Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Servify-express rate limit issue CVE-2025-67731, GHSA-qgc4-8p88-4w7m | High | 0.4% | 11 Dec, 2025 | npm servify-express |
Malicious release: Malicious code in mw-proto-ts (npm) GHSA-g95x-gc97-8c32, MAL-2025-192543 | Malicious | Not scored | 11 Dec, 2025 | npm mw-proto-ts |
Malicious release: Malicious code in mui-wrapper-icons (npm) GHSA-c5f8-883m-6j44, MAL-2025-192541 | Malicious | Not scored | 11 Dec, 2025 | npm mui-wrapper-icons |
Malicious release: Malicious code in mui-wrapper-styles (npm) GHSA-3mq4-3vvv-jjrq, MAL-2025-192542 | Malicious | Not scored | 11 Dec, 2025 | npm mui-wrapper-styles |
Malicious release: Malicious code in tnaparserxml (npm) GHSA-37j4-5fh6-h5h6, MAL-2025-192465 | Malicious | Not scored | 11 Dec, 2025 | npm tnaparserxml |
Malicious release: Malicious code in elf-stats-ember-stockpile-448 (npm) GHSA-4m4c-4wq7-8vj3, MAL-2025-192442 | Malicious | Not scored | 11 Dec, 2025 | npm elf-stats-ember-stockpile-448 |
Malicious release: Malicious code in fadafas3 (npm) GHSA-6h44-w72p-7j43, MAL-2025-192450 | Malicious | Not scored | 11 Dec, 2025 | npm fadafas3 |
Malicious release: Malicious code in elf-stats-merry-icicle-449 (npm) GHSA-7h89-jv4c-5hpg, MAL-2025-192444 | Malicious | Not scored | 11 Dec, 2025 | npm elf-stats-merry-icicle-449 |
Malicious release: Malicious code in ofjaaah12 (npm) GHSA-7r9r-f3j7-969w, MAL-2025-192464 | Malicious | Not scored | 11 Dec, 2025 | npm ofjaaah12 |
Malicious release: Malicious code in elf-stats-silvered-mailbag-755 (npm) GHSA-84cm-jw9q-wr47, MAL-2025-192445 | Malicious | Not scored | 11 Dec, 2025 | npm elf-stats-silvered-mailbag-755 |
Malicious release: Malicious code in elf-stats-jolly-hammer-980 (npm) GHSA-9qmh-jjxw-fpm2, MAL-2025-192443 | Malicious | Not scored | 11 Dec, 2025 | npm elf-stats-jolly-hammer-980 |
Malicious release: Malicious code in elf-stats-sparkly-snowglobe-243 (npm) GHSA-cjq9-7vg8-w7x6, MAL-2025-192448 | Malicious | Not scored | 11 Dec, 2025 | npm elf-stats-sparkly-snowglobe-243 |
Malicious release: Malicious code in elf-stats-cosy-garland-592 (npm) GHSA-fp7c-3w5c-w2x8, MAL-2025-192441 | Malicious | Not scored | 11 Dec, 2025 | npm elf-stats-cosy-garland-592 |
Malicious release: Malicious code in elf-stats-silvered-wishlist-243 (npm) GHSA-g328-49mp-9rv8, MAL-2025-192446 | Malicious | Not scored | 11 Dec, 2025 | npm elf-stats-silvered-wishlist-243 |
Malicious release: Malicious code in elf-stats-snowy-toolkit-186 (npm) GHSA-h796-3gg3-mcgx, MAL-2025-192447 | Malicious | Not scored | 11 Dec, 2025 | npm elf-stats-snowy-toolkit-186 |
Malicious release: Malicious code in asdfgh3 (npm) GHSA-jf55-h662-7w2j, MAL-2025-192439 | Malicious | Not scored | 11 Dec, 2025 | npm asdfgh3 |
Malicious release: Malicious code in elf-stats-candystriped-snowglobe-426 (npm) GHSA-mp3c-326j-96mw, MAL-2025-192440 | Malicious | Not scored | 11 Dec, 2025 | npm elf-stats-candystriped-snowglobe-426 |
Malicious release: Malicious code in elf-stats-sugarplum-mitten-141 (npm) GHSA-pq84-52r2-cmvm, MAL-2025-192449 | Malicious | Not scored | 11 Dec, 2025 | npm elf-stats-sugarplum-mitten-141 |
Malicious release: Malicious code in libxmlfinal (npm) MAL-2025-192451 | Malicious | Not scored | 11 Dec, 2025 | npm libxmlfinal |
Malicious release: Malicious code in libxmlfinal3 (npm) MAL-2025-192452 | Malicious | Not scored | 11 Dec, 2025 | npm libxmlfinal3 |
Malicious release: Malicious code in libxmlfinal4 (npm) MAL-2025-192453 | Malicious | Not scored | 11 Dec, 2025 | npm libxmlfinal4 |
Malicious release: Malicious code in libxmlfinal5 (npm) MAL-2025-192454 | Malicious | Not scored | 11 Dec, 2025 | npm libxmlfinal5 |
Malicious release: Malicious code in libxmlhere (npm) MAL-2025-192455 | Malicious | Not scored | 11 Dec, 2025 | npm libxmlhere |
Malicious release: Malicious code in libxmljs10 (npm) MAL-2025-192456 | Malicious | Not scored | 11 Dec, 2025 | npm libxmljs10 |
Malicious release: Malicious code in libxmljs2var234 (npm) MAL-2025-192457 | Malicious | Not scored | 11 Dec, 2025 | npm libxmljs2var234 |
Malicious release: Malicious code in libxmljsololo (npm) MAL-2025-192458 | Malicious | Not scored | 11 Dec, 2025 | npm libxmljsololo |
Malicious release: Malicious code in libxmljsololo3 (npm) MAL-2025-192459 | Malicious | Not scored | 11 Dec, 2025 | npm libxmljsololo3 |
Malicious release: Malicious code in libxmljsololo4 (npm) MAL-2025-192460 | Malicious | Not scored | 11 Dec, 2025 | npm libxmljsololo4 |
Malicious release: Malicious code in libxmljsololos (npm) MAL-2025-192461 | Malicious | Not scored | 11 Dec, 2025 | npm libxmljsololos |
Malicious release: Malicious code in libxmlpupupu (npm) MAL-2025-192462 | Malicious | Not scored | 11 Dec, 2025 | npm libxmlpupupu |
Malicious release: Malicious code in libxmlussr (npm) MAL-2025-192463 | Malicious | Not scored | 11 Dec, 2025 | npm libxmlussr |
Malicious release: Malicious code in tnaxmlparserctf (npm) MAL-2025-192466 | Malicious | Not scored | 11 Dec, 2025 | npm tnaxmlparserctf |
Improper Validation of Query Parameters in Auth0 Next.js SDK CVE-2025-67716, GHSA-mr6f-h57v-rpj5 | Medium | 0.3% | 10 Dec, 2025 | npm @auth0/nextjs-auth0 |
Improper Request Caching Lookup in the Auth0 Next.js SDK CVE-2025-67490, GHSA-wcgj-f865-c7j7 | Medium | 0.2% | 10 Dec, 2025 | npm @auth0/nextjs-auth0 |
Formio improperly authorized permission elevation through specially crafted request path CVE-2025-67718, GHSA-m654-769v-qjv7 | High | 0.3% | 10 Dec, 2025 | npm formio |
Malicious release: Malicious code in @cheqplease/structured-logger (npm) GHSA-x55c-jcjf-hj69, MAL-2025-192434 | Malicious | Not scored | 10 Dec, 2025 | npm @cheqplease/structured-logger |
Malicious release: Malicious code in mws-common-ui (npm) GHSA-wpw9-qh8w-2hv5, MAL-2025-192433 | Malicious | Not scored | 10 Dec, 2025 | npm mws-common-ui |
Malicious release: Malicious code in vue2-amis-custom-widget-pro (npm) GHSA-56x8-3f6p-7w9f, MAL-2025-192423 | Malicious | Not scored | 10 Dec, 2025 | npm vue2-amis-custom-widget-pro |
Malicious release: Malicious code in yunxohang3 (npm) GHSA-8h39-jmgp-jp79, MAL-2025-192429 | Malicious | Not scored | 10 Dec, 2025 | npm yunxohang3 |
Malicious release: Malicious code in yunxoahng2 (npm) GHSA-v4mq-xqfq-xcqj, MAL-2025-192428 | Malicious | Not scored | 10 Dec, 2025 | npm yunxoahng2 |
Malicious release: Malicious code in real-time-tweet-streamer (npm) GHSA-r69v-rwfw-jcv6, MAL-2025-192422, SNYK-JS-REALTIMETWEETSTREAMER-14287388 | Malicious | Not scored | 10 Dec, 2025 | npm real-time-tweet-streamer |
Malicious release: Malicious code in near-fast-auth-signer (npm) GHSA-49ww-28p9-h5ww, MAL-2025-192420 | Malicious | Not scored | 10 Dec, 2025 | npm near-fast-auth-signer |
Malicious release: Malicious code in vue2-amis-custom-widget123 (npm) MAL-2025-192421 | Malicious | Not scored | 10 Dec, 2025 | npm vue2-amis-custom-widget123 |
Malicious release: Malicious code in meteor-developer-oauth (npm) GHSA-22p4-hppx-hwrf, MAL-2025-192412 | Malicious | Not scored | 10 Dec, 2025 | npm meteor-developer-oauth |
Malicious release: Malicious code in facts-base (npm) GHSA-372w-hg58-49vx, MAL-2025-192410 | Malicious | Not scored | 10 Dec, 2025 | npm facts-base |
Malicious release: Malicious code in mongo-decimal (npm) GHSA-376f-q7pp-c9wj, MAL-2025-192414 | Malicious | Not scored | 10 Dec, 2025 | npm mongo-decimal |
Malicious release: Malicious code in ddp-common (npm) GHSA-ghw6-6h66-6c38, MAL-2025-192408 | Malicious | Not scored | 10 Dec, 2025 | npm ddp-common |
Malicious release: Malicious code in modules-runtime (npm) GHSA-gw2p-8mmc-wh8m, MAL-2025-192413 | Malicious | Not scored | 10 Dec, 2025 | npm modules-runtime |
Malicious release: Malicious code in allow-deny (npm) GHSA-hpgf-fg4w-q8p3, MAL-2025-192403 | Malicious | Not scored | 10 Dec, 2025 | npm allow-deny |
Malicious release: Malicious code in callback-hook (npm) GHSA-ppjg-6q9j-w45r, MAL-2025-192404 | Malicious | Not scored | 10 Dec, 2025 | npm callback-hook |