Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models (npm) MAL-2026-13656 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models |
Malicious release: Malicious code in sme-rko-finance-front-operations-income (npm) MAL-2026-13639 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-income |
Malicious release: Malicious code in sme-rko-finance-front-operations-feed-impl (npm) MAL-2026-13636 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-feed-impl |
Malicious release: Malicious code in sme-rko-finance-front-operations-penalty (npm) MAL-2026-13645 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-penalty |
Malicious release: Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm) MAL-2026-13655 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl |
Malicious release: Malicious code in sme-rko-finance-front-operations-feed-models (npm) MAL-2026-13637 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-feed-models |
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain CVE-2026-71851, GHSA-rg76-677x-56q9 | Critical | 0.5% | 07 Aug, 2026 | npm crypto-js |
Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure CVE-2026-71850, GHSA-f23p-vx2j-j53r | Medium | 0.3% | 07 Aug, 2026 | npm hono |
Hono: Proxy Helper does not remove response headers listed in the `Connection` header CVE-2026-71849, GHSA-79qm-7rj5-m7r9 | Low | 0.4% | 07 Aug, 2026 | npm hono |
Hono: Algorithmic Complexity DoS in Language Middleware CVE-2026-71848, GHSA-54fx-42gc-7vw4 | Medium | 0.5% | 07 Aug, 2026 | npm hono |
Malicious release: Malicious code in streak-map-kit (npm) GHSA-w8wc-wm2m-27hv, MAL-2026-13628 | Malicious | Not scored | 07 Aug, 2026 | npm streak-map-kit |
Malicious release: Malicious code in @nestjs-passport/jwt (npm) MAL-2026-13627 | Malicious | Not scored | 07 Aug, 2026 | npm @nestjs-passport/jwt |
Malicious release: Malicious code in svelte-map-visual (npm) GHSA-5qqf-5c4c-p53q, MAL-2026-13678 | Malicious | Not scored | 07 Aug, 2026 | npm svelte-map-visual |
Malicious release: Malicious code in svelte-cache-kit (npm) GHSA-9qqc-qrf8-gp8j, MAL-2026-13676 | Malicious | Not scored | 07 Aug, 2026 | npm svelte-cache-kit |
Malicious release: Malicious code in @mrbenty8jf1p9y5/oidc-bind-canary (npm) MAL-2026-13626 | Malicious | Not scored | 07 Aug, 2026 | npm @mrbenty8jf1p9y5/oidc-bind-canary |
Malicious release: Malicious code in @depup/memfs (npm) MAL-2026-13624 | Malicious | Not scored | 07 Aug, 2026 | npm @depup/memfs |
Malicious release: Malicious code in @depup/nuxt (npm) MAL-2026-13625 | Malicious | Not scored | 07 Aug, 2026 | npm @depup/nuxt |
Malicious release: Malicious code in @depup/astro (npm) MAL-2026-13622 | Malicious | Not scored | 07 Aug, 2026 | npm @depup/astro |
Malicious release: Malicious code in @depup/aws-sdk__credential-provider-process (npm) MAL-2026-13623 | Malicious | Not scored | 07 Aug, 2026 | npm @depup/aws-sdk__credential-provider-process |
Malicious release: Malicious code in @decido/backend-core (npm) MAL-2026-13621 | Malicious | Not scored | 07 Aug, 2026 | npm @decido/backend-core |
Malicious release: Malicious code in @lambda-platform/lambda-vue (npm) GHSA-jm85-g3fj-922w, MAL-2026-13668 | Malicious | Not scored | 07 Aug, 2026 | npm @lambda-platform/lambda-vue |
Malicious release: Malicious code in @catamania/front-components (npm) MAL-2026-13620 | Malicious | Not scored | 07 Aug, 2026 | npm @catamania/front-components |
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header CVE-2026-66062, GHSA-29g2-3rmr-qm68 | Medium | 0.5% | 07 Aug, 2026 | npm @sveltejs/kit |
Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint CVE-2026-72744, GHSA-7c4v-fwgw-9rf7 | Medium | 0.2% | 07 Aug, 2026 | npm nuxt |
Malicious release: Malicious code in aclade-agent (npm) MAL-2026-13614 | Malicious | Not scored | 07 Aug, 2026 | npm aclade-agent |
