Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @vietmoney/react-native-smart-gallery (npm) GHSA-jpfq-j254-3ppf, MAL-2025-192998 | Malicious | Not scored | 31 Dec, 2025 | npm @vietmoney/react-native-smart-gallery |
Malicious release: Malicious code in landingpage-service (npm) GHSA-mhgg-gv4f-whxg, MAL-2025-193005 | Malicious | Not scored | 31 Dec, 2025 | npm landingpage-service |
Malicious release: Malicious code in @vietmoney/react-native-vnpay-merchant (npm) GHSA-pwm4-mv3r-mpx3, MAL-2025-193002 | Malicious | Not scored | 31 Dec, 2025 | npm @vietmoney/react-native-vnpay-merchant |
Malicious release: Malicious code in @vietmoney/react-native-action-button (npm) GHSA-rjr7-qcfc-hjcv, MAL-2025-192995 | Malicious | Not scored | 31 Dec, 2025 | npm @vietmoney/react-native-action-button |
Malicious release: Malicious code in @vietmoney/react-native-tags-input (npm) GHSA-vc6p-43hp-v2xf, MAL-2025-193000 | Malicious | Not scored | 31 Dec, 2025 | npm @vietmoney/react-native-tags-input |
Malicious release: Malicious code in @vietmoney/react-native-htmlview (npm) GHSA-wv3x-qp6r-29w6, MAL-2025-192996 | Malicious | Not scored | 31 Dec, 2025 | npm @vietmoney/react-native-htmlview |
PsiTransfer has Zip Slip Path Traversal via TAR Archive Download GHSA-xphh-5v4r-r3rx | High | Not scored | 30 Dec, 2025 | npm psitransfer |
serverless MCP Server vulnerable to Command Injection in list-projects tool CVE-2025-69256, GHSA-rwc2-f344-q6w6 | High | 2.4% | 30 Dec, 2025 | npm serverless |
Malicious release: Malicious code in nbugs-video (npm) GHSA-g2c8-q7fr-7gx3, MAL-2025-192986 | Malicious | Not scored | 30 Dec, 2025 | npm nbugs-video |
Malicious release: Malicious code in npm-xmt (npm) GHSA-2fqg-43mh-6h87, MAL-2025-192987 | Malicious | Not scored | 30 Dec, 2025 | npm npm-xmt |
Malicious release: Malicious code in error-fallback (npm) GHSA-3pfc-mwg4-r94r, MAL-2025-192985 | Malicious | Not scored | 30 Dec, 2025 | npm error-fallback |
Malicious release: Malicious code in chai-promised-chains (npm) GHSA-ccjq-68q9-54h9, MAL-2025-192984 | Malicious | Not scored | 30 Dec, 2025 | npm chai-promised-chains |
Malicious release: Malicious code in @ptest2535/ui-core_mal (npm) GHSA-85qg-c3xq-4w49, MAL-2025-192982 | Malicious | Not scored | 30 Dec, 2025 | npm @ptest2535/ui-core_mal |
Malicious release: Malicious code in @ptest2535/artifactory-demo-ptest (npm) GHSA-9hr6-h5xf-hp2v, MAL-2025-192979 | Malicious | Not scored | 30 Dec, 2025 | npm @ptest2535/artifactory-demo-ptest |
Malicious release: Malicious code in @ptest2535/l_woker_mal (npm) GHSA-q8m4-6xmm-4234, MAL-2025-192980 | Malicious | Not scored | 30 Dec, 2025 | npm @ptest2535/l_woker_mal |
Malicious release: Malicious code in @ptest2535/test_package (npm) GHSA-r34w-369w-v8w9, MAL-2025-192981 | Malicious | Not scored | 30 Dec, 2025 | npm @ptest2535/test_package |
Malicious release: Malicious code in yellowdiscordlookup (npm) GHSA-87w3-vjjr-47gf, MAL-2025-192988 | Malicious | Not scored | 30 Dec, 2025 | npm yellowdiscordlookup |
Malicious release: Malicious code in bigmathex (npm) GHSA-4v7j-fv5q-vv2q, MAL-2025-192983 | Malicious | Not scored | 30 Dec, 2025 | npm bigmathex |
Malicious release: Malicious code in portal-lise (npm) GHSA-h847-vpq8-2hj8, MAL-2025-192970 | Malicious | Not scored | 30 Dec, 2025 | npm portal-lise |
Malicious release: Malicious code in shop-minis-docs (npm) GHSA-2g5f-63gc-p7jh, MAL-2025-192976 | Malicious | Not scored | 30 Dec, 2025 | npm shop-minis-docs |
Malicious release: Malicious code in cdd-plugin-for-datawarrior (npm) GHSA-45h7-9rxv-wjrr, MAL-2025-192966 | Malicious | Not scored | 30 Dec, 2025 | npm cdd-plugin-for-datawarrior |
Malicious release: Malicious code in rt-interactive-card-collection (npm) GHSA-67wx-pprw-w2v6, MAL-2025-192974 | Malicious | Not scored | 30 Dec, 2025 | npm rt-interactive-card-collection |
Malicious release: Malicious code in react-devtools-shared (npm) GHSA-9mmf-qx8w-8798, MAL-2025-192972 | Malicious | Not scored | 30 Dec, 2025 | npm react-devtools-shared |
Malicious release: Malicious code in rt-text-media-collection (npm) GHSA-chc2-cmwr-8f69, MAL-2025-192975 | Malicious | Not scored | 30 Dec, 2025 | npm rt-text-media-collection |
