Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in core_main (npm) GHSA-rxjr-qr5x-q4q7, MAL-2026-15668 | Malicious | Not scored | 01 Sep, 2026 | npm core_main |
Malicious release: Malicious code in quartz-core (npm) GHSA-w63g-6crc-rq2w, MAL-2026-15671 | Malicious | Not scored | 01 Sep, 2026 | npm quartz-core |
Malicious release: Malicious code in @mrlegendbot/baileys (npm) MAL-2026-15819 | Malicious | Not scored | 01 Sep, 2026 | npm @mrlegendbot/baileys |
Malicious release: Malicious code in @systemzero/baileys (npm) MAL-2026-15820 | Malicious | Not scored | 01 Sep, 2026 | npm @systemzero/baileys |
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS GHSA-rgwj-5xj2-c3m3 | Medium | Not scored | 31 Aug, 2026 | npm mysql2 |
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install CVE-2026-82393, GHSA-vq4v-j7r6-jq4m | High | 0.6% | 31 Aug, 2026 | npm pnpm |
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph CVE-2026-82392, GHSA-c59q-g84q-2gj5 | High | 0.6% | 31 Aug, 2026 | npm pnpm |
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking CVE-2026-81888, GHSA-fm3f-ch8h-qw8q | Medium | 0.2% | 31 Aug, 2026 | npm @hono/oauth-providers |
Malicious release: Malicious code in @testrelic/appium-analytics (npm) GHSA-6cpr-jwvc-jhg7, MAL-2026-15647 | Malicious | Not scored | 31 Aug, 2026 | npm @testrelic/appium-analytics |
Malicious release: Malicious code in claude-channel-telegram (npm) MAL-2026-15624 | Malicious | Not scored | 31 Aug, 2026 | npm claude-channel-telegram |
Malicious release: Malicious code in nextjsupdater (npm) MAL-2026-15631 | Malicious | Not scored | 31 Aug, 2026 | npm nextjsupdater |
Malicious release: Malicious code in mfaatest (npm) MAL-2026-15629 | Malicious | Not scored | 31 Aug, 2026 | npm mfaatest |
Malicious release: Malicious code in hyperliquid-composer (npm) GHSA-5v7v-27c5-fr8q, MAL-2026-15627 | Malicious | Not scored | 31 Aug, 2026 | npm hyperliquid-composer |
Malicious release: Malicious code in test__123q2 (npm) MAL-2026-15638 | Malicious | Not scored | 31 Aug, 2026 | npm test__123q2 |
Malicious release: Malicious code in spc-grafeno-login (npm) MAL-2026-15633 | Malicious | Not scored | 31 Aug, 2026 | npm spc-grafeno-login |
Malicious release: Malicious code in node-request-utils (npm) MAL-2026-15632 | Malicious | Not scored | 31 Aug, 2026 | npm node-request-utils |
Malicious release: Malicious code in tailwind-minanimated (npm) MAL-2026-15634 | Malicious | Not scored | 31 Aug, 2026 | npm tailwind-minanimated |
Malicious release: Malicious code in mfafix (npm) MAL-2026-15630 | Malicious | Not scored | 31 Aug, 2026 | npm mfafix |
Malicious release: Malicious code in tailwind-modernanimation (npm) MAL-2026-15635 | Malicious | Not scored | 31 Aug, 2026 | npm tailwind-modernanimation |
Malicious release: Malicious code in mfa.io (npm) MAL-2026-15628 | Malicious | Not scored | 31 Aug, 2026 | npm mfa.io |
Malicious release: Malicious code in tailwindcss-forms-style (npm) MAL-2026-15636 | Malicious | Not scored | 31 Aug, 2026 | npm tailwindcss-forms-style |
Malicious release: Malicious code in test__123q1 (npm) MAL-2026-15637 | Malicious | Not scored | 31 Aug, 2026 | npm test__123q1 |
Malicious release: Malicious code in @baipiaodajun/npmsshx (npm) GHSA-g966-5c49-vx6m, MAL-2026-15641 | Malicious | Not scored | 31 Aug, 2026 | npm @baipiaodajun/npmsshx |
Malicious release: Malicious code in @baipiaodajun/reverseproxy-fm (npm) GHSA-gfhr-qx4h-34fv, MAL-2026-15643 | Malicious | Not scored | 31 Aug, 2026 | npm @baipiaodajun/reverseproxy-fm |
Malicious release: Malicious code in @baipiaodajun/mcbots (npm) GHSA-j3fw-7753-9v62, MAL-2026-15640 | Malicious | Not scored | 31 Aug, 2026 | npm @baipiaodajun/mcbots |
Malicious release: Malicious code in @baipiaodajun/podman_env (npm) GHSA-p684-v3gf-5wj2, MAL-2026-15642 | Malicious | Not scored | 31 Aug, 2026 | npm @baipiaodajun/podman_env |
