Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in spark-ar-dynamic-mocks (npm) GHSA-49hr-49hg-g9cp, MAL-2026-146 | Malicious | Not scored | 07 Jan, 2026 | npm spark-ar-dynamic-mocks |
Malicious release: Malicious code in npe-toolkit-server-deps (npm) GHSA-5g5g-r8fj-hhx8, MAL-2026-136 | Malicious | Not scored | 07 Jan, 2026 | npm npe-toolkit-server-deps |
Malicious release: Malicious code in create-react-app-lambda (npm) GHSA-63fr-4847-v74w, MAL-2026-132 | Malicious | Not scored | 07 Jan, 2026 | npm create-react-app-lambda |
Malicious release: Malicious code in npe-toolkit-faves (npm) GHSA-65j4-84gr-p696, MAL-2026-135 | Malicious | Not scored | 07 Jan, 2026 | npm npe-toolkit-faves |
Malicious release: Malicious code in spark-ar-core-libs (npm) GHSA-9mx5-3qr6-486f, MAL-2026-145 | Malicious | Not scored | 07 Jan, 2026 | npm spark-ar-core-libs |
Malicious release: Malicious code in aws-target-mediator (npm) GHSA-c9gm-cjj9-6rxh, MAL-2026-129 | Malicious | Not scored | 07 Jan, 2026 | npm aws-target-mediator |
Malicious release: Malicious code in rt-global-nav (npm) GHSA-g3vm-hj67-w973, MAL-2026-139 | Malicious | Not scored | 07 Jan, 2026 | npm rt-global-nav |
Malicious release: Malicious code in rt-da-classic-card-collection (npm) GHSA-j58j-xg89-q4hq, MAL-2026-137 | Malicious | Not scored | 07 Jan, 2026 | npm rt-da-classic-card-collection |
Malicious release: Malicious code in spark-ar-jest-mocks (npm) GHSA-m2pg-m276-vcjg, MAL-2026-147 | Malicious | Not scored | 07 Jan, 2026 | npm spark-ar-jest-mocks |
Malicious release: Malicious code in rt-footer (npm) GHSA-pm9v-3jmc-jh7g, MAL-2026-138 | Malicious | Not scored | 07 Jan, 2026 | npm rt-footer |
Malicious release: Malicious code in rt-qa-sampler (npm) GHSA-qhhm-464c-xmwg, MAL-2026-142 | Malicious | Not scored | 07 Jan, 2026 | npm rt-qa-sampler |
Malicious release: Malicious code in awsm-core (npm) GHSA-vg8m-cc62-9rfj, MAL-2026-131 | Malicious | Not scored | 07 Jan, 2026 | npm awsm-core |
Malicious release: Malicious code in rt-text-media-grid-collection (npm) GHSA-wwf9-54mp-94mh, MAL-2026-143 | Malicious | Not scored | 07 Jan, 2026 | npm rt-text-media-grid-collection |
Malicious release: Malicious code in scrollbar-stylecss (npm) GHSA-vmfh-wx67-675j, MAL-2026-144 | Malicious | Not scored | 07 Jan, 2026 | npm scrollbar-stylecss |
Malicious release: Malicious code in tailwind-autoanimation (npm) GHSA-pw37-854x-rf46, MAL-2026-148 | Malicious | Not scored | 07 Jan, 2026 | npm tailwind-autoanimation |
Malicious release: Malicious code in cko-ui-toolkit (npm) GHSA-wrmj-53cj-p8pj, MAL-2026-193 | Malicious | Not scored | 07 Jan, 2026 | npm cko-ui-toolkit |
Preact has JSON VNode Injection issue CVE-2026-22028, GHSA-36hm-qxxp-pg3m | High | 0.3% | 07 Jan, 2026 | npm preact |
n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks CVE-2026-21894, GHSA-jf52-3f2h-h9j5 | Medium | 0.5% | 07 Jan, 2026 | npm n8n |
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling CVE-2026-21858, GHSA-v4pr-fm98-w9pg | Critical | 78.2% | 07 Jan, 2026 | npm n8n |
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" CVE-2025-69264, GHSA-379q-355j-w6rj | Critical | 1.0% | 07 Jan, 2026 | npm pnpm |
pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies CVE-2025-69263, GHSA-7vhp-vf5g-r2fw | High | 0.5% | 07 Jan, 2026 | npm pnpm |
pnpm vulnerable to Command Injection via environment variable substitution CVE-2025-69262, GHSA-2phv-j68v-wwqx | High | 1.0% | 07 Jan, 2026 | npm pnpm |
fast-filesystem-mcp has a Path Traversal vulnerability CVE-2025-67364, GHSA-j893-m93w-jwjw | High | 0.6% | 07 Jan, 2026 | npm fast-filesystem-mcp |
Malicious release: Malicious code in @bingads-webui-component-legacy/storage (npm) MAL-2026-127 | Malicious | Not scored | 07 Jan, 2026 | npm @bingads-webui-component-legacy/storage |
