Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in ecmascript-runtime-client (npm) GHSA-rp93-xhfx-74w2, MAL-2025-192409 | Malicious | Not scored | 10 Dec, 2025 | npm ecmascript-runtime-client |
Malicious release: Malicious code in pymongo (npm) GHSA-4gv4-3h86-8cpc, MAL-2025-192416 | Malicious | Not scored | 10 Dec, 2025 | npm pymongo |
Malicious release: Malicious code in fastavro (npm) GHSA-85hv-887w-rf37, MAL-2025-192411 | Malicious | Not scored | 10 Dec, 2025 | npm fastavro |
Malicious release: Malicious code in sfdc-abstract-legend (npm) GHSA-fmjv-78v6-3546, MAL-2025-192418 | Malicious | Not scored | 10 Dec, 2025 | npm sfdc-abstract-legend |
Malicious release: Malicious code in datadog-checks-dependency-provider (npm) GHSA-h53r-mc84-8rrv, MAL-2025-192406 | Malicious | Not scored | 10 Dec, 2025 | npm datadog-checks-dependency-provider |
Malicious release: Malicious code in wasm-bindgen (npm) GHSA-hjw6-26cg-2jvr, MAL-2025-192419 | Malicious | Not scored | 10 Dec, 2025 | npm wasm-bindgen |
Malicious release: Malicious code in datadog-checks-downloader (npm) GHSA-q8v3-9jxv-8cfv, MAL-2025-192407 | Malicious | Not scored | 10 Dec, 2025 | npm datadog-checks-downloader |
Malicious release: Malicious code in confluent-kafka (npm) GHSA-rvvf-gwxx-5hw5, MAL-2025-192405 | Malicious | Not scored | 10 Dec, 2025 | npm confluent-kafka |
Malicious release: Malicious code in rum-events-format (npm) GHSA-wxhj-h5c7-c92j, MAL-2025-192417, SNYK-JS-RUMEVENTSFORMAT-14287377 | Malicious | Not scored | 10 Dec, 2025 | npm rum-events-format |
Malicious release: Malicious code in portal-lim (npm) GHSA-2c7g-wjwx-45cr, MAL-2025-192415 | Malicious | Not scored | 10 Dec, 2025 | npm portal-lim |
Malicious release: Malicious code in database-mongoose-kit (npm) GHSA-3c76-cvvv-7wf5, MAL-2025-192398, SNYK-JS-DATABASEMONGOOSEKIT-14287384 | Malicious | Not scored | 10 Dec, 2025 | npm database-mongoose-kit |
Malicious release: Malicious code in @onlytoodles/crypto-jsa (npm) GHSA-8454-2xp4-m86m, MAL-2025-192397 | Malicious | Not scored | 10 Dec, 2025 | npm @onlytoodles/crypto-jsa |
Malicious release: Malicious code in wartsila-text-csv (npm) GHSA-vvf9-w333-7h9q, MAL-2025-192402, SNYK-JS-WARTSILATEXTCSV-14287379 | Malicious | Not scored | 10 Dec, 2025 | npm wartsila-text-csv |
Malicious release: Malicious code in serval-integrations-common-frontend (npm) GHSA-3j9j-c9rg-f95f, MAL-2025-192401, SNYK-JS-SERVALINTEGRATIONSCOMMONFRONTEND-14287374 | Malicious | Not scored | 10 Dec, 2025 | npm serval-integrations-common-frontend |
Malicious release: Malicious code in node-calculator-0d96 (npm) GHSA-mh7x-j32p-xwvh, MAL-2025-192400, SNYK-JS-NODECALCULATOR0D96-14287386 | Malicious | Not scored | 10 Dec, 2025 | npm node-calculator-0d96 |
Malicious release: Malicious code in malicius-pdf (npm) GHSA-w3m5-47q7-h8m4, MAL-2025-192399 | Malicious | Not scored | 10 Dec, 2025 | npm malicius-pdf |
Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability CVE-2025-65513, GHSA-8fxj-2g9q-8fjw | High | 0.4% | 09 Dec, 2025 | npm mcp-fetch-server |
Malicious release: Malicious code in libxmlrussia (npm) MAL-2025-192395 | Malicious | Not scored | 09 Dec, 2025 | npm libxmlrussia |
Malicious release: Malicious code in libxmlussr2 (npm) MAL-2025-192394 | Malicious | Not scored | 09 Dec, 2025 | npm libxmlussr2 |
Malicious release: Malicious code in libxmlussr1 (npm) MAL-2025-192427 | Malicious | Not scored | 09 Dec, 2025 | npm libxmlussr1 |
Malicious release: Malicious code in libxmljsololo2 (npm) MAL-2025-192426 | Malicious | Not scored | 09 Dec, 2025 | npm libxmljsololo2 |
Elysia affected by arbitrary code injection through cookie config CVE-2025-66457, GHSA-8vch-m3f4-q8jf | High | 0.8% | 09 Dec, 2025 | npm elysia |
Elysia vulnerable to prototype pollution with multiple standalone schema validation CVE-2025-66456, GHSA-hxj9-33pp-j2cc | Critical | 0.6% | 09 Dec, 2025 | npm elysia |
@tiptap/extension-link vulnerable to Cross-site Scripting (XSS) CVE-2025-14284, GHSA-vhrc-hgrq-x75r | Low | 0.4% | 09 Dec, 2025 | npm @tiptap/extension-link |
