Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in m2fcsfyjkuxb (npm) GHSA-7qc3-j6rw-97cj, MAL-2026-15605 | Malicious | Not scored | 26 Aug, 2026 | npm m2fcsfyjkuxb |
Malicious release: Malicious code in m3fdfocdoewn (npm) GHSA-875w-cq68-wx4x, MAL-2026-15606 | Malicious | Not scored | 26 Aug, 2026 | npm m3fdfocdoewn |
Malicious release: Malicious code in mndsxcusiwlk1 (npm) GHSA-9hfw-wfrj-ch4w, MAL-2026-15612 | Malicious | Not scored | 26 Aug, 2026 | npm mndsxcusiwlk1 |
Malicious release: Malicious code in ndmxchdjxn2 (npm) GHSA-fmcc-5g3h-mfcv, MAL-2026-15616 | Malicious | Not scored | 26 Aug, 2026 | npm ndmxchdjxn2 |
Malicious release: Malicious code in mjsdqwocvn (npm) GHSA-g8p8-qh38-wcch, MAL-2026-15608 | Malicious | Not scored | 26 Aug, 2026 | npm mjsdqwocvn |
Malicious release: Malicious code in mn2adskhweox (npm) GHSA-g95p-vc6m-hcc4, MAL-2026-15609 | Malicious | Not scored | 26 Aug, 2026 | npm mn2adskhweox |
Malicious release: Malicious code in tesgfvbncsdbcv (npm) GHSA-g964-6ghm-6425, MAL-2026-15618 | Malicious | Not scored | 26 Aug, 2026 | npm tesgfvbncsdbcv |
Malicious release: Malicious code in mobiwaefhxc3 (npm) GHSA-p3q4-92gv-p4rx, MAL-2026-15613 | Malicious | Not scored | 26 Aug, 2026 | npm mobiwaefhxc3 |
Malicious release: Malicious code in mn4xcouzvhus (npm) GHSA-qq52-45wm-mmfg, MAL-2026-15611 | Malicious | Not scored | 26 Aug, 2026 | npm mn4xcouzvhus |
Malicious release: Malicious code in testdgdbcsd (npm) GHSA-w89m-c7mr-rcm9, MAL-2026-15619 | Malicious | Not scored | 26 Aug, 2026 | npm testdgdbcsd |
Malicious release: Malicious code in vxhjkseuiaqkb (npm) GHSA-x28c-cwx7-wqhf, MAL-2026-15620 | Malicious | Not scored | 26 Aug, 2026 | npm vxhjkseuiaqkb |
@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys CVE-2026-54511, GHSA-8h6h-x5pq-56fq | High | 0.5% | 26 Aug, 2026 | npm @logtape/syslog |
Malicious release: Malicious code in zenntechinc-cli (npm) GHSA-6wh9-pcqw-jp9j, MAL-2026-14539 | Malicious | Not scored | 26 Aug, 2026 | npm zenntechinc-cli |
Malicious release: Malicious code in spotify-url-resolvers (npm) GHSA-w77g-6g5j-wr2r, MAL-2026-14538 | Malicious | Not scored | 26 Aug, 2026 | npm spotify-url-resolvers |
Malicious release: Malicious code in chai-plus (npm) GHSA-2r27-f59g-4hcx, MAL-2026-14533 | Malicious | Not scored | 26 Aug, 2026 | npm chai-plus |
Malicious release: Malicious code in commonjs-code-token (npm) MAL-2026-14534 | Malicious | Not scored | 26 Aug, 2026 | npm commonjs-code-token |
Malicious release: Malicious code in analytics-v2 (npm) MAL-2026-14531 | Malicious | Not scored | 26 Aug, 2026 | npm analytics-v2 |
Malicious release: Malicious code in mt-ts-serverless-starter (npm) MAL-2026-14536 | Malicious | Not scored | 26 Aug, 2026 | npm mt-ts-serverless-starter |
Malicious release: Malicious code in hydration-vli-ui (npm) GHSA-v229-xfmv-q98w, MAL-2026-14535 | Malicious | Not scored | 26 Aug, 2026 | npm hydration-vli-ui |
Malicious release: Malicious code in chai-as-org (npm) MAL-2026-14532 | Malicious | Not scored | 26 Aug, 2026 | npm chai-as-org |
Malicious release: Malicious code in octopus-action (npm) GHSA-27rc-jrqq-3wvj, MAL-2026-14537 | Malicious | Not scored | 26 Aug, 2026 | npm octopus-action |
Malicious release: Malicious code in @lordmega/baileys (npm) GHSA-98ch-w7w3-xfq9, MAL-2026-14540 | Malicious | Not scored | 26 Aug, 2026 | npm @lordmega/baileys |
Malicious release: Malicious code in baileys-mbuilder (npm) GHSA-8m87-xx52-4rjw, MAL-2026-14529 | Malicious | Not scored | 26 Aug, 2026 | npm baileys-mbuilder |
Malicious release: Malicious code in @fongsidev/scraper (npm) GHSA-cm89-9x7j-wr2g, MAL-2026-14527 | Malicious | Not scored | 26 Aug, 2026 | npm @fongsidev/scraper |
Malicious release: Malicious code in baileys-inmemory-store (npm) GHSA-gr9h-5xx6-g7cc, MAL-2026-14528 | Malicious | Not scored | 26 Aug, 2026 | npm baileys-inmemory-store |
