Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @ra-ide/source-code-frontend (npm) MAL-2025-190594 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ide/source-code-frontend |
Malicious release: Malicious code in @ra-ide/tag-editor-frontend (npm) MAL-2025-190597 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ide/tag-editor-frontend |
Malicious release: Malicious code in @ra-ide/code-editor-frontend (npm) MAL-2025-190590 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ide/code-editor-frontend |
Malicious release: Malicious code in @ra-ide/st-frontend (npm) MAL-2025-190595 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ide/st-frontend |
Malicious release: Malicious code in @ra-ide/ld-frontend (npm) MAL-2025-190592 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ide/ld-frontend |
Malicious release: Malicious code in @ra-ftds/motion-extension (npm) MAL-2025-190589 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ftds/motion-extension |
Malicious release: Malicious code in @ra-ftds/ra-flourish-design-tokens (npm) MAL-2025-190588 | Malicious | Not scored | 20 Nov, 2025 | npm @ra-ftds/ra-flourish-design-tokens |
md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter CVE-2025-65108, GHSA-547r-qmjm-8hvw | Critical | 1.0% | 20 Nov, 2025 | npm md-to-pdf |
@hpke/core reuses AEAD nonces CVE-2025-64767, GHSA-73g8-5h73-26h4 | Critical | 0.2% | 20 Nov, 2025 | npm @hpke/core |
zx Uses Incorrectly-Resolved Name or Reference CVE-2025-13437, GHSA-w87r-vg9q-crqm | Medium | 0.1% | 20 Nov, 2025 | npm zx |
@perfood/couch-auth may expose session tokens, passwords CVE-2025-60794, GHSA-62vx-hpcr-m9ch | Medium | 0.2% | 20 Nov, 2025 | npm @perfood/couch-auth |
Malicious release: Malicious code in alicenpmpocpackage (npm) MAL-2025-190587 | Malicious | Not scored | 20 Nov, 2025 | npm alicenpmpocpackage |
Malicious release: Malicious code in expertsvc-onboard-offboard (npm) MAL-2025-190585 | Malicious | Not scored | 20 Nov, 2025 | npm expertsvc-onboard-offboard |
Malicious release: Malicious code in identity-authn-core-ui (npm) MAL-2025-190586 | Malicious | Not scored | 20 Nov, 2025 | npm identity-authn-core-ui |
Malicious release: Malicious code in @kiwiiw/ez-lib (npm) GHSA-mjhq-f89r-w6x5, MAL-2025-190584 | Malicious | Not scored | 20 Nov, 2025 | npm @kiwiiw/ez-lib |
Malicious release: Malicious code in com.unity.polyspatial.xr (npm) GHSA-vqfj-g744-cc9j, MAL-2025-190581 | Malicious | Not scored | 20 Nov, 2025 | npm com.unity.polyspatial.xr |
Malicious release: Malicious code in node-calculator-fa00 (npm) GHSA-jfq2-j35r-66j7, MAL-2025-190583 | Malicious | Not scored | 20 Nov, 2025 | npm node-calculator-fa00 |
Malicious release: Malicious code in just-a-calculator (npm) GHSA-qprp-2464-fqq9, MAL-2025-190582 | Malicious | Not scored | 20 Nov, 2025 | npm just-a-calculator |
Malicious release: Malicious code in lululemon-b2b-utils (npm) GHSA-fjhh-wwxc-6722, MAL-2025-190580 | Malicious | Not scored | 19 Nov, 2025 | npm lululemon-b2b-utils |
Malicious release: Malicious code in hellospa (npm) GHSA-r5r4-xjfg-pv5h, MAL-2025-190579 | Malicious | Not scored | 19 Nov, 2025 | npm hellospa |
Claude Code vulnerable to command execution prior to startup trust dialog CVE-2025-65099, GHSA-5hhx-v7f6-x7gv | High | 0.5% | 19 Nov, 2025 | npm @anthropic-ai/claude-code |
Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint CVE-2025-65019, GHSA-fvmw-cj7j-j39q | Medium | 0.3% | 19 Nov, 2025 | npm astro |
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values CVE-2025-64765, GHSA-ggxq-hp9w-j794 | Medium | 0.5% | 19 Nov, 2025 | npm astro |
Astro vulnerable to reflected XSS via the server islands feature CVE-2025-64764, GHSA-wrwg-2hg8-v723 | High | 0.5% | 19 Nov, 2025 | npm astro |
Astro Development Server has Arbitrary Local File Read CVE-2025-64757, GHSA-x3h8-62x9-952g | Low | 0.4% | 19 Nov, 2025 | npm astro |
Malicious release: Malicious code in node-calculator-cf8c (npm) MAL-2025-190578 | Malicious | Not scored | 19 Nov, 2025 | npm node-calculator-cf8c |
Malicious release: Malicious code in alicenpmpackage13 (npm) MAL-2025-190577 | Malicious | Not scored | 19 Nov, 2025 | npm alicenpmpackage13 |
Malicious release: Malicious code in alicenpmpackage1 (npm) MAL-2025-190576 | Malicious | Not scored | 19 Nov, 2025 | npm alicenpmpackage1 |
Malicious release: Malicious code in react-svg-helper (npm) GHSA-g6h3-2jvp-vhqr, MAL-2025-190571 | Malicious | Not scored | 19 Nov, 2025 | npm react-svg-helper |
Malicious release: Malicious code in react-svg-module (npm) GHSA-vc42-m59c-6gw6, MAL-2025-190572 | Malicious | Not scored | 19 Nov, 2025 | npm react-svg-module |
Malicious release: Malicious code in node-calculator-8bf9 (npm) MAL-2025-190570 | Malicious | Not scored | 19 Nov, 2025 | npm node-calculator-8bf9 |
Malicious release: Malicious code in node-calculator-b0e4 (npm) MAL-2025-190569 | Malicious | Not scored | 19 Nov, 2025 | npm node-calculator-b0e4 |
Malicious release: Malicious code in werufgugweuiguiwergqui (npm) MAL-2025-190575 | Malicious | Not scored | 19 Nov, 2025 | npm werufgugweuiguiwergqui |
Malicious release: Malicious code in kc-next (npm) GHSA-cmmm-3vrh-vj98, MAL-2025-190574 | Malicious | Not scored | 19 Nov, 2025 | npm kc-next |
Malicious release: Malicious code in captcha-paypal (npm) MAL-2025-190568 | Malicious | Not scored | 18 Nov, 2025 | npm captcha-paypal |
Malicious release: Malicious code in gbiz-next (npm) GHSA-rfgw-mj8j-mg3g, MAL-2025-190573 | Malicious | Not scored | 18 Nov, 2025 | npm gbiz-next |
Malicious release: Malicious code in security-testing-research22 (npm) MAL-2025-190567 | Malicious | Not scored | 18 Nov, 2025 | npm security-testing-research22 |
Malicious release: Malicious code in node-calculator-3e62 (npm) GHSA-wxfw-hh76-hwr8, MAL-2025-190562 | Malicious | Not scored | 18 Nov, 2025 | npm node-calculator-3e62 |
Malicious release: Malicious code in tailwindcss-breezium (npm) GHSA-f6vh-22p7-hxp5, MAL-2025-190564 | Malicious | Not scored | 18 Nov, 2025 | npm tailwindcss-breezium |
Malicious release: Malicious code in @grumpycoffeecup/hello-npm-world (npm) GHSA-v2r5-pjpm-4cj5, MAL-2025-190557 | Malicious | Not scored | 18 Nov, 2025 | npm @grumpycoffeecup/hello-npm-world |
Malicious release: Malicious code in @profmego/alipay-babyblue (npm) GHSA-7w8p-r52j-w959, MAL-2025-190558 | Malicious | Not scored | 18 Nov, 2025 | npm @profmego/alipay-babyblue |
Malicious release: Malicious code in mongoose-odm (npm) GHSA-v4g2-4g52-qj9j, MAL-2025-190560 | Malicious | Not scored | 18 Nov, 2025 | npm mongoose-odm |
Malicious release: Malicious code in tailwindcss-setfavicon (npm) GHSA-8jr3-598q-gcm6, MAL-2025-190565 | Malicious | Not scored | 18 Nov, 2025 | npm tailwindcss-setfavicon |
Malicious release: Malicious code in scriptstealer (npm) GHSA-277g-646w-r9r6, MAL-2025-190563 | Malicious | Not scored | 18 Nov, 2025 | npm scriptstealer |
Malicious release: Malicious code in 1libxmljs2 (npm) GHSA-2rf3-g9x6-m6fv, MAL-2025-190556 | Malicious | Not scored | 18 Nov, 2025 | npm 1libxmljs2 |
Malicious release: Malicious code in finastealer (npm) GHSA-357r-4r78-6gf6, MAL-2025-190559 | Malicious | Not scored | 18 Nov, 2025 | npm finastealer |
Malicious release: Malicious code in mystealer (npm) GHSA-39r9-xrr6-j5hc, MAL-2025-190561 | Malicious | Not scored | 18 Nov, 2025 | npm mystealer |
Malicious release: Malicious code in workingstealer (npm) GHSA-q7xw-mvh2-96rq, MAL-2025-190566 | Malicious | Not scored | 18 Nov, 2025 | npm workingstealer |
Malicious release: Malicious code in chai-type (npm) GHSA-f2j6-rgp6-p5qp, MAL-2025-190552 | Malicious | Not scored | 18 Nov, 2025 | npm chai-type |
Malicious release: Malicious code in pretty-jsonify (npm) GHSA-f2g5-jc9j-vfp5, MAL-2025-190554 | Malicious | Not scored | 18 Nov, 2025 | npm pretty-jsonify |