w25w, MAL-2026-341 | Malicious | Not scored | 19 Jan, 2026 | npm ofjaaah-auth-module |
Malicious release: Malicious code in ofjaaah-security-lib (npm) GHSA-6vhq-9rv5-4fhh, MAL-2026-344 | Malicious | Not scored | 19 Jan, 2026 | npm ofjaaah-security-lib |
Malicious release: Malicious code in ofjaaah-build-tools (npm) GHSA-6w58-gfqh-9m8f, MAL-2026-342 | Malicious | Not scored | 19 Jan, 2026 | npm ofjaaah-build-tools |
Malicious release: Malicious code in private-payment-lib (npm) GHSA-cj92-mmxc-m23c, MAL-2026-345 | Malicious | Not scored | 19 Jan, 2026 | npm private-payment-lib |
Malicious release: Malicious code in ofjaaah-internal-utils (npm) GHSA-f477-h27j-73mq, MAL-2026-343 | Malicious | Not scored | 19 Jan, 2026 | npm ofjaaah-internal-utils |
Malicious release: Malicious code in internal-company-sdk (npm) GHSA-gjfx-xc74-r6gx, MAL-2026-338 | Malicious | Not scored | 19 Jan, 2026 | npm internal-company-sdk |
Malicious release: Malicious code in @cda-apps/source (npm) GHSA-6gqx-gcxc-q57c, MAL-2026-336 | Malicious | Not scored | 19 Jan, 2026 | npm @cda-apps/source |
Malicious release: Malicious code in chai-as-executed (npm) GHSA-v4xj-7hwf-8j5p, MAL-2026-337 | Malicious | Not scored | 19 Jan, 2026 | npm chai-as-executed |
Malicious release: Malicious code in libsignal-yazxzcode (npm) GHSA-7f3f-f4mw-rcrm, MAL-2026-340 | Malicious | Not scored | 19 Jan, 2026 | npm libsignal-yazxzcode |
Malicious release: Malicious code in zod-js (npm) GHSA-6h2f-4qcq-99fr, MAL-2026-346 | Malicious | Not scored | 19 Jan, 2026 | npm zod-js |
Malicious release: Malicious code in wac-react-relay (npm) GHSA-h56r-m52j-p8mj, MAL-2026-335 | Malicious | Not scored | 19 Jan, 2026 | npm wac-react-relay |
Malicious release: Malicious code in @brokenzzz/garfish (npm) GHSA-vxcp-cr2c-vq4r, MAL-2026-329 | Malicious | Not scored | 19 Jan, 2026 | npm @brokenzzz/garfish |
Malicious release: Malicious code in 1231dai (npm) GHSA-7v67-7g8x-pph4, MAL-2026-328 | Malicious | Not scored | 19 Jan, 2026 | npm 1231dai |
Malicious release: Malicious code in viem-js (npm) GHSA-257w-wr4p-5rxp, MAL-2026-334 | Malicious | Not scored | 19 Jan, 2026 | npm viem-js |
Malicious release: Malicious code in cyrpto (npm) GHSA-4pxr-pch5-8x98, MAL-2026-331 | Malicious | Not scored | 19 Jan, 2026 | npm cyrpto |
Malicious release: Malicious code in tailwin (npm) GHSA-vfm7-jg7w-6mwv, MAL-2026-332 | Malicious | Not scored | 19 Jan, 2026 | npm tailwin |
Malicious release: Malicious code in tronweb-tool (npm) GHSA-6w7h-3h2q-h6qm, MAL-2026-333 | Malicious | Not scored | 19 Jan, 2026 | npm tronweb-tool |
Malicious release: Malicious code in @daffadeveloper/signal-node (npm) GHSA-m9wr-f6xx-j3p9, MAL-2026-330 | Malicious | Not scored | 19 Jan, 2026 | npm @daffadeveloper/signal-node |
Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) CVE-2026-23733, GHSA-4gpc-rhpj-9443 | Critical | 0.1% | 18 Jan, 2026 | npm @lobehub/chat |
Open Chinese Convert has Out-of-bounds Write CVE-2025-15536, GHSA-5pr6-crvp-2j9f | Low | 0.3% | 18 Jan, 2026 | npm opencc |
Malicious release: Malicious code in typedoc-plugin-fuel-variants (npm) MAL-2026-324 | Malicious | Not scored | 17 Jan, 2026 | npm typedoc-plugin-fuel-variants |
Malicious release: Malicious code in eslint-plugin-fuel-react (npm) MAL-2026-323 | Malicious | Not scored | 17 Jan, 2026 | npm eslint-plugin-fuel-react |
Malicious release: Malicious code in mapkit-example-vanillajs (npm) GHSA-w856-vp94-4mqj, MAL-2026-327 | Malicious | Not scored | 17 Jan, 2026 | npm mapkit-example-vanillajs |
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization CVE-2026-23745, GHSA-8qq5-rm4j-mr97 | High | 0.4% | 16 Jan, 2026 | npm tar |
Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM GHSA-38cw-85xc-xr9x | Medium | Not scored | 16 Jan, 2026 | npm @veramo/data-store |
svelte is vulnerable to XSS with textarea bind:value GHSA-gw32-9rmw-qwww | High | Not scored | 16 Jan, 2026 | npm svelte |
REC in MCPJam inspector due to HTTP Endpoint exposes CVE-2026-23744, GHSA-232v-j27c-5pp6 | Critical | 67.5% | 16 Jan, 2026 | npm @mcpjam/inspector |
GraphQL Modules has a Race Condition issue CVE-2026-23735, GHSA-53wg-r69p-v3r7 | High | 0.6% | 16 Jan, 2026 | npm graphql-modules |
Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability CVE-2025-15104, GHSA-fccg-7w3p-w66f | Medium | 0.5% | 16 Jan, 2026 | Maven nu.validator:validator npm vnu-jar |
Malicious release: Malicious code in admin10001 (npm) GHSA-m8m9-h738-g5fh, MAL-2026-322 | Malicious | Not scored | 16 Jan, 2026 | npm admin10001 |
Malicious release: Malicious code in flip-prx (npm) GHSA-vj8r-7f53-45wq, MAL-2026-321 | Malicious | Not scored | 16 Jan, 2026 | npm flip-prx |
Malicious release: Malicious code in eniram-web-common-ui (npm) GHSA-2pxv-3xpq-wmmp, MAL-2026-281 | Malicious | Not scored | 16 Jan, 2026 | npm eniram-web-common-ui |
Malicious release: Malicious code in base-ui-vue3 (npm) GHSA-356f-2x7m-qhjf, MAL-2026-270 | Malicious | Not scored | 16 Jan, 2026 | npm base-ui-vue3 |
Malicious release: Malicious code in tailwind-merge-v3 (npm) GHSA-3679-84c2-v5xm, MAL-2026-316 | Malicious | Not scored | 16 Jan, 2026 | npm tailwind-merge-v3 |