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools CVE-2025-9611, GHSA-6fg3-hvw7-2fwq, GHSA-8rgw-6xp9-2fg3 | High | 1.2% | 07 Jan, 2026 | npm @playwright/mcp |
carbone Code Injection vulnerability CVE-2024-14020, GHSA-6rcw-ww3x-xqwm | Low | 0.3% | 07 Jan, 2026 | npm carbone |
Malicious release: Malicious code in kmeet (npm) MAL-2026-125 | Malicious | Not scored | 07 Jan, 2026 | npm kmeet |
Malicious release: Malicious code in garfield000 (npm) GHSA-377q-vgp4-qxgm, MAL-2026-113 | Malicious | Not scored | 07 Jan, 2026 | npm garfield000 |
Malicious release: Malicious code in wwwt (npm) GHSA-3rh2-443w-cw39, MAL-2026-124 | Malicious | Not scored | 07 Jan, 2026 | npm wwwt |
Malicious release: Malicious code in @nestor_hexom/garfield1 (npm) GHSA-764p-6xwr-97gc, MAL-2026-109 | Malicious | Not scored | 07 Jan, 2026 | npm @nestor_hexom/garfield1 |
Malicious release: Malicious code in klywarns (npm) GHSA-86fq-5pcc-9v5g, MAL-2026-119 | Malicious | Not scored | 07 Jan, 2026 | npm klywarns |
Malicious release: Malicious code in @nestor_hexom/qyxb (npm) GHSA-873w-7m5r-r4m4, MAL-2026-110 | Malicious | Not scored | 07 Jan, 2026 | npm @nestor_hexom/qyxb |
Malicious release: Malicious code in vjri (npm) GHSA-8c45-7hqf-gqqq, MAL-2026-122 | Malicious | Not scored | 07 Jan, 2026 | npm vjri |
Malicious release: Malicious code in wifzap (npm) GHSA-c735-rg96-8gg7, MAL-2026-123 | Malicious | Not scored | 07 Jan, 2026 | npm wifzap |
Malicious release: Malicious code in klywarn (npm) GHSA-cm27-c6rj-v9v7, MAL-2026-118 | Malicious | Not scored | 07 Jan, 2026 | npm klywarn |
Malicious release: Malicious code in @nestor_hexom/garfield (npm) GHSA-cq46-x67r-674j, MAL-2026-108 | Malicious | Not scored | 07 Jan, 2026 | npm @nestor_hexom/garfield |
Malicious release: Malicious code in hiqomu (npm) GHSA-fm6f-5g7r-cm54, MAL-2026-115 | Malicious | Not scored | 07 Jan, 2026 | npm hiqomu |
Malicious release: Malicious code in garfield777 (npm) GHSA-q84f-j4jm-fr42, MAL-2026-114 | Malicious | Not scored | 07 Jan, 2026 | npm garfield777 |
Malicious release: Malicious code in syqara (npm) GHSA-qpqp-c5jx-hw5x, MAL-2026-121 | Malicious | Not scored | 07 Jan, 2026 | npm syqara |
Malicious release: Malicious code in jh5o (npm) GHSA-rp2f-3wxj-cm3p, MAL-2026-116 | Malicious | Not scored | 07 Jan, 2026 | npm jh5o |
Malicious release: Malicious code in aog3 (npm) GHSA-v39f-m426-rpq7, MAL-2026-111 | Malicious | Not scored | 07 Jan, 2026 | npm aog3 |
Malicious release: Malicious code in qyxb (npm) GHSA-wf4w-9mhw-5h55, MAL-2026-120 | Malicious | Not scored | 07 Jan, 2026 | npm qyxb |
Malicious release: Malicious code in kdb1-demo-v2 (npm) GHSA-2c3x-8jx5-g4wg, MAL-2026-117 | Malicious | Not scored | 07 Jan, 2026 | npm kdb1-demo-v2 |
Malicious release: Malicious code in fbfu (npm) GHSA-33mg-fcjg-m4vc, MAL-2026-112 | Malicious | Not scored | 07 Jan, 2026 | npm fbfu |
Malicious release: Malicious code in 1kzr (npm) GHSA-9vv2-wr7x-g95p, MAL-2026-107 | Malicious | Not scored | 07 Jan, 2026 | npm 1kzr |
Malicious release: Malicious code in syntax-class-properties (npm) GHSA-4mwx-mh36-vm84, MAL-2026-105 | Malicious | Not scored | 07 Jan, 2026 | npm syntax-class-properties |
Malicious release: Malicious code in sort-imports-es6-autofix (npm) GHSA-9w4p-mhx9-rcmp, MAL-2026-104 | Malicious | Not scored | 07 Jan, 2026 | npm sort-imports-es6-autofix |
Malicious release: Malicious code in transform-decorators-legacy (npm) GHSA-cfv7-hfm3-27qf, MAL-2026-106 | Malicious | Not scored | 07 Jan, 2026 | npm transform-decorators-legacy |
Malicious release: Malicious code in const-enum (npm) GHSA-pwjh-p895-7767, MAL-2026-103 | Malicious | Not scored | 07 Jan, 2026 | npm const-enum |
Malicious release: Malicious code in openblox-ts (npm) GHSA-59qx-85r3-h37j, MAL-2026-101 | Malicious | Not scored | 07 Jan, 2026 | npm openblox-ts |