Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @ensdomains/cypress-metamask (npm) GHSA-xc86-vfw2-q5gj, MAL-2025-190803 | Malicious | Not scored | 24 Nov, 2025 | npm @ensdomains/cypress-metamask |
Malicious release: Malicious code in @validate-pubkey/hex (npm) GHSA-4f7x-m25q-x292, MAL-2025-190634, SNYK-JS-VALIDATEPUBKEYHEX-14102887 | Malicious | Not scored | 24 Nov, 2025 | npm @validate-pubkey/hex |
Malicious release: Malicious code in parse-session (npm) GHSA-3w6m-fgww-62wh, MAL-2025-190630, SNYK-JS-PARSESESSION-14102884 | Malicious | Not scored | 24 Nov, 2025 | npm parse-session |
Malicious release: Malicious code in chai-async-chain (npm) GHSA-9c7f-644c-p3xw, MAL-2025-190627, SNYK-JS-CHAIASYNCCHAIN-14102888 | Malicious | Not scored | 24 Nov, 2025 | npm chai-async-chain |
Malicious release: Malicious code in tailwind-inquirer (npm) GHSA-rgrq-p348-q687, MAL-2025-190631 | Malicious | Not scored | 24 Nov, 2025 | npm tailwind-inquirer |
Malicious release: Malicious code in tailwind-pulse (npm) GHSA-wwch-7p98-fc3h, MAL-2025-190632 | Malicious | Not scored | 24 Nov, 2025 | npm tailwind-pulse |
Malicious release: Malicious code in hash-guard (npm) GHSA-4cv7-jcc9-9gwf, MAL-2025-190628 | Malicious | Not scored | 24 Nov, 2025 | npm hash-guard |
Malicious release: Malicious code in loliloli (npm) GHSA-36fv-222j-ppf5, MAL-2025-190629 | Malicious | Not scored | 24 Nov, 2025 | npm loliloli |
Malicious release: Malicious code in token-verify-passport (npm) GHSA-gjj2-6wcj-mv3q, MAL-2025-190633 | Malicious | Not scored | 24 Nov, 2025 | npm token-verify-passport |
Malicious release: Malicious code in vue3-transpiler (npm) MAL-2025-190626 | Malicious | Not scored | 24 Nov, 2025 | npm vue3-transpiler |
Malicious release: Malicious code in shinhan-limit-scrap (npm) GHSA-p92h-9qvq-2vq2, MAL-2025-190782 | Malicious | Not scored | 24 Nov, 2025 | npm shinhan-limit-scrap |
Malicious release: Malicious code in @quick-start-soft/quick-markdown-image (npm) GHSA-62qm-7xcr-w8mv, MAL-2025-190823 | Malicious | Not scored | 24 Nov, 2025 | npm @quick-start-soft/quick-markdown-image |
Malicious release: Malicious code in @quick-start-soft/quick-markdown-print (npm) GHSA-89j8-wr2j-w75m, MAL-2025-191306 | Malicious | Not scored | 24 Nov, 2025 | npm @quick-start-soft/quick-markdown-print |
Malicious release: Malicious code in base62-58x (npm) GHSA-35vp-3qxv-xfp5, MAL-2025-190624, SNYK-JS-BASE6258X-14102877 | Malicious | Not scored | 24 Nov, 2025 | npm base62-58x |
Malicious release: Malicious code in lion-second-package (npm) GHSA-jmrp-jrpv-w3xp, MAL-2025-190625 | Malicious | Not scored | 24 Nov, 2025 | npm lion-second-package |
Malicious release: Malicious code in cbre-flow-common (npm) MAL-2025-190623 | Malicious | Not scored | 24 Nov, 2025 | npm cbre-flow-common |
Malicious release: Malicious code in com.unity.xr.visionos (npm) GHSA-453j-55mv-5p43, MAL-2025-190622 | Malicious | Not scored | 23 Nov, 2025 | npm com.unity.xr.visionos |
Malicious release: Malicious code in hyatt-ui (npm) MAL-2025-190619 | Malicious | Not scored | 22 Nov, 2025 | npm hyatt-ui |
Malicious release: Malicious code in epicgames-ui (npm) MAL-2025-190618 | Malicious | Not scored | 22 Nov, 2025 | npm epicgames-ui |
Malicious release: Malicious code in lyft-ui (npm) MAL-2025-190620 | Malicious | Not scored | 22 Nov, 2025 | npm lyft-ui |
Malicious release: Malicious code in doordash-ui (npm) MAL-2025-190617 | Malicious | Not scored | 22 Nov, 2025 | npm doordash-ui |
Malicious release: Malicious code in snapchat-ui (npm) MAL-2025-190615 | Malicious | Not scored | 22 Nov, 2025 | npm snapchat-ui |
Malicious release: Malicious code in linkedin-ui (npm) MAL-2025-190613 | Malicious | Not scored | 22 Nov, 2025 | npm linkedin-ui |
Malicious release: Malicious code in sentry-ui (npm) MAL-2025-190614 | Malicious | Not scored | 22 Nov, 2025 | npm sentry-ui |
