Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
jsPDF has Local File Inclusion/Path Traversal vulnerability CVE-2025-68428, GHSA-f8cm-6447-x5h2 | Critical | 2.2% | 05 Jan, 2026 | npm jspdf |
Malicious release: Malicious code in faceplate-ui (npm) GHSA-vwmp-5366-h59v, MAL-2026-50 | Malicious | Not scored | 05 Jan, 2026 | npm faceplate-ui |
Malicious release: Malicious code in diskho (npm) MAL-2026-49 | Malicious | Not scored | 05 Jan, 2026 | npm diskho |
Malicious release: Malicious code in shop-state (npm) MAL-2026-48 | Malicious | Not scored | 05 Jan, 2026 | npm shop-state |
Malicious release: Malicious code in @airtel-web/legos (npm) GHSA-22x6-7f33-8w4f, MAL-2026-44 | Malicious | Not scored | 05 Jan, 2026 | npm @airtel-web/legos |
Malicious release: Malicious code in @signify/vue-components (npm) GHSA-j8hr-3qpv-xqf3, MAL-2026-45 | Malicious | Not scored | 05 Jan, 2026 | npm @signify/vue-components |
Malicious release: Malicious code in published_at (npm) GHSA-8xrh-276g-pwhf, MAL-2026-43 | Malicious | Not scored | 05 Jan, 2026 | npm published_at |
Malicious release: Malicious code in spire.officejs-document (npm) MAL-2026-41 | Malicious | Not scored | 05 Jan, 2026 | npm spire.officejs-document |
Malicious release: Malicious code in spire.officejs-common (npm) MAL-2026-39 | Malicious | Not scored | 05 Jan, 2026 | npm spire.officejs-common |
Malicious release: Malicious code in spire.officejs-editors (npm) MAL-2026-40 | Malicious | Not scored | 05 Jan, 2026 | npm spire.officejs-editors |
Malicious release: Malicious code in atm_bmw (npm) GHSA-r7mc-c86h-c2h3, MAL-2026-34 | Malicious | Not scored | 04 Jan, 2026 | npm atm_bmw |
Malicious release: Malicious code in blobhunter-depconf-poc (npm) GHSA-qm8x-x4wp-qmmw, MAL-2026-32 | Malicious | Not scored | 04 Jan, 2026 | npm blobhunter-depconf-poc |
Malicious release: Malicious code in dstny-utils (npm) MAL-2026-30 | Malicious | Not scored | 03 Jan, 2026 | npm dstny-utils |
Malicious release: Malicious code in ipvision-selfcare (npm) MAL-2026-29 | Malicious | Not scored | 03 Jan, 2026 | npm ipvision-selfcare |
Malicious release: Malicious code in orchestration-node-common-errors (npm) GHSA-6944-qjj4-p4pp, MAL-2026-21 | Malicious | Not scored | 02 Jan, 2026 | npm orchestration-node-common-errors |
Malicious release: Malicious code in fix-cc-raiesy (npm) GHSA-7q6m-qvfp-37hm, MAL-2026-16 | Malicious | Not scored | 02 Jan, 2026 | npm fix-cc-raiesy |
Malicious release: Malicious code in initializers (npm) GHSA-8jc9-28hh-6773, MAL-2026-18 | Malicious | Not scored | 02 Jan, 2026 | npm initializers |
Malicious release: Malicious code in 511fola (npm) GHSA-9m43-q5hv-rc36, MAL-2026-9 | Malicious | Not scored | 02 Jan, 2026 | npm 511fola |
Malicious release: Malicious code in tickncook-robot (npm) GHSA-p52r-cmjv-v6mr, MAL-2026-24 | Malicious | Not scored | 02 Jan, 2026 | npm tickncook-robot |
Malicious release: Malicious code in ent-file-upload-widget-v2 (npm) GHSA-pqqf-r5w3-jqc2, MAL-2026-13 | Malicious | Not scored | 02 Jan, 2026 | npm ent-file-upload-widget-v2 |
Malicious release: Malicious code in datatables-editor (npm) GHSA-q7mc-g6jm-8pjq, MAL-2026-12 | Malicious | Not scored | 02 Jan, 2026 | npm datatables-editor |
Malicious release: Malicious code in ent-profile-unauth-msr-stop (npm) GHSA-qvgq-rj55-h35g, MAL-2026-14 | Malicious | Not scored | 02 Jan, 2026 | npm ent-profile-unauth-msr-stop |
Malicious release: Malicious code in usaa-authentication-mocks (npm) GHSA-x9pm-m7hq-f2q8, MAL-2026-25 | Malicious | Not scored | 02 Jan, 2026 | npm usaa-authentication-mocks |
Malicious release: Malicious code in babel-preset-ibm-cloud-cognitive (npm) MAL-2026-10 | Malicious | Not scored | 02 Jan, 2026 | npm babel-preset-ibm-cloud-cognitive |
Malicious release: Malicious code in cc-double-1 (npm) MAL-2026-11 | Malicious | Not scored | 02 Jan, 2026 | npm cc-double-1 |
