Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in tailwindcss-animate-styles (npm) MAL-2026-15906 | Malicious | Not scored | 04 Sep, 2026 | npm tailwindcss-animate-styles |
Malicious release: Malicious code in peertube-plugin-video-views-counter (npm) MAL-2026-15902 | Malicious | Not scored | 04 Sep, 2026 | npm peertube-plugin-video-views-counter |
Malicious release: Malicious code in tailwind-scrollbar-styles (npm) MAL-2026-15904 | Malicious | Not scored | 04 Sep, 2026 | npm tailwind-scrollbar-styles |
Malicious release: Malicious code in tiny-folder-tree (npm) MAL-2026-15907 | Malicious | Not scored | 04 Sep, 2026 | npm tiny-folder-tree |
Malicious release: Malicious code in tailwind-container-queries (npm) MAL-2026-15903 | Malicious | Not scored | 04 Sep, 2026 | npm tailwind-container-queries |
Malicious release: Malicious code in hydration-ui-pkg (npm) MAL-2026-15900 | Malicious | Not scored | 04 Sep, 2026 | npm hydration-ui-pkg |
Malicious release: Malicious code in wallet-watcher (npm) GHSA-jq3q-655j-wjqh, MAL-2026-15871 | Malicious | Not scored | 04 Sep, 2026 | npm wallet-watcher |
Malicious release: Malicious code in vitest-cli-dev (npm) MAL-2026-15870 | Malicious | Not scored | 04 Sep, 2026 | npm vitest-cli-dev |
Malicious release: Malicious code in mcp-consultasdeveiculos-client (npm) MAL-2026-15869 | Malicious | Not scored | 04 Sep, 2026 | npm mcp-consultasdeveiculos-client |
Malicious release: Malicious code in @bx-ui-framework/authentication (npm) MAL-2026-15866 | Malicious | Not scored | 04 Sep, 2026 | npm @bx-ui-framework/authentication |
Malicious release: Malicious code in @bx-ui-framework/microfrontend (npm) MAL-2026-15868 | Malicious | Not scored | 04 Sep, 2026 | npm @bx-ui-framework/microfrontend |
Malicious release: Malicious code in @bx-ui-framework/common (npm) MAL-2026-15867 | Malicious | Not scored | 04 Sep, 2026 | npm @bx-ui-framework/common |
Malicious release: Malicious code in orbitron-tui (npm) MAL-2026-16011 | Malicious | Not scored | 04 Sep, 2026 | npm orbitron-tui |
Malicious release: Malicious code in orbitron-cli (npm) MAL-2026-16012 | Malicious | Not scored | 04 Sep, 2026 | npm orbitron-cli |
Malicious release: Malicious code in agent-free (npm) MAL-2026-16013 | Malicious | Not scored | 04 Sep, 2026 | npm agent-free |
Malicious release: Malicious code in prime-coding-agent (npm) MAL-2026-16014 | Malicious | Not scored | 04 Sep, 2026 | npm prime-coding-agent |
Malicious release: Malicious code in @avigilon/node-webrtc (npm) MAL-2026-15865 | Malicious | Not scored | 03 Sep, 2026 | npm @avigilon/node-webrtc |
Malicious release: Malicious code in 1nestjs (npm) MAL-2026-15909 | Malicious | Not scored | 03 Sep, 2026 | npm 1nestjs |
Malicious release: Malicious code in 0nestjs (npm) MAL-2026-15908 | Malicious | Not scored | 03 Sep, 2026 | npm 0nestjs |
node-csv: Prototype replacement still reachable via columns path CVE-2026-85063, GHSA-8cw4-87c7-c6xx | Medium | 0.6% | 03 Sep, 2026 | npm csv-parse |
Colord: Slow rejection of oversized malformed color strings CVE-2026-85062, GHSA-2wm5-q62r-hmrv | Medium | 0.5% | 03 Sep, 2026 | npm colord |
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip CVE-2026-85061, GHSA-jrc7-96c5-q579 | Critical | 0.5% | 03 Sep, 2026 | npm maplibre-gl |
toml-node: Uncontrolled Recursion CVE-2026-77465, GHSA-82x6-q7mm-w9cf | High | 0.6% | 03 Sep, 2026 | npm toml |
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization CVE-2026-63376, GHSA-v5mp-jgw5-2x6j | High | 0.7% | 03 Sep, 2026 | npm toml |
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS) CVE-2026-71429, GHSA-528h-pc64-c93x | Medium | 0.2% | 03 Sep, 2026 | npm stream-json |
