Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in global-intel (npm) GHSA-gr4h-f42r-xcxf, MAL-2026-13952 | Malicious | Not scored | 13 Aug, 2026 | npm global-intel |
Malicious release: Malicious code in vexium-kit (npm) MAL-2026-13963 | Malicious | Not scored | 13 Aug, 2026 | npm vexium-kit |
Malicious release: Malicious code in @kolbo/mcp (npm) MAL-2026-13938 | Malicious | Not scored | 13 Aug, 2026 | npm @kolbo/mcp |
Malicious release: Malicious code in ventra-kit (npm) MAL-2026-13962 | Malicious | Not scored | 13 Aug, 2026 | npm ventra-kit |
Malicious release: Malicious code in prediction-trader (npm) MAL-2026-13959 | Malicious | Not scored | 13 Aug, 2026 | npm prediction-trader |
Malicious release: Malicious code in velora-kit (npm) GHSA-c48p-mmxp-3g9c, MAL-2026-13961 | Malicious | Not scored | 13 Aug, 2026 | npm velora-kit |
Malicious release: Malicious code in chai-as-reformed (npm) MAL-2026-13942 | Malicious | Not scored | 13 Aug, 2026 | npm chai-as-reformed |
Malicious release: Malicious code in functions-framework-nodejs (npm) MAL-2026-13951 | Malicious | Not scored | 13 Aug, 2026 | npm functions-framework-nodejs |
Malicious release: Malicious code in cilm-ui-commons (npm) MAL-2026-13943 | Malicious | Not scored | 13 Aug, 2026 | npm cilm-ui-commons |
Malicious release: Malicious code in copytrade-core (npm) MAL-2026-13944 | Malicious | Not scored | 13 Aug, 2026 | npm copytrade-core |
Malicious release: Malicious code in fmt-util-k7x2 (npm) MAL-2026-13950 | Malicious | Not scored | 13 Aug, 2026 | npm fmt-util-k7x2 |
Malicious release: Malicious code in process-live-log (npm) MAL-2026-13960 | Malicious | Not scored | 13 Aug, 2026 | npm process-live-log |
Malicious release: Malicious code in @ethers-js/contracts (npm) MAL-2026-13937 | Malicious | Not scored | 13 Aug, 2026 | npm @ethers-js/contracts |
Malicious release: Malicious code in @opezneppelin/contracts (npm) MAL-2026-13940 | Malicious | Not scored | 13 Aug, 2026 | npm @opezneppelin/contracts |
Malicious release: Malicious code in npm-hex-utils (npm) MAL-2026-13956 | Malicious | Not scored | 13 Aug, 2026 | npm npm-hex-utils |
Malicious release: Malicious code in js-assert-plus (npm) MAL-2026-13953 | Malicious | Not scored | 13 Aug, 2026 | npm js-assert-plus |
Malicious release: Malicious code in minimalistic-assert-plus (npm) MAL-2026-13954 | Malicious | Not scored | 13 Aug, 2026 | npm minimalistic-assert-plus |
Malicious release: Malicious code in power-assert-plus (npm) MAL-2026-13958 | Malicious | Not scored | 13 Aug, 2026 | npm power-assert-plus |
Malicious release: Malicious code in postcss-initialize-plugin (npm) MAL-2026-13957 | Malicious | Not scored | 13 Aug, 2026 | npm postcss-initialize-plugin |
Malicious release: Malicious code in debug-proxy-chrome-devtools (npm) MAL-2026-13948 | Malicious | Not scored | 13 Aug, 2026 | npm debug-proxy-chrome-devtools |
Malicious release: Malicious code in date-fmt-helper-xz (npm) MAL-2026-13946 | Malicious | Not scored | 13 Aug, 2026 | npm date-fmt-helper-xz |
Malicious release: Malicious code in date-fmt-utils-helper (npm) MAL-2026-13947 | Malicious | Not scored | 13 Aug, 2026 | npm date-fmt-utils-helper |
Malicious release: Malicious code in core-js-buffer (npm) MAL-2026-13945 | Malicious | Not scored | 13 Aug, 2026 | npm core-js-buffer |
Malicious release: Malicious code in index-design-system (npm) GHSA-2mmx-39f8-r8rm, MAL-2026-14002 | Malicious | Not scored | 13 Aug, 2026 | npm index-design-system |
Malicious release: Malicious code in finvu-hdfc-sdk (npm) GHSA-h83v-q7wq-gvgf, MAL-2026-14001, SNYK-JS-FINVUHDFCSDK-18758934 | Malicious | Not scored | 13 Aug, 2026 | npm finvu-hdfc-sdk |
Malicious release: Malicious code in @dsp-next-gen-ui/needs-review (npm) GHSA-r336-hh6w-xp9q, MAL-2026-13995 | Malicious | Not scored | 13 Aug, 2026 | npm @dsp-next-gen-ui/needs-review |
