Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in secure-test-browser-khflxpz7 (npm) GHSA-xf8p-w65g-3q5x, MAL-2026-15376 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-khflxpz7 |
Malicious release: Malicious code in secure-test-browser-1yjarnvk (npm) GHSA-6fwp-p6m6-f567, MAL-2026-15266 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-1yjarnvk |
Malicious release: Malicious code in secure-test-browser-z6d4ruii (npm) GHSA-6gqq-8v8v-hhwj, MAL-2026-15465 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-z6d4ruii |
Malicious release: Malicious code in secure-test-browser-r270knja (npm) GHSA-fpp3-rrjf-8849, MAL-2026-15416 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-r270knja |
Malicious release: Malicious code in secure-test-browser-ezbajpcd (npm) GHSA-rrh9-56m7-ww4w, MAL-2026-15339 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-ezbajpcd |
Malicious release: Malicious code in cacao1 (npm) MAL-2026-14591 | Malicious | Not scored | 28 Aug, 2026 | npm cacao1 |
Malicious release: Malicious code in @fleetbo/svro (npm) GHSA-4hrx-gqq5-q956, MAL-2026-14586 | Malicious | Not scored | 28 Aug, 2026 | npm @fleetbo/svro |
Malicious release: Malicious code in @znan/wabot (npm) GHSA-2jxx-8fv2-h8mj, MAL-2026-14585 | Malicious | Not scored | 28 Aug, 2026 | npm @znan/wabot |
Malicious release: Malicious code in pushgitquickx (npm) GHSA-wx29-h78g-ww4f, MAL-2026-14578 | Malicious | Not scored | 27 Aug, 2026 | npm pushgitquickx |
Malicious release: Malicious code in @hd-team/app-dnpkg-prod (npm) GHSA-35w7-82wv-vwxj, MAL-2026-14571 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-dnpkg-prod |
Malicious release: Malicious code in @hd-team/app-dnpkg-beta (npm) GHSA-6p53-v557-745c, MAL-2026-14569 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-dnpkg-beta |
Malicious release: Malicious code in @hd-team/app-impkg-prod (npm) GHSA-g7cq-7vcf-rp48, MAL-2026-14575 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-impkg-prod |
Malicious release: Malicious code in @hd-team/app-impkg-test (npm) GHSA-hxxw-mprp-h9w7, MAL-2026-14576 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-impkg-test |
Malicious release: Malicious code in @hd-team/app-dnpkg-three (npm) GHSA-qwcv-3958-fhq5, MAL-2026-14574 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-dnpkg-three |
Malicious release: Malicious code in @hd-team/app-dnpkg-test (npm) GHSA-6fm3-xp27-2556, MAL-2026-14573 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-dnpkg-test |
Malicious release: Malicious code in @hd-team/app-dnpkg-eight (npm) GHSA-97qc-463w-p2jr, MAL-2026-14570 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-dnpkg-eight |
Malicious release: Malicious code in @hd-team/app-dnpkg-ten (npm) GHSA-q7mf-7f69-7qpr, MAL-2026-14572 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-dnpkg-ten |
Malicious release: Malicious code in svelte-ui-dlx (npm) GHSA-7qq8-vjh5-hpgw, MAL-2026-14579 | Malicious | Not scored | 27 Aug, 2026 | npm svelte-ui-dlx |
Malicious release: Malicious code in hydration-ui-dlx (npm) GHSA-j5x7-qc6j-xwg4, MAL-2026-14577 | Malicious | Not scored | 27 Aug, 2026 | npm hydration-ui-dlx |
Malicious release: Malicious code in tailwindcss-3d-animate (npm) GHSA-683p-54mf-9297, MAL-2026-14567 | Malicious | Not scored | 27 Aug, 2026 | npm tailwindcss-3d-animate |
Malicious release: Malicious code in tailwindcss-form-styles (npm) GHSA-8wj9-gw6r-6vqh, MAL-2026-14568 | Malicious | Not scored | 27 Aug, 2026 | npm tailwindcss-form-styles |
libreoffice-convert vulnerable to path traversal / arbitrary file write CVE-2026-54732, GHSA-gmxc-r82q-347r | Medium | 0.4% | 27 Aug, 2026 | npm libreoffice-convert |
n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter) CVE-2026-54687, GHSA-q7m3-rhxg-7vxr | Medium | 0.8% | 27 Aug, 2026 | npm n8n-nodes-sqlite3 |
Malicious release: Malicious code in stackpaths (npm) GHSA-6hcw-m358-fq4q, MAL-2026-14565 | Malicious | Not scored | 27 Aug, 2026 | npm stackpaths |
