Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in fdir4 (npm) MAL-2025-192355 | Malicious | Not scored | 06 Dec, 2025 | npm fdir4 |
Malicious release: Malicious code in sharp32 (npm) MAL-2025-192358 | Malicious | Not scored | 06 Dec, 2025 | npm sharp32 |
Malicious release: Malicious code in fdir2 (npm) MAL-2025-192354 | Malicious | Not scored | 06 Dec, 2025 | npm fdir2 |
Malicious release: Malicious code in ssf-desktop-api-openfin (npm) MAL-2025-192360 | Malicious | Not scored | 06 Dec, 2025 | npm ssf-desktop-api-openfin |
Malicious release: Malicious code in express-my-error-handler (npm) GHSA-vf2p-5pcm-655m, MAL-2025-192350 | Malicious | Not scored | 06 Dec, 2025 | npm express-my-error-handler |
Malicious release: Malicious code in native-component-list (npm) GHSA-857j-xfpm-cxrp, MAL-2025-192345 | Malicious | Not scored | 05 Dec, 2025 | npm native-component-list |
Malicious release: Malicious code in non-modular-buildable (npm) GHSA-wj95-4qrc-6r3h, MAL-2025-192346 | Malicious | Not scored | 05 Dec, 2025 | npm non-modular-buildable |
Malicious release: Malicious code in ambient-map (npm) MAL-2025-192324 | Malicious | Not scored | 05 Dec, 2025 | npm ambient-map |
Malicious release: Malicious code in elf-stats-aurora-mailbag-938 (npm) MAL-2025-192325 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-aurora-mailbag-938 |
Malicious release: Malicious code in elf-stats-candlelit-hollyberry-248 (npm) MAL-2025-192326 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-candlelit-hollyberry-248 |
Malicious release: Malicious code in elf-stats-candystriped-garland-735 (npm) MAL-2025-192327 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-candystriped-garland-735 |
Malicious release: Malicious code in elf-stats-cosy-sled-550 (npm) MAL-2025-192328 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-cosy-sled-550 |
Malicious release: Malicious code in elf-stats-cosy-toy-308 (npm) MAL-2025-192329 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-cosy-toy-308 |
Malicious release: Malicious code in elf-stats-cranberry-pinecone-878 (npm) MAL-2025-192330 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-cranberry-pinecone-878 |
Malicious release: Malicious code in elf-stats-evergreen-satchel-264 (npm) MAL-2025-192331 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-evergreen-satchel-264 |
Malicious release: Malicious code in elf-stats-flickering-lantern-502 (npm) MAL-2025-192332 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-flickering-lantern-502 |
Malicious release: Malicious code in elf-stats-lanternlit-saddlebag-279 (npm) MAL-2025-192333 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-lanternlit-saddlebag-279 |
Malicious release: Malicious code in elf-stats-midnight-rocket-813 (npm) MAL-2025-192334 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-midnight-rocket-813 |
Malicious release: Malicious code in elf-stats-mulled-snowglobe-636 (npm) MAL-2025-192335 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-mulled-snowglobe-636 |
Malicious release: Malicious code in elf-stats-northbound-drum-422 (npm) MAL-2025-192336 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-northbound-drum-422 |
Malicious release: Malicious code in elf-stats-shimmering-garland-476 (npm) MAL-2025-192337 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-shimmering-garland-476 |
Malicious release: Malicious code in elf-stats-shimmering-toolkit-483 (npm) MAL-2025-192338 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-shimmering-toolkit-483 |
Malicious release: Malicious code in elf-stats-snowdusted-chimney-406 (npm) MAL-2025-192339 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-snowdusted-chimney-406 |
Malicious release: Malicious code in elf-stats-sparkly-icicle-845 (npm) MAL-2025-192340 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-sparkly-icicle-845 |
Malicious release: Malicious code in elf-stats-sparkly-workbench-689 (npm) MAL-2025-192341 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-sparkly-workbench-689 |