Malicious release: Malicious code in w-screenctl (npm) MAL-2026-13618 | Malicious | Not scored | 07 Aug, 2026 | npm w-screenctl |
Malicious release: Malicious code in agenthub-ai (npm) MAL-2026-13615 | Malicious | Not scored | 07 Aug, 2026 | npm agenthub-ai |
Malicious release: Malicious code in ts-utility-plus (npm) MAL-2026-13617 | Malicious | Not scored | 07 Aug, 2026 | npm ts-utility-plus |
Malicious release: Malicious code in hardhat-cap (npm) GHSA-3jrx-49jf-x2rp, MAL-2026-13616 | Malicious | Not scored | 07 Aug, 2026 | npm hardhat-cap |
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS CVE-2026-75838, GHSA-55q2-fjhq-7xh7 | Medium | 0.4% | 07 Aug, 2026 | npm dompurify |
Malicious release: Malicious code in big-tss (npm) MAL-2026-13613 | Malicious | Not scored | 07 Aug, 2026 | npm big-tss |
Malicious release: Malicious code in mangomind-agent (npm) MAL-2026-13611 | Malicious | Not scored | 07 Aug, 2026 | npm mangomind-agent |
Malicious release: Malicious code in transform-es2015-unicode-regex (npm) GHSA-fmrp-cpm8-5245, GHSA-jcxm-5v55-599q, MAL-2026-13612, SNYK-JS-DEPUPAWSSDKCREDENTIALPROVIDERPROCESS-18584483 | Malicious | Not scored | 07 Aug, 2026 | npm transform-es2015-unicode-regex |
Malicious release: Malicious code in f-termx (npm) MAL-2026-13610 | Malicious | Not scored | 07 Aug, 2026 | npm f-termx |
Malicious release: Malicious code in hardhat-set (npm) MAL-2026-13609 | Malicious | Not scored | 07 Aug, 2026 | npm hardhat-set |
Malicious release: Malicious code in @vertexa/prisma-fetch-engine (npm) MAL-2026-13608 | Malicious | Not scored | 07 Aug, 2026 | npm @vertexa/prisma-fetch-engine |
Malicious release: Malicious code in yakuza0 (npm) MAL-2026-13605 | Malicious | Not scored | 07 Aug, 2026 | npm yakuza0 |
Malicious release: Malicious code in @aster110/cc2wechat (npm) MAL-2026-13520 | Malicious | Not scored | 07 Aug, 2026 | npm @aster110/cc2wechat |
Malicious release: Malicious code in dojo-rn-interview (npm) GHSA-7phf-cqrv-j3jg, MAL-2026-13549 | Malicious | Not scored | 07 Aug, 2026 | npm dojo-rn-interview |
Malicious release: Malicious code in delivery-ci-codeceptjs (npm) MAL-2026-13539 | Malicious | Not scored | 07 Aug, 2026 | npm delivery-ci-codeceptjs |
Malicious release: Malicious code in dolyame-ui-inputautocomplete (npm) MAL-2026-13574 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputautocomplete |
Malicious release: Malicious code in devplatform-spa-plugin-remote-module (npm) MAL-2026-13547 | Malicious | Not scored | 07 Aug, 2026 | npm devplatform-spa-plugin-remote-module |
Malicious release: Malicious code in dolyame-ui-checkablegroup (npm) MAL-2026-13557 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-checkablegroup |
Malicious release: Malicious code in dolyame-ui-inputdate (npm) MAL-2026-13577 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputdate |
Malicious release: Malicious code in delivery-ci-jira (npm) MAL-2026-13542 | Malicious | Not scored | 07 Aug, 2026 | npm delivery-ci-jira |
Malicious release: Malicious code in dolyame-boxy-independent-bnpl-main-title (npm) MAL-2026-13552 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-boxy-independent-bnpl-main-title |
Malicious release: Malicious code in dolyame-ui-progressline (npm) MAL-2026-13596 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-progressline |
Malicious release: Malicious code in dolyame-ui-inputsearchtagged (npm) MAL-2026-13583 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputsearchtagged |
Malicious release: Malicious code in dolyame-ui-deprecatepropshoc (npm) MAL-2026-13566 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-deprecatepropshoc |
Malicious release: Malicious code in dolyame-ui-inputcount (npm) MAL-2026-13576 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputcount |