Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in dims-hydration-ui (npm) GHSA-5hwv-w72c-55qw, MAL-2026-14416 | Malicious | Not scored | 24 Aug, 2026 | npm dims-hydration-ui |
Malicious release: Malicious code in tkyoussef-hb (npm) GHSA-g95w-qwf7-2h4p, MAL-2026-14419 | Malicious | Not scored | 24 Aug, 2026 | npm tkyoussef-hb |
Malicious release: Malicious code in @elc-online/up-analytics (npm) MAL-2026-14443 | Malicious | Not scored | 24 Aug, 2026 | npm @elc-online/up-analytics |
Malicious release: Malicious code in react-dynamic-parser (npm) GHSA-r8wh-m45c-f35g, MAL-2026-14415 | Malicious | Not scored | 24 Aug, 2026 | npm react-dynamic-parser |
Malicious release: Malicious code in livemcp (npm) GHSA-rxwc-v5gg-9hhw, MAL-2026-14413 | Malicious | Not scored | 24 Aug, 2026 | npm livemcp |
Malicious release: Malicious code in mcp-real-chrome (npm) GHSA-vqm6-238c-g856, MAL-2026-14414 | Malicious | Not scored | 24 Aug, 2026 | npm mcp-real-chrome |
Malicious release: Malicious code in @deepaksilaych/sess (npm) GHSA-wxfm-64xv-2h3m, MAL-2026-14412 | Malicious | Not scored | 24 Aug, 2026 | npm @deepaksilaych/sess |
adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite CVE-2026-76845, GHSA-vwc7-r8mq-g2x9 | Medium | 0.2% | 24 Aug, 2026 | npm adm-zip |
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath CVE-2026-76844, GHSA-g84c-rxfj-3j2c | High | 0.6% | 24 Aug, 2026 | npm webpack-dev-middleware |
Malicious release: Malicious code in @medisend/webview-bridge (npm) GHSA-j743-3xjm-x63m, MAL-2026-14424 | Malicious | Not scored | 24 Aug, 2026 | npm @medisend/webview-bridge |
Malicious release: Malicious code in dpg-media-7ehemel (npm) MAL-2026-14411 | Malicious | Not scored | 24 Aug, 2026 | npm dpg-media-7ehemel |
Malicious release: Malicious code in @temptation.js/utils (npm) MAL-2026-14410 | Malicious | Not scored | 24 Aug, 2026 | npm @temptation.js/utils |
Malicious release: Malicious code in dext-crate-video (npm) GHSA-299m-84fp-94p9, MAL-2026-14408 | Malicious | Not scored | 24 Aug, 2026 | npm dext-crate-video |
Malicious release: Malicious code in dext-crate-check (npm) GHSA-9m4w-p72c-cqwq, MAL-2026-14406 | Malicious | Not scored | 24 Aug, 2026 | npm dext-crate-check |
Malicious release: Malicious code in create-json-client (npm) GHSA-9m88-8qj5-73j8, MAL-2026-14405 | Malicious | Not scored | 24 Aug, 2026 | npm create-json-client |
Malicious release: Malicious code in dext-crate-image (npm) GHSA-mj2f-654h-x283, MAL-2026-14407 | Malicious | Not scored | 24 Aug, 2026 | npm dext-crate-image |
Malicious release: Malicious code in polis-diraja (npm) GHSA-6rrq-x6hp-4xcm, MAL-2026-14409 | Malicious | Not scored | 24 Aug, 2026 | npm polis-diraja |
Malicious release: Malicious code in @blurrydespair/libsignal-node (npm) GHSA-rw8r-gxqp-rwfh, MAL-2026-14404 | Malicious | Not scored | 24 Aug, 2026 | npm @blurrydespair/libsignal-node |
fast-uri vulnerable to host confusion via percent-encoded scheme normalization CVE-2026-76172, GHSA-jqff-g426-hqxp | High | 0.2% | 24 Aug, 2026 | npm fast-uri |
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization CVE-2026-75975, GHSA-f65p-4m7j-42xc | High | 0.2% | 24 Aug, 2026 | npm fast-uri |
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references CVE-2026-75931, GHSA-5jgf-p345-68v8 | High | 0.4% | 24 Aug, 2026 | npm fast-uri |
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding CVE-2026-75899, GHSA-fph4-wmhf-6fwf | High | 0.2% | 24 Aug, 2026 | npm fast-uri |
Malicious release: Malicious code in react-emits (npm) GHSA-8gjf-85f5-p24f, MAL-2026-14403, SNYK-JS-REACTEMITS-19268012 | Malicious | Not scored | 24 Aug, 2026 | npm react-emits |
Malicious release: Malicious code in agentgui (npm) GHSA-3g4v-p5hc-83qm, MAL-2026-14402 | Malicious | Not scored | 24 Aug, 2026 | npm agentgui |
Malicious release: Malicious code in message-compiler (npm) MAL-2026-14392 | Malicious | Not scored | 24 Aug, 2026 | npm message-compiler |