Malicious release: Malicious code in blocks-angular (npm) GHSA-v98x-q47m-h6qf, MAL-2026-14000 | Malicious | Not scored | 13 Aug, 2026 | npm blocks-angular |
Malicious release: Malicious code in @caspianph/third-npm-package (npm) GHSA-g4m3-cq7f-6f85, MAL-2026-13994 | Malicious | Not scored | 13 Aug, 2026 | npm @caspianph/third-npm-package |
Malicious release: Malicious code in @caspianph/second-npm-package (npm) GHSA-qmxg-fj5j-hjx8, MAL-2026-13993 | Malicious | Not scored | 13 Aug, 2026 | npm @caspianph/second-npm-package |
Malicious release: Malicious code in @caspianph/first-npm-package (npm) GHSA-r6j8-4ffv-6mcj, MAL-2026-13992 | Malicious | Not scored | 13 Aug, 2026 | npm @caspianph/first-npm-package |
Malicious release: Malicious code in try-lock-runner (npm) GHSA-5wp3-7whm-64mv, MAL-2026-14014 | Malicious | Not scored | 13 Aug, 2026 | npm try-lock-runner |
Malicious release: Malicious code in async-lock-queue (npm) GHSA-h6x7-5w93-p56j, MAL-2026-13999 | Malicious | Not scored | 13 Aug, 2026 | npm async-lock-queue |
Malicious release: Malicious code in single-flight-lock (npm) GHSA-m29h-wrvw-xpqw, MAL-2026-14012 | Malicious | Not scored | 13 Aug, 2026 | npm single-flight-lock |
Malicious release: Malicious code in mutex-forge (npm) GHSA-2gqm-6m3p-62g5, MAL-2026-13955 | Malicious | Not scored | 13 Aug, 2026 | npm mutex-forge |
Malicious release: Malicious code in lock-deadline-guard (npm) GHSA-c74f-2wp8-f38r, MAL-2026-14004 | Malicious | Not scored | 13 Aug, 2026 | npm lock-deadline-guard |
Malicious release: Malicious code in priority-mutex-lane (npm) GHSA-fx8h-qw3r-xvf3, MAL-2026-14006 | Malicious | Not scored | 13 Aug, 2026 | npm priority-mutex-lane |
Malicious release: Malicious code in semaphore-job-pool (npm) GHSA-m4rw-m6pc-rjrx, MAL-2026-14010 | Malicious | Not scored | 13 Aug, 2026 | npm semaphore-job-pool |
Malicious release: Malicious code in resource-lease-pool (npm) GHSA-mf7m-8rhh-j3vr, MAL-2026-14008 | Malicious | Not scored | 13 Aug, 2026 | npm resource-lease-pool |
Malicious release: Malicious code in shared-slot-gate (npm) GHSA-r7rw-hjv5-9hcj, MAL-2026-14011 | Malicious | Not scored | 13 Aug, 2026 | npm shared-slot-gate |
Malicious release: Malicious code in keyed-mutex-map (npm) GHSA-vcgv-x4wj-fr9f, MAL-2026-14003 | Malicious | Not scored | 13 Aug, 2026 | npm keyed-mutex-map |
Malicious release: Malicious code in async-critical-section (npm) GHSA-wpw5-2h95-j823, MAL-2026-13998 | Malicious | Not scored | 13 Aug, 2026 | npm async-critical-section |
Malicious release: Malicious code in ts-enum-helper (npm) GHSA-7q63-6v9w-j7mf, MAL-2026-14015 | Malicious | Not scored | 13 Aug, 2026 | npm ts-enum-helper |
Malicious release: Malicious code in ai-analyzer (npm) GHSA-fqv8-262c-j5xv, MAL-2026-13934 | Malicious | Not scored | 13 Aug, 2026 | npm ai-analyzer |
Malicious release: Malicious code in datetime-format-xutil (npm) MAL-2026-13936 | Malicious | Not scored | 13 Aug, 2026 | npm datetime-format-xutil |
Malicious release: Malicious code in datetime-fmt-xutil (npm) MAL-2026-13935 | Malicious | Not scored | 13 Aug, 2026 | npm datetime-fmt-xutil |
hashi-vault-js: Vault token and secret values exposed in thrown errors CVE-2026-55102, GHSA-5pq8-3ffp-7w5m | Medium | 0.2% | 13 Aug, 2026 | npm hashi-vault-js |
ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token CVE-2026-55088, GHSA-vqfp-p66c-xrp9 | Medium | 0.4% | 13 Aug, 2026 | npm ep_etherpad-lite |
ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite CVE-2026-55086, GHSA-2jwf-f4xq-f24h | Medium | 0.1% | 13 Aug, 2026 | npm ep_etherpad-lite |
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header CVE-2026-55087, GHSA-fjgc-3mj7-8rg8 | Medium | 0.6% | 13 Aug, 2026 | npm ep_etherpad-lite |
Malicious release: Malicious code in @nolimit-agent/win32-x64 (npm) GHSA-473g-3cfv-3m59, MAL-2026-13997 | Malicious | Not scored | 13 Aug, 2026 | npm @nolimit-agent/win32-x64 |