Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in integrator-2830 (npm) GHSA-f59x-2qgp-j2c2, MAL-2025-190507 | Malicious | Not scored | 17 Nov, 2025 | npm integrator-2830 |
Malicious release: Malicious code in applicationooks21 (npm) GHSA-p95v-8f68-x5vh, MAL-2025-190503 | Malicious | Not scored | 17 Nov, 2025 | npm applicationooks21 |
Malicious release: Malicious code in signals-embed (npm) GHSA-pjxr-h3qv-879p, MAL-2025-190511 | Malicious | Not scored | 17 Nov, 2025 | npm signals-embed |
Malicious release: Malicious code in chai-proxify (npm) GHSA-532g-9ffw-j8mq, MAL-2025-190504 | Malicious | Not scored | 17 Nov, 2025 | npm chai-proxify |
Malicious release: Malicious code in react-native-animated-shine (npm) GHSA-f849-6pjg-5fhc, MAL-2025-190510 | Malicious | Not scored | 17 Nov, 2025 | npm react-native-animated-shine |
Malicious release: Malicious code in react-confetti-modern (npm) GHSA-fj72-f875-9vw7, MAL-2025-190509 | Malicious | Not scored | 17 Nov, 2025 | npm react-confetti-modern |
Malicious release: Malicious code in tailwind-styled-scrollbar (npm) GHSA-p2jq-3496-h69h, MAL-2025-190501 | Malicious | Not scored | 17 Nov, 2025 | npm tailwind-styled-scrollbar |
Malicious release: Malicious code in com.mixpanel.unity (npm) MAL-2025-190500 | Malicious | Not scored | 16 Nov, 2025 | npm com.mixpanel.unity |
Malicious release: Malicious code in filifecycleserv-paypal (npm) GHSA-gj5f-c6h7-9v2f, MAL-2025-190499 | Malicious | Not scored | 15 Nov, 2025 | npm filifecycleserv-paypal |
Apollo Federation has Improper Enforcement of Access Control on Transitive Fields GHSA-m8jr-fxqx-8xx6 | High | Not scored | 14 Nov, 2025 | npm @apollo/composition |
Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change CVE-2025-71328, GHSA-fjh6-8679-9pch | High | 0.5% | 14 Nov, 2025 | npm flowise-ui |
Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials) CVE-2025-71337, GHSA-x39m-3393-3qp4 | High | 0.4% | 14 Nov, 2025 | npm flowise-ui |
Flowise Fails to Invalidate Existing Sessions After Password Changes CVE-2025-71335, GHSA-x7rp-qj2h-ghgw | High | 0.4% | 14 Nov, 2025 | npm flowise |
expr-eval vulnerable to Prototype Pollution CVE-2025-13204, GHSA-8gw3-rxh4-v6jx | Critical | 0.9% | 14 Nov, 2025 | npm expr-eval npm expr-eval-fork |
Malicious release: Malicious code in loger-parser (npm) GHSA-c448-fx5r-7ggw, MAL-2025-190496, SNYK-JS-LOGERPARSER-13961689 | Malicious | Not scored | 14 Nov, 2025 | npm loger-parser |
Malicious release: Malicious code in tailwindcss-setflex (npm) GHSA-rf9v-4rc9-33wg, MAL-2025-190497 | Malicious | Not scored | 14 Nov, 2025 | npm tailwindcss-setflex |
Malicious release: Malicious code in validator-node (npm) GHSA-hxf9-58r2-q8f4, MAL-2025-190498, SNYK-JS-VALIDATORNODE-13961690 | Malicious | Not scored | 14 Nov, 2025 | npm validator-node |
Malicious release: Malicious code in chain-test-async (npm) GHSA-m3ww-fr92-p4xx, MAL-2025-190495, SNYK-JS-CHAINTESTASYNC-13961687 | Malicious | Not scored | 14 Nov, 2025 | npm chain-test-async |
Malicious release: Malicious code in chai-test-async (npm) GHSA-pm4f-x94x-7v26, MAL-2025-190494, SNYK-JS-CHAITESTASYNC-13961688 | Malicious | Not scored | 14 Nov, 2025 | npm chai-test-async |
@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields CVE-2025-64530, GHSA-mx7m-j9xf-62hw | High | 0.4% | 13 Nov, 2025 | npm @apollo/composition |
AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance GHSA-8wj8-cfxr-9374 | High | Not scored | 13 Nov, 2025 | npm aws-advanced-nodejs-wrapper |
Directus Vulnerable to Information Leakage in Existing Collections CVE-2025-64749, GHSA-cph6-524f-3hgr | Medium | 0.3% | 13 Nov, 2025 | npm @directus/api npm directus |
Directus's conceal fields are searchable if read permissions enabled CVE-2025-64748, GHSA-8jpw-gpr4-8cmh | Medium | 0.3% | 13 Nov, 2025 | npm @directus/api npm directus |
Directus is Vulnerable to Stored Cross-site Scripting CVE-2025-64747, GHSA-vv2v-pw69-8crf | Medium | 0.3% | 13 Nov, 2025 | npm directus |
Directus has Improper Permission Handling on Deleted Fields CVE-2025-64746, GHSA-9x5g-62gj-wqf2 | Medium | 0.2% | 13 Nov, 2025 | npm directus |
