Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in ordered-kv-index (npm) GHSA-r948-p23m-ffg3, MAL-2026-15891 | Malicious | Not scored | 03 Sep, 2026 | npm ordered-kv-index |
Malicious release: Malicious code in btree-core (npm) GHSA-wj64-2cmx-c3j4, MAL-2026-15873 | Malicious | Not scored | 03 Sep, 2026 | npm btree-core |
Malicious release: Malicious code in ordered-freq-counter (npm) GHSA-xjh3-6ch8-mr8c, MAL-2026-15890 | Malicious | Not scored | 03 Sep, 2026 | npm ordered-freq-counter |
Malicious release: Malicious code in indexed-btree (npm) GHSA-f3xx-wvxc-5vh4, MAL-2026-15888 | Malicious | Not scored | 03 Sep, 2026 | npm indexed-btree |
Malicious release: Malicious code in cbc97b7a (npm) GHSA-9m3c-67f2-gjwf, MAL-2026-15878 | Malicious | Not scored | 03 Sep, 2026 | npm cbc97b7a |
Malicious release: Malicious code in fullcalendar-windos (npm) GHSA-r79q-6mfx-5r5v, MAL-2026-15883 | Malicious | Not scored | 03 Sep, 2026 | npm fullcalendar-windos |
Malicious release: Malicious code in element-guci-util (npm) GHSA-rv3j-whh5-7gwg, MAL-2026-15880 | Malicious | Not scored | 03 Sep, 2026 | npm element-guci-util |
Malicious release: Malicious code in element-icon-guci (npm) GHSA-vmx8-58pp-r729, MAL-2026-15881 | Malicious | Not scored | 03 Sep, 2026 | npm element-icon-guci |
Malicious release: Malicious code in guci-wxrout (npm) GHSA-wm72-hv9c-mxxr, MAL-2026-15886 | Malicious | Not scored | 03 Sep, 2026 | npm guci-wxrout |
Malicious release: Malicious code in element-utils-guci (npm) GHSA-xmq8-5hmm-8m7p, MAL-2026-15882 | Malicious | Not scored | 03 Sep, 2026 | npm element-utils-guci |
Malicious release: Malicious code in guci-main (npm) GHSA-xv44-v947-3jrh, MAL-2026-15885 | Malicious | Not scored | 03 Sep, 2026 | npm guci-main |
Malicious release: Malicious code in guci-date (npm) GHSA-pg5x-8f3x-f3x5, MAL-2026-15884 | Malicious | Not scored | 03 Sep, 2026 | npm guci-date |
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority CVE-2026-84394, GHSA-58mr-gqgx-xq4g | High | 0.4% | 03 Sep, 2026 | npm fast-uri |
Malicious release: Malicious code in google-cloud-internal-build-helper (npm) GHSA-3qp7-c8c6-w6vj, MAL-2026-15839 | Malicious | Not scored | 03 Sep, 2026 | npm google-cloud-internal-build-helper |
Malicious release: Malicious code in frank-apple-sync-service (npm) GHSA-463x-3972-8874, MAL-2026-15837 | Malicious | Not scored | 03 Sep, 2026 | npm frank-apple-sync-service |
Malicious release: Malicious code in google-cloud-internal-core-utils (npm) GHSA-4vvq-8686-f44c, MAL-2026-15840 | Malicious | Not scored | 03 Sep, 2026 | npm google-cloud-internal-core-utils |
Malicious release: Malicious code in apple-internal-test-utility (npm) GHSA-54h3-c256-wpw8, MAL-2026-15834 | Malicious | Not scored | 03 Sep, 2026 | npm apple-internal-test-utility |
Malicious release: Malicious code in apple-cktool-internal-api-v9 (npm) GHSA-5cfx-4hvj-jxm8, MAL-2026-15833 | Malicious | Not scored | 03 Sep, 2026 | npm apple-cktool-internal-api-v9 |
Malicious release: Malicious code in google-cloud-mono-repo-helper (npm) GHSA-8rcc-3mvv-4c2x, MAL-2026-15841 | Malicious | Not scored | 03 Sep, 2026 | npm google-cloud-mono-repo-helper |
Malicious release: Malicious code in google-internal-cloud-audit-security-check (npm) GHSA-cw6m-gmx9-x556, MAL-2026-15842 | Malicious | Not scored | 03 Sep, 2026 | npm google-internal-cloud-audit-security-check |
Malicious release: Malicious code in frank-apple-utils (npm) GHSA-xg8f-3qvf-9cfp, MAL-2026-15838 | Malicious | Not scored | 03 Sep, 2026 | npm frank-apple-utils |
Malicious release: Malicious code in tailwindcss-fluid-styles (npm) MAL-2026-15826 | Malicious | Not scored | 02 Sep, 2026 | npm tailwindcss-fluid-styles |
Malicious release: Malicious code in real-router-utils (npm) MAL-2026-15825 | Malicious | Not scored | 02 Sep, 2026 | npm real-router-utils |
fast-uri vulnerable to authority injection via an unvalidated port in serialize CVE-2026-84292, GHSA-qw65-cvwx-89v3 | High | 0.2% | 02 Sep, 2026 | npm fast-uri |