Malicious release: Malicious code in kisama-js (npm) GHSA-vqwx-8v7g-55j3, MAL-2026-15645 | Malicious | Not scored | 31 Aug, 2026 | npm kisama-js |
Malicious release: Malicious code in @baipiaodajun/mcbot (npm) GHSA-wfgg-7wr2-9fwc, MAL-2026-15639 | Malicious | Not scored | 31 Aug, 2026 | npm @baipiaodajun/mcbot |
Malicious release: Malicious code in @pipi596888/ccursor (npm) GHSA-46qc-q49r-c3q4, MAL-2026-15644 | Malicious | Not scored | 31 Aug, 2026 | npm @pipi596888/ccursor |
Malicious release: Malicious code in pig-ui-first (npm) GHSA-cj5g-xq95-52x6, MAL-2026-15646 | Malicious | Not scored | 31 Aug, 2026 | npm pig-ui-first |
Malicious release: Malicious code in selfsigned-certificate (npm) GHSA-3whj-3fjw-x5w8, MAL-2026-15623 | Malicious | Not scored | 31 Aug, 2026 | npm selfsigned-certificate |
Malicious release: Malicious code in spc_login (npm) MAL-2026-15622 | Malicious | Not scored | 31 Aug, 2026 | npm spc_login |
Malicious release: Malicious code in gas-monitor (npm) MAL-2026-15621 | Malicious | Not scored | 31 Aug, 2026 | npm gas-monitor |
Malicious release: Malicious code in evilpostinstall (npm) MAL-2026-15625 | Malicious | Not scored | 31 Aug, 2026 | npm evilpostinstall |
Malicious release: Malicious code in eslint-prettier-js (npm) GHSA-fp43-fcrg-6w93, MAL-2026-15601 | Malicious | Not scored | 31 Aug, 2026 | npm eslint-prettier-js |
Malicious release: Malicious code in redis-cookie-server (npm) GHSA-jgx3-v64x-v2w5, MAL-2026-15602 | Malicious | Not scored | 31 Aug, 2026 | npm redis-cookie-server |
Malicious release: Malicious code in fuels-versions (npm) GHSA-7478-v9hq-9835, MAL-2026-15673 | Malicious | Not scored | 31 Aug, 2026 | npm fuels-versions |
Malicious release: Malicious code in fuels-forc (npm) GHSA-h4w6-844f-2fxw, MAL-2026-15626 | Malicious | Not scored | 31 Aug, 2026 | npm fuels-forc |
Malicious release: Malicious code in @lucideproxy/svg (npm) GHSA-6j97-93gg-j7r8, MAL-2026-15600 | Malicious | Not scored | 30 Aug, 2026 | npm @lucideproxy/svg |
Malicious release: Malicious code in cloudfcrxz (npm) GHSA-p375-pmrj-262v, MAL-2026-15581 | Malicious | Not scored | 30 Aug, 2026 | npm cloudfcrxz |
Malicious release: Malicious code in @fidzzhost/baileys (npm) GHSA-vc2v-c8j2-qxg9, MAL-2026-15579 | Malicious | Not scored | 30 Aug, 2026 | npm @fidzzhost/baileys |
Malicious release: Malicious code in brat-codex (npm) GHSA-63wg-22hx-h5q4, MAL-2026-15580 | Malicious | Not scored | 30 Aug, 2026 | npm brat-codex |
Malicious release: Malicious code in h3client (npm) GHSA-89vf-5xgx-fhq7, MAL-2026-15585 | Malicious | Not scored | 30 Aug, 2026 | npm h3client |
Malicious release: Malicious code in h2-codex (npm) GHSA-8h78-gfj3-qrp2, MAL-2026-15583 | Malicious | Not scored | 30 Aug, 2026 | npm h2-codex |
Malicious release: Malicious code in real-browser-plus (npm) GHSA-ffvr-gx62-j45m, MAL-2026-15587 | Malicious | Not scored | 30 Aug, 2026 | npm real-browser-plus |
Malicious release: Malicious code in cloufcrxz (npm) GHSA-gxpc-36pf-vcrw, MAL-2026-15582 | Malicious | Not scored | 30 Aug, 2026 | npm cloufcrxz |
Malicious release: Malicious code in h3-codex (npm) GHSA-w6m7-6jhr-mfjc, MAL-2026-15584 | Malicious | Not scored | 30 Aug, 2026 | npm h3-codex |
Malicious release: Malicious code in originaldevelopmentstelemetry (npm) GHSA-m8hq-jrvf-g8xm, MAL-2026-15586 | Malicious | Not scored | 30 Aug, 2026 | npm originaldevelopmentstelemetry |
Malicious release: Malicious code in verify-contract-ethers (npm) GHSA-cvw4-2h4c-hm3f, MAL-2026-15598 | Malicious | Not scored | 30 Aug, 2026 | npm verify-contract-ethers |
Malicious release: Malicious code in fuels-typegen (npm) GHSA-c4wf-579x-f397, MAL-2026-15593 | Malicious | Not scored | 30 Aug, 2026 | npm fuels-typegen |