Astro development server error page is vulnerable to reflected Cross-site Scripting CVE-2025-64745, GHSA-w2vj-39qv-7vh7 | Medium | 0.3% | 13 Nov, 2025 | npm astro |
Malicious release: Malicious code in com.unity.polyspatial (npm) GHSA-3v5x-69xc-6277, MAL-2025-190493 | Malicious | Not scored | 13 Nov, 2025 | npm com.unity.polyspatial |
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable CVE-2025-59840, GHSA-7f2v-3qq3-vvjf | High | 0.4% | 13 Nov, 2025 | npm vega npm vega-expression npm vega-interpreter |
Malicious release: Malicious code in bitsight (npm) MAL-2025-190490 | Malicious | Not scored | 13 Nov, 2025 | npm bitsight |
Malicious release: Malicious code in form-classifier (npm) MAL-2025-190491 | Malicious | Not scored | 13 Nov, 2025 | npm form-classifier |
Malicious release: Malicious code in worldskills (npm) MAL-2025-190492 | Malicious | Not scored | 13 Nov, 2025 | npm worldskills |
js-yaml has prototype pollution in merge (<<) CVE-2025-64718, GHSA-mh29-5h37-fv8m | Medium | 0.4% | 13 Nov, 2025 | npm js-yaml |
Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass CVE-2025-64525, GHSA-hr2q-hp5q-x767 | Medium | 1.2% | 13 Nov, 2025 | npm astro |
Malicious release: Malicious code in @walletify/backend (npm) GHSA-6w28-jf63-4wpq, MAL-2025-185350 | Malicious | Not scored | 13 Nov, 2025 | npm @walletify/backend |
Malicious release: Malicious code in @walletify/ui (npm) GHSA-h59v-jw97-cw7g, MAL-2025-185352 | Malicious | Not scored | 13 Nov, 2025 | npm @walletify/ui |
Malicious release: Malicious code in @walletify/core (npm) GHSA-pq5h-xj9v-2wxh, MAL-2025-185351 | Malicious | Not scored | 13 Nov, 2025 | npm @walletify/core |
Malicious release: Malicious code in vite-chunk-master (npm) GHSA-g4jc-qxwg-2vmx, MAL-2025-190176 | Malicious | Not scored | 13 Nov, 2025 | npm vite-chunk-master |
Malicious release: Malicious code in abiogenesis-airbnb-supernova-rollup (npm) MAL-2025-185353 | Malicious | Not scored | 13 Nov, 2025 | npm abiogenesis-airbnb-supernova-rollup |
Malicious release: Malicious code in abiogenesis-cli-start-jest (npm) MAL-2025-185354 | Malicious | Not scored | 13 Nov, 2025 | npm abiogenesis-cli-start-jest |
Malicious release: Malicious code in abiogenesis-cli-tachyon-miranda (npm) MAL-2025-185355 | Malicious | Not scored | 13 Nov, 2025 | npm abiogenesis-cli-tachyon-miranda |
Malicious release: Malicious code in abiogenesis-cluster-astrophysics-epigenetics (npm) MAL-2025-185356 | Malicious | Not scored | 13 Nov, 2025 | npm abiogenesis-cluster-astrophysics-epigenetics |
Malicious release: Malicious code in abiogenesis-proxima-astro-backend (npm) MAL-2025-185357 | Malicious | Not scored | 13 Nov, 2025 | npm abiogenesis-proxima-astro-backend |
Malicious release: Malicious code in abiogenesis-start-petrology-webdriverio (npm) MAL-2025-185358 | Malicious | Not scored | 13 Nov, 2025 | npm abiogenesis-start-petrology-webdriverio |
Malicious release: Malicious code in abiogenesis-terraforming-sublimation-supercluster (npm) MAL-2025-185359 | Malicious | Not scored | 13 Nov, 2025 | npm abiogenesis-terraforming-sublimation-supercluster |
Malicious release: Malicious code in abiogenesis-version-magnetosphere-typeorm (npm) MAL-2025-185360 | Malicious | Not scored | 13 Nov, 2025 | npm abiogenesis-version-magnetosphere-typeorm |
Malicious release: Malicious code in ablation-entanglement-got-epigenetics (npm) MAL-2025-185361 | Malicious | Not scored | 13 Nov, 2025 | npm ablation-entanglement-got-epigenetics |
Malicious release: Malicious code in ablation-rigel-phoenix-despina (npm) MAL-2025-185362 | Malicious | Not scored | 13 Nov, 2025 | npm ablation-rigel-phoenix-despina |
Malicious release: Malicious code in ablation-scripts-pino-terraforming (npm) MAL-2025-185363 | Malicious | Not scored | 13 Nov, 2025 | npm ablation-scripts-pino-terraforming |
Malicious release: Malicious code in ablation-semantic-ui-readable-xerxes (npm) MAL-2025-185364 | Malicious | Not scored | 13 Nov, 2025 | npm ablation-semantic-ui-readable-xerxes |
Malicious release: Malicious code in abstract-decrypt-async-public-phi (npm) MAL-2025-185365 | Malicious | Not scored | 13 Nov, 2025 | npm abstract-decrypt-async-public-phi |