Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox CVE-2025-61914, GHSA-58jc-rcg5-95f3 | High | 0.2% | 26 Dec, 2025 | npm n8n |
apidoc-core has a prototype pollution vulnerability CVE-2025-13158, GHSA-6vj3-p34w-xxjp | Critical | 0.5% | 26 Dec, 2025 | npm apidoc-core |
libxmljs has segmentation fault, potentially leading to a denial-of-service (DoS) CVE-2025-25341, GHSA-jv72-59wq-8rxm | High | 0.4% | 26 Dec, 2025 | npm libxmljs |
Malicious release: Malicious code in bola511 (npm) MAL-2025-192941 | Malicious | Not scored | 26 Dec, 2025 | npm bola511 |
Malicious release: Malicious code in yunxohang4 (npm) GHSA-qqjp-xcww-46gp, MAL-2026-184 | Malicious | Not scored | 26 Dec, 2025 | npm yunxohang4 |
Malicious release: Malicious code in magic-poc (npm) GHSA-m6v9-f3q8-q9qj, MAL-2025-192939 | Malicious | Not scored | 26 Dec, 2025 | npm magic-poc |
Malicious release: Malicious code in bettermode-icons (npm) MAL-2025-192938 | Malicious | Not scored | 25 Dec, 2025 | npm bettermode-icons |
Malicious release: Malicious code in bettermode-common (npm) GHSA-w55f-m97h-c6pf, MAL-2025-192937 | Malicious | Not scored | 25 Dec, 2025 | npm bettermode-common |
Malicious release: Malicious code in ing-feat-kyc-consent (npm) GHSA-r682-hfrx-mp6j, MAL-2025-192934 | Malicious | Not scored | 25 Dec, 2025 | npm ing-feat-kyc-consent |
Malicious release: Malicious code in ing-feat-auth-idin (npm) GHSA-mqvw-23c8-9fxf, MAL-2025-192933 | Malicious | Not scored | 25 Dec, 2025 | npm ing-feat-auth-idin |
Malicious release: Malicious code in ing-feat-mortgage-consent-starter (npm) MAL-2025-192935 | Malicious | Not scored | 25 Dec, 2025 | npm ing-feat-mortgage-consent-starter |
Malicious release: Malicious code in ing-feat-pis-single-payments (npm) MAL-2025-192936 | Malicious | Not scored | 25 Dec, 2025 | npm ing-feat-pis-single-payments |
Malicious release: Malicious code in cc-raiesy (npm) MAL-2025-192932 | Malicious | Not scored | 25 Dec, 2025 | npm cc-raiesy |
Malicious release: Malicious code in adril7123 (npm) GHSA-wx7c-p492-4g92, MAL-2025-192927 | Malicious | Not scored | 24 Dec, 2025 | npm adril7123 |
Malicious release: Malicious code in @airtel-web/clickstream (npm) GHSA-5qc2-32p6-rqq4, MAL-2025-192926 | Malicious | Not scored | 24 Dec, 2025 | npm @airtel-web/clickstream |
Malicious release: Malicious code in secguest-react-lib (npm) GHSA-42jv-5r4v-m7qq, MAL-2026-170 | Malicious | Not scored | 24 Dec, 2025 | npm secguest-react-lib |
LangChain serialization injection vulnerability enables secret extraction CVE-2025-68665, GHSA-r399-636x-v7f6 | Critical | 0.8% | 23 Dec, 2025 | npm @langchain/core npm langchain |
Malicious release: Malicious code in @google_recaptcha/js (npm) GHSA-j3x4-vhvj-627x, MAL-2025-192752 | Malicious | Not scored | 23 Dec, 2025 | npm @google_recaptcha/js |
Malicious release: Malicious code in supply_chain_dummy_test_2 (npm) GHSA-6rjq-vggp-p672, MAL-2025-192761 | Malicious | Not scored | 23 Dec, 2025 | npm supply_chain_dummy_test_2 |
Malicious release: Malicious code in supply_chain_dummy_test_4 (npm) GHSA-q5x2-6fv5-qxp8, MAL-2025-192763 | Malicious | Not scored | 23 Dec, 2025 | npm supply_chain_dummy_test_4 |
Malicious release: Malicious code in supply_chain_dummy_test_3 (npm) GHSA-r6g5-cgp3-h24c, MAL-2025-192762 | Malicious | Not scored | 23 Dec, 2025 | npm supply_chain_dummy_test_3 |
Malicious release: Malicious code in supply_chain_dummy_test_1 (npm) GHSA-vh5p-f9g9-c2mg, MAL-2025-192760 | Malicious | Not scored | 23 Dec, 2025 | npm supply_chain_dummy_test_1 |
Malicious release: Malicious code in dotjsenv (npm) GHSA-63qm-964q-w2w5, MAL-2025-192755 | Malicious | Not scored | 23 Dec, 2025 | npm dotjsenv |
Malicious release: Malicious code in qxytest1 (npm) GHSA-cw4m-2fcc-rpc5, MAL-2025-192757 | Malicious | Not scored | 23 Dec, 2025 | npm qxytest1 |
