Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @uol-afiliados/affiliated-config-lib (npm) GHSA-mx57-mmpv-mwjr, MAL-2026-16370 | Malicious | Not scored | 21 Sep, 2026 | npm @uol-afiliados/affiliated-config-lib |
@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory CVE-2026-61647, GHSA-jjhp-8crj-mppq | High | 0.4% | 21 Sep, 2026 | npm @roomi-fields/notebooklm-mcp |
Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory) CVE-2026-58272, GHSA-29hq-23m2-2j47 | Medium | 0.4% | 21 Sep, 2026 | npm @sync-in/server |
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters` CVE-2026-58270, GHSA-jx63-h26r-8cph | Medium | 0.4% | 21 Sep, 2026 | npm @sync-in/server |
@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register` CVE-2026-58271, GHSA-274f-6w77-8qm9 | Medium | 0.2% | 21 Sep, 2026 | npm @sync-in/server |
Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token` CVE-2026-58269, GHSA-92cr-jxw4-5wjg | High | 0.3% | 21 Sep, 2026 | npm @sync-in/server |
Malicious release: Malicious code in math-universe (npm) GHSA-97cg-r346-fg22, MAL-2026-16367 | Malicious | Not scored | 21 Sep, 2026 | npm math-universe |
Malicious release: Malicious code in mathsbase (npm) GHSA-v4cx-64j6-84xm, MAL-2026-16369 | Malicious | Not scored | 21 Sep, 2026 | npm mathsbase |
Malicious release: Malicious code in bytepack-probe-a7x3 (npm) MAL-2026-16364 | Malicious | Not scored | 21 Sep, 2026 | npm bytepack-probe-a7x3 |
Malicious release: Malicious code in mathmain (npm) GHSA-v6mx-2p6p-3628, MAL-2026-16368 | Malicious | Not scored | 21 Sep, 2026 | npm mathmain |
Malicious release: Malicious code in blue-string-formatter-utilss (npm) MAL-2026-16363 | Malicious | Not scored | 21 Sep, 2026 | npm blue-string-formatter-utilss |
Malicious release: Malicious code in my-ctf-helper-script-9921 (npm) GHSA-7mhc-78r2-fgw8, MAL-2026-16365 | Malicious | Not scored | 21 Sep, 2026 | npm my-ctf-helper-script-9921 |
Malicious release: Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm) GHSA-xxcj-347q-8rrr, MAL-2026-16357 | Malicious | Not scored | 21 Sep, 2026 | npm @asdfaskdjfksadhfkasf/nadaver2 |
Malicious release: Malicious code in @uh-platform/nadaver (npm) GHSA-v7wx-gg27-6p9g, MAL-2026-16360 | Malicious | Not scored | 21 Sep, 2026 | npm @uh-platform/nadaver |
Malicious release: Malicious code in @uh-platform/domain-widget (npm) GHSA-c842-qvgg-5vpf, MAL-2026-16359 | Malicious | Not scored | 21 Sep, 2026 | npm @uh-platform/domain-widget |
Malicious release: Malicious code in @uh-platform/webcard (npm) GHSA-7w7p-g9xr-2v29, MAL-2026-16362 | Malicious | Not scored | 21 Sep, 2026 | npm @uh-platform/webcard |
Malicious release: Malicious code in @uh-platform/cloud (npm) GHSA-xrhc-2pph-j3f7, MAL-2026-16358 | Malicious | Not scored | 21 Sep, 2026 | npm @uh-platform/cloud |
Malicious release: Malicious code in @uh-platform/nadaver2 (npm) GHSA-x2pw-3pc4-xvh5, MAL-2026-16361 | Malicious | Not scored | 21 Sep, 2026 | npm @uh-platform/nadaver2 |
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509 CVE-2026-61612, GHSA-798p-78g2-v556 | Medium | 0.4% | 21 Sep, 2026 | npm @aborruso/ckan-mcp-server |
Malicious release: Malicious code in gemini-computer-use (npm) MAL-2026-16355 | Malicious | Not scored | 21 Sep, 2026 | npm gemini-computer-use |
Malicious release: Malicious code in @woodpecker-web-shared/components (npm) GHSA-44hm-95r4-wcrf, MAL-2026-16354 | Malicious | Not scored | 21 Sep, 2026 | npm @woodpecker-web-shared/components |
deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes CVE-2026-63116, GHSA-89vx-jh4q-vg3w | High | 0.5% | 21 Sep, 2026 | npm @deepstream/server |
Malicious release: Malicious code in @baanx/blockchain-config (npm) GHSA-f67m-pjx9-96cv, MAL-2026-16352 | Malicious | Not scored | 21 Sep, 2026 | npm @baanx/blockchain-config |
Malicious release: Malicious code in @baanx/abis (npm) GHSA-598m-93qh-82f9, MAL-2026-16351 | Malicious | Not scored | 21 Sep, 2026 | npm @baanx/abis |
