Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in json-into-html (npm) GHSA-xvrp-hmjm-74qr, MAL-2026-15990 | Malicious | Not scored | 05 Sep, 2026 | npm json-into-html |
Malicious release: Malicious code in drive-album (npm) GHSA-xwpg-4hvv-jxjq, MAL-2026-15978 | Malicious | Not scored | 05 Sep, 2026 | npm drive-album |
Malicious release: Malicious code in trading-bot-utils (npm) GHSA-2h3c-rw6j-mpq7, MAL-2026-16003 | Malicious | Not scored | 05 Sep, 2026 | npm trading-bot-utils |
Malicious release: Malicious code in eth-query-utils (npm) GHSA-c33f-ppxr-8r7j, MAL-2026-15982 | Malicious | Not scored | 05 Sep, 2026 | npm eth-query-utils |
Malicious release: Malicious code in gas-price-checker (npm) GHSA-fw8f-xwq4-q3v8, MAL-2026-15984 | Malicious | Not scored | 05 Sep, 2026 | npm gas-price-checker |
Malicious release: Malicious code in eth-lib-helpers (npm) GHSA-h3xf-4f7r-v9xf, MAL-2026-15981 | Malicious | Not scored | 05 Sep, 2026 | npm eth-lib-helpers |
Malicious release: Malicious code in ens-namehash-utils (npm) GHSA-qfrg-2m38-35gp, MAL-2026-15980 | Malicious | Not scored | 05 Sep, 2026 | npm ens-namehash-utils |
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop GHSA-7q9c-hpx7-9cwm | High | Not scored | 04 Sep, 2026 | npm @typespec/spector |
Malicious release: Malicious code in ulid-intel (npm) GHSA-h48j-674x-299v, MAL-2026-16004 | Malicious | Not scored | 04 Sep, 2026 | npm ulid-intel |
undici vulnerable to Denial of Service via unbounded decompression of compressed responses CVE-2026-84890, GHSA-3xpg-4rpp-hhhm | Medium | 0.4% | 04 Sep, 2026 | npm undici |
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol CVE-2026-19534, GHSA-rfgv-xxqx-mfg5 | High | 0.4% | 04 Sep, 2026 | npm undici |
undici vulnerable to downstream response splitting via retry interceptor CVE-2026-18540, GHSA-r53p-7pc4-xj5r | Low | 0.3% | 04 Sep, 2026 | npm undici |
undici vulnerable to Denial of Service via orphaned RetryHandler response body CVE-2026-18149, GHSA-pmjh-fq2x-6v4x | Medium | 0.5% | 04 Sep, 2026 | npm undici |
SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor GHSA-6hxq-p678-4hr2 | Low | Not scored | 04 Sep, 2026 | npm @simplewebauthn/server |
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors CVE-2026-85152, GHSA-vp8m-p9jh-q5pm | High | 0.2% | 04 Sep, 2026 | npm undici |
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression CVE-2026-85024, GHSA-3wwx-pv8p-q78v | Medium | 0.4% | 04 Sep, 2026 | npm undici |
undici vulnerable to Denial of Service via WebSocketStream unclean close CVE-2026-85014, GHSA-rx4f-c7p8-82vq | High | 0.4% | 04 Sep, 2026 | npm undici |
undici vulnerable to caching and replay of unsafe HTTP method responses CVE-2026-85008, GHSA-8436-99hf-9mmv | Medium | 0.1% | 04 Sep, 2026 | npm undici |
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool CVE-2026-84961, GHSA-w293-vg96-wgc3 | Critical | 0.2% | 04 Sep, 2026 | npm undici |
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor CVE-2026-84947, GHSA-2gqq-gqf2-x968 | Medium | 0.2% | 04 Sep, 2026 | npm undici |
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches CVE-2026-84933, GHSA-2jfj-6hjv-fm6j | High | 0.3% | 04 Sep, 2026 | npm undici |
smol-toml: Denial of Service via malformed TOML documents CVE-2026-85730, GHSA-7w5x-hrqm-74c2 | High | 0.5% | 04 Sep, 2026 | npm smol-toml |
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write) CVE-2026-85651, GHSA-qxpp-qjg8-x4jv | High | 0.5% | 04 Sep, 2026 | npm trigger.dev |
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL CVE-2026-85650, GHSA-xxv7-2vv3-h682 | High | 0.3% | 04 Sep, 2026 | npm trigger.dev |