Malicious release: Malicious code in @modss/baileys (npm) GHSA-4c9v-m7qm-2mpr, MAL-2026-15918 | Malicious | Not scored | 03 Sep, 2026 | npm @modss/baileys |
Malicious release: Malicious code in @crysnovax/baileys (npm) GHSA-c34p-4828-cg5g, MAL-2026-15917 | Malicious | Not scored | 03 Sep, 2026 | npm @crysnovax/baileys |
Malicious release: Malicious code in megan-baileys (npm) MAL-2026-15919 | Malicious | Not scored | 03 Sep, 2026 | npm megan-baileys |
Malicious release: Malicious code in html_vue (npm) GHSA-3j85-w3wg-w28x, MAL-2026-15887 | Malicious | Not scored | 03 Sep, 2026 | npm html_vue |
Malicious release: Malicious code in vscode-vue (npm) GHSA-5vjf-q259-p82j, MAL-2026-15894 | Malicious | Not scored | 03 Sep, 2026 | npm vscode-vue |
Malicious release: Malicious code in @a23842/dsh-notifier (npm) GHSA-995p-9xmc-j7v3, MAL-2026-15872 | Malicious | Not scored | 03 Sep, 2026 | npm @a23842/dsh-notifier |
Malicious release: Malicious code in dsh-waste-market (npm) GHSA-h4p9-qw93-r884, MAL-2026-15879 | Malicious | Not scored | 03 Sep, 2026 | npm dsh-waste-market |
Malicious release: Malicious code in @quantixfinance/config (npm) MAL-2026-15850 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/config |
Malicious release: Malicious code in @quantixfinance/tron (npm) MAL-2026-15855 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/tron |
Malicious release: Malicious code in @quantixfinance/common (npm) MAL-2026-15849 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/common |
Malicious release: Malicious code in @quantixfinance/sdk (npm) MAL-2026-15852 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/sdk |
Malicious release: Malicious code in @quantixfinance/contracts (npm) MAL-2026-15851 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/contracts |
Malicious release: Malicious code in @quantixfinance/ui (npm) MAL-2026-15856 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/ui |
Malicious release: Malicious code in @quantixfinance/wallet (npm) MAL-2026-15857 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/wallet |
Malicious release: Malicious code in @quantixfinance/token (npm) MAL-2026-15854 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/token |
Malicious release: Malicious code in @quantixfinance/supabase (npm) MAL-2026-15853 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/supabase |
Malicious release: Malicious code in @quantixfinance/api (npm) MAL-2026-15848 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/api |
Malicious release: Malicious code in fieldbase-webapplication-buildtools (npm) MAL-2026-15847 | Malicious | Not scored | 03 Sep, 2026 | npm fieldbase-webapplication-buildtools |
Malicious release: Malicious code in btree-range-store (npm) GHSA-5p9f-98mr-w2hr, MAL-2026-15876 | Malicious | Not scored | 03 Sep, 2026 | npm btree-range-store |
Malicious release: Malicious code in priority-slot-queue (npm) GHSA-7gh9-f2pq-8vf3, MAL-2026-15892 | Malicious | Not scored | 03 Sep, 2026 | npm priority-slot-queue |
Malicious release: Malicious code in btree-time-index (npm) GHSA-7r97-jh52-2rx8, MAL-2026-15877 | Malicious | Not scored | 03 Sep, 2026 | npm btree-time-index |
Malicious release: Malicious code in sliding-score-window (npm) GHSA-7wm7-mj8v-49f7, MAL-2026-15893 | Malicious | Not scored | 03 Sep, 2026 | npm sliding-score-window |
Malicious release: Malicious code in neighbor-key-map (npm) GHSA-c7w5-hg7j-94q4, MAL-2026-15889 | Malicious | Not scored | 03 Sep, 2026 | npm neighbor-key-map |
Malicious release: Malicious code in btree-leaderboard (npm) GHSA-jj56-73wg-7pff, MAL-2026-15874 | Malicious | Not scored | 03 Sep, 2026 | npm btree-leaderboard |
Malicious release: Malicious code in btree-lru-cache (npm) GHSA-p5xg-f96c-j538, MAL-2026-15875 | Malicious | Not scored | 03 Sep, 2026 | npm btree-lru-cache |