Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in sing-fest-es-logger (npm) MAL-2025-191587 | Malicious | Not scored | 01 Dec, 2025 | npm sing-fest-es-logger |
Malicious release: Malicious code in session-validate (npm) MAL-2025-191586, SNYK-JS-SESSIONVALIDATE-14152304 | Malicious | Not scored | 01 Dec, 2025 | npm session-validate |
Malicious release: Malicious code in revit-to-ifc-scheduler (npm) MAL-2025-191585 | Malicious | Not scored | 01 Dec, 2025 | npm revit-to-ifc-scheduler |
Malicious release: Malicious code in redirect-clrm2u (npm) MAL-2025-191584 | Malicious | Not scored | 01 Dec, 2025 | npm redirect-clrm2u |
Malicious release: Malicious code in redirect-5k9q5v (npm) MAL-2025-191583 | Malicious | Not scored | 01 Dec, 2025 | npm redirect-5k9q5v |
Malicious release: Malicious code in react-mandes (npm) MAL-2025-191582, SNYK-JS-REACTMANDES-14152287 | Malicious | Not scored | 01 Dec, 2025 | npm react-mandes |
Malicious release: Malicious code in react-adparser (npm) MAL-2025-191581, SNYK-JS-REACTADPARSER-14152283 | Malicious | Not scored | 01 Dec, 2025 | npm react-adparser |
Malicious release: Malicious code in pixel-bloom (npm) MAL-2025-191580, SNYK-JS-PIXELBLOOM-14152280 | Malicious | Not scored | 01 Dec, 2025 | npm pixel-bloom |
Malicious release: Malicious code in lbank-connector-nodejs (npm) MAL-2025-191579 | Malicious | Not scored | 01 Dec, 2025 | npm lbank-connector-nodejs |
Malicious release: Malicious code in lbank-connector (npm) MAL-2025-191578 | Malicious | Not scored | 01 Dec, 2025 | npm lbank-connector |
Malicious release: Malicious code in kyjnzu (npm) MAL-2025-191577, SNYK-JS-KYJNZU-14152274 | Malicious | Not scored | 01 Dec, 2025 | npm kyjnzu |
Malicious release: Malicious code in jqxcore (npm) MAL-2025-191576 | Malicious | Not scored | 01 Dec, 2025 | npm jqxcore |
Malicious release: Malicious code in ing-ideal-acquiring-shared (npm) MAL-2025-191575 | Malicious | Not scored | 01 Dec, 2025 | npm ing-ideal-acquiring-shared |
Malicious release: Malicious code in eslint-lodash (npm) MAL-2025-191574 | Malicious | Not scored | 01 Dec, 2025 | npm eslint-lodash |
Malicious release: Malicious code in data-noxcqn (npm) MAL-2025-191573 | Malicious | Not scored | 01 Dec, 2025 | npm data-noxcqn |
Malicious release: Malicious code in cwanner (npm) MAL-2025-191572, SNYK-JS-CWANNER-14152252 | Malicious | Not scored | 01 Dec, 2025 | npm cwanner |
Malicious release: Malicious code in ctf2libxmljs2 (npm) MAL-2025-191571 | Malicious | Not scored | 01 Dec, 2025 | npm ctf2libxmljs2 |
Malicious release: Malicious code in core-ruw7ck (npm) MAL-2025-191570 | Malicious | Not scored | 01 Dec, 2025 | npm core-ruw7ck |
Malicious release: Malicious code in cookie-validate (npm) MAL-2025-191569, SNYK-JS-COOKIEVALIDATE-14152250 | Malicious | Not scored | 01 Dec, 2025 | npm cookie-validate |
Malicious release: Malicious code in client-6wr4qk (npm) MAL-2025-191568 | Malicious | Not scored | 01 Dec, 2025 | npm client-6wr4qk |
Malicious release: Malicious code in chai-sync (npm) MAL-2025-191567, SNYK-JS-CHAISYNC-14152246 | Malicious | Not scored | 01 Dec, 2025 | npm chai-sync |
Malicious release: Malicious code in chai-promise-chain (npm) MAL-2025-191566, SNYK-JS-CHAIPROMISECHAIN-14152242 | Malicious | Not scored | 01 Dec, 2025 | npm chai-promise-chain |
Malicious release: Malicious code in auth-1s7epg (npm) MAL-2025-191565 | Malicious | Not scored | 01 Dec, 2025 | npm auth-1s7epg |
Malicious release: Malicious code in aps-simple-viewer-nodejs (npm) MAL-2025-191564 | Malicious | Not scored | 01 Dec, 2025 | npm aps-simple-viewer-nodejs |
Malicious release: Malicious code in @ukg-oneapp/common-lib (npm) MAL-2025-191563 | Malicious | Not scored | 01 Dec, 2025 | npm @ukg-oneapp/common-lib |
Malicious release: Malicious code in @gr-exports/head (npm) MAL-2025-191562 | Malicious | Not scored | 01 Dec, 2025 | npm @gr-exports/head |