Malicious release: Malicious code in infomedia (npm) GHSA-mpxq-q6j7-77jh, MAL-2026-14530 | Malicious | Not scored | 26 Aug, 2026 | npm infomedia |
Malicious release: Malicious code in omniauth-recharge-rails-example (npm) MAL-2026-14526 | Malicious | Not scored | 26 Aug, 2026 | npm omniauth-recharge-rails-example |
Malicious release: Malicious code in array-shuffler-utils-99 (npm) GHSA-22jp-536p-wwgr, MAL-2026-14519 | Malicious | Not scored | 26 Aug, 2026 | npm array-shuffler-utils-99 |
Malicious release: Malicious code in fivem-tool-helper-v2 (npm) GHSA-qgxc-chq8-gvrg, MAL-2026-14521 | Malicious | Not scored | 26 Aug, 2026 | npm fivem-tool-helper-v2 |
Malicious release: Malicious code in fivem-tool-helper (npm) GHSA-7jgv-5jq7-38g6, MAL-2026-14520 | Malicious | Not scored | 26 Aug, 2026 | npm fivem-tool-helper |
Malicious release: Malicious code in hydration-ui-cls (npm) GHSA-596w-j9vp-pr5x, MAL-2026-14517 | Malicious | Not scored | 25 Aug, 2026 | npm hydration-ui-cls |
Malicious release: Malicious code in svelte-ui-cls (npm) GHSA-q88r-gcjf-c3jc, MAL-2026-14518 | Malicious | Not scored | 25 Aug, 2026 | npm svelte-ui-cls |
consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write CVE-2026-55609, GHSA-xc9g-j69q-37xw | High | 0.2% | 25 Aug, 2026 | npm consciousness-explorer npm sublinear-time-solver |
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation) CVE-2026-55663, GHSA-p7x2-g5cq-fhmq | Medium | 0.2% | 25 Aug, 2026 | crates.io mediasoup npm mediasoup |
Malicious release: Malicious code in bamru (npm) MAL-2026-15674 | Malicious | Not scored | 25 Aug, 2026 | npm bamru |
Malicious release: Malicious code in wm-eslint-fe (npm) GHSA-59qg-7f2g-4p3c, MAL-2026-14514 | Malicious | Not scored | 25 Aug, 2026 | npm wm-eslint-fe |
Malicious release: Malicious code in wm-lib-env-provider (npm) GHSA-54m9-xjx6-pf8x, MAL-2026-14515 | Malicious | Not scored | 25 Aug, 2026 | npm wm-lib-env-provider |
Malicious release: Malicious code in hexdrift (npm) GHSA-4p5f-gmxw-44x3, MAL-2026-14508 | Malicious | Not scored | 25 Aug, 2026 | npm hexdrift |
Malicious release: Malicious code in foldmap (npm) GHSA-q4hh-v9hg-92w7, MAL-2026-14507 | Malicious | Not scored | 25 Aug, 2026 | npm foldmap |
Malicious release: Malicious code in snapbuf (npm) GHSA-82xg-f5h2-7xf8, MAL-2026-14510 | Malicious | Not scored | 25 Aug, 2026 | npm snapbuf |
Malicious release: Malicious code in dim-svelte-ui (npm) GHSA-w5m9-548m-c928, MAL-2026-14506 | Malicious | Not scored | 25 Aug, 2026 | npm dim-svelte-ui |
Malicious release: Malicious code in svelte-cls-ui (npm) GHSA-f6cw-gvwj-gw7f, MAL-2026-14511 | Malicious | Not scored | 25 Aug, 2026 | npm svelte-cls-ui |
Malicious release: Malicious code in r4wk-book (npm) GHSA-jqfp-p3qc-cqm9, MAL-2026-14509 | Malicious | Not scored | 25 Aug, 2026 | npm r4wk-book |
Malicious release: Malicious code in typedoc-xyz (npm) GHSA-v386-vp36-g4h2, MAL-2026-14513 | Malicious | Not scored | 25 Aug, 2026 | npm typedoc-xyz |
Malicious release: Malicious code in tailwind-scrollbar-hider (npm) GHSA-869j-r989-xpvr, MAL-2026-14512 | Malicious | Not scored | 25 Aug, 2026 | npm tailwind-scrollbar-hider |
browse-mcp has an arbitrary file write via unconfined download and state paths CVE-2026-55557, GHSA-m9mq-7m7q-xc6p | High | 0.2% | 25 Aug, 2026 | npm browse-mcp |
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage CVE-2026-55553, GHSA-hq3h-g68c-hp78 | High | 0.7% | 25 Aug, 2026 | npm urllib |
Malicious release: Malicious code in voice-crate-check (npm) GHSA-3vqr-jqwr-7m6q, MAL-2026-14505 | Malicious | Not scored | 25 Aug, 2026 | npm voice-crate-check |
Malicious release: Malicious code in video-crate-check (npm) GHSA-gwcq-5jcj-p2x4, MAL-2026-14504 | Malicious | Not scored | 25 Aug, 2026 | npm video-crate-check |
Malicious release: Malicious code in text-crate-check (npm) GHSA-c5pr-66ph-gfp9, MAL-2026-14503 | Malicious | Not scored | 25 Aug, 2026 | npm text-crate-check |