Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in afhmxiewpsf (npm) GHSA-59f6-ch49-395j, MAL-2026-16158 | Malicious | Not scored | 14 Sep, 2026 | npm afhmxiewpsf |
Malicious release: Malicious code in ultra-ws (npm) GHSA-rwhp-v7w5-c6cc, MAL-2026-16155 | Malicious | Not scored | 14 Sep, 2026 | npm ultra-ws |
Malicious release: Malicious code in noblox-asset.js (npm) MAL-2026-16148 | Malicious | Not scored | 14 Sep, 2026 | npm noblox-asset.js |
Malicious release: Malicious code in postgreesqlhelper (npm) MAL-2026-16150 | Malicious | Not scored | 14 Sep, 2026 | npm postgreesqlhelper |
Malicious release: Malicious code in sql-limit-enforcer (npm) MAL-2026-16151 | Malicious | Not scored | 14 Sep, 2026 | npm sql-limit-enforcer |
Malicious release: Malicious code in n8n-nodes-sysdiag (npm) MAL-2026-16147 | Malicious | Not scored | 14 Sep, 2026 | npm n8n-nodes-sysdiag |
Malicious release: Malicious code in os-info-meeb322k (npm) MAL-2026-16149 | Malicious | Not scored | 14 Sep, 2026 | npm os-info-meeb322k |
Malicious release: Malicious code in strapi-plugin-os-info-meeb322k (npm) MAL-2026-16152 | Malicious | Not scored | 14 Sep, 2026 | npm strapi-plugin-os-info-meeb322k |
Malicious release: Malicious code in web-main (npm) MAL-2026-16153 | Malicious | Not scored | 14 Sep, 2026 | npm web-main |
Malicious release: Malicious code in @aiwfm/communitywfm.scripts.api (npm) MAL-2026-16146 | Malicious | Not scored | 14 Sep, 2026 | npm @aiwfm/communitywfm.scripts.api |
Malicious release: Malicious code in concierge-sdk (npm) MAL-2026-16145 | Malicious | Not scored | 14 Sep, 2026 | npm concierge-sdk |
Malicious release: Malicious code in app-rrhh (npm) MAL-2026-16144 | Malicious | Not scored | 14 Sep, 2026 | npm app-rrhh |
Malicious release: Malicious code in meraz-project-tracker (npm) GHSA-54v8-j59m-366h, MAL-2026-16161 | Malicious | Not scored | 14 Sep, 2026 | npm meraz-project-tracker |
Malicious release: Malicious code in lpulogin (npm) GHSA-5823-3hg3-27v8, MAL-2026-16160 | Malicious | Not scored | 14 Sep, 2026 | npm lpulogin |
Malicious release: Malicious code in @merazmz/project-tracker (npm) GHSA-x98w-cqq8-v3q2, MAL-2026-16157 | Malicious | Not scored | 14 Sep, 2026 | npm @merazmz/project-tracker |
Malicious release: Malicious code in dilxztech (npm) GHSA-5wh2-j94m-rwpf, MAL-2026-16159 | Malicious | Not scored | 14 Sep, 2026 | npm dilxztech |
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads CVE-2026-88932, GHSA-3pph-fpjx-jg34 | Medium | 0.5% | 14 Sep, 2026 | npm multer |
Malicious release: Malicious code in @biz44/process-runtime-utils (npm) MAL-2026-16171 | Malicious | Not scored | 14 Sep, 2026 | npm @biz44/process-runtime-utils |
Malicious release: Malicious code in @biz44/runtime-utils (npm) MAL-2026-16172 | Malicious | Not scored | 14 Sep, 2026 | npm @biz44/runtime-utils |
Malicious release: Malicious code in webpackbootstrap5 (npm) GHSA-2q27-vrr7-584g, MAL-2026-16201 | Malicious | Not scored | 14 Sep, 2026 | npm webpackbootstrap5 |
Malicious release: Malicious code in @zaka13/thing (npm) GHSA-fxc7-fpjq-q7vf, MAL-2026-16200 | Malicious | Not scored | 14 Sep, 2026 | npm @zaka13/thing |
Malicious release: Malicious code in pino-ulid (npm) MAL-2026-16154 | Malicious | Not scored | 14 Sep, 2026 | npm pino-ulid |
Malicious release: Malicious code in webpackbootstrapscripts (npm) MAL-2026-16202 | Malicious | Not scored | 14 Sep, 2026 | npm webpackbootstrapscripts |
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) CVE-2026-90776, GHSA-prgh-xp8r-p3m5 | High | 0.7% | 13 Sep, 2026 | npm nodemailer |
joi messages compilation allows prototype replacement through __proto__ error codes CVE-2026-90771, GHSA-wr44-6hxh-3jwq | Medium | 0.4% | 13 Sep, 2026 | npm joi |
