Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @syncraft-labs/vue (npm) GHSA-pv4r-p86x-36rw, MAL-2026-14369 | Malicious | Not scored | 23 Aug, 2026 | npm @syncraft-labs/vue |
Malicious release: Malicious code in @syncraft-labs/core (npm) GHSA-vhcg-r2h4-gx3m, MAL-2026-14367 | Malicious | Not scored | 23 Aug, 2026 | npm @syncraft-labs/core |
Malicious release: Malicious code in chai-as-testkit (npm) GHSA-wg38-qj68-8g87, MAL-2026-14371 | Malicious | Not scored | 23 Aug, 2026 | npm chai-as-testkit |
Malicious release: Malicious code in rust-testing-utils (npm) MAL-2026-14374 | Malicious | Not scored | 23 Aug, 2026 | npm rust-testing-utils |
Malicious release: Malicious code in solidity-testing-utils (npm) MAL-2026-14375 | Malicious | Not scored | 23 Aug, 2026 | npm solidity-testing-utils |
Malicious release: Malicious code in hatdhat-testkit (npm) MAL-2026-14373 | Malicious | Not scored | 23 Aug, 2026 | npm hatdhat-testkit |
Malicious release: Malicious code in stillm4ddpocs-rtest-bravo (npm) MAL-2026-14378 | Malicious | Not scored | 23 Aug, 2026 | npm stillm4ddpocs-rtest-bravo |
Malicious release: Malicious code in stillm4ddpocs-demo-sprocket (npm) MAL-2026-14376 | Malicious | Not scored | 23 Aug, 2026 | npm stillm4ddpocs-demo-sprocket |
Malicious release: Malicious code in stillm4ddpocs-rtest-alpha (npm) MAL-2026-14377 | Malicious | Not scored | 23 Aug, 2026 | npm stillm4ddpocs-rtest-alpha |
Malicious release: Malicious code in @postman-cse/okta-aio-darwin-arm64 (npm) MAL-2026-14580 | Malicious | Not scored | 23 Aug, 2026 | npm @postman-cse/okta-aio-darwin-arm64 |
Malicious release: Malicious code in stillm4ddpocs-demo-gadget (npm) MAL-2026-14361 | Malicious | Not scored | 22 Aug, 2026 | npm stillm4ddpocs-demo-gadget |
Malicious release: Malicious code in stillm4ddpocs-demo-widget (npm) MAL-2026-14360 | Malicious | Not scored | 22 Aug, 2026 | npm stillm4ddpocs-demo-widget |
Malicious release: Malicious code in internallib_v902 (npm) GHSA-3p65-4jqj-5j69, MAL-2026-14359 | Malicious | Not scored | 22 Aug, 2026 | npm internallib_v902 |
Malicious release: Malicious code in @postman-cse/okta-aio-linux-arm64 (npm) GHSA-h84r-259m-g3fg, MAL-2026-14357 | Malicious | Not scored | 22 Aug, 2026 | npm @postman-cse/okta-aio-linux-arm64 |
Malicious release: Malicious code in lumen-pages-community (npm) MAL-2026-14356 | Malicious | Not scored | 21 Aug, 2026 | npm lumen-pages-community |
Malicious release: Malicious code in fuel-react (npm) MAL-2026-14355 | Malicious | Not scored | 21 Aug, 2026 | npm fuel-react |
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions CVE-2026-77415, GHSA-66mm-25pp-rfff | Critical | 0.9% | 21 Aug, 2026 | npm jsonata |
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions CVE-2026-77414, GHSA-2943-5xfg-gq5f | Critical | 0.6% | 21 Aug, 2026 | npm jsonata |
JSONata: Arbitrary Code Execution via crafted JSONata expressions CVE-2026-77413, GHSA-8gq3-vp5j-2grp | Critical | 0.7% | 21 Aug, 2026 | npm jsonata |
Keystone vulnerable to `graphql.maxTake` bypass with negative `take` CVE-2026-63421, GHSA-cqmq-8755-7xvh | High | 0.7% | 21 Aug, 2026 | npm @keystone-6/core |
Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors CVE-2026-61824, GHSA-jg4p-g6xj-4qmf | High | 0.4% | 21 Aug, 2026 | npm defuddle |
Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username CVE-2026-63466, GHSA-w4mq-xh27-6xpx | Medium | 0.3% | 21 Aug, 2026 | npm unleash-server |
Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers CVE-2026-63004, GHSA-5vf6-jrqr-78fj | Medium | 0.4% | 21 Aug, 2026 | npm unleash-server |
Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter CVE-2026-63462, GHSA-r5pq-6chh-j3xp | High | 0.7% | 21 Aug, 2026 | npm unleash-server |
Malicious release: Malicious code in kelly-sizing (npm) GHSA-vj74-3pcr-5p7j, MAL-2026-14354 | Malicious | Not scored | 21 Aug, 2026 | npm kelly-sizing |