Malicious release: Malicious code in libxmljs2woter (npm) GHSA-h63c-r25g-p7rw, MAL-2025-192390 | Malicious | Not scored | 09 Dec, 2025 | npm libxmljs2woter |
Malicious release: Malicious code in libxmljs2qwerty (npm) MAL-2025-192389 | Malicious | Not scored | 09 Dec, 2025 | npm libxmljs2qwerty |
Malicious release: Malicious code in libxmlfinal2 (npm) MAL-2025-192425 | Malicious | Not scored | 09 Dec, 2025 | npm libxmlfinal2 |
Malicious release: Malicious code in libxmljs2varaboba (npm) MAL-2025-192388 | Malicious | Not scored | 09 Dec, 2025 | npm libxmljs2varaboba |
Malicious release: Malicious code in baidu-oscp (npm) MAL-2025-192424 | Malicious | Not scored | 09 Dec, 2025 | npm baidu-oscp |
Malicious release: Malicious code in jsonify-errors (npm) GHSA-4hp4-98m6-767r, MAL-2025-192384, SNYK-JS-JSONIFYERRORS-14235579 | Malicious | Not scored | 09 Dec, 2025 | npm jsonify-errors |
Malicious release: Malicious code in chai-uuids (npm) GHSA-9gvh-rg3c-5gr6, MAL-2025-192383, SNYK-JS-CHAIUUIDS-14235578 | Malicious | Not scored | 09 Dec, 2025 | npm chai-uuids |
Malicious release: Malicious code in configurator-framework (npm) GHSA-wq4m-xvmv-ch8w, MAL-2025-192381 | Malicious | Not scored | 09 Dec, 2025 | npm configurator-framework |
@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server CVE-2025-67489, GHSA-j76j-5p5g-9wfr | Critical | 0.8% | 08 Dec, 2025 | npm @vitejs/plugin-rsc |
n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook CVE-2025-65964, GHSA-wpqc-h9wp-chmq | Critical | 0.7% | 08 Dec, 2025 | npm n8n |
Altcha Proof-of-Work obfuscation mode cryptanalytic break CVE-2025-65849, GHSA-mpmc-qchh-r9q8 | Critical | 0.2% | 08 Dec, 2025 | npm altcha |
Malicious release: Malicious code in shop-api-sdk (npm) MAL-2025-192378 | Malicious | Not scored | 08 Dec, 2025 | npm shop-api-sdk |
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 CVE-2025-66202, GHSA-whqg-ppgf-wp8c | Medium | 0.3% | 08 Dec, 2025 | npm astro |
Malicious release: Malicious code in gs-uitk-lodash (npm) MAL-2025-192377 | Malicious | Not scored | 08 Dec, 2025 | npm gs-uitk-lodash |
Malicious release: Malicious code in @notrainers/nobtrainer-sdk (npm) GHSA-49w9-gcx6-2wfh, MAL-2025-192373 | Malicious | Not scored | 08 Dec, 2025 | npm @notrainers/nobtrainer-sdk |
Malicious release: Malicious code in solana-dexco-basic (npm) GHSA-3377-9226-4w97, MAL-2025-192374 | Malicious | Not scored | 08 Dec, 2025 | npm solana-dexco-basic |
Malicious release: Malicious code in tensor-fi-utils-core (npm) GHSA-hjxg-jf6x-5vqp, MAL-2025-192375, SNYK-JS-TENSORFIUTILSCORE-14221996 | Malicious | Not scored | 08 Dec, 2025 | npm tensor-fi-utils-core |
Malicious release: Malicious code in paysera-checkout-modal (npm) MAL-2025-192368 | Malicious | Not scored | 07 Dec, 2025 | npm paysera-checkout-modal |
Malicious release: Malicious code in tna_xmlparser (npm) MAL-2025-192371 | Malicious | Not scored | 07 Dec, 2025 | npm tna_xmlparser |
Malicious release: Malicious code in react-hook-form-5 (npm) MAL-2025-192366 | Malicious | Not scored | 07 Dec, 2025 | npm react-hook-form-5 |
Malicious release: Malicious code in datadog-checks-base (npm) GHSA-6gq4-p64c-9qqf, MAL-2025-192361 | Malicious | Not scored | 06 Dec, 2025 | npm datadog-checks-base |
Malicious release: Malicious code in fdir5 (npm) MAL-2025-192356 | Malicious | Not scored | 06 Dec, 2025 | npm fdir5 |
Malicious release: Malicious code in ssf-desktop-api-browser (npm) MAL-2025-192359 | Malicious | Not scored | 06 Dec, 2025 | npm ssf-desktop-api-browser |
Malicious release: Malicious code in enclose-eslint (npm) MAL-2025-192352 | Malicious | Not scored | 06 Dec, 2025 | npm enclose-eslint |
Malicious release: Malicious code in fdir1 (npm) MAL-2025-192353 | Malicious | Not scored | 06 Dec, 2025 | npm fdir1 |
Malicious release: Malicious code in ido-sdk-web (npm) MAL-2025-192357 | Malicious | Not scored | 06 Dec, 2025 | npm ido-sdk-web |