Malicious release: Malicious code in eslint-config-skynet (npm) MAL-2026-15 | Malicious | Not scored | 02 Jan, 2026 | npm eslint-config-skynet |
Malicious release: Malicious code in identity-emitter (npm) MAL-2026-17 | Malicious | Not scored | 02 Jan, 2026 | npm identity-emitter |
Malicious release: Malicious code in jest-config-ibm-cloud-cognitive (npm) MAL-2026-19 | Malicious | Not scored | 02 Jan, 2026 | npm jest-config-ibm-cloud-cognitive |
Malicious release: Malicious code in kid-api (npm) MAL-2026-20 | Malicious | Not scored | 02 Jan, 2026 | npm kid-api |
Malicious release: Malicious code in pkg1bate5apg1 (npm) MAL-2026-22 | Malicious | Not scored | 02 Jan, 2026 | npm pkg1bate5apg1 |
Malicious release: Malicious code in showdownxss (npm) MAL-2026-23 | Malicious | Not scored | 02 Jan, 2026 | npm showdownxss |
Malicious release: Malicious code in @nitaiapiiro/rand_emoji (npm) MAL-2026-8 | Malicious | Not scored | 02 Jan, 2026 | npm @nitaiapiiro/rand_emoji |
AdonisJS Path Traversal in Multipart File Handling CVE-2026-21440, GHSA-gvq6-hvvp-h34h | Critical | 1.0% | 02 Jan, 2026 | npm @adonisjs/bodyparser |
Signal K Server Vulnerable to Access Request Spoofing CVE-2025-69203, GHSA-vfrf-vcj7-wvr8 | High | 0.3% | 01 Jan, 2026 | npm signalk-server |
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling CVE-2025-68620, GHSA-fq56-hvg6-wvm5 | Critical | 0.5% | 01 Jan, 2026 | npm signalk-server |
Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package CVE-2025-68619, GHSA-93jc-vqqc-vvvh | High | 0.7% | 01 Jan, 2026 | npm signalk-server |
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints CVE-2025-68273, GHSA-fpf5-w967-rr2m | Medium | 0.8% | 01 Jan, 2026 | npm signalk-server |
Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding CVE-2025-68272, GHSA-7rqc-ff8m-7j23 | High | 0.6% | 01 Jan, 2026 | npm signalk-server |
Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) CVE-2025-66398, GHSA-w3x5-7c4c-66p9 | Critical | 19.9% | 01 Jan, 2026 | npm signalk-server |
Malicious release: Malicious code in rules-playground (npm) MAL-2026-4 | Malicious | Not scored | 01 Jan, 2026 | npm rules-playground |
Malicious release: Malicious code in rules-deployer (npm) MAL-2026-3 | Malicious | Not scored | 01 Jan, 2026 | npm rules-deployer |
Malicious release: Malicious code in common-cli-utils (npm) MAL-2026-2 | Malicious | Not scored | 01 Jan, 2026 | npm common-cli-utils |
Trix has a stored XSS vulnerability through its attachment attribute GHSA-g9jg-w8vm-g96v | Medium | Not scored | 31 Dec, 2025 | RubyGems action_text-trix npm trix |
Malicious release: Malicious code in @polystream/streaming (npm) GHSA-fw93-78h7-rwpv, MAL-2025-193009 | Malicious | Not scored | 31 Dec, 2025 | npm @polystream/streaming |
Malicious release: Malicious code in @vietmoney/react-big-calendar (npm) GHSA-2w42-mjvc-7mgq, MAL-2025-192994 | Malicious | Not scored | 31 Dec, 2025 | npm @vietmoney/react-big-calendar |
Malicious release: Malicious code in @vietmoney/vietmoneywork (npm) GHSA-58jp-97fm-4xq3, MAL-2025-193003 | Malicious | Not scored | 31 Dec, 2025 | npm @vietmoney/vietmoneywork |
Malicious release: Malicious code in @vietmoney/react-native-true-id (npm) GHSA-94j6-x699-jcc3, MAL-2025-193001 | Malicious | Not scored | 31 Dec, 2025 | npm @vietmoney/react-native-true-id |
Malicious release: Malicious code in @vietmoney/react-native-image-transformer (npm) GHSA-c475-w7cw-vjcc, MAL-2025-192997 | Malicious | Not scored | 31 Dec, 2025 | npm @vietmoney/react-native-image-transformer |
Malicious release: Malicious code in @vietmoney/react-native-smart-page (npm) GHSA-f7qx-mq63-fxcr, MAL-2025-192999 | Malicious | Not scored | 31 Dec, 2025 | npm @vietmoney/react-native-smart-page |
Malicious release: Malicious code in @vietmoney/vision-camera-code-scanner (npm) GHSA-gmq9-cfc9-7w39, MAL-2025-193004 | Malicious | Not scored | 31 Dec, 2025 | npm @vietmoney/vision-camera-code-scanner |