Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in pinochiomathm (npm) MAL-2026-16123 | Malicious | Not scored | 10 Sep, 2026 | npm pinochiomathm |
Malicious release: Malicious code in tailwindcss-contact-forms (npm) MAL-2026-16124 | Malicious | Not scored | 10 Sep, 2026 | npm tailwindcss-contact-forms |
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name GHSA-x7m8-jrm8-hpvx | High | Not scored | 10 Sep, 2026 | npm @eigenpal/docx-editor-core npm @eigenpal/docx-editor-react |
Malicious release: Malicious code in etoro-cashout (npm) MAL-2026-16117 | Malicious | Not scored | 10 Sep, 2026 | npm etoro-cashout |
Malicious release: Malicious code in etoro-builders (npm) MAL-2026-16116 | Malicious | Not scored | 10 Sep, 2026 | npm etoro-builders |
Malicious release: Malicious code in etoro-aggregator (npm) MAL-2026-16111 | Malicious | Not scored | 10 Sep, 2026 | npm etoro-aggregator |
Malicious release: Malicious code in etoro-analytics (npm) MAL-2026-16112 | Malicious | Not scored | 10 Sep, 2026 | npm etoro-analytics |
Malicious release: Malicious code in etoro-api (npm) MAL-2026-16113 | Malicious | Not scored | 10 Sep, 2026 | npm etoro-api |
Malicious release: Malicious code in etoro-client (npm) MAL-2026-16119 | Malicious | Not scored | 10 Sep, 2026 | npm etoro-client |
Malicious release: Malicious code in etoro-core (npm) MAL-2026-16120 | Malicious | Not scored | 10 Sep, 2026 | npm etoro-core |
Malicious release: Malicious code in etoro-charts (npm) MAL-2026-16118 | Malicious | Not scored | 10 Sep, 2026 | npm etoro-charts |
Malicious release: Malicious code in etoro-auth (npm) MAL-2026-16114 | Malicious | Not scored | 10 Sep, 2026 | npm etoro-auth |
Malicious release: Malicious code in etoro-billing (npm) MAL-2026-16115 | Malicious | Not scored | 10 Sep, 2026 | npm etoro-billing |
@openhop/server: Path Traversal in Flow ID File Operations CVE-2026-59179, GHSA-g72f-jw3w-mgh7 | High | 0.4% | 09 Sep, 2026 | npm @openhop/server |
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import CVE-2026-59176, GHSA-wcjj-9m6g-2fr2 | High | 0.2% | 09 Sep, 2026 | npm functype-mcp-server |
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run CVE-2026-59160, GHSA-2r5q-h53f-9rp3 | High | 0.5% | 09 Sep, 2026 | npm @yeger/turbo-graph |
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients CVE-2026-59158, GHSA-fxg7-897c-57mp | High | 0.5% | 09 Sep, 2026 | npm nuxt-ollama |
Malicious release: Malicious code in @nexustechpro/baileys (npm) GHSA-8w6v-4xp9-rvrr, MAL-2026-16104 | Malicious | Not scored | 09 Sep, 2026 | npm @nexustechpro/baileys |
Malicious release: Malicious code in @neroxkira/vangal-baileys (npm) MAL-2026-16103 | Malicious | Not scored | 09 Sep, 2026 | npm @neroxkira/vangal-baileys |
Malicious release: Malicious code in @sahril2nd/baileys (npm) MAL-2026-16105 | Malicious | Not scored | 09 Sep, 2026 | npm @sahril2nd/baileys |
Malicious release: Malicious code in @auction-fe/ui-kit (npm) GHSA-2r37-886p-hj65, MAL-2026-16109 | Malicious | Not scored | 09 Sep, 2026 | npm @auction-fe/ui-kit |
Malicious release: Malicious code in @auction-fe/reporting-system (npm) GHSA-4x79-pcqv-r9rf, MAL-2026-16108 | Malicious | Not scored | 09 Sep, 2026 | npm @auction-fe/reporting-system |
Malicious release: Malicious code in @auction-fe/portal (npm) GHSA-qmw2-mp2f-cgg3, MAL-2026-16107 | Malicious | Not scored | 09 Sep, 2026 | npm @auction-fe/portal |
Malicious release: Malicious code in @auction-fe/base (npm) GHSA-w6hj-c25h-wgh7, MAL-2026-16106 | Malicious | Not scored | 09 Sep, 2026 | npm @auction-fe/base |
Malicious release: Malicious code in @convertics/script (npm) GHSA-c74p-4c5p-6v9r, MAL-2026-16110 | Malicious | Not scored | 09 Sep, 2026 | npm @convertics/script |