Malicious release: Malicious code in @insiderintelligence/componentlibrary (npm) GHSA-rjh6-qm48-cg84, MAL-2026-16353 | Malicious | Not scored | 21 Sep, 2026 | npm @insiderintelligence/componentlibrary |
Malicious release: Malicious code in bnppf-flag-icons (npm) GHSA-34p9-xxp2-hv3g, MAL-2026-16350 | Malicious | Not scored | 21 Sep, 2026 | npm bnppf-flag-icons |
Malicious release: Malicious code in hardhat-base (npm) MAL-2026-16348 | Malicious | Not scored | 21 Sep, 2026 | npm hardhat-base |
Malicious release: Malicious code in hardhat-devkit (npm) MAL-2026-16349 | Malicious | Not scored | 21 Sep, 2026 | npm hardhat-devkit |
Malicious release: Malicious code in pf23727 (npm) GHSA-p2hc-jmvm-qwc9, MAL-2026-16338 | Malicious | Not scored | 21 Sep, 2026 | npm pf23727 |
Malicious release: Malicious code in pflag14570 (npm) GHSA-qxgf-vc83-fc34, MAL-2026-16341 | Malicious | Not scored | 21 Sep, 2026 | npm pflag14570 |
Malicious release: Malicious code in pflag29424 (npm) GHSA-8jr8-g7mm-57m6, MAL-2026-16342 | Malicious | Not scored | 21 Sep, 2026 | npm pflag29424 |
Malicious release: Malicious code in pf25133 (npm) GHSA-8f7g-cf69-g5p8, MAL-2026-16339 | Malicious | Not scored | 21 Sep, 2026 | npm pf25133 |
Malicious release: Malicious code in keroeltopgg (npm) MAL-2026-16334 | Malicious | Not scored | 21 Sep, 2026 | npm keroeltopgg |
Malicious release: Malicious code in keroeltopkkk (npm) MAL-2026-16336 | Malicious | Not scored | 21 Sep, 2026 | npm keroeltopkkk |
Malicious release: Malicious code in keroeltopkk (npm) MAL-2026-16335 | Malicious | Not scored | 21 Sep, 2026 | npm keroeltopkk |
Malicious release: Malicious code in my-cdn-script (npm) MAL-2026-16337 | Malicious | Not scored | 21 Sep, 2026 | npm my-cdn-script |
Malicious release: Malicious code in pf25262 (npm) GHSA-3pg3-52vp-54fg, MAL-2026-16340 | Malicious | Not scored | 21 Sep, 2026 | npm pf25262 |
Malicious release: Malicious code in homestack-cheer (npm) GHSA-x567-p88w-3697, MAL-2026-16333 | Malicious | Not scored | 21 Sep, 2026 | npm homestack-cheer |
Malicious release: Malicious code in @asenfotech/unplugin-element-plus (npm) MAL-2026-16318 | Malicious | Not scored | 21 Sep, 2026 | npm @asenfotech/unplugin-element-plus |
Malicious release: Malicious code in feed-widget-helper (npm) GHSA-r52r-vpcc-38v2, MAL-2026-16332 | Malicious | Not scored | 21 Sep, 2026 | npm feed-widget-helper |
Malicious release: Malicious code in element-plus-vite-cli (npm) MAL-2026-16331 | Malicious | Not scored | 21 Sep, 2026 | npm element-plus-vite-cli |
Malicious release: Malicious code in catwrestlingbird (npm) MAL-2026-16327 | Malicious | Not scored | 21 Sep, 2026 | npm catwrestlingbird |
Malicious release: Malicious code in sorrawit-dev-helper (npm) MAL-2026-16344 | Malicious | Not scored | 21 Sep, 2026 | npm sorrawit-dev-helper |
Malicious release: Malicious code in catwrestlinghuman (npm) MAL-2026-16328 | Malicious | Not scored | 21 Sep, 2026 | npm catwrestlinghuman |
Malicious release: Malicious code in action-slack-message-root (npm) GHSA-mrmw-mqq6-fp9w, MAL-2026-16323 | Malicious | Not scored | 21 Sep, 2026 | npm action-slack-message-root |
Malicious release: Malicious code in bulk-add-sdk (npm) MAL-2026-16325 | Malicious | Not scored | 21 Sep, 2026 | npm bulk-add-sdk |
Malicious release: Malicious code in better-envforge (npm) GHSA-3h54-43fv-m822, MAL-2026-16324 | Malicious | Not scored | 21 Sep, 2026 | npm better-envforge |
Malicious release: Malicious code in chai-as-viem (npm) GHSA-88fm-v2m3-mx8x, MAL-2026-16329 | Malicious | Not scored | 21 Sep, 2026 | npm chai-as-viem |
Malicious release: Malicious code in byted-commerce-materials (npm) MAL-2026-16326 | Malicious | Not scored | 21 Sep, 2026 | npm byted-commerce-materials |
Malicious release: Malicious code in siriusbeyond (npm) MAL-2026-16343 | Malicious | Not scored | 21 Sep, 2026 | npm siriusbeyond |