Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in tailwindcss-aspectratio-styles (npm) MAL-2026-16049 | Malicious | Not scored | 08 Sep, 2026 | npm tailwindcss-aspectratio-styles |
Malicious release: Malicious code in punypump (npm) MAL-2026-16048 | Malicious | Not scored | 08 Sep, 2026 | npm punypump |
n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content CVE-2026-86074, GHSA-q5wm-mgqx-fv2f | Medium | 0.4% | 08 Sep, 2026 | npm n8n |
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution CVE-2026-86073, GHSA-cw9w-vv67-hf73 | Medium | 0.4% | 08 Sep, 2026 | npm n8n |
DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API CVE-2026-82533, GHSA-8m2g-8cgm-3vcp | Critical | 1.2% | 08 Sep, 2026 | npm @deepseek-ai/dsh-client-connection |
Malicious release: Malicious code in @usemosaik/template-react-js (npm) GHSA-8rcc-9ggm-659p, MAL-2026-16047 | Malicious | Not scored | 08 Sep, 2026 | npm @usemosaik/template-react-js |
Snowflake drivers writes sensitive information to logs CVE-2026-86597, GHSA-qqj6-54q6-cxv6, GO-2026-6665, PYSEC-2026-4301 | Medium | 0.1% | 08 Sep, 2026 | Go github.com/snowflakedb/gosnowflake Go github.com/snowflakedb/gosnowflake/v2 Maven net.snowflake:snowflake-jdbc Maven net.snowflake:snowflake-jdbc-fips +3 more |
Malicious release: Malicious code in i18nexus (npm) GHSA-38hw-f37p-99jj, MAL-2026-16045 | Malicious | Not scored | 08 Sep, 2026 | npm i18nexus |
Malicious release: Malicious code in i18nexus-tools (npm) GHSA-9cfw-xh4g-cc2f, MAL-2026-16046 | Malicious | Not scored | 08 Sep, 2026 | npm i18nexus-tools |
Malicious release: Malicious code in @web2apk/baileys (npm) GHSA-f4f2-cqqp-jcrx, MAL-2026-16043 | Malicious | Not scored | 08 Sep, 2026 | npm @web2apk/baileys |
Malicious release: Malicious code in krdpass-auth-react-native (npm) GHSA-3j7p-44mj-76hx, MAL-2026-16042 | Malicious | Not scored | 08 Sep, 2026 | npm krdpass-auth-react-native |
@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP) CVE-2026-76969, GHSA-955m-rr6m-2f9v | Critical | 0.4% | 08 Sep, 2026 | npm @sap/cds-mtxs |
Malicious release: Malicious code in plogme (npm) MAL-2026-16199 | Malicious | Not scored | 08 Sep, 2026 | npm plogme |
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json CVE-2026-86540, GHSA-mc52-mwq4-vfx3 | High | 0.2% | 07 Sep, 2026 | npm knowns |
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools CVE-2026-86439, GHSA-9gfj-28hw-jchp | High | 1.1% | 07 Sep, 2026 | npm knowns |
Malicious release: Malicious code in @cp-shared-14/frontend-ui (npm) MAL-2026-16015 | Malicious | Not scored | 07 Sep, 2026 | npm @cp-shared-14/frontend-ui |
Malicious release: Malicious code in @aircanada/navigation-handler (npm) GHSA-356v-pcf2-7958, MAL-2026-16020 | Malicious | Not scored | 07 Sep, 2026 | npm @aircanada/navigation-handler |
Malicious release: Malicious code in @aircanada/core (npm) GHSA-46mp-56rw-qpmm, MAL-2026-16019 | Malicious | Not scored | 07 Sep, 2026 | npm @aircanada/core |
Malicious release: Malicious code in @aircanada/components (npm) GHSA-w6c3-rrw8-wxrx, MAL-2026-16018 | Malicious | Not scored | 07 Sep, 2026 | npm @aircanada/components |
Malicious release: Malicious code in @idkruan-10/dpd-depconf-probe (npm) GHSA-994q-v55m-r2mw, MAL-2026-16021 | Malicious | Not scored | 07 Sep, 2026 | npm @idkruan-10/dpd-depconf-probe |
Malicious release: Malicious code in op-ts-server-core (npm) GHSA-cj4c-268v-m597, MAL-2026-16034 | Malicious | Not scored | 07 Sep, 2026 | npm op-ts-server-core |
Malicious release: Malicious code in service-home (npm) GHSA-m2c9-2v7c-fxf9, MAL-2026-16039 | Malicious | Not scored | 07 Sep, 2026 | npm service-home |
Malicious release: Malicious code in redis-type-intel (npm) GHSA-v9rh-vg7p-gwqm, MAL-2026-16036 | Malicious | Not scored | 07 Sep, 2026 | npm redis-type-intel |
Malicious release: Malicious code in oscar-redis (npm) GHSA-c6m6-wr2f-6f63, MAL-2026-16035 | Malicious | Not scored | 07 Sep, 2026 | npm oscar-redis |
Malicious release: Malicious code in kiki-baileys (npm) GHSA-g8cr-3r7q-pcr6, MAL-2026-16033 | Malicious | Not scored | 07 Sep, 2026 | npm kiki-baileys |