Malicious release: Malicious code in qxytest (npm) GHSA-hvqc-82p3-6gpf, MAL-2025-192756 | Malicious | Not scored | 23 Dec, 2025 | npm qxytest |
Malicious release: Malicious code in start-log-plugin (npm) GHSA-qc6r-xf7q-j45q, MAL-2025-192759 | Malicious | Not scored | 23 Dec, 2025 | npm start-log-plugin |
Malicious release: Malicious code in start-log-backend (npm) GHSA-qqfh-xwc2-gx36, MAL-2025-192758 | Malicious | Not scored | 23 Dec, 2025 | npm start-log-backend |
Malicious release: Malicious code in trial-guard (npm) GHSA-vjg7-9cf4-mpp8, MAL-2025-192764 | Malicious | Not scored | 23 Dec, 2025 | npm trial-guard |
Malicious release: Malicious code in chai-max (npm) GHSA-cgcm-g6p8-2xxm, MAL-2025-192754 | Malicious | Not scored | 23 Dec, 2025 | npm chai-max |
Malicious release: Malicious code in chai-async-chains (npm) GHSA-r8fq-6pxg-2f6q, MAL-2025-192753 | Malicious | Not scored | 23 Dec, 2025 | npm chai-async-chains |
Malicious release: Malicious code in excluder-mcp (npm) GHSA-gg9p-qcrr-r7fv, MAL-2025-192746 | Malicious | Not scored | 23 Dec, 2025 | npm excluder-mcp |
Malicious release: Malicious code in excluder-mcp-package (npm) GHSA-h43q-7r78-rf73, MAL-2025-192747 | Malicious | Not scored | 23 Dec, 2025 | npm excluder-mcp-package |
Malicious release: Malicious code in rpc-validate (npm) GHSA-xqfj-679p-362j, MAL-2025-192749 | Malicious | Not scored | 23 Dec, 2025 | npm rpc-validate |
Malicious release: Malicious code in lotusbail (npm) GHSA-qmh8-v4jq-m242, MAL-2025-192748 | Malicious | Not scored | 23 Dec, 2025 | npm lotusbail |
Malicious release: Malicious code in @aa-techops-ui/ping-authentication (npm) GHSA-jvg2-gw63-4hq4, MAL-2025-192745 | Malicious | Not scored | 23 Dec, 2025 | npm @aa-techops-ui/ping-authentication |
Malicious release: Malicious code in chai-tests-await (npm) GHSA-g8cf-w8cw-2659, MAL-2025-192742 | Malicious | Not scored | 23 Dec, 2025 | npm chai-tests-await |
Malicious release: Malicious code in dotenv-extend (npm) GHSA-jr68-9xqf-rp8q, MAL-2025-192743 | Malicious | Not scored | 23 Dec, 2025 | npm dotenv-extend |
Malicious release: Malicious code in huangmingming-demo (npm) GHSA-33cf-82vq-86w6, MAL-2025-192744 | Malicious | Not scored | 23 Dec, 2025 | npm huangmingming-demo |
Malicious release: Malicious code in streamixer (npm) GHSA-c5q9-xg8w-2hv3, MAL-2025-192729 | Malicious | Not scored | 23 Dec, 2025 | npm streamixer |
Malicious release: Malicious code in workvivo-chatbot (npm) MAL-2025-192887 | Malicious | Not scored | 23 Dec, 2025 | npm workvivo-chatbot |
Malicious release: Malicious code in workvivo-layout-extension (npm) MAL-2025-192888 | Malicious | Not scored | 23 Dec, 2025 | npm workvivo-layout-extension |
Malicious release: Malicious code in workvivo-anniversary-automation (npm) MAL-2025-192886 | Malicious | Not scored | 23 Dec, 2025 | npm workvivo-anniversary-automation |
Malicious release: Malicious code in wealthbox-marketing (npm) MAL-2025-192885 | Malicious | Not scored | 23 Dec, 2025 | npm wealthbox-marketing |
Malicious release: Malicious code in vite-react-setting (npm) MAL-2025-192884 | Malicious | Not scored | 23 Dec, 2025 | npm vite-react-setting |
Malicious release: Malicious code in varshade-afc (npm) MAL-2025-192883 | Malicious | Not scored | 23 Dec, 2025 | npm varshade-afc |
Malicious release: Malicious code in vapark-boost-v1 (npm) MAL-2025-192882 | Malicious | Not scored | 23 Dec, 2025 | npm vapark-boost-v1 |
Malicious release: Malicious code in typeface-maison-neue (npm) MAL-2025-192881 | Malicious | Not scored | 23 Dec, 2025 | npm typeface-maison-neue |
Malicious release: Malicious code in tierlist (npm) MAL-2025-192880 | Malicious | Not scored | 23 Dec, 2025 | npm tierlist |
Malicious release: Malicious code in tescoutils (npm) MAL-2025-192879 | Malicious | Not scored | 23 Dec, 2025 | npm tescoutils |
Malicious release: Malicious code in teeseest (npm) MAL-2025-192878 | Malicious | Not scored | 23 Dec, 2025 | npm teeseest |