Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in sd-ccp-module-client (npm) GHSA-xf24-7298-x53c, MAL-2026-305 | Malicious | Not scored | 16 Jan, 2026 | npm sd-ccp-module-client |
Malicious release: Malicious code in flag-v21 (npm) MAL-2026-283 | Malicious | Not scored | 16 Jan, 2026 | npm flag-v21 |
Malicious release: Malicious code in flag-v211 (npm) MAL-2026-284 | Malicious | Not scored | 16 Jan, 2026 | npm flag-v211 |
Malicious release: Malicious code in omnicore-ds2-sdk2 (npm) MAL-2026-298 | Malicious | Not scored | 16 Jan, 2026 | npm omnicore-ds2-sdk2 |
Malicious release: Malicious code in s3-cache-handler (npm) MAL-2026-302 | Malicious | Not scored | 16 Jan, 2026 | npm s3-cache-handler |
Malicious release: Malicious code in sky1oauth2 (npm) MAL-2026-310 | Malicious | Not scored | 16 Jan, 2026 | npm sky1oauth2 |
Malicious release: Malicious code in spire.officejs-externs (npm) MAL-2026-312 | Malicious | Not scored | 16 Jan, 2026 | npm spire.officejs-externs |
Malicious release: Malicious code in spire.officejs-fonts (npm) MAL-2026-313 | Malicious | Not scored | 16 Jan, 2026 | npm spire.officejs-fonts |
Pepr Has Overly Permissive RBAC ClusterRole in Admin Mode CVE-2026-23634, GHSA-w54x-r83c-x79q | Medium | 0.2% | 15 Jan, 2026 | npm pepr |
svelte vulnerable to Cross-site Scripting CVE-2025-15265, GHSA-6738-r8g5-qwp3 | Medium | 0.3% | 15 Jan, 2026 | npm svelte |
h3 v1 has Request Smuggling (TE.TE) issue CVE-2026-23527, GHSA-mp2g-9vg9-f4cg | Critical | 0.6% | 15 Jan, 2026 | npm h3 |
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse CVE-2026-22775, GHSA-g2pg-6438-jwpf | High | 0.6% | 15 Jan, 2026 | npm devalue |
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata) CVE-2026-22803, GHSA-j2f3-wq62-6q46 | High | 0.6% | 15 Jan, 2026 | npm @sveltejs/kit |
Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse CVE-2026-22774, GHSA-vw5p-8cq8-m7mv | High | 0.6% | 15 Jan, 2026 | npm devalue |
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering CVE-2025-67647, GHSA-j62c-4x62-9r35 | High | 0.5% | 15 Jan, 2026 | npm @sveltejs/adapter-node npm @sveltejs/kit |
Malicious release: Malicious code in experian-design-system (npm) GHSA-jvff-mx8m-g6wr, MAL-2026-282 | Malicious | Not scored | 15 Jan, 2026 | npm experian-design-system |
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch CVE-2026-24001, GHSA-73rr-hh4g-fpgx | Low | 0.6% | 14 Jan, 2026 | npm diff |
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion CVE-2026-22036, GHSA-g9mf-h72j-4rw9 | High | 0.5% | 14 Jan, 2026 | npm undici |
html2pdf.js contains a cross-site scripting vulnerability CVE-2026-22787, GHSA-w8x4-x68c-m6fc | High | 0.4% | 14 Jan, 2026 | npm html2pdf.js |
Malicious release: Malicious code in webmd-page-common (npm) GHSA-j3m8-jhfm-w3qc, MAL-2026-258 | Malicious | Not scored | 14 Jan, 2026 | npm webmd-page-common |
Malicious release: Malicious code in silvermine (npm) GHSA-g37j-jvxp-qrjv, MAL-2026-257 | Malicious | Not scored | 14 Jan, 2026 | npm silvermine |
enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain CVE-2026-22686, GHSA-7qm7-455j-5p63 | Critical | 0.8% | 14 Jan, 2026 | npm enclave-vm |
Outray cli is vulnerable to race conditions in tunnels creation CVE-2026-22820, GHSA-3pqc-836w-jgr7 | Medium | 0.2% | 13 Jan, 2026 | npm outray |
Outray has a Race Condition in the cli's webapp CVE-2026-22819, GHSA-45hj-9x76-wp9g | Medium | 0.2% | 13 Jan, 2026 | npm outray |
Quill is vulnerable to XSS via HTML export feature CVE-2025-15056, GHSA-v3m3-f69x-jf25 | Medium | 0.3% | 13 Jan, 2026 | npm quill |
Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file CVE-2026-76232, GHSA-3f44-xw83-3pmg | High | 1.0% | 13 Jan, 2026 | npm renovate |
Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file CVE-2026-76233, GHSA-xjr7-3c3g-m763 | High | 1.0% | 13 Jan, 2026 | npm renovate |
Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies CVE-2026-76231, GHSA-36j9-mx87-2cff | High | 1.0% | 13 Jan, 2026 | npm renovate |
Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration CVE-2026-76230, GHSA-fr4j-65pv-gjjj | High | 1.0% | 13 Jan, 2026 | npm renovate |
Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback) CVE-2026-22818, GHSA-3vhc-576x-3qv4 | High | 0.1% | 13 Jan, 2026 | npm hono |
Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass CVE-2026-22817, GHSA-f67f-6cw9-8mq4 | High | 0.2% | 13 Jan, 2026 | npm hono |
Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State CVE-2026-22814, GHSA-g5gc-h5hp-555f | High | 0.5% | 13 Jan, 2026 | npm @adonisjs/lucid |
tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability CVE-2026-22809, GHSA-q5f6-qxm2-mcqm | Medium | 0.1% | 13 Jan, 2026 | npm tarteaucitronjs |
Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository CVE-2026-76229, GHSA-xv56-3wq5-9997 | High | 1.0% | 13 Jan, 2026 | npm renovate |
Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl` CVE-2026-76228, GHSA-pfq2-hh62-7m96 | High | 1.0% | 13 Jan, 2026 | npm renovate |
Malicious release: Malicious code in ts-tweetnacl (npm) GHSA-vj23-9g2p-fvww, MAL-2026-247 | Malicious | Not scored | 13 Jan, 2026 | npm ts-tweetnacl |
Malicious release: Malicious code in admin1001 (npm) GHSA-j48w-xpqc-jv3w, MAL-2026-246 | Malicious | Not scored | 13 Jan, 2026 | npm admin1001 |
n8n: Webhook Node IP Whitelist Bypass via Partial String Matching CVE-2025-68949, GHSA-w96v-gf22-crwp | Medium | 0.3% | 13 Jan, 2026 | npm n8n |
Malicious release: Malicious code in @flipster/utils (npm) GHSA-6r97-q2pc-v98m, MAL-2026-249 | Malicious | Not scored | 13 Jan, 2026 | npm @flipster/utils |
Malicious release: Malicious code in cnamts-captcha-component (npm) GHSA-p55f-fh32-33wx, MAL-2026-245 | Malicious | Not scored | 13 Jan, 2026 | npm cnamts-captcha-component |
Malicious release: Malicious code in helium-module (npm) GHSA-v72c-68qv-fq35, MAL-2026-244 | Malicious | Not scored | 13 Jan, 2026 | npm helium-module |
Malicious release: Malicious code in francium-utils (npm) GHSA-45m3-pf6h-c243, MAL-2026-242 | Malicious | Not scored | 13 Jan, 2026 | npm francium-utils |
Malicious release: Malicious code in francium-ui (npm) GHSA-4x69-gp4j-mpm5, MAL-2026-241 | Malicious | Not scored | 13 Jan, 2026 | npm francium-ui |
Malicious release: Malicious code in francium-web-visitors (npm) GHSA-5c69-2ppp-w4fv, MAL-2026-243 | Malicious | Not scored | 13 Jan, 2026 | npm francium-web-visitors |
Malicious release: Malicious code in extended-path (npm) GHSA-3j82-vrp8-g357, MAL-2026-240 | Malicious | Not scored | 13 Jan, 2026 | npm extended-path |
Malicious release: Malicious code in chai-as-enhanced (npm) GHSA-5572-pgc4-7mjf, MAL-2026-239 | Malicious | Not scored | 13 Jan, 2026 | npm chai-as-enhanced |
Malicious release: Malicious code in paytmsiddlewaree (npm) GHSA-w8jh-cww6-w5qq, MAL-2026-238 | Malicious | Not scored | 13 Jan, 2026 | npm paytmsiddlewaree |
Malicious website can execute commands on the local system through XSS in the OpenCode web UI CVE-2026-22813, GHSA-c83v-7274-4vgp | Critical | 0.9% | 12 Jan, 2026 | npm opencode-ai |
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution CVE-2026-22812, GHSA-vxw4-wv6m-9hhh | High | 16.5% | 12 Jan, 2026 | npm opencode-ai |
orval MCP client is vulnerable to a code injection attack. CVE-2026-22785, GHSA-mwr6-3gp8-9jmj | Critical | 0.8% | 12 Jan, 2026 | npm @orval/mcp |