Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in plugin-senna (npm) GHSA-935r-3293-428p, MAL-2025-192602 | Malicious | Not scored | 17 Dec, 2025 | npm plugin-senna |
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits CVE-2025-71399, GHSA-x732-6j76-qmhm | High | 0.5% | 16 Dec, 2025 | npm better-auth |
@vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint CVE-2025-68155, GHSA-g239-q96q-x4qm | High | 0.5% | 16 Dec, 2025 | npm @vitejs/plugin-rsc |
systeminformation has a Command Injection vulnerability in fsSize() function on Windows CVE-2025-68154, GHSA-wphj-fx3q-84ch | High | 13.0% | 16 Dec, 2025 | npm systeminformation |
Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter BIT-parse-2025-68150, CVE-2025-68150, GHSA-3f5f-xgrj-97pf | High | 0.3% | 16 Dec, 2025 | npm parse-server |
tRPC has possible prototype pollution in `experimental_nextAppDirCaller` CVE-2025-68130, GHSA-43p4-m455-4f4j | High | 0.4% | 16 Dec, 2025 | npm @trpc/server |
Malicious release: Malicious code in vscode-azure-mcp-server (npm) GHSA-g3xg-r65r-rjp9, MAL-2025-192601 | Malicious | Not scored | 16 Dec, 2025 | npm vscode-azure-mcp-server |
Malicious release: Malicious code in raven-hubspot (npm) GHSA-wggj-3c6j-49w5, MAL-2025-192597 | Malicious | Not scored | 16 Dec, 2025 | npm raven-hubspot |
Malicious release: Malicious code in tailwind-variables (npm) GHSA-2fr9-wfcg-g278, MAL-2025-192600 | Malicious | Not scored | 16 Dec, 2025 | npm tailwind-variables |
Malicious release: Malicious code in tailwind-stylecss (npm) GHSA-6p9g-26px-4p2j, MAL-2025-192599 | Malicious | Not scored | 16 Dec, 2025 | npm tailwind-stylecss |
Malicious release: Malicious code in bigmathlib (npm) GHSA-5mv4-pjx6-7x42, MAL-2025-192598, SNYK-JS-BIGMATHLIB-14423941 | Malicious | Not scored | 16 Dec, 2025 | npm bigmathlib |
Malicious release: Malicious code in example-vue2-micro (npm) GHSA-9rqv-9897-8v59, MAL-2025-192590, SNYK-JS-EXAMPLEVUE2MICRO-14423937 | Malicious | Not scored | 16 Dec, 2025 | npm example-vue2-micro |
Malicious release: Malicious code in openhands-frontend (npm) GHSA-f5xm-4hwm-3fmf, MAL-2025-192593, SNYK-JS-OPENHANDSFRONTEND-14423935 | Malicious | Not scored | 16 Dec, 2025 | npm openhands-frontend |
Malicious release: Malicious code in dubbo-js-private-workspace (npm) GHSA-fhq4-8wqq-qjw8, MAL-2025-192586, SNYK-JS-DUBBOJSPRIVATEWORKSPACE-14423931 | Malicious | Not scored | 16 Dec, 2025 | npm dubbo-js-private-workspace |
Malicious release: Malicious code in nad-home (npm) GHSA-3j59-8fh5-f32x, MAL-2025-192592, SNYK-JS-NADHOME-14423943 | Malicious | Not scored | 16 Dec, 2025 | npm nad-home |
Malicious release: Malicious code in smart-utils-alice (npm) GHSA-6fwq-962w-p65h, MAL-2025-192595, SNYK-JS-SMARTUTILSALICE-14423944 | Malicious | Not scored | 16 Dec, 2025 | npm smart-utils-alice |
Malicious release: Malicious code in i18never (npm) GHSA-h3qr-rcp8-8x7v, MAL-2025-192591, SNYK-JS-I18NEVER-14423938 | Malicious | Not scored | 16 Dec, 2025 | npm i18never |
Malicious release: Malicious code in prod-natwest (npm) GHSA-r372-c736-29hr, MAL-2025-192594, SNYK-JS-PRODNATWEST-14423932 | Malicious | Not scored | 16 Dec, 2025 | npm prod-natwest |
Malicious release: Malicious code in starling-api (npm) GHSA-xmqp-vmx8-v537, MAL-2025-192596, SNYK-JS-STARLINGAPI-14423939 | Malicious | Not scored | 16 Dec, 2025 | npm starling-api |
Malicious release: Malicious code in elf-stats-aurora-cocoa-911 (npm) GHSA-4vv5-g9j4-6v4v, MAL-2025-192587 | Malicious | Not scored | 16 Dec, 2025 | npm elf-stats-aurora-cocoa-911 |
Malicious release: Malicious code in elf-stats-fuzzy-wreath-278 (npm) GHSA-rhvr-922h-rhwj, MAL-2025-192588 | Malicious | Not scored | 16 Dec, 2025 | npm elf-stats-fuzzy-wreath-278 |
Malicious release: Malicious code in jsondatatoruby (npm) MAL-2025-192584 | Malicious | Not scored | 16 Dec, 2025 | npm jsondatatoruby |
Malicious release: Malicious code in elf-stats-nutmeg-sleigh-350 (npm) GHSA-r2xw-jwfw-jh45, MAL-2025-192589 | Malicious | Not scored | 16 Dec, 2025 | npm elf-stats-nutmeg-sleigh-350 |
Malicious release: Malicious code in betterjsloggin (npm) GHSA-g9v2-5x8c-cwcp, MAL-2025-192585 | Malicious | Not scored | 16 Dec, 2025 | npm betterjsloggin |