Malicious release: Malicious code in @stellarshift/evm-address-kit (npm) GHSA-99vv-f5jw-j464, MAL-2026-15823 | Malicious | Not scored | 02 Sep, 2026 | npm @stellarshift/evm-address-kit |
Malicious release: Malicious code in @stellarshift/abi-tools (npm) GHSA-gjx7-hpjv-9pwq, MAL-2026-15821 | Malicious | Not scored | 02 Sep, 2026 | npm @stellarshift/abi-tools |
Malicious release: Malicious code in @stellarshift/token-units (npm) GHSA-rj7g-9fgf-944x, MAL-2026-15824 | Malicious | Not scored | 02 Sep, 2026 | npm @stellarshift/token-units |
Malicious release: Malicious code in @stellarshift/chain-metadata (npm) GHSA-vwjw-qgfw-xg9m, MAL-2026-15822 | Malicious | Not scored | 02 Sep, 2026 | npm @stellarshift/chain-metadata |
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base CVE-2026-84376, GHSA-376h-93r7-7g6f | Medium | 0.7% | 02 Sep, 2026 | npm astro |
TOON: Prototype pollution when decoding untrusted TOON input CVE-2026-82404, GHSA-p95v-992w-h6c3 | High | 0.7% | 02 Sep, 2026 | npm @toon-format/toon |
Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes GHSA-cp6q-959q-f8rh | Medium | Not scored | 02 Sep, 2026 | npm @tiptap/core |
humanfs: Recursive copy follows symlinked files and copies data from outside the source tree GHSA-p498-v437-472g | Medium | Not scored | 02 Sep, 2026 | npm @humanfs/node |
Malicious release: Malicious code in onceaction (npm) GHSA-2grr-qxm8-p84x, MAL-2026-15844 | Malicious | Not scored | 02 Sep, 2026 | npm onceaction |
Malicious release: Malicious code in is-generator-check (npm) GHSA-94x2-74x8-w7hv, MAL-2026-15843 | Malicious | Not scored | 02 Sep, 2026 | npm is-generator-check |
Malicious release: Malicious code in daisypick (npm) GHSA-8ppm-gjvm-rvj5, MAL-2026-15835 | Malicious | Not scored | 02 Sep, 2026 | npm daisypick |
Malicious release: Malicious code in tailwind-theme-engine (npm) GHSA-f9gx-h8rp-2vgm, MAL-2026-15846 | Malicious | Not scored | 02 Sep, 2026 | npm tailwind-theme-engine |
Malicious release: Malicious code in eyiouss (npm) GHSA-h2w3-x32h-cpqq, MAL-2026-15836 | Malicious | Not scored | 02 Sep, 2026 | npm eyiouss |
Malicious release: Malicious code in vitest-cli-pro (npm) MAL-2026-15818 | Malicious | Not scored | 02 Sep, 2026 | npm vitest-cli-pro |
Malicious release: Malicious code in peertube-plugin-poc-marker (npm) MAL-2026-15817 | Malicious | Not scored | 02 Sep, 2026 | npm peertube-plugin-poc-marker |
Malicious release: Malicious code in cminhouse-api-gateway-nodejs (npm) MAL-2026-15815 | Malicious | Not scored | 02 Sep, 2026 | npm cminhouse-api-gateway-nodejs |
Malicious release: Malicious code in eslint-rxjs (npm) MAL-2026-15812 | Malicious | Not scored | 02 Sep, 2026 | npm eslint-rxjs |
Malicious release: Malicious code in chromatitle-dev (npm) MAL-2026-15814 | Malicious | Not scored | 02 Sep, 2026 | npm chromatitle-dev |
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources CVE-2026-84375, GHSA-2883-xcg3-v3hh | High | 0.5% | 01 Sep, 2026 | npm js-yaml |
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock CVE-2026-84373, GHSA-82fw-gwwq-j7x9 | Medium | 0.5% | 01 Sep, 2026 | npm @vitest/mocker npm vitest |
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers CVE-2026-75604, GHSA-p293-qw3h-jr36 | Critical | 2.1% | 01 Sep, 2026 | npm next |
Malicious release: Malicious code in @viertechjs/wb (npm) GHSA-3f73-cx58-g87j, MAL-2026-15832 | Malicious | Not scored | 01 Sep, 2026 | npm @viertechjs/wb |
Malicious release: Malicious code in @viertechjs/api (npm) GHSA-62qr-2m9g-fm38, MAL-2026-15830 | Malicious | Not scored | 01 Sep, 2026 | npm @viertechjs/api |
Malicious release: Malicious code in @viertechjs/baileys (npm) GHSA-wcqj-8x6x-4pxr, MAL-2026-15831 | Malicious | Not scored | 01 Sep, 2026 | npm @viertechjs/baileys |
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass CVE-2026-84371, GHSA-g8qq-57p8-ggw5 | Medium | 0.3% | 01 Sep, 2026 | npm sanitize-html |
SVGO: removeScripts allows executable links through namespace and control-character bypasses CVE-2026-84370, GHSA-w27v-7q3p-w38r | High | 0.5% | 01 Sep, 2026 | npm svgo |