Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in karem5 (npm) MAL-2025-191961 | Malicious | Not scored | 03 Dec, 2025 | npm karem5 |
Malicious release: Malicious code in karemm2 (npm) MAL-2025-191964 | Malicious | Not scored | 03 Dec, 2025 | npm karemm2 |
Malicious release: Malicious code in karemm1 (npm) MAL-2025-191963 | Malicious | Not scored | 03 Dec, 2025 | npm karemm1 |
Malicious release: Malicious code in karem10 (npm) MAL-2025-191959 | Malicious | Not scored | 03 Dec, 2025 | npm karem10 |
Malicious release: Malicious code in karem7 (npm) MAL-2025-191962 | Malicious | Not scored | 03 Dec, 2025 | npm karem7 |
Malicious release: Malicious code in karem4 (npm) MAL-2025-191960 | Malicious | Not scored | 03 Dec, 2025 | npm karem4 |
Malicious release: Malicious code in karem1 (npm) MAL-2025-191958 | Malicious | Not scored | 03 Dec, 2025 | npm karem1 |
Malicious release: Malicious code in kkkaremn (npm) MAL-2025-191969 | Malicious | Not scored | 03 Dec, 2025 | npm kkkaremn |
Malicious release: Malicious code in karemz (npm) MAL-2025-191947 | Malicious | Not scored | 03 Dec, 2025 | npm karemz |
Malicious release: Malicious code in kmz1 (npm) MAL-2025-191949 | Malicious | Not scored | 03 Dec, 2025 | npm kmz1 |
Malicious release: Malicious code in kwp-router (npm) GHSA-m6rh-gg4p-9c8g, MAL-2025-191970 | Malicious | Not scored | 03 Dec, 2025 | npm kwp-router |
Malicious release: Malicious code in kkkarem (npm) MAL-2025-191948 | Malicious | Not scored | 03 Dec, 2025 | npm kkkarem |
Malicious release: Malicious code in wfui-dbd-react-ui (npm) GHSA-gxh6-cc7g-p7g8, MAL-2025-191668 | Malicious | Not scored | 02 Dec, 2025 | npm wfui-dbd-react-ui |
Malicious release: Malicious code in wfui-dsm-react-ui (npm) GHSA-j5pp-2wcm-mf3m, MAL-2025-191669 | Malicious | Not scored | 02 Dec, 2025 | npm wfui-dsm-react-ui |
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default CVE-2025-66414, GHSA-w48q-cv73-mx4w | High | 0.5% | 02 Dec, 2025 | npm @modelcontextprotocol/sdk |
Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments CVE-2025-13877, GHSA-mv7p-34fv-4874 | Medium | 0.3% | 02 Dec, 2025 | npm @nocobase/auth |
Malicious release: Malicious code in codemirror-5 (npm) GHSA-494g-rprp-qcj7, MAL-2025-191557 | Malicious | Not scored | 02 Dec, 2025 | npm codemirror-5 |
Malicious release: Malicious code in data-xabit (npm) GHSA-93wh-2c42-vrrj, MAL-2025-191558 | Malicious | Not scored | 02 Dec, 2025 | npm data-xabit |
Malicious release: Malicious code in btc-transaction-helper (npm) GHSA-hrrx-v3pg-9j4m, MAL-2025-191556 | Malicious | Not scored | 02 Dec, 2025 | npm btc-transaction-helper |
Malicious release: Malicious code in chai-status (npm) GHSA-wh9m-xqr4-wc75, MAL-2025-191546, SNYK-JS-CHAISTATUS-14152245, SNYK-JS-CHAISTATUS-14157129 | Malicious | Not scored | 02 Dec, 2025 | npm chai-status |
Malicious release: Malicious code in ui-cluster-driver-otccce (npm) GHSA-m76g-qp4m-jp32, MAL-2025-191555 | Malicious | Not scored | 02 Dec, 2025 | npm ui-cluster-driver-otccce |
Malicious release: Malicious code in internallib_v881 (npm) GHSA-7vhv-q3wg-rc77, MAL-2025-191548 | Malicious | Not scored | 02 Dec, 2025 | npm internallib_v881 |
Malicious release: Malicious code in ddos-l7 (npm) GHSA-378w-r2h3-q97m, MAL-2025-191547 | Malicious | Not scored | 02 Dec, 2025 | npm ddos-l7 |
Malicious release: Malicious code in react-animated-glow (npm) GHSA-rh79-jpg8-28qc, MAL-2025-191550 | Malicious | Not scored | 02 Dec, 2025 | npm react-animated-glow |
Malicious release: Malicious code in multer-cli (npm) GHSA-qx36-9vh9-239w, MAL-2025-191549 | Malicious | Not scored | 02 Dec, 2025 | npm multer-cli |
Malicious release: Malicious code in solana-dexfi-suite (npm) GHSA-87fh-6v83-84j3, MAL-2025-191551 | Malicious | Not scored | 02 Dec, 2025 | npm solana-dexfi-suite |
