Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in babel-plugin-standalone (npm) GHSA-3q93-fg6q-g42q, MAL-2025-191491 | Malicious | Not scored | 30 Nov, 2025 | npm babel-plugin-standalone |
Tryton sao allows XSS because it does not escape completion values CVE-2025-66421, GHSA-6qj9-2g9m-29x9 | Medium | 0.2% | 30 Nov, 2025 | npm tryton-sao |
Tryton sao allows XSS via an HTML attachment CVE-2025-66420, GHSA-xhgv-99mj-8m2x | Medium | 0.2% | 30 Nov, 2025 | npm tryton-sao |
Malicious release: Malicious code in wds-icons (npm) GHSA-jhm5-cg5j-fj77, MAL-2025-191494 | Malicious | Not scored | 29 Nov, 2025 | npm wds-icons |
Malicious release: Malicious code in com.unity.sharp-zip-lib (npm) GHSA-gvf2-cfhj-mmjq, MAL-2025-191490 | Malicious | Not scored | 29 Nov, 2025 | npm com.unity.sharp-zip-lib |
Malicious release: Malicious code in liblynxtextra.so (npm) GHSA-8g38-j744-p228, MAL-2025-191489 | Malicious | Not scored | 29 Nov, 2025 | npm liblynxtextra.so |
Malicious release: Malicious code in eslint-plugin-react-hooks-published (npm) GHSA-35rg-r2fv-8hp3, MAL-2025-191488 | Malicious | Not scored | 29 Nov, 2025 | npm eslint-plugin-react-hooks-published |
Malicious release: Malicious code in chain-selectors (npm) GHSA-2p37-4g2g-f26j, MAL-2025-191487 | Malicious | Not scored | 29 Nov, 2025 | npm chain-selectors |
Malicious release: Malicious code in vitest-environment-jsdom-patched (npm) GHSA-g639-r35h-h4pw, MAL-2025-191486 | Malicious | Not scored | 29 Nov, 2025 | npm vitest-environment-jsdom-patched |
Malicious release: Malicious code in x402-legacy (npm) GHSA-4q5j-w322-jwjq, MAL-2025-191485 | Malicious | Not scored | 29 Nov, 2025 | npm x402-legacy |
Malicious release: Malicious code in browser-client-neptune (npm) GHSA-367v-g33p-g8jc, MAL-2025-191484 | Malicious | Not scored | 28 Nov, 2025 | npm browser-client-neptune |
Malicious release: Malicious code in accounts-base (npm) GHSA-64q9-hhhw-wg7q, MAL-2025-191480 | Malicious | Not scored | 27 Nov, 2025 | npm accounts-base |
Malicious release: Malicious code in wartsila-application-json (npm) GHSA-9872-7p83-qwqv, MAL-2025-191482 | Malicious | Not scored | 27 Nov, 2025 | npm wartsila-application-json |
Malicious release: Malicious code in chia-gaming-lobby-connection (npm) GHSA-qqrm-g247-g8f2, MAL-2025-191479 | Malicious | Not scored | 27 Nov, 2025 | npm chia-gaming-lobby-connection |
Malicious release: Malicious code in bitcoin-lib-js (npm) GHSA-6wg2-qx3c-5w54, MAL-2025-191478 | Malicious | Not scored | 27 Nov, 2025 | npm bitcoin-lib-js |
Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements CVE-2025-12758, GHSA-vghf-hv5q-vc2g | High | 0.6% | 27 Nov, 2025 | npm validator |
Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client CVE-2025-66035, GHSA-58c5-g7wp-6w37 | High | 0.7% | 26 Nov, 2025 | npm @angular/common |
Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions CVE-2025-71402, GHSA-wmjr-v86c-m9jj | Low | 0.3% | 26 Nov, 2025 | npm better-auth |
willitmerge has a Command Injection vulnerability CVE-2025-66219, GHSA-j9wj-m24m-7jj6 | Medium | 2.7% | 26 Nov, 2025 | npm willitmerge |
node-forge has ASN.1 Unbounded Recursion CVE-2025-66031, GHSA-554w-wpv2-vw27 | High | 0.4% | 26 Nov, 2025 | npm node-forge |
node-forge is vulnerable to ASN.1 OID Integer Truncation CVE-2025-66030, GHSA-65ch-62r8-g69g | Medium | 0.3% | 26 Nov, 2025 | npm node-forge |
OneUptime Unauthorized User Creation via API CVE-2025-65966, GHSA-m449-vh5f-574g | High | 0.3% | 26 Nov, 2025 | npm @oneuptime/common |
Malicious release: Malicious code in bitcoin-main-lib (npm) GHSA-2869-rqcg-vfpc, MAL-2025-191477 | Malicious | Not scored | 26 Nov, 2025 | npm bitcoin-main-lib |
Malicious release: Malicious code in br2s-ui-componentlibrary_r2 (npm) GHSA-p229-7wq7-fxmp, MAL-2025-191481 | Malicious | Not scored | 26 Nov, 2025 | npm br2s-ui-componentlibrary_r2 |
Malicious release: Malicious code in vite-dynachunk (npm) GHSA-f3jr-c664-4426, MAL-2025-191474, SNYK-JS-VITEDYNACHUNK-14114718 | Malicious | Not scored | 26 Nov, 2025 | npm vite-dynachunk |