Malicious release: Malicious code in swissid-common (npm) GHSA-r5fr-fvr3-8vpc, MAL-2025-192583, SNYK-JS-SWISSIDCOMMON-14423922 | Malicious | Not scored | 16 Dec, 2025 | npm swissid-common |
Malicious release: Malicious code in sds-swissid-common (npm) GHSA-xr56-7xpv-9gcq, MAL-2025-192582 | Malicious | Not scored | 16 Dec, 2025 | npm sds-swissid-common |
Malicious release: Malicious code in sds-auth-ui (npm) GHSA-8vxx-c327-477r, MAL-2025-192580 | Malicious | Not scored | 16 Dec, 2025 | npm sds-auth-ui |
Malicious release: Malicious code in sds-oauth-client (npm) GHSA-wf9w-2w3f-44v4, MAL-2025-192581 | Malicious | Not scored | 16 Dec, 2025 | npm sds-oauth-client |
Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables BIT-parse-2025-68115, CVE-2025-68115, GHSA-jhgf-2h8h-ggxv | Medium | 0.2% | 16 Dec, 2025 | npm parse-server |
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay CVE-2025-68113, GHSA-6gvq-jcmp-8959, GO-2025-4239, PYSEC-2026-1115 | Medium | 0.5% | 16 Dec, 2025 | Go github.com/altcha-org/altcha-lib-go Hex altcha Maven org.altcha:altcha Packagist altcha-org/altcha +3 more |
Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVE-2025-66482, GHSA-wwrj-3hvj-prpm | Medium | 0.3% | 15 Dec, 2025 | npm misskey-js |
misskey.js's export data contains private post data CVE-2025-66402, GHSA-496g-mmpw-j9x3 | High | 0.3% | 15 Dec, 2025 | npm misskey-js |
Malicious release: Malicious code in xboxlive-auth (npm) GHSA-q7m9-qpv4-57jh, MAL-2025-192578 | Malicious | Not scored | 15 Dec, 2025 | npm xboxlive-auth |
Malicious release: Malicious code in bignumex (npm) GHSA-cvwj-6h92-w2cp, MAL-2025-192574, SNYK-JS-BIGNUMEX-14417296 | Malicious | Not scored | 15 Dec, 2025 | npm bignumex |
Malicious release: Malicious code in polygon-src (npm) GHSA-x2rc-mfgw-jfp8, MAL-2025-192575 | Malicious | Not scored | 15 Dec, 2025 | npm polygon-src |
Malicious release: Malicious code in @revvity-signals/chemdraw-js (npm) GHSA-2vh3-gf8f-8524, MAL-2025-192573, SNYK-JS-REVVITYSIGNALSCHEMDRAWJS-14417298 | Malicious | Not scored | 15 Dec, 2025 | npm @revvity-signals/chemdraw-js |
Malicious release: Malicious code in sd-security (npm) GHSA-g69f-6vrm-x88p, MAL-2025-192576, SNYK-JS-SDSECURITY-14417303 | Malicious | Not scored | 15 Dec, 2025 | npm sd-security |
Malicious release: Malicious code in sd-skbms (npm) GHSA-ww9c-3crf-rqcp, MAL-2025-192577, SNYK-JS-SDSKBMS-14417297 | Malicious | Not scored | 15 Dec, 2025 | npm sd-skbms |
Malicious release: Malicious code in phx-core (npm) GHSA-jfqw-pq2x-x7rg, MAL-2025-192572, SNYK-JS-PHXCORE-14417293 | Malicious | Not scored | 15 Dec, 2025 | npm phx-core |
Malicious release: Malicious code in paypal-scripts-server-utils (npm) GHSA-97r7-62jh-mxcf, MAL-2025-192571, SNYK-JS-PAYPALSCRIPTSSERVERUTILS-14417292 | Malicious | Not scored | 15 Dec, 2025 | npm paypal-scripts-server-utils |
Malicious release: Malicious code in @mohamed1687/iut-encrypt (npm) GHSA-xvw5-m66f-f7g7, MAL-2025-192570 | Malicious | Not scored | 15 Dec, 2025 | npm @mohamed1687/iut-encrypt |
MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827 CVE-2025-67898, GHSA-45h5-66jx-r2wf | Medium | 0.3% | 14 Dec, 2025 | npm mjml |
Malicious release: Malicious code in @ikarem/telemetry (npm) GHSA-5q62-g32j-g4hp, MAL-2025-192569 | Malicious | Not scored | 14 Dec, 2025 | npm @ikarem/telemetry |
Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule CVE-2025-67750, GHSA-55jh-84jv-8mx8 | High | 0.2% | 12 Dec, 2025 | npm lightning-flow-scanner |
Vuetify has a Prototype Pollution vulnerability CVE-2025-8083, GHSA-3jp5-5f8r-q2wg | High | 0.3% | 12 Dec, 2025 | npm vuetify |
Vuetify has a Cross-site Scripting (XSS) vulnerability in the VDatePicker component CVE-2025-8082, GHSA-9w3x-85mw-4fwm | Medium | 0.2% | 12 Dec, 2025 | npm vuetify |
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up GHSA-5j59-xgg2-r9c4 | High | Not scored | 12 Dec, 2025 | npm next |
Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components GHSA-c6m7-q6pr-c64r | Medium | Not scored | 12 Dec, 2025 | npm @vitejs/plugin-rsc |
Vite Plugin React has a Denial of Service Vulnerability in React Server Components GHSA-cpqf-f22c-r95x | High | Not scored | 12 Dec, 2025 | npm @vitejs/plugin-rsc |
Malicious release: Malicious code in kashif-mallah-fca (npm) GHSA-pxvw-rf2w-m2h5, MAL-2025-192560 | Malicious | Not scored | 12 Dec, 2025 | npm kashif-mallah-fca |