Malicious release: Malicious code in tensorfi-secure-hash (npm) GHSA-gqx8-mxhr-v69r, MAL-2025-191554 | Malicious | Not scored | 02 Dec, 2025 | npm tensorfi-secure-hash |
Malicious release: Malicious code in tailwind-scrollbar-variant (npm) GHSA-cg4x-fqxw-pwf7, MAL-2025-191553 | Malicious | Not scored | 02 Dec, 2025 | npm tailwind-scrollbar-variant |
Malicious release: Malicious code in tailwind-scrollbar-plugin (npm) GHSA-v2q6-hwjq-q4v9, MAL-2025-191552 | Malicious | Not scored | 02 Dec, 2025 | npm tailwind-scrollbar-plugin |
Malicious release: Malicious code in wfui-test-e2e (npm) GHSA-69hf-2v5h-fqx5, MAL-2025-191545 | Malicious | Not scored | 02 Dec, 2025 | npm wfui-test-e2e |
Malicious release: Malicious code in stream-xor-chain (npm) GHSA-x33f-q2pg-mgh6, MAL-2025-191543 | Malicious | Not scored | 02 Dec, 2025 | npm stream-xor-chain |
Malicious release: Malicious code in @shr3k/tdspt-helper-ng (npm) GHSA-737m-f4wr-hfph, MAL-2025-191540 | Malicious | Not scored | 02 Dec, 2025 | npm @shr3k/tdspt-helper-ng |
Malicious release: Malicious code in @shr3k/tdspt-helper (npm) GHSA-mxvw-g6jp-8hhg, MAL-2025-191539 | Malicious | Not scored | 02 Dec, 2025 | npm @shr3k/tdspt-helper |
Malicious release: Malicious code in tdspt-helper (npm) GHSA-wv8c-8vpg-rc5x, MAL-2025-191544 | Malicious | Not scored | 02 Dec, 2025 | npm tdspt-helper |
Malicious release: Malicious code in nodenetbanxsdk (npm) GHSA-549w-jx4q-46gw, MAL-2025-191542, SNYK-JS-NODENETBANXSDK-14157117 | Malicious | Not scored | 02 Dec, 2025 | npm nodenetbanxsdk |
Malicious release: Malicious code in bignumx (npm) GHSA-fqx6-v425-9qwr, MAL-2025-191541, SNYK-JS-BIGNUMX-14157118 | Malicious | Not scored | 02 Dec, 2025 | npm bignumx |
Malicious release: Malicious code in @wxi-dev/serverless-tsc-config (npm) GHSA-8vgr-2977-855f, MAL-2025-191536 | Malicious | Not scored | 02 Dec, 2025 | npm @wxi-dev/serverless-tsc-config |
Malicious release: Malicious code in cyber-fca (npm) GHSA-fwq7-wx79-2667, MAL-2025-191537 | Malicious | Not scored | 02 Dec, 2025 | npm cyber-fca |
fastify-reply-from affected by bypass of reply forwarding CVE-2025-66415, GHSA-2q7r-29rg-6m5h | Medium | 0.2% | 01 Dec, 2025 | npm @fastify/reply-from |
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes CVE-2025-66412, GHSA-v4hv-rgfq-gp49 | High | 0.4% | 01 Dec, 2025 | npm @angular/compiler |
Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host CVE-2025-66405, GHSA-hhh5-2cvx-vmfp | Medium | 0.4% | 01 Dec, 2025 | npm @portkey-ai/gateway |
MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL CVE-2025-66401, GHSA-27m7-ffhq-jqrm | Critical | 2.2% | 01 Dec, 2025 | npm mcp-watch |
mdast-util-to-hast has unsanitized class attribute CVE-2025-66400, GHSA-4fh9-h7wg-q85m | Medium | 0.3% | 01 Dec, 2025 | npm mdast-util-to-hast |
Better Auth affected by external request basePath modification DoS CVE-2025-71401, GHSA-569q-mpph-wgww | Critical | 0.5% | 01 Dec, 2025 | npm better-auth |
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls CVE-2025-14874, GHSA-rcmh-qjqh-p98v | High | 0.6% | 01 Dec, 2025 | Maven org.webjars.npm:nodemailer npm nodemailer |
Malicious release: Malicious code in angular-promql (npm) MAL-2025-191505 | Malicious | Not scored | 01 Dec, 2025 | npm angular-promql |
Malicious release: Malicious code in animation-debug-app (npm) MAL-2025-191506 | Malicious | Not scored | 01 Dec, 2025 | npm animation-debug-app |
Malicious release: Malicious code in b3dtiles-sample (npm) MAL-2025-191507 | Malicious | Not scored | 01 Dec, 2025 | npm b3dtiles-sample |
Malicious release: Malicious code in dataset-view (npm) MAL-2025-191508 | Malicious | Not scored | 01 Dec, 2025 | npm dataset-view |
Malicious release: Malicious code in debug-common (npm) MAL-2025-191509 | Malicious | Not scored | 01 Dec, 2025 | npm debug-common |