Malicious release: Malicious code in sm-oauth (npm) GHSA-9v7m-8hh3-3mc3, MAL-2026-14398 | Malicious | Not scored | 24 Aug, 2026 | npm sm-oauth |
Malicious release: Malicious code in amundi-compare (npm) MAL-2026-14390 | Malicious | Not scored | 24 Aug, 2026 | npm amundi-compare |
Malicious release: Malicious code in fund-calculator (npm) MAL-2026-14391 | Malicious | Not scored | 24 Aug, 2026 | npm fund-calculator |
Malicious release: Malicious code in @opap/player-kyc-widget (npm) GHSA-356g-cp7r-g5f5, MAL-2026-14387 | Malicious | Not scored | 23 Aug, 2026 | npm @opap/player-kyc-widget |
Malicious release: Malicious code in sm-apikey-model (npm) GHSA-r6qx-cjjw-53q3, MAL-2026-14394 | Malicious | Not scored | 23 Aug, 2026 | npm sm-apikey-model |
Malicious release: Malicious code in sm-checkout (npm) GHSA-ccvj-vpx6-qq27, MAL-2026-14397 | Malicious | Not scored | 23 Aug, 2026 | npm sm-checkout |
Malicious release: Malicious code in sm-payment (npm) GHSA-xr9c-mx62-832c, MAL-2026-14399 | Malicious | Not scored | 23 Aug, 2026 | npm sm-payment |
Malicious release: Malicious code in sm-session (npm) GHSA-2f9h-c49j-w22r, MAL-2026-14400 | Malicious | Not scored | 23 Aug, 2026 | npm sm-session |
Malicious release: Malicious code in sm-admin (npm) GHSA-9jm5-rh3f-jr86, MAL-2026-14393 | Malicious | Not scored | 23 Aug, 2026 | npm sm-admin |
Malicious release: Malicious code in sm-cart (npm) GHSA-79hh-8hx9-8jjr, MAL-2026-14396 | Malicious | Not scored | 23 Aug, 2026 | npm sm-cart |
Malicious release: Malicious code in sm-billing-form (npm) GHSA-5fmw-xf3x-g32g, MAL-2026-14395 | Malicious | Not scored | 23 Aug, 2026 | npm sm-billing-form |
Malicious release: Malicious code in svelte-dim-kit (npm) GHSA-64x3-8jmm-fhp8, MAL-2026-14386 | Malicious | Not scored | 23 Aug, 2026 | npm svelte-dim-kit |
Malicious release: Malicious code in hydration-dim-kit (npm) GHSA-p33f-w7x3-mxrr, MAL-2026-14385 | Malicious | Not scored | 23 Aug, 2026 | npm hydration-dim-kit |
Malicious release: Malicious code in @sdgdfgdfhhhfd/multiviewr (npm) GHSA-wwgv-4qvc-7339, MAL-2026-14383 | Malicious | Not scored | 23 Aug, 2026 | npm @sdgdfgdfhhhfd/multiviewr |
Malicious release: Malicious code in @sdgdfgdfhhhfd/chainvista (npm) GHSA-849m-c6hc-74xx, MAL-2026-14382 | Malicious | Not scored | 23 Aug, 2026 | npm @sdgdfgdfhhhfd/chainvista |
Malicious release: Malicious code in fund-list-filter (npm) MAL-2026-14380 | Malicious | Not scored | 23 Aug, 2026 | npm fund-list-filter |
Malicious release: Malicious code in fund-portfolio (npm) MAL-2026-14381 | Malicious | Not scored | 23 Aug, 2026 | npm fund-portfolio |
Malicious release: Malicious code in 10-shardsight-web (npm) MAL-2026-14362 | Malicious | Not scored | 23 Aug, 2026 | npm 10-shardsight-web |
Malicious release: Malicious code in 2-loadsight-web (npm) MAL-2026-14363 | Malicious | Not scored | 23 Aug, 2026 | npm 2-loadsight-web |
Malicious release: Malicious code in 3-buildsight-web (npm) MAL-2026-14364 | Malicious | Not scored | 23 Aug, 2026 | npm 3-buildsight-web |
Malicious release: Malicious code in 8-fetchsight-web (npm) MAL-2026-14366 | Malicious | Not scored | 23 Aug, 2026 | npm 8-fetchsight-web |
Malicious release: Malicious code in 6-viewsight-web (npm) MAL-2026-14365 | Malicious | Not scored | 23 Aug, 2026 | npm 6-viewsight-web |
Malicious release: Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm) GHSA-hhfp-ggmv-qx2x, MAL-2026-14370 | Malicious | Not scored | 23 Aug, 2026 | npm @usaa-grp-personal-profile/personal-profile-common |
Malicious release: Malicious code in @syncraft-labs/react (npm) GHSA-4xx4-j6wx-746g, MAL-2026-14368 | Malicious | Not scored | 23 Aug, 2026 | npm @syncraft-labs/react |
Malicious release: Malicious code in create-coin (npm) MAL-2026-14372 | Malicious | Not scored | 23 Aug, 2026 | npm create-coin |