Malicious release: Malicious code in bmc-i18n-extract-cli (npm) GHSA-327g-rcr8-hp3p, MAL-2026-16025 | Malicious | Not scored | 07 Sep, 2026 | npm bmc-i18n-extract-cli |
Malicious release: Malicious code in bmc-translate-utils (npm) GHSA-997w-vpm2-ww7x, MAL-2026-16026 | Malicious | Not scored | 07 Sep, 2026 | npm bmc-translate-utils |
Malicious release: Malicious code in blueai-cli (npm) GHSA-c2v5-8c2f-jj54, MAL-2026-16024 | Malicious | Not scored | 07 Sep, 2026 | npm blueai-cli |
Malicious release: Malicious code in feishu-docx-mcp (npm) GHSA-q5c6-p5q5-g3px, MAL-2026-16032 | Malicious | Not scored | 07 Sep, 2026 | npm feishu-docx-mcp |
Malicious release: Malicious code in scw-mobile (npm) GHSA-h9g8-rwcg-hpmh, MAL-2026-16038 | Malicious | Not scored | 07 Sep, 2026 | npm scw-mobile |
Malicious release: Malicious code in base-account-core (npm) GHSA-vgm8-2vf8-769j, MAL-2026-16022 | Malicious | Not scored | 07 Sep, 2026 | npm base-account-core |
Malicious release: Malicious code in cb-wallet-solana-provider (npm) GHSA-5cg4-38v4-j4vc, MAL-2026-16030 | Malicious | Not scored | 07 Sep, 2026 | npm cb-wallet-solana-provider |
Malicious release: Malicious code in cb-wallet-analytics (npm) GHSA-7944-c265-3ff7, MAL-2026-16027 | Malicious | Not scored | 07 Sep, 2026 | npm cb-wallet-analytics |
Malicious release: Malicious code in base-app-data (npm) GHSA-9hpg-rmwp-vg4p, MAL-2026-16023 | Malicious | Not scored | 07 Sep, 2026 | npm base-app-data |
Malicious release: Malicious code in cb-wallet-metadata (npm) GHSA-cxwc-958j-45g8, MAL-2026-16029 | Malicious | Not scored | 07 Sep, 2026 | npm cb-wallet-metadata |
Malicious release: Malicious code in scw-core (npm) GHSA-fv48-xvcx-h3qh, MAL-2026-16037 | Malicious | Not scored | 07 Sep, 2026 | npm scw-core |
Malicious release: Malicious code in cb-wallet-store (npm) GHSA-gw4f-3mgw-h64x, MAL-2026-16031 | Malicious | Not scored | 07 Sep, 2026 | npm cb-wallet-store |
Malicious release: Malicious code in cb-wallet-env (npm) GHSA-m477-pr6m-v2fp, MAL-2026-16028 | Malicious | Not scored | 07 Sep, 2026 | npm cb-wallet-env |
Malicious release: Malicious code in wallet-cds-web (npm) GHSA-qh9w-32r6-2qpw, MAL-2026-16040 | Malicious | Not scored | 07 Sep, 2026 | npm wallet-cds-web |
Malicious release: Malicious code in wallet-engine-signing (npm) GHSA-qw4m-ccr9-7r43, MAL-2026-16041 | Malicious | Not scored | 07 Sep, 2026 | npm wallet-engine-signing |
Malicious release: Malicious code in @caliperx2/components (npm) MAL-2026-16007 | Malicious | Not scored | 07 Sep, 2026 | npm @caliperx2/components |
Malicious release: Malicious code in b2b-frontend-external-library (npm) MAL-2026-16008 | Malicious | Not scored | 07 Sep, 2026 | npm b2b-frontend-external-library |
Malicious release: Malicious code in omni-channel-configurator-wireline-frontend (npm) MAL-2026-16009 | Malicious | Not scored | 07 Sep, 2026 | npm omni-channel-configurator-wireline-frontend |
Malicious release: Malicious code in oce-configurator-wireless-frontend (npm) MAL-2026-15940 | Malicious | Not scored | 06 Sep, 2026 | npm oce-configurator-wireless-frontend |
Malicious release: Malicious code in omni-channel-order-frontend (npm) MAL-2026-15942 | Malicious | Not scored | 06 Sep, 2026 | npm omni-channel-order-frontend |
Malicious release: Malicious code in ocfe-tv-subscription-center-web (npm) MAL-2026-15941 | Malicious | Not scored | 06 Sep, 2026 | npm ocfe-tv-subscription-center-web |
Malicious release: Malicious code in omni-channel-oid-frontend (npm) MAL-2026-15939 | Malicious | Not scored | 06 Sep, 2026 | npm omni-channel-oid-frontend |
Malicious release: Malicious code in agentrc-security-poc-policy (npm) MAL-2026-16005 | Malicious | Not scored | 06 Sep, 2026 | npm agentrc-security-poc-policy |
Malicious release: Malicious code in vishal_312pkg (npm) MAL-2026-16006 | Malicious | Not scored | 06 Sep, 2026 | npm vishal_312pkg |
Malicious release: Malicious code in @liuliang520500/sinataoke_cn_test (npm) GHSA-36jr-wqjh-q55x, MAL-2026-15961 | Malicious | Not scored | 06 Sep, 2026 | npm @liuliang520500/sinataoke_cn_test |