Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in sui-gql-lite (npm) GHSA-r92j-xvgv-4q9c, MAL-2026-14095 | Malicious | Not scored | 14 Aug, 2026 | npm sui-gql-lite |
Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints CVE-2026-55156, GHSA-76pc-mqxp-3rq5 | Medium | 0.4% | 14 Aug, 2026 | npm @ooples/token-optimizer-mcp |
Token Optimizer MCP: OS command injection in smart_user via username in get-user-info CVE-2026-55157, GHSA-49mq-fc6q-3h46 | High | 0.9% | 14 Aug, 2026 | npm @ooples/token-optimizer-mcp |
Malicious release: Malicious code in @peptideventure/peptide-unit (npm) GHSA-73vr-mf4r-r3p5, MAL-2026-14072 | Malicious | Not scored | 14 Aug, 2026 | npm @peptideventure/peptide-unit |
Malicious release: Malicious code in @peptideventure/peptide-score-modifier (npm) GHSA-jw4c-f75m-9wfj, MAL-2026-14071 | Malicious | Not scored | 14 Aug, 2026 | npm @peptideventure/peptide-score-modifier |
Malicious release: Malicious code in @polymarkets/clob-client-v2 (npm) MAL-2026-14050 | Malicious | Not scored | 14 Aug, 2026 | npm @polymarkets/clob-client-v2 |
Malicious release: Malicious code in @mexc/shared-utils (npm) MAL-2026-14049 | Malicious | Not scored | 14 Aug, 2026 | npm @mexc/shared-utils |
Malicious release: Malicious code in @lodash-js/lodash-js (npm) MAL-2026-14048 | Malicious | Not scored | 14 Aug, 2026 | npm @lodash-js/lodash-js |
Malicious release: Malicious code in @guangnao/agent-proxy (npm) MAL-2026-14047 | Malicious | Not scored | 14 Aug, 2026 | npm @guangnao/agent-proxy |
Malicious release: Malicious code in @ghost_debugger/nanocache (npm) MAL-2026-14046 | Malicious | Not scored | 14 Aug, 2026 | npm @ghost_debugger/nanocache |
Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist CVE-2026-35219, GHSA-5fpj-28rv-84r7 | High | 0.5% | 14 Aug, 2026 | npm @budibase/server |
Malicious release: Malicious code in @ferudionz/webautomation (npm) MAL-2026-14045 | Malicious | Not scored | 14 Aug, 2026 | npm @ferudionz/webautomation |
Malicious release: Malicious code in @ferudionz/web_logger_js (npm) MAL-2026-14044 | Malicious | Not scored | 14 Aug, 2026 | npm @ferudionz/web_logger_js |
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning CVE-2026-73846, GHSA-78x9-fhhx-v2g6 | Medium | 0.2% | 14 Aug, 2026 | npm @aborruso/ckan-mcp-server |
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`) CVE-2026-73845, GHSA-83x6-42hr-jc76 | Medium | 0.4% | 14 Aug, 2026 | npm @aborruso/ckan-mcp-server |
CKAN MCP Server: Information disclosure via verbose error reflection CVE-2026-73844, GHSA-6f9w-9hf2-5rg3 | Low | 0.4% | 14 Aug, 2026 | npm @aborruso/ckan-mcp-server |
Malicious release: Malicious code in @divineubg/divine (npm) MAL-2026-14043 | Malicious | Not scored | 14 Aug, 2026 | npm @divineubg/divine |
Malicious release: Malicious code in @devmikets/hyperliquid-sdk (npm) MAL-2026-14042 | Malicious | Not scored | 14 Aug, 2026 | npm @devmikets/hyperliquid-sdk |
Malicious release: Malicious code in @demopack/www (npm) MAL-2026-14041 | Malicious | Not scored | 14 Aug, 2026 | npm @demopack/www |
Malicious release: Malicious code in @cdnshell/loader (npm) MAL-2026-14039 | Malicious | Not scored | 14 Aug, 2026 | npm @cdnshell/loader |
Malicious release: Malicious code in @workoscalifant/sudoku-term (npm) MAL-2026-14040 | Malicious | Not scored | 14 Aug, 2026 | npm @workoscalifant/sudoku-term |
Malicious release: Malicious code in axios-fast (npm) MAL-2026-14029 | Malicious | Not scored | 14 Aug, 2026 | npm axios-fast |
Malicious release: Malicious code in alelo-auth (npm) GHSA-hgrh-c34j-mc7w, MAL-2026-14021 | Malicious | Not scored | 14 Aug, 2026 | npm alelo-auth |
Malicious release: Malicious code in alelo-api (npm) GHSA-j3cg-h6v6-c6mc, MAL-2026-14020 | Malicious | Not scored | 14 Aug, 2026 | npm alelo-api |
Malicious release: Malicious code in alelo-sdk (npm) GHSA-mqpp-48wh-cm9m, MAL-2026-14026 | Malicious | Not scored | 14 Aug, 2026 | npm alelo-sdk |