Malicious release: Malicious code in elf-stats-tinsel-muffin-395 (npm) MAL-2025-192342 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-tinsel-muffin-395 |
Malicious release: Malicious code in elf-stats-velvet-train-152 (npm) MAL-2025-192343 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-velvet-train-152 |
Malicious release: Malicious code in elf-stats-whimsical-pantry-974 (npm) MAL-2025-192344 | Malicious | Not scored | 05 Dec, 2025 | npm elf-stats-whimsical-pantry-974 |
Malicious release: Malicious code in sd-123456 (npm) MAL-2025-192347 | Malicious | Not scored | 05 Dec, 2025 | npm sd-123456 |
Malicious release: Malicious code in json-map-source (npm) GHSA-qfx2-px7q-fq7c, MAL-2025-192321, SNYK-JS-JSONMAPSOURCE-14188259 | Malicious | Not scored | 05 Dec, 2025 | npm json-map-source |
Malicious release: Malicious code in chai-as-deployed (npm) GHSA-3c8c-2jpp-67vq, MAL-2025-192318, SNYK-JS-CHAIASDEPLOYED-14152235 | Malicious | Not scored | 05 Dec, 2025 | npm chai-as-deployed |
Malicious release: Malicious code in chai-promised-chain (npm) GHSA-26mv-pxh2-2mc8, MAL-2025-192319, SNYK-JS-CHAIPROMISEDCHAIN-14188260 | Malicious | Not scored | 05 Dec, 2025 | npm chai-promised-chain |
Malicious release: Malicious code in dotnetenv (npm) GHSA-vphr-fmcc-hxf9, MAL-2025-192320, SNYK-JS-DOTNETENV-14188258 | Malicious | Not scored | 05 Dec, 2025 | npm dotnetenv |
Malicious release: Malicious code in tailwindcss-setfont (npm) GHSA-5hx3-5h6c-3xv9, MAL-2025-192317 | Malicious | Not scored | 05 Dec, 2025 | npm tailwindcss-setfont |
Malicious release: Malicious code in tailwindcss-animation-helper (npm) GHSA-j75p-9523-pwqj, MAL-2025-192316 | Malicious | Not scored | 05 Dec, 2025 | npm tailwindcss-animation-helper |
Malicious release: Malicious code in seeds-random (npm) GHSA-w2qv-99v5-h3f5, MAL-2025-192315, SNYK-JS-SEEDSRANDOM-14152299 | Malicious | Not scored | 05 Dec, 2025 | npm seeds-random |
Malicious release: Malicious code in react-svg-fill (npm) GHSA-hj6v-2wq4-jjf5, MAL-2025-192313 | Malicious | Not scored | 05 Dec, 2025 | npm react-svg-fill |
Malicious release: Malicious code in react-svg-bundler (npm) GHSA-mg29-c6qj-j4qc, MAL-2025-192312 | Malicious | Not scored | 05 Dec, 2025 | npm react-svg-bundler |
Malicious release: Malicious code in react-svg-supporter (npm) GHSA-p835-r6qr-5vww, MAL-2025-192314 | Malicious | Not scored | 05 Dec, 2025 | npm react-svg-supporter |
Malicious release: Malicious code in react-icon-updater (npm) GHSA-c3mg-cwv6-hf7f, MAL-2025-192311 | Malicious | Not scored | 05 Dec, 2025 | npm react-icon-updater |
Malicious release: Malicious code in jsonify-settings (npm) GHSA-69m9-9vpv-rw48, MAL-2025-192307 | Malicious | Not scored | 05 Dec, 2025 | npm jsonify-settings |
Malicious release: Malicious code in node-tailwind (npm) GHSA-75mj-jqg4-927f, MAL-2025-192310 | Malicious | Not scored | 05 Dec, 2025 | npm node-tailwind |
Malicious release: Malicious code in module-listener (npm) GHSA-8r5p-ph77-4q47, MAL-2025-192308 | Malicious | Not scored | 05 Dec, 2025 | npm module-listener |
Malicious release: Malicious code in node-dpapi1 (npm) GHSA-94c7-pr5j-9xpx, MAL-2025-192309 | Malicious | Not scored | 05 Dec, 2025 | npm node-dpapi1 |
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF' CVE-2025-65959, GHSA-8wvc-869r-xfqf | High | 0.3% | 04 Dec, 2025 | npm open-webui |
Malicious release: Malicious code in elf-stats-northbound-sparkler-410 (npm) MAL-2025-192304 | Malicious | Not scored | 04 Dec, 2025 | npm elf-stats-northbound-sparkler-410 |
Malicious release: Malicious code in elf-stats-snowdusted-cookiejar-250 (npm) MAL-2025-192370 | Malicious | Not scored | 04 Dec, 2025 | npm elf-stats-snowdusted-cookiejar-250 |
Malicious release: Malicious code in elf-stats-caroling-wishlist-626 (npm) MAL-2025-192369 | Malicious | Not scored | 04 Dec, 2025 | npm elf-stats-caroling-wishlist-626 |
Anthropic Sandbox Runtime Incorrectly Implemented Network Sandboxing CVE-2025-66479, GHSA-9gqj-5w7c-vx47 | Low | 0.2% | 04 Dec, 2025 | npm @anthropic-ai/sandbox-runtime |
auth0/node-jws Improperly Verifies HMAC Signature CVE-2025-65945, GHSA-869p-cjfg-cm3x | High | 0.2% | 04 Dec, 2025 | npm jws |