Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in yunxohang10 (npm) GHSA-6w59-qrq3-26r2, MAL-2026-182 | Malicious | Not scored | 09 Jan, 2026 | npm yunxohang10 |
Malicious release: Malicious code in yunxohang6 (npm) GHSA-9c94-wvj8-727x, MAL-2026-186 | Malicious | Not scored | 09 Jan, 2026 | npm yunxohang6 |
Malicious release: Malicious code in yunxohang11 (npm) GHSA-g83m-jwqh-vh49, MAL-2026-183 | Malicious | Not scored | 09 Jan, 2026 | npm yunxohang11 |
Malicious release: Malicious code in shreddit.styles (npm) GHSA-jfvh-jh3m-75wr, MAL-2026-180 | Malicious | Not scored | 09 Jan, 2026 | npm shreddit.styles |
Malicious release: Malicious code in yunxohang7 (npm) GHSA-m6hc-9484-pxmw, MAL-2026-187 | Malicious | Not scored | 09 Jan, 2026 | npm yunxohang7 |
Malicious release: Malicious code in yunxohang5 (npm) GHSA-v4rg-gvp2-j668, MAL-2026-185 | Malicious | Not scored | 09 Jan, 2026 | npm yunxohang5 |
Malicious release: Malicious code in chai-tests-async (npm) GHSA-cprx-7wv5-xx9f, MAL-2026-172 | Malicious | Not scored | 09 Jan, 2026 | npm chai-tests-async |
Malicious release: Malicious code in dotenv-intended (npm) GHSA-wrjh-25x7-qpfv, MAL-2026-174 | Malicious | Not scored | 09 Jan, 2026 | npm dotenv-intended |
Malicious release: Malicious code in jwtdapp (npm) GHSA-vh46-5jmf-4vf9, MAL-2026-175 | Malicious | Not scored | 09 Jan, 2026 | npm jwtdapp |
Malicious release: Malicious code in mixpanel-lib (npm) GHSA-cghh-vxg3-pmq9, MAL-2026-176 | Malicious | Not scored | 09 Jan, 2026 | npm mixpanel-lib |
Malicious release: Malicious code in smintio-portals-component-sdk (npm) GHSA-fr88-v524-h4f5, MAL-2026-181 | Malicious | Not scored | 09 Jan, 2026 | npm smintio-portals-component-sdk |
Malicious release: Malicious code in cng-web-lib (npm) GHSA-jxj2-8hv9-xgqf, MAL-2026-173 | Malicious | Not scored | 09 Jan, 2026 | npm cng-web-lib |
Malicious release: Malicious code in amdocs-core (npm) GHSA-q69g-cfhr-mwjg, MAL-2026-171 | Malicious | Not scored | 09 Jan, 2026 | npm amdocs-core |
JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3 GHSA-j965-2qgj-vjmq | Low | Not scored | 08 Jan, 2026 | npm aws-sdk |
AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value GHSA-6475-r3vj-m8vf | Low | Not scored | 08 Jan, 2026 | npm @smithy/config-resolver |
Ghost has SQL Injection in Members Activity Feed BIT-ghost-2026-22596, CVE-2026-22596, GHSA-gjrp-xgmh-x9qq | High | 0.5% | 08 Jan, 2026 | npm ghost |
Ghost has SSRF via External Media Inliner BIT-ghost-2026-22597, CVE-2026-22597, GHSA-vmc4-9828-r48r | Medium | 0.3% | 08 Jan, 2026 | npm ghost |
Ghost has Staff Token permission bypass BIT-ghost-2026-22595, CVE-2026-22595, GHSA-9xg7-mwmp-xmjx | High | 0.5% | 08 Jan, 2026 | npm ghost |
Ghost has Staff 2FA bypass BIT-ghost-2026-22594, CVE-2026-22594, GHSA-5fp7-g646-ccf4 | High | 1.3% | 08 Jan, 2026 | npm ghost |
Elliptic Uses a Cryptographic Primitive with a Risky Implementation CVE-2025-14505, GHSA-848j-6mx2-7j84 | Medium | 0.2% | 08 Jan, 2026 | npm elliptic |
Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles GHSA-96qw-h329-v5rg | High | Not scored | 08 Jan, 2026 | RubyGems shakapacker npm shakapacker |
React Router has CSRF issue in Action/Server Action Request Processing CVE-2026-22030, GHSA-h5cw-625j-3rxh | Medium | 0.2% | 08 Jan, 2026 | npm @remix-run/server-runtime npm react-router |
React Router vulnerable to XSS via Open Redirects CVE-2026-22029, GHSA-2w69-qvjg-hvjx | High | 0.9% | 08 Jan, 2026 | npm @remix-run/router npm react-router |
React Router SSR XSS in ScrollRestoration CVE-2026-21884, GHSA-8v8x-cx79-35w7 | High | 0.5% | 08 Jan, 2026 | npm @remix-run/react npm react-router |
React Router has unexpected external redirect via untrusted paths CVE-2025-68470, GHSA-9jcx-v3wj-wh4m | Medium | 0.5% | 08 Jan, 2026 | npm react-router |