Malicious release: Malicious code in hilton-ui (npm) MAL-2025-190611 | Malicious | Not scored | 22 Nov, 2025 | npm hilton-ui |
Malicious release: Malicious code in instacart-ui (npm) MAL-2025-190612 | Malicious | Not scored | 22 Nov, 2025 | npm instacart-ui |
Malicious release: Malicious code in uber-ui (npm) MAL-2025-190616 | Malicious | Not scored | 22 Nov, 2025 | npm uber-ui |
Malicious release: Malicious code in @eagleview/ev-mapviewer-interactions (npm) MAL-2025-190621 | Malicious | Not scored | 22 Nov, 2025 | npm @eagleview/ev-mapviewer-interactions |
Malicious release: Malicious code in o2-modal (npm) MAL-2025-190608 | Malicious | Not scored | 22 Nov, 2025 | npm o2-modal |
Malicious release: Malicious code in airbnb-react-router-legacy-v3 (npm) MAL-2025-190605 | Malicious | Not scored | 22 Nov, 2025 | npm airbnb-react-router-legacy-v3 |
Malicious release: Malicious code in airbnb-react-router-legacy (npm) MAL-2025-190604 | Malicious | Not scored | 22 Nov, 2025 | npm airbnb-react-router-legacy |
Malicious release: Malicious code in wishlist_dropdown (npm) MAL-2025-190610 | Malicious | Not scored | 22 Nov, 2025 | npm wishlist_dropdown |
Malicious release: Malicious code in airbnb-blueimp-file-upload (npm) MAL-2025-190601 | Malicious | Not scored | 22 Nov, 2025 | npm airbnb-blueimp-file-upload |
Malicious release: Malicious code in airbnb-vermeer-node (npm) MAL-2025-190607 | Malicious | Not scored | 22 Nov, 2025 | npm airbnb-vermeer-node |
Malicious release: Malicious code in o2-tooltip (npm) MAL-2025-190609 | Malicious | Not scored | 22 Nov, 2025 | npm o2-tooltip |
Malicious release: Malicious code in airbnb-phoenix (npm) MAL-2025-190603 | Malicious | Not scored | 22 Nov, 2025 | npm airbnb-phoenix |
Malicious release: Malicious code in airbnb-luxury-messaging (npm) MAL-2025-190602 | Malicious | Not scored | 22 Nov, 2025 | npm airbnb-luxury-messaging |
Malicious release: Malicious code in airbnb-story-constants (npm) MAL-2025-190606 | Malicious | Not scored | 22 Nov, 2025 | npm airbnb-story-constants |
Malicious release: Malicious code in optly (npm) MAL-2025-190600 | Malicious | Not scored | 21 Nov, 2025 | npm optly |
Malicious release: Malicious code in @vreden-team/baileys (npm) GHSA-rpmx-cvh3-2xqf, MAL-2025-190599, SNYK-JS-VREDENTEAMBAILEYS-14084077 | Malicious | Not scored | 21 Nov, 2025 | npm @vreden-team/baileys |
Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage CVE-2025-63700, GHSA-3mm3-wfpv-q85g | Medium | Not scored | 20 Nov, 2025 | npm @clerk/clerk-js |
authkit-nextjs may let session cookies be cached in CDNs CVE-2025-64762, GHSA-p8pf-44ff-93gf | High | 0.4% | 20 Nov, 2025 | npm @workos-inc/authkit-nextjs |
@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes CVE-2025-64755, GHSA-7mv8-j34q-vp7q | High | 0.6% | 20 Nov, 2025 | npm @anthropic-ai/claude-code |
Malicious release: Malicious code in @ra-ide/udt-frontend (npm) MAL-2025-190598 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ide/udt-frontend |
Malicious release: Malicious code in @ra-ide/extension-ui (npm) MAL-2025-190591 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ide/extension-ui |
Malicious release: Malicious code in @ra-ide/system (npm) MAL-2025-190596 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ide/system |
Malicious release: Malicious code in @ra-ide/logix-frontend (npm) MAL-2025-190593 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ide/logix-frontend |
Malicious release: Malicious code in @ra-ide/source-code-frontend (npm) MAL-2025-190594 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ide/source-code-frontend |
Malicious release: Malicious code in @ra-ide/tag-editor-frontend (npm) MAL-2025-190597 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ide/tag-editor-frontend |
Malicious release: Malicious code in @ra-ide/code-editor-frontend (npm) MAL-2025-190590 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ide/code-editor-frontend |