Malicious release: Malicious code in @gr-exports/body (npm) MAL-2025-191561 | Malicious | Not scored | 01 Dec, 2025 | npm @gr-exports/body |
Malicious release: Malicious code in @gr-exports/async (npm) MAL-2025-191560 | Malicious | Not scored | 01 Dec, 2025 | npm @gr-exports/async |
Malicious release: Malicious code in @gr-common/async (npm) MAL-2025-191559 | Malicious | Not scored | 01 Dec, 2025 | npm @gr-common/async |
Malicious release: Malicious code in 7715-permissions-shared (npm) GHSA-cr3j-vwfg-rcv8, MAL-2025-191493 | Malicious | Not scored | 30 Nov, 2025 | npm 7715-permissions-shared |
Malicious release: Malicious code in umap-wasm (npm) GHSA-p2rm-9qxp-658x, MAL-2025-191492 | Malicious | Not scored | 30 Nov, 2025 | npm umap-wasm |
Malicious release: Malicious code in babel-plugin-standalone (npm) GHSA-3q93-fg6q-g42q, MAL-2025-191491 | Malicious | Not scored | 30 Nov, 2025 | npm babel-plugin-standalone |
Tryton sao allows XSS because it does not escape completion values CVE-2025-66421, GHSA-6qj9-2g9m-29x9 | Medium | 0.2% | 30 Nov, 2025 | npm tryton-sao |
Tryton sao allows XSS via an HTML attachment CVE-2025-66420, GHSA-xhgv-99mj-8m2x | Medium | 0.2% | 30 Nov, 2025 | npm tryton-sao |
Malicious release: Malicious code in wds-icons (npm) GHSA-jhm5-cg5j-fj77, MAL-2025-191494 | Malicious | Not scored | 29 Nov, 2025 | npm wds-icons |
Malicious release: Malicious code in com.unity.sharp-zip-lib (npm) GHSA-gvf2-cfhj-mmjq, MAL-2025-191490 | Malicious | Not scored | 29 Nov, 2025 | npm com.unity.sharp-zip-lib |
Malicious release: Malicious code in liblynxtextra.so (npm) GHSA-8g38-j744-p228, MAL-2025-191489 | Malicious | Not scored | 29 Nov, 2025 | npm liblynxtextra.so |
Malicious release: Malicious code in eslint-plugin-react-hooks-published (npm) GHSA-35rg-r2fv-8hp3, MAL-2025-191488 | Malicious | Not scored | 29 Nov, 2025 | npm eslint-plugin-react-hooks-published |
Malicious release: Malicious code in chain-selectors (npm) GHSA-2p37-4g2g-f26j, MAL-2025-191487 | Malicious | Not scored | 29 Nov, 2025 | npm chain-selectors |
Malicious release: Malicious code in vitest-environment-jsdom-patched (npm) GHSA-g639-r35h-h4pw, MAL-2025-191486 | Malicious | Not scored | 29 Nov, 2025 | npm vitest-environment-jsdom-patched |
Malicious release: Malicious code in x402-legacy (npm) GHSA-4q5j-w322-jwjq, MAL-2025-191485 | Malicious | Not scored | 29 Nov, 2025 | npm x402-legacy |
Malicious release: Malicious code in browser-client-neptune (npm) GHSA-367v-g33p-g8jc, MAL-2025-191484 | Malicious | Not scored | 28 Nov, 2025 | npm browser-client-neptune |
Malicious release: Malicious code in accounts-base (npm) GHSA-64q9-hhhw-wg7q, MAL-2025-191480 | Malicious | Not scored | 27 Nov, 2025 | npm accounts-base |
Malicious release: Malicious code in wartsila-application-json (npm) GHSA-9872-7p83-qwqv, MAL-2025-191482 | Malicious | Not scored | 27 Nov, 2025 | npm wartsila-application-json |
Malicious release: Malicious code in chia-gaming-lobby-connection (npm) GHSA-qqrm-g247-g8f2, MAL-2025-191479 | Malicious | Not scored | 27 Nov, 2025 | npm chia-gaming-lobby-connection |
Malicious release: Malicious code in bitcoin-lib-js (npm) GHSA-6wg2-qx3c-5w54, MAL-2025-191478 | Malicious | Not scored | 27 Nov, 2025 | npm bitcoin-lib-js |
Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements CVE-2025-12758, GHSA-vghf-hv5q-vc2g | High | 0.6% | 27 Nov, 2025 | npm validator |
Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client CVE-2025-66035, GHSA-58c5-g7wp-6w37 | High | 0.7% | 26 Nov, 2025 | npm @angular/common |
Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions CVE-2025-71402, GHSA-wmjr-v86c-m9jj | Low | 0.3% | 26 Nov, 2025 | npm better-auth |
willitmerge has a Command Injection vulnerability CVE-2025-66219, GHSA-j9wj-m24m-7jj6 | Medium | 2.7% | 26 Nov, 2025 | npm willitmerge |