Malicious release: Malicious code in datefmt-core-utils (npm) MAL-2026-14031 | Malicious | Not scored | 14 Aug, 2026 | npm datefmt-core-utils |
Malicious release: Malicious code in datefmt-simple-utils (npm) MAL-2026-14032 | Malicious | Not scored | 14 Aug, 2026 | npm datefmt-simple-utils |
Malicious release: Malicious code in alelo-utils (npm) GHSA-chg6-4g6x-82gw, MAL-2026-14028 | Malicious | Not scored | 14 Aug, 2026 | npm alelo-utils |
Malicious release: Malicious code in tailwind-plugin-kit (npm) MAL-2026-14037 | Malicious | Not scored | 14 Aug, 2026 | npm tailwind-plugin-kit |
Malicious release: Malicious code in alelo-payment (npm) GHSA-4whx-hjpv-g8xf, MAL-2026-14025 | Malicious | Not scored | 14 Aug, 2026 | npm alelo-payment |
Malicious release: Malicious code in alelo-common (npm) GHSA-4w9c-fcxm-hf28, MAL-2026-14023 | Malicious | Not scored | 14 Aug, 2026 | npm alelo-common |
Malicious release: Malicious code in meualelo (npm) GHSA-m6g5-fpx6-6x7v, MAL-2026-14033 | Malicious | Not scored | 14 Aug, 2026 | npm meualelo |
Malicious release: Malicious code in tailwind-toolkit (npm) MAL-2026-14038 | Malicious | Not scored | 14 Aug, 2026 | npm tailwind-toolkit |
Malicious release: Malicious code in bootstrap-custom-ui (npm) MAL-2026-14030 | Malicious | Not scored | 14 Aug, 2026 | npm bootstrap-custom-ui |
Malicious release: Malicious code in alelo-core (npm) GHSA-pwg9-w9cr-cg23, MAL-2026-14024 | Malicious | Not scored | 14 Aug, 2026 | npm alelo-core |
Malicious release: Malicious code in alelo-services (npm) GHSA-f9gp-j44v-7447, MAL-2026-14027 | Malicious | Not scored | 14 Aug, 2026 | npm alelo-services |
Malicious release: Malicious code in notafollower1226 (npm) MAL-2026-14036 | Malicious | Not scored | 14 Aug, 2026 | npm notafollower1226 |
Malicious release: Malicious code in alelo-client (npm) GHSA-v865-m9wp-5xhc, MAL-2026-14022 | Malicious | Not scored | 14 Aug, 2026 | npm alelo-client |
Malicious release: Malicious code in notafollower122 (npm) MAL-2026-14035 | Malicious | Not scored | 14 Aug, 2026 | npm notafollower122 |
Malicious release: Malicious code in notafollower1 (npm) MAL-2026-14034 | Malicious | Not scored | 14 Aug, 2026 | npm notafollower1 |
Malicious release: Malicious code in heft-storybook-v6-react-tutorial-storykit (npm) GHSA-p9w8-w4px-249v, MAL-2026-14083 | Malicious | Not scored | 14 Aug, 2026 | npm heft-storybook-v6-react-tutorial-storykit |
Malicious release: Malicious code in ak-mal-test-poc (npm) GHSA-p2rc-847p-5jpq, MAL-2026-14075 | Malicious | Not scored | 14 Aug, 2026 | npm ak-mal-test-poc |
Malicious release: Malicious code in game_overlay (npm) GHSA-8g9r-jp73-9wqr, MAL-2026-14081 | Malicious | Not scored | 14 Aug, 2026 | npm game_overlay |
Malicious release: Malicious code in pocbitbarrontest (npm) GHSA-55p8-9h4q-g3jf, MAL-2026-14091 | Malicious | Not scored | 14 Aug, 2026 | npm pocbitbarrontest |
Malicious release: Malicious code in zip-bundle (npm) GHSA-c3r4-rgqq-2f7v, MAL-2026-14099 | Malicious | Not scored | 14 Aug, 2026 | npm zip-bundle |
Malicious release: Malicious code in dinotech-auth-utils (npm) GHSA-xhcw-fx9m-56pc, MAL-2026-14077 | Malicious | Not scored | 14 Aug, 2026 | npm dinotech-auth-utils |
Malicious release: Malicious code in @veertly/web-app (npm) GHSA-cj2v-gp59-8682, MAL-2026-14073 | Malicious | Not scored | 14 Aug, 2026 | npm @veertly/web-app |
Malicious release: Malicious code in @vyzensockets/baileys (npm) GHSA-7q4x-h5q4-8q8m, MAL-2026-14074 | Malicious | Not scored | 14 Aug, 2026 | npm @vyzensockets/baileys |
Malicious release: Malicious code in hrp9872 (npm) GHSA-fc8q-7g22-2mh2, MAL-2026-14085 | Malicious | Not scored | 14 Aug, 2026 | npm hrp9872 |
Malicious release: Malicious code in hrp9871 (npm) GHSA-969j-h3jv-fm8w, MAL-2026-14084 | Malicious | Not scored | 14 Aug, 2026 | npm hrp9871 |