Malicious release: Malicious code in inspectstack (npm) GHSA-xjx7-pff2-34gp, MAL-2026-14560 | Malicious | Not scored | 27 Aug, 2026 | npm inspectstack |
Malicious release: Malicious code in deepjoin (npm) GHSA-37cw-jw3f-qf4v, MAL-2026-14558 | Malicious | Not scored | 27 Aug, 2026 | npm deepjoin |
Malicious release: Malicious code in charclass (npm) GHSA-ccgj-rp72-9hvj, MAL-2026-14557 | Malicious | Not scored | 27 Aug, 2026 | npm charclass |
Malicious release: Malicious code in veloq (npm) GHSA-gccc-9phc-w64p, MAL-2026-14566 | Malicious | Not scored | 27 Aug, 2026 | npm veloq |
Malicious release: Malicious code in module-relpath (npm) GHSA-pmg4-2q5x-v3x5, MAL-2026-14561 | Malicious | Not scored | 27 Aug, 2026 | npm module-relpath |
Malicious release: Malicious code in sigcheck (npm) GHSA-qm8v-w5qj-32jq, MAL-2026-14564 | Malicious | Not scored | 27 Aug, 2026 | npm sigcheck |
Malicious release: Malicious code in morglog (npm) GHSA-v899-gp96-p5rv, MAL-2026-14562 | Malicious | Not scored | 27 Aug, 2026 | npm morglog |
Malicious release: Malicious code in imo-allowlist-xss-poc (npm) GHSA-4whj-8383-9gc6, MAL-2026-14559 | Malicious | Not scored | 27 Aug, 2026 | npm imo-allowlist-xss-poc |
Malicious release: Malicious code in rn-push-provisioning (npm) GHSA-mjgw-fv57-pvwm, MAL-2026-14563 | Malicious | Not scored | 27 Aug, 2026 | npm rn-push-provisioning |
Malicious release: Malicious code in @cortana-md/engine (npm) GHSA-2569-5468-g975, MAL-2026-14553 | Malicious | Not scored | 27 Aug, 2026 | npm @cortana-md/engine |
Malicious release: Malicious code in bnotify-web-sdk (npm) GHSA-h2p9-v9rw-px6c, MAL-2026-14551 | Malicious | Not scored | 27 Aug, 2026 | npm bnotify-web-sdk |
Malicious release: Malicious code in dumb-binding-gyp-package (npm) GHSA-p8h8-j624-2qhc, MAL-2026-14546 | Malicious | Not scored | 26 Aug, 2026 | npm dumb-binding-gyp-package |
Malicious release: Malicious code in the_tax_free_cashier_is_at_9f (npm) GHSA-4hc4-fpvc-7chp, MAL-2026-14549 | Malicious | Not scored | 26 Aug, 2026 | npm the_tax_free_cashier_is_at_9f |
Malicious release: Malicious code in tset_racie (npm) GHSA-7978-5fh2-74q2, MAL-2026-14550 | Malicious | Not scored | 26 Aug, 2026 | npm tset_racie |
Malicious release: Malicious code in shai_hulululud (npm) GHSA-c83w-r5p2-qhmj, MAL-2026-14548 | Malicious | Not scored | 26 Aug, 2026 | npm shai_hulululud |
Malicious release: Malicious code in grandfather_of_the_desert (npm) GHSA-fjvc-xq44-gq59, MAL-2026-14547 | Malicious | Not scored | 26 Aug, 2026 | npm grandfather_of_the_desert |
Malicious release: Malicious code in self-sign (npm) GHSA-9jvg-g3cg-g557, MAL-2026-14544 | Malicious | Not scored | 26 Aug, 2026 | npm self-sign |
Malicious release: Malicious code in self-certificates (npm) GHSA-rwg4-cx82-h5hq, MAL-2026-14543 | Malicious | Not scored | 26 Aug, 2026 | npm self-certificates |
Malicious release: Malicious code in svelte-vli-ui (npm) GHSA-hxqf-cq68-wh37, MAL-2026-14541 | Malicious | Not scored | 26 Aug, 2026 | npm svelte-vli-ui |
SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed CVE-2026-54606, GHSA-w93q-cq9w-58p7 | High | 0.6% | 26 Aug, 2026 | npm suneditor |
Malicious release: Malicious code in skxcmwuncbg2 (npm) GHSA-359j-h655-qjj8, MAL-2026-15617 | Malicious | Not scored | 26 Aug, 2026 | npm skxcmwuncbg2 |
Malicious release: Malicious code in ndmushdkeqe (npm) GHSA-37vh-p33m-66qj, MAL-2026-15615 | Malicious | Not scored | 26 Aug, 2026 | npm ndmushdkeqe |
Malicious release: Malicious code in @worrisome/reutil (npm) GHSA-4f5p-mp5p-863f, MAL-2026-15604 | Malicious | Not scored | 26 Aug, 2026 | npm @worrisome/reutil |
Malicious release: Malicious code in mbxcnsuwgs1 (npm) GHSA-4vx3-9fv9-qg2m, MAL-2026-15607 | Malicious | Not scored | 26 Aug, 2026 | npm mbxcnsuwgs1 |
Malicious release: Malicious code in mn3sadkoiewu (npm) GHSA-75jq-g4f8-9qc8, MAL-2026-15610 | Malicious | Not scored | 26 Aug, 2026 | npm mn3sadkoiewu |
Malicious release: Malicious code in ndmfguyhoxc3 (npm) GHSA-78rr-8f2w-5rc6, MAL-2026-15614 | Malicious | Not scored | 26 Aug, 2026 | npm ndmfguyhoxc3 |