Malicious release: Malicious code in @gfe/lx-watcher (npm) GHSA-wg37-hw83-hqwf, MAL-2026-14353 | Malicious | Not scored | 21 Aug, 2026 | npm @gfe/lx-watcher |
Malicious release: Malicious code in totp-utils (npm) GHSA-m72r-95xc-q6g8, MAL-2026-14379 | Malicious | Not scored | 21 Aug, 2026 | npm totp-utils |
Malicious release: Malicious code in tailwind-animate-css-plugin (npm) GHSA-5w98-j73p-rv7m, MAL-2026-14352 | Malicious | Not scored | 21 Aug, 2026 | npm tailwind-animate-css-plugin |
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name CVE-2026-74866, GHSA-gxm5-99cw-xjw9 | Medium | 0.3% | 21 Aug, 2026 | npm @fastify/busboy |
Malicious release: Malicious code in @next-fonts/font (npm) MAL-2026-14346 | Malicious | Not scored | 21 Aug, 2026 | npm @next-fonts/font |
Malicious release: Malicious code in mcq-session (npm) MAL-2026-14347 | Malicious | Not scored | 21 Aug, 2026 | npm mcq-session |
Malicious release: Malicious code in moidevy (npm) MAL-2026-14348 | Malicious | Not scored | 21 Aug, 2026 | npm moidevy |
Malicious release: Malicious code in express-session-handler (npm) MAL-2026-14345 | Malicious | Not scored | 21 Aug, 2026 | npm express-session-handler |
Malicious release: Malicious code in @js-lib-team/env-parser (npm) MAL-2026-14344 | Malicious | Not scored | 21 Aug, 2026 | npm @js-lib-team/env-parser |
Malicious release: Malicious code in chai-as-soul (npm) MAL-2026-14343 | Malicious | Not scored | 21 Aug, 2026 | npm chai-as-soul |
Malicious release: Malicious code in coin-fees (npm) MAL-2026-14342 | Malicious | Not scored | 21 Aug, 2026 | npm coin-fees |
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials) CVE-2026-68921, GHSA-gcr2-9v8m-gq45 | Medium | 0.3% | 20 Aug, 2026 | npm @dicebear/core npm @dicebear/initials |
gettext-converter: Prototype pollution in js2i18next() via crafted translation keys CVE-2026-55451, GHSA-f4jp-rw7w-ccwg | High | 0.6% | 20 Aug, 2026 | npm gettext-converter |
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution GHSA-ghvf-qf6h-g8x5 | High | Not scored | 20 Aug, 2026 | npm @nocobase/server |
node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS CVE-2026-54156, GHSA-6wvw-vrw4-363w | High | 0.8% | 20 Aug, 2026 | npm node-opcua |
node-opcua missing nonce verification in UserNameIdentityToken authentication CVE-2026-54155, GHSA-mq36-523m-x7vv | High | 0.4% | 20 Aug, 2026 | npm node-opcua |
next-video: Unauthenticated arbitrary file read via /api/video request handler CVE-2026-54150, GHSA-2p39-2jf3-fv2q | Medium | 0.4% | 20 Aug, 2026 | npm next-video |
Malicious release: Malicious code in exam-kit (npm) GHSA-3g8c-37c3-75vv, MAL-2026-14331 | Malicious | Not scored | 20 Aug, 2026 | npm exam-kit |
Malicious release: Malicious code in @pablo_clueless/sniffr (npm) GHSA-2gvc-mrh5-885x, MAL-2026-14330 | Malicious | Not scored | 20 Aug, 2026 | npm @pablo_clueless/sniffr |
Malicious release: Malicious code in @pablo_clueless/printr (npm) GHSA-3jxq-xch2-6hpm, MAL-2026-14329 | Malicious | Not scored | 20 Aug, 2026 | npm @pablo_clueless/printr |
Plate: SSRF with response disclosure in DOCX image embedding CVE-2026-65842, GHSA-4q39-2jhr-7qx8 | High | 0.5% | 20 Aug, 2026 | npm @platejs/docx-io |
link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897 CVE-2026-61704, GHSA-cpjf-6666-r8fx | High | 0.5% | 20 Aug, 2026 | npm link-preview-js |
Malicious release: Malicious code in ethereum-validator (npm) GHSA-f4c6-m557-c5qf, MAL-2026-14327 | Malicious | Not scored | 20 Aug, 2026 | npm ethereum-validator |
Malicious release: Malicious code in goldstar-api-server (npm) GHSA-w5wj-pp55-835w, MAL-2026-14328 | Malicious | Not scored | 20 Aug, 2026 | npm goldstar-api-server |
Malicious release: Malicious code in create-react-app-text (npm) GHSA-9324-2pfx-4w9r, MAL-2026-14324 | Malicious | Not scored | 20 Aug, 2026 | npm create-react-app-text |