Malicious release: Malicious code in mfatest2 (npm) MAL-2026-16102 | Malicious | Not scored | 09 Sep, 2026 | npm mfatest2 |
Malicious release: Malicious code in mfaby (npm) MAL-2026-16101 | Malicious | Not scored | 09 Sep, 2026 | npm mfaby |
Malicious release: Malicious code in discord-mfa-solver (npm) GHSA-vf4w-775x-ccfh, MAL-2026-16100 | Malicious | Not scored | 09 Sep, 2026 | npm discord-mfa-solver |
Malicious release: Malicious code in matrixkit-js (npm) MAL-2026-16095 | Malicious | Not scored | 09 Sep, 2026 | npm matrixkit-js |
Malicious release: Malicious code in gmgn-trading-kit (npm) MAL-2026-16094 | Malicious | Not scored | 09 Sep, 2026 | npm gmgn-trading-kit |
Malicious release: Malicious code in twilio-hackerone-poc-b8f21a (npm) MAL-2026-16097 | Malicious | Not scored | 09 Sep, 2026 | npm twilio-hackerone-poc-b8f21a |
Malicious release: Malicious code in soltinel-pro (npm) MAL-2026-16096 | Malicious | Not scored | 09 Sep, 2026 | npm soltinel-pro |
Malicious release: Malicious code in sams-run-style (npm) GHSA-2r8h-5pr4-fr3v, MAL-2026-16090 | Malicious | Not scored | 09 Sep, 2026 | npm sams-run-style |
Malicious release: Malicious code in graphql-js-client-transform (npm) GHSA-xm59-fwxf-vq6g, MAL-2026-16086 | Malicious | Not scored | 09 Sep, 2026 | npm graphql-js-client-transform |
Malicious release: Malicious code in sams-text-style (npm) GHSA-xqx8-w483-rq8x, MAL-2026-16091 | Malicious | Not scored | 09 Sep, 2026 | npm sams-text-style |
Malicious release: Malicious code in @staticj/cropperxmjs (npm) MAL-2026-16081 | Malicious | Not scored | 09 Sep, 2026 | npm @staticj/cropperxmjs |
Malicious release: Malicious code in @umschool/platform (npm) MAL-2026-16082 | Malicious | Not scored | 09 Sep, 2026 | npm @umschool/platform |
Malicious release: Malicious code in vinnleys (npm) GHSA-p8f8-xjrg-2v4g, MAL-2026-16092 | Malicious | Not scored | 09 Sep, 2026 | npm vinnleys |
Malicious release: Malicious code in @vnxsync/libsignal-node (npm) GHSA-369v-phqf-c9g9, MAL-2026-16083 | Malicious | Not scored | 09 Sep, 2026 | npm @vnxsync/libsignal-node |
Malicious release: Malicious code in amprem-activator (npm) GHSA-4crw-26f5-4v62, MAL-2026-16084 | Malicious | Not scored | 09 Sep, 2026 | npm amprem-activator |
Malicious release: Malicious code in xbailsync (npm) GHSA-vfrg-29g4-854p, MAL-2026-16093 | Malicious | Not scored | 09 Sep, 2026 | npm xbailsync |
Malicious release: Malicious code in pumpswap-sdk-v1 (npm) GHSA-5qr5-f8q7-r844, MAL-2026-16088 | Malicious | Not scored | 09 Sep, 2026 | npm pumpswap-sdk-v1 |
Malicious release: Malicious code in polygon-toolkits-validator (npm) GHSA-cmwm-j5px-xrpf, MAL-2026-16087 | Malicious | Not scored | 09 Sep, 2026 | npm polygon-toolkits-validator |
Malicious release: Malicious code in raydium-clmm-sdk (npm) GHSA-cq4p-x9wg-m5wv, MAL-2026-16089 | Malicious | Not scored | 09 Sep, 2026 | npm raydium-clmm-sdk |
Malicious release: Malicious code in crypto-validates (npm) GHSA-v5v6-h869-g34f, MAL-2026-16085 | Malicious | Not scored | 09 Sep, 2026 | npm crypto-validates |
Malicious release: Malicious code in server-authorized-cleanup (npm) MAL-2026-16079 | Malicious | Not scored | 09 Sep, 2026 | npm server-authorized-cleanup |
Malicious release: Malicious code in cache-cleanup-module (npm) MAL-2026-16078 | Malicious | Not scored | 09 Sep, 2026 | npm cache-cleanup-module |
Malicious release: Malicious code in chai-as-sleek (npm) MAL-2026-16077 | Malicious | Not scored | 09 Sep, 2026 | npm chai-as-sleek |
Malicious release: Malicious code in external_deps_enjoyer (npm) MAL-2026-16076 | Malicious | Not scored | 09 Sep, 2026 | npm external_deps_enjoyer |
Malicious release: Malicious code in easypanel-agent (npm) MAL-2026-16072 | Malicious | Not scored | 09 Sep, 2026 | npm easypanel-agent |