Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in eslint-plugin-supertest (npm) GHSA-8p6w-g2jw-h46q, MAL-2026-100 | Malicious | Not scored | 07 Jan, 2026 | npm eslint-plugin-supertest |
Malicious release: Malicious code in redis-cookie-ts (npm) GHSA-jm3x-2mc2-v7xf, MAL-2026-102 | Malicious | Not scored | 07 Jan, 2026 | npm redis-cookie-ts |
Directus has open redirect in SAML CVE-2026-22032, GHSA-3573-4c68-g8cc | Medium | 0.2% | 06 Jan, 2026 | npm @directus/api npm directus |
n8n Vulnerable to RCE via Arbitrary File Write CVE-2026-21877, GHSA-v364-rw7m-3263 | Critical | 5.4% | 06 Jan, 2026 | npm n8n |
Malicious release: Malicious code in elastic-docs-v3-utilities (npm) GHSA-2jpc-7j69-3hpx, MAL-2026-85 | Malicious | Not scored | 06 Jan, 2026 | npm elastic-docs-v3-utilities |
Malicious release: Malicious code in evm-gateway-contracts-private (npm) GHSA-pc73-wmwf-xpcr, MAL-2026-88 | Malicious | Not scored | 06 Jan, 2026 | npm evm-gateway-contracts-private |
Malicious release: Malicious code in code-review-frontend (npm) GHSA-876w-v2q8-4hmr, MAL-2026-84 | Malicious | Not scored | 06 Jan, 2026 | npm code-review-frontend |
Malicious release: Malicious code in x-clients-features (npm) GHSA-p2x4-8c93-j38q, MAL-2026-95 | Malicious | Not scored | 06 Jan, 2026 | npm x-clients-features |
Malicious release: Malicious code in electra-web-player-event (npm) GHSA-cmrr-4hqq-rhhf, MAL-2026-87 | Malicious | Not scored | 06 Jan, 2026 | npm electra-web-player-event |
Malicious release: Malicious code in shopify-perf-kit (npm) GHSA-jw6p-pj4v-q43j, MAL-2026-94 | Malicious | Not scored | 06 Jan, 2026 | npm shopify-perf-kit |
Malicious release: Malicious code in importmap-polyfil (npm) GHSA-m365-ph8h-jmwf, MAL-2026-89 | Malicious | Not scored | 06 Jan, 2026 | npm importmap-polyfil |
Malicious release: Malicious code in okta-loginpage-render (npm) GHSA-mpr5-992q-49cx, MAL-2026-92 | Malicious | Not scored | 06 Jan, 2026 | npm okta-loginpage-render |
Malicious release: Malicious code in matic-transfer-consumer (npm) GHSA-p7h3-8m4j-fw27, MAL-2026-90 | Malicious | Not scored | 06 Jan, 2026 | npm matic-transfer-consumer |
Malicious release: Malicious code in electra-web-player (npm) GHSA-pcx5-h28j-38cg, MAL-2026-86 | Malicious | Not scored | 06 Jan, 2026 | npm electra-web-player |
Malicious release: Malicious code in okta-signin-widget (npm) GHSA-r3jx-4g39-9qjm, MAL-2026-93 | Malicious | Not scored | 06 Jan, 2026 | npm okta-signin-widget |
Malicious release: Malicious code in okta-auth-js (npm) GHSA-vf5w-f7rc-4hrj, MAL-2026-91 | Malicious | Not scored | 06 Jan, 2026 | npm okta-auth-js |
Malicious release: Malicious code in polymarket-clob (npm) GHSA-hcj7-4cx9-9g6q, MAL-2026-77 | Malicious | Not scored | 06 Jan, 2026 | npm polymarket-clob |
Malicious release: Malicious code in ethos2.0 (npm) GHSA-3526-6w6q-27cm, MAL-2026-75 | Malicious | Not scored | 06 Jan, 2026 | npm ethos2.0 |
Malicious release: Malicious code in react-native-kyc (npm) GHSA-4p2x-3qwc-7rx3, MAL-2026-78 | Malicious | Not scored | 06 Jan, 2026 | npm react-native-kyc |
Malicious release: Malicious code in smartspacestoreapp (npm) GHSA-4xhh-rhhc-8xw6, MAL-2026-80 | Malicious | Not scored | 06 Jan, 2026 | npm smartspacestoreapp |
Malicious release: Malicious code in wikibuy-mobile-analytics (npm) GHSA-5rjq-m8xg-68ww, MAL-2026-83 | Malicious | Not scored | 06 Jan, 2026 | npm wikibuy-mobile-analytics |
Malicious release: Malicious code in open-telemetry-mini-client (npm) GHSA-8962-3mh7-58pr, MAL-2026-76 | Malicious | Not scored | 06 Jan, 2026 | npm open-telemetry-mini-client |
Malicious release: Malicious code in seanp-test-package-do-not-use2 (npm) GHSA-fm2f-ghwv-hvrw, MAL-2026-79 | Malicious | Not scored | 06 Jan, 2026 | npm seanp-test-package-do-not-use2 |
Malicious release: Malicious code in upgrade-mobile (npm) GHSA-ggjj-h3c7-hv47, MAL-2026-81 | Malicious | Not scored | 06 Jan, 2026 | npm upgrade-mobile |
Malicious release: Malicious code in wikibuy-mobile (npm) GHSA-m4g9-w4p4-6rhg, MAL-2026-82 | Malicious | Not scored | 06 Jan, 2026 | npm wikibuy-mobile |