Malicious release: Malicious code in @biz44/id79-client (npm) MAL-2026-16168 | Malicious | Not scored | 12 Sep, 2026 | npm @biz44/id79-client |
Malicious release: Malicious code in @biz44/id12-client (npm) MAL-2026-16166 | Malicious | Not scored | 12 Sep, 2026 | npm @biz44/id12-client |
Malicious release: Malicious code in @biz44/id10-client (npm) MAL-2026-16165 | Malicious | Not scored | 12 Sep, 2026 | npm @biz44/id10-client |
Malicious release: Malicious code in @biz44/id95-client (npm) MAL-2026-16169 | Malicious | Not scored | 12 Sep, 2026 | npm @biz44/id95-client |
Malicious release: Malicious code in @biz44/id99-client (npm) MAL-2026-16170 | Malicious | Not scored | 12 Sep, 2026 | npm @biz44/id99-client |
Malicious release: Malicious code in id79-client (npm) MAL-2026-16173 | Malicious | Not scored | 12 Sep, 2026 | npm id79-client |
Malicious release: Malicious code in @biz44/id44-client (npm) MAL-2026-16167 | Malicious | Not scored | 12 Sep, 2026 | npm @biz44/id44-client |
Malicious release: Malicious code in greensaver (npm) MAL-2026-16138 | Malicious | Not scored | 11 Sep, 2026 | npm greensaver |
Malicious release: Malicious code in cr-bot-common (npm) MAL-2026-16137 | Malicious | Not scored | 11 Sep, 2026 | npm cr-bot-common |
Malicious release: Malicious code in tracker-cloudflare (npm) MAL-2026-16140 | Malicious | Not scored | 11 Sep, 2026 | npm tracker-cloudflare |
yayson: Prototype pollution in Store/LegacyStore deserialization CVE-2026-61534, GHSA-325j-mg25-8q58 | Critical | 0.8% | 11 Sep, 2026 | npm yayson |
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix CVE-2026-59973, GHSA-65h7-9wrw-629c | High | 0.4% | 11 Sep, 2026 | npm @frontmcp/adapters npm frontmcp npm mcp-from-openapi |
Malicious release: Malicious code in @nimbusedge/auth (npm) MAL-2026-16132 | Malicious | Not scored | 11 Sep, 2026 | npm @nimbusedge/auth |
Malicious release: Malicious code in tailwind-form-kit (npm) GHSA-8p5f-pjcw-69mw, MAL-2026-16139 | Malicious | Not scored | 11 Sep, 2026 | npm tailwind-form-kit |
compression vulnerable to Denial of Service via memory leak on premature response close CVE-2026-87776, GHSA-vc2v-76pw-4v95 | High | 0.5% | 11 Sep, 2026 | npm compression |
morgan vulnerable to Log Injection via unescaped double quote in quoted log fields CVE-2026-87859, GHSA-9f6g-j8ch-79g4 | Medium | 0.4% | 11 Sep, 2026 | npm morgan |
Malicious release: Malicious code in strapi-plugin-vinsoc-1109 (npm) MAL-2026-16126 | Malicious | Not scored | 11 Sep, 2026 | npm strapi-plugin-vinsoc-1109 |
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission CVE-2026-59965, GHSA-4qpv-39hg-f7fx | High | 0.4% | 10 Sep, 2026 | npm @jhb.software/payload-alt-text-plugin |
@argos-ci/core: CI Branch Name OS Command Injection CVE-2026-59960, GHSA-4x45-gxvp-6283 | High | 0.6% | 10 Sep, 2026 | npm @argos-ci/core |
OmniRoute ACP Custom-Agent Remote Code Execution (RCE) CVE-2026-88062, GHSA-hf57-cqmx-p4gr | Critical | 1.4% | 10 Sep, 2026 | npm omniroute |
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVE-2026-88060, GHSA-v3p8-whq6-r5jg | High | 0.4% | 10 Sep, 2026 | npm @angular/platform-server |
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent` CVE-2026-88059, GHSA-p297-fm68-3q8c | Medium | 0.3% | 10 Sep, 2026 | npm @angular/common |
Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVE-2026-88058, GHSA-j3r3-mxqp-r2p4 | High | 0.3% | 10 Sep, 2026 | npm @angular/platform-server |
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler CVE-2026-88057, GHSA-hh8m-fm6v-7cvg | Medium | 0.4% | 10 Sep, 2026 | npm @angular/compiler npm @angular/core |
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVE-2026-88056, GHSA-f6mr-pjwc-34m4 | High | 0.5% | 10 Sep, 2026 | npm @angular/platform-server |