Malicious release: Malicious code in react-devtools-extensions (npm) GHSA-ph84-3h48-w4gw, MAL-2025-192971 | Malicious | Not scored | 30 Dec, 2025 | npm react-devtools-extensions |
Malicious release: Malicious code in react-dom-bindings (npm) GHSA-r2mv-xp84-8cc6, MAL-2025-192973 | Malicious | Not scored | 30 Dec, 2025 | npm react-dom-bindings |
Malicious release: Malicious code in awsmcc (npm) GHSA-r2x7-xp3v-fcwm, MAL-2025-192965 | Malicious | Not scored | 30 Dec, 2025 | npm awsmcc |
Malicious release: Malicious code in shopify-app-react-router (npm) GHSA-rw2j-q47r-j658, MAL-2025-192977 | Malicious | Not scored | 30 Dec, 2025 | npm shopify-app-react-router |
Malicious release: Malicious code in eb-csr (npm) GHSA-x757-3w6f-f9rm, MAL-2025-192967 | Malicious | Not scored | 30 Dec, 2025 | npm eb-csr |
Malicious release: Malicious code in @peter_wilson12091/internal-json-test-parser (npm) GHSA-26xj-cgvf-rcmv, MAL-2025-192964 | Malicious | Not scored | 30 Dec, 2025 | npm @peter_wilson12091/internal-json-test-parser |
Malicious release: Malicious code in express-js-web (npm) GHSA-wpr4-9cjg-p8mm, MAL-2025-192968 | Malicious | Not scored | 30 Dec, 2025 | npm express-js-web |
Malicious release: Malicious code in tailwindcss-typography-style (npm) GHSA-gg45-2h47-hmmj, MAL-2025-192978 | Malicious | Not scored | 30 Dec, 2025 | npm tailwindcss-typography-style |
Malicious release: Malicious code in pepsico-ds (npm) GHSA-9xh2-g3jf-q47w, MAL-2025-192969 | Malicious | Not scored | 30 Dec, 2025 | npm pepsico-ds |
Malicious release: Malicious code in @bugdtest/test1 (npm) GHSA-xwx3-8548-fqr3, MAL-2025-192963 | Malicious | Not scored | 30 Dec, 2025 | npm @bugdtest/test1 |
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion CVE-2025-15284, GHSA-6rw7-vpxm-498p | Medium | 0.4% | 29 Dec, 2025 | npm qs |
axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header CVE-2025-69202, GHSA-x4m5-4cw8-vc44 | Medium | 0.3% | 29 Dec, 2025 | npm axios-cache-interceptor |
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU) CVE-2025-69211, GHSA-8wpr-639p-ccrj | Medium | 0.4% | 29 Dec, 2025 | npm @nestjs/platform-fastify |
hemmelig allows SSRF Filter bypass via Secret Request functionality CVE-2025-69206, GHSA-vvxf-wj5w-6gj5 | Medium | 0.2% | 29 Dec, 2025 | npm hemmelig |
Malicious release: Malicious code in kcheck (npm) GHSA-rw58-vpg4-jcpx, MAL-2025-192960 | Malicious | Not scored | 29 Dec, 2025 | npm kcheck |
Malicious release: Malicious code in intl-tel-input-utils (npm) GHSA-478v-fp9g-73v2, MAL-2025-192959 | Malicious | Not scored | 29 Dec, 2025 | npm intl-tel-input-utils |
Malicious release: Malicious code in crypto-trade-analyzer (npm) MAL-2025-192957 | Malicious | Not scored | 29 Dec, 2025 | npm crypto-trade-analyzer |
Malicious release: Malicious code in eslint-config-pexip-engage (npm) MAL-2025-192955 | Malicious | Not scored | 28 Dec, 2025 | npm eslint-config-pexip-engage |
Malicious release: Malicious code in api-umbrella-admin-ui (npm) GHSA-pq2q-gwxh-rmh2, MAL-2025-192954 | Malicious | Not scored | 28 Dec, 2025 | npm api-umbrella-admin-ui |
Malicious release: Malicious code in eslint-config-sdk (npm) MAL-2025-192952 | Malicious | Not scored | 27 Dec, 2025 | npm eslint-config-sdk |
Malicious release: Malicious code in ugc-kit (npm) GHSA-v4w5-3vhx-g64x, MAL-2025-192951 | Malicious | Not scored | 27 Dec, 2025 | npm ugc-kit |
Malicious release: Malicious code in ing-feat-malware-detection (npm) GHSA-838c-jj63-x7mf, MAL-2025-192949 | Malicious | Not scored | 27 Dec, 2025 | npm ing-feat-malware-detection |
Malicious release: Malicious code in ing-feat-ui-image (npm) GHSA-6wj8-2g22-38w9, MAL-2025-192950 | Malicious | Not scored | 27 Dec, 2025 | npm ing-feat-ui-image |
Malicious release: Malicious code in backstage-plugin-glean (npm) GHSA-86v9-6365-r69x, MAL-2025-192944 | Malicious | Not scored | 27 Dec, 2025 | npm backstage-plugin-glean |
Self-hosted n8n has Legacy Code node that enables arbitrary file read/write CVE-2025-68697, GHSA-j4p8-h8mh-rh8q | High | 0.3% | 26 Dec, 2025 | npm n8n |
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node CVE-2025-68668, GHSA-62r4-hw23-cc8v | Critical | 13.2% | 26 Dec, 2025 | npm n8n |