Malicious release: Malicious code in cp_amm (npm) GHSA-qjp3-7854-4xfc, MAL-2026-74 | Malicious | Not scored | 06 Jan, 2026 | npm cp_amm |
Malicious release: Malicious code in bignumber.js-new (npm) GHSA-wfxh-ph5v-mqgv, MAL-2026-72 | Malicious | Not scored | 06 Jan, 2026 | npm bignumber.js-new |
Malicious release: Malicious code in chai-as-required (npm) GHSA-fxq5-9w23-cggc, MAL-2026-73 | Malicious | Not scored | 06 Jan, 2026 | npm chai-as-required |
Malicious release: Malicious code in redis-request-parser (npm) GHSA-wffw-vj4r-vqc2, MAL-2026-71 | Malicious | Not scored | 06 Jan, 2026 | npm redis-request-parser |
Malicious release: Malicious code in @shop-cicd/webpack-package-artifact (npm) GHSA-m92m-8f5v-2qc4, MAL-2026-70 | Malicious | Not scored | 06 Jan, 2026 | npm @shop-cicd/webpack-package-artifact |
Malicious release: Malicious code in n8n-performance-metrics (npm) GHSA-f36h-5w69-v3gg, MAL-2026-69 | Malicious | Not scored | 06 Jan, 2026 | npm n8n-performance-metrics |
Malicious release: Malicious code in n8n-nodes-performance-metrics (npm) GHSA-f6mv-mcr8-fx9v, MAL-2026-68 | Malicious | Not scored | 06 Jan, 2026 | npm n8n-nodes-performance-metrics |
Malicious release: Malicious code in redis-cookie-parser (npm) GHSA-8p37-qwm5-pmmc, MAL-2026-67 | Malicious | Not scored | 06 Jan, 2026 | npm redis-cookie-parser |
Malicious release: Malicious code in eslint-supertest (npm) GHSA-w2jj-v9w4-6c56, MAL-2026-58 | Malicious | Not scored | 06 Jan, 2026 | npm eslint-supertest |
Malicious release: Malicious code in redis-cookie-js (npm) GHSA-x45j-xp3r-xhpr, MAL-2026-66 | Malicious | Not scored | 06 Jan, 2026 | npm redis-cookie-js |
Malicious release: Malicious code in oj-sp-common-util (npm) GHSA-ccq6-q67g-g6h4, MAL-2026-63 | Malicious | Not scored | 06 Jan, 2026 | npm oj-sp-common-util |
Malicious release: Malicious code in oj-sp-messages-banner (npm) GHSA-j6gc-mh7f-664c, MAL-2026-65 | Malicious | Not scored | 06 Jan, 2026 | npm oj-sp-messages-banner |
Malicious release: Malicious code in oj-sp-css-additions (npm) GHSA-x2r2-5qgq-gv97, MAL-2026-64 | Malicious | Not scored | 06 Jan, 2026 | npm oj-sp-css-additions |
Malicious release: Malicious code in oj-sp-common (npm) GHSA-8m9j-cv9p-hw75, MAL-2026-61 | Malicious | Not scored | 06 Jan, 2026 | npm oj-sp-common |
Malicious release: Malicious code in oj-sp-about-page (npm) GHSA-v7cp-744w-37v6, MAL-2026-60 | Malicious | Not scored | 06 Jan, 2026 | npm oj-sp-about-page |
Malicious release: Malicious code in oj-sp-common-strings (npm) GHSA-wv3r-36w4-jc8g, MAL-2026-62 | Malicious | Not scored | 06 Jan, 2026 | npm oj-sp-common-strings |
Malicious release: Malicious code in hello-world-npm-demo-example (npm) GHSA-28cc-p24p-9v6w, MAL-2026-59 | Malicious | Not scored | 06 Jan, 2026 | npm hello-world-npm-demo-example |
`vega-functions` vulnerable to Cross-site Scripting via `setdata` function CVE-2025-66648, GHSA-m9rg-mr6g-75gm | High | 0.2% | 05 Jan, 2026 | npm vega-functions |
Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope CVE-2025-65110, GHSA-829q-m3qg-ph8r | Critical | 0.5% | 05 Jan, 2026 | npm vega-selections |
Malicious release: Malicious code in react-transition-group-legacy (npm) MAL-2026-57 | Malicious | Not scored | 05 Jan, 2026 | npm react-transition-group-legacy |
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability CVE-2026-0621, GHSA-8r9q-7v3j-jr4g | High | 0.4% | 05 Jan, 2026 | npm @modelcontextprotocol/sdk |
evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API CVE-2025-67427, GHSA-vp8w-wj4m-3r7j | Medium | 0.2% | 05 Jan, 2026 | npm @evershop/evershop |
evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API CVE-2025-67419, GHSA-m2q5-xhqg-92r2 | High | 0.3% | 05 Jan, 2026 | npm @evershop/evershop |
ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds. CVE-2026-73645, GHSA-hqf9-8xv5-x8xw | Medium | 0.5% | 05 Jan, 2026 | npm @openzeppelin/confidential-contracts |
Malicious release: Malicious code in @crepo/crepo-url-query-mapper (npm) MAL-2026-56 | Malicious | Not scored | 05 Jan, 2026 | npm @crepo/crepo-url-query-mapper |