React Router has Path Traversal in File Session Storage CVE-2025-61686, GHSA-9583-h5hc-x8cw | Critical | 17.3% | 08 Jan, 2026 | npm @react-router/node npm @remix-run/deno npm @remix-run/node |
React Router has XSS Vulnerability CVE-2025-59057, GHSA-3cgp-3xvw-98x8 | High | 0.5% | 08 Jan, 2026 | npm @remix-run/react npm react-router |
Malicious release: Malicious code in @zuora-marketing/linting (npm) MAL-2026-168 | Malicious | Not scored | 08 Jan, 2026 | npm @zuora-marketing/linting |
Malicious release: Malicious code in icon-service (npm) MAL-2026-167 | Malicious | Not scored | 08 Jan, 2026 | npm icon-service |
Malicious release: Malicious code in @kyriba/mf-kit (npm) GHSA-vm49-whhj-p386, MAL-2026-165 | Malicious | Not scored | 08 Jan, 2026 | npm @kyriba/mf-kit |
Malicious release: Malicious code in @kyriba/ui-workspace (npm) GHSA-q8wh-fgpf-f5w2, MAL-2026-166 | Malicious | Not scored | 08 Jan, 2026 | npm @kyriba/ui-workspace |
Malicious release: Malicious code in @kyriba/data-frontend (npm) GHSA-hgcp-m893-66q4, MAL-2026-164 | Malicious | Not scored | 08 Jan, 2026 | npm @kyriba/data-frontend |
Malicious release: Malicious code in chai-min (npm) GHSA-hj2h-8cm5-mh8x, MAL-2026-159 | Malicious | Not scored | 08 Jan, 2026 | npm chai-min |
Malicious release: Malicious code in jsonify-setting (npm) GHSA-34cc-8h54-969x, MAL-2026-161 | Malicious | Not scored | 08 Jan, 2026 | npm jsonify-setting |
Malicious release: Malicious code in json-mappings (npm) GHSA-jjf5-hhf5-4mcc, MAL-2026-160 | Malicious | Not scored | 08 Jan, 2026 | npm json-mappings |
Malicious release: Malicious code in shaktihacker2026 (npm) GHSA-rfvh-x7m8-8fj8, MAL-2026-155 | Malicious | Not scored | 08 Jan, 2026 | npm shaktihacker2026 |
Malicious release: Malicious code in ncodeauth (npm) GHSA-fg7g-mvgf-7r6v, MAL-2026-154 | Malicious | Not scored | 08 Jan, 2026 | npm ncodeauth |
Malicious release: Malicious code in darknet-dispatches-internal (npm) GHSA-3ph9-jq3j-rmqq, MAL-2026-153 | Malicious | Not scored | 08 Jan, 2026 | npm darknet-dispatches-internal |
Malicious release: Malicious code in test-thegenetic-module (npm) GHSA-c9xw-qqgr-5v3w, MAL-2026-157 | Malicious | Not scored | 08 Jan, 2026 | npm test-thegenetic-module |
Malicious release: Malicious code in timeout-ts (npm) GHSA-38gr-j9wx-947f, MAL-2026-158 | Malicious | Not scored | 08 Jan, 2026 | npm timeout-ts |
Malicious release: Malicious code in sparkling-cli (npm) GHSA-vf56-rcrw-rmqw, MAL-2026-156 | Malicious | Not scored | 08 Jan, 2026 | npm sparkling-cli |
Malicious release: Malicious code in bnia-work (npm) GHSA-99cj-5xg8-p68g, MAL-2026-149 | Malicious | Not scored | 08 Jan, 2026 | npm bnia-work |
Malicious release: Malicious code in week-4-node-modularization (npm) GHSA-gx4r-79mc-gpvf, MAL-2026-152 | Malicious | Not scored | 08 Jan, 2026 | npm week-4-node-modularization |
Malicious release: Malicious code in hoppscotch-agent (npm) GHSA-mcvr-f6p2-ppr3, MAL-2026-150 | Malicious | Not scored | 08 Jan, 2026 | npm hoppscotch-agent |
Malicious release: Malicious code in svelte-monorepo (npm) GHSA-v98m-m7mc-g24r, MAL-2026-151 | Malicious | Not scored | 08 Jan, 2026 | npm svelte-monorepo |
Malicious release: Malicious code in @testfeii/hallo-word (npm) GHSA-vr52-p84w-52jv, MAL-2026-192 | Malicious | Not scored | 08 Jan, 2026 | npm @testfeii/hallo-word |
Malicious release: Malicious code in rt-live-hero (npm) GHSA-27hr-2hrw-j6c6, MAL-2026-140 | Malicious | Not scored | 07 Jan, 2026 | npm rt-live-hero |
Malicious release: Malicious code in awsm-acslibs (npm) GHSA-2f6g-98j7-c42m, MAL-2026-130 | Malicious | Not scored | 07 Jan, 2026 | npm awsm-acslibs |
Malicious release: Malicious code in language-capirca (npm) GHSA-2v35-f9xm-rh9x, MAL-2026-133 | Malicious | Not scored | 07 Jan, 2026 | npm language-capirca |
Malicious release: Malicious code in rt-long-form-content (npm) GHSA-4335-9p5j-227w, MAL-2026-141 | Malicious | Not scored | 07 Jan, 2026 | npm rt-long-form-content |