Malicious release: Malicious code in chai-jsons (npm) GHSA-5qcc-669p-2584, MAL-2025-191473 | Malicious | Not scored | 26 Nov, 2025 | npm chai-jsons |
Malicious release: Malicious code in chai-auth (npm) GHSA-mp9m-mrc8-rrvj, MAL-2025-191472, SNYK-JS-CHAIAUTH-14114720 | Malicious | Not scored | 26 Nov, 2025 | npm chai-auth |
Malicious release: Malicious code in ahmed_salem_t (npm) GHSA-4hmm-c7vc-3m4v, MAL-2025-191471 | Malicious | Not scored | 26 Nov, 2025 | npm ahmed_salem_t |
Malicious release: Malicious code in @lokeswari-satyanarayanan/rn-zustand-expo-template (npm) MAL-2025-191468 | Malicious | Not scored | 26 Nov, 2025 | npm @lokeswari-satyanarayanan/rn-zustand-expo-template |
Valibot has a ReDoS vulnerability in `EMOJI_REGEX` CVE-2025-66020, GHSA-vqpr-j7v3-hqw9 | High | 0.4% | 26 Nov, 2025 | npm valibot |
OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation CVE-2025-66028, GHSA-675q-66gf-gqg8 | Medium | 0.3% | 25 Nov, 2025 | npm @oneuptime/common |
Better Auth Passkey Plugin allows passkey deletion through IDOR CVE-2025-71400, GHSA-4vcf-q4xf-f48m | High | 0.4% | 25 Nov, 2025 | npm @better-auth/passkey |
node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization CVE-2025-12816, GHSA-5gfm-wpxj-wjgq | High | 0.6% | 25 Nov, 2025 | npm node-forge |
Malicious release: Malicious code in bip40 (npm) GHSA-vh2r-52fp-rj7h, MAL-2025-191469 | Malicious | Not scored | 25 Nov, 2025 | npm bip40 |
Malicious release: Malicious code in xrpl-api (npm) GHSA-47c3-m332-vx5q, MAL-2025-191467 | Malicious | Not scored | 25 Nov, 2025 | npm xrpl-api |
Malicious release: Malicious code in rpc-validator (npm) GHSA-9w3c-c34p-h7m8, MAL-2025-191466 | Malicious | Not scored | 25 Nov, 2025 | npm rpc-validator |
Malicious release: Malicious code in mcp-polymarket (npm) GHSA-f8cg-j5h4-4v2j, MAL-2025-191465 | Malicious | Not scored | 25 Nov, 2025 | npm mcp-polymarket |
Malicious release: Malicious code in mayhem-wma (npm) GHSA-m7f2-m25c-crj6, MAL-2025-191464 | Malicious | Not scored | 25 Nov, 2025 | npm mayhem-wma |
Malicious release: Malicious code in initial-path (npm) GHSA-xqrj-354c-mg93, MAL-2025-191463, SNYK-JS-INITIALPATH-14111278 | Malicious | Not scored | 25 Nov, 2025 | npm initial-path |
Malicious release: Malicious code in react-svgs-helper (npm) GHSA-5rpr-mpxw-57vp, MAL-2025-191462 | Malicious | Not scored | 25 Nov, 2025 | npm react-svgs-helper |
Malicious release: Malicious code in baidu-src-test3 (npm) MAL-2025-191461 | Malicious | Not scored | 25 Nov, 2025 | npm baidu-src-test3 |
Malicious release: Malicious code in baidu-src-test (npm) MAL-2025-191460 | Malicious | Not scored | 25 Nov, 2025 | npm baidu-src-test |
Malicious release: Malicious code in @vleo-dev/a11y-js-service (npm) GHSA-487m-gw8w-94hc, MAL-2025-191459 | Malicious | Not scored | 25 Nov, 2025 | npm @vleo-dev/a11y-js-service |
Malicious release: Malicious code in eslint-config-kinvey-flex-service (npm) GHSA-26r9-3qfg-cx8c, MAL-2025-191395 | Malicious | Not scored | 25 Nov, 2025 | npm eslint-config-kinvey-flex-service |
Malicious release: Malicious code in ceviz (npm) GHSA-2g8r-3grq-jx99, MAL-2025-191390 | Malicious | Not scored | 25 Nov, 2025 | npm ceviz |
Malicious release: Malicious code in @voiceflow/tsconfig (npm) GHSA-2p99-x643-gvfv, MAL-2025-191379 | Malicious | Not scored | 25 Nov, 2025 | npm @voiceflow/tsconfig |
Malicious release: Malicious code in @voiceflow/nestjs-common (npm) GHSA-2qr3-584r-qj9v, MAL-2025-191357 | Malicious | Not scored | 25 Nov, 2025 | npm @voiceflow/nestjs-common |
Malicious release: Malicious code in @voiceflow/google-dfes-types (npm) GHSA-3gc8-xqj9-q2gv, MAL-2025-191351 | Malicious | Not scored | 25 Nov, 2025 | npm @voiceflow/google-dfes-types |
Malicious release: Malicious code in @voiceflow/voiceflow-types (npm) GHSA-3hw8-3r29-j4gm, MAL-2025-191386 | Malicious | Not scored | 25 Nov, 2025 | npm @voiceflow/voiceflow-types |
Malicious release: Malicious code in silgi (npm) GHSA-43x8-586r-rr56, MAL-2025-191425 | Malicious | Not scored | 25 Nov, 2025 | npm silgi |