Malicious release: Malicious code in @crysnovax/baileys-fixed (npm) GHSA-262v-p7h8-9574, MAL-2026-15944 | Malicious | Not scored | 04 Sep, 2026 | npm @crysnovax/baileys-fixed |
Malicious release: Malicious code in @crysnovax/baileys-stable (npm) GHSA-p579-542j-6v98, MAL-2026-15945 | Malicious | Not scored | 04 Sep, 2026 | npm @crysnovax/baileys-stable |
Malicious release: Malicious code in @crysnovax/plug (npm) GHSA-vg98-2r8g-7qw2, MAL-2026-15946 | Malicious | Not scored | 04 Sep, 2026 | npm @crysnovax/plug |
fastify vulnerable to header validation bypass via incomplete schema case normalization CVE-2026-84428, GHSA-9q9j-q6p8-xq58 | High | 0.5% | 04 Sep, 2026 | npm fastify |
fastify vulnerable to request body replacement via an async validation result collision CVE-2026-84504, GHSA-667r-xxjv-c9mm | High | 0.4% | 04 Sep, 2026 | npm fastify |
fastify vulnerable to request validation bypass via skipped boolean false schemas CVE-2026-84469, GHSA-hwr6-493r-vm6h | High | 0.5% | 04 Sep, 2026 | npm fastify |
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers CVE-2026-76169, GHSA-p68q-wchp-6fh7 | High | 0.5% | 04 Sep, 2026 | npm fastify |
Malicious release: Malicious code in tailwind-contact-forms (npm) MAL-2026-15925 | Malicious | Not scored | 04 Sep, 2026 | npm tailwind-contact-forms |
Malicious release: Malicious code in box-sign-client-poc (npm) MAL-2026-15921 | Malicious | Not scored | 04 Sep, 2026 | npm box-sign-client-poc |
Malicious release: Malicious code in box-sign-client (npm) MAL-2026-15920 | Malicious | Not scored | 04 Sep, 2026 | npm box-sign-client |
Malicious release: Malicious code in claude-channel-discord (npm) MAL-2026-15922 | Malicious | Not scored | 04 Sep, 2026 | npm claude-channel-discord |
Malicious release: Malicious code in real-router-telemetry (npm) MAL-2026-15924 | Malicious | Not scored | 04 Sep, 2026 | npm real-router-telemetry |
Malicious release: Malicious code in line-through (npm) MAL-2026-15923 | Malicious | Not scored | 04 Sep, 2026 | npm line-through |
Malicious release: Malicious code in taskforge-9xv (npm) MAL-2026-15914 | Malicious | Not scored | 04 Sep, 2026 | npm taskforge-9xv |
Malicious release: Malicious code in taskforge-8xv (npm) MAL-2026-15913 | Malicious | Not scored | 04 Sep, 2026 | npm taskforge-8xv |
Malicious release: Malicious code in text-transform-plus (npm) MAL-2026-15915 | Malicious | Not scored | 04 Sep, 2026 | npm text-transform-plus |
Malicious release: Malicious code in tailwind-aspect (npm) MAL-2026-15912 | Malicious | Not scored | 04 Sep, 2026 | npm tailwind-aspect |
Malicious release: Malicious code in 2nestjs (npm) MAL-2026-15911 | Malicious | Not scored | 04 Sep, 2026 | npm 2nestjs |
Malicious release: Malicious code in xcryption (npm) MAL-2026-15916 | Malicious | Not scored | 04 Sep, 2026 | npm xcryption |
Malicious release: Malicious code in net-util-y8 (npm) MAL-2026-15901 | Malicious | Not scored | 04 Sep, 2026 | npm net-util-y8 |
Malicious release: Malicious code in easypanel-ctl (npm) MAL-2026-15898 | Malicious | Not scored | 04 Sep, 2026 | npm easypanel-ctl |
Malicious release: Malicious code in tailwindcss-3d-styles (npm) MAL-2026-15905 | Malicious | Not scored | 04 Sep, 2026 | npm tailwindcss-3d-styles |
Malicious release: Malicious code in easypanel-core (npm) MAL-2026-15897 | Malicious | Not scored | 04 Sep, 2026 | npm easypanel-core |
Malicious release: Malicious code in easypanel-client (npm) MAL-2026-15896 | Malicious | Not scored | 04 Sep, 2026 | npm easypanel-client |
Malicious release: Malicious code in easypanel-app (npm) MAL-2026-15895 | Malicious | Not scored | 04 Sep, 2026 | npm easypanel-app |
Malicious release: Malicious code in easypanel-docker (npm) MAL-2026-15899 | Malicious | Not scored | 04 Sep, 2026 | npm easypanel-docker |