Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in eacq-dialog (npm) MAL-2026-13515 | Malicious | Not scored | 07 Aug, 2026 | npm eacq-dialog |
Malicious release: Malicious code in bigops-telephony-mock (npm) MAL-2026-13494 | Malicious | Not scored | 07 Aug, 2026 | npm bigops-telephony-mock |
Malicious release: Malicious code in ded-pwa-c-page-maker-props (npm) MAL-2026-13497 | Malicious | Not scored | 07 Aug, 2026 | npm ded-pwa-c-page-maker-props |
Malicious release: Malicious code in eacq-core (npm) MAL-2026-13514 | Malicious | Not scored | 07 Aug, 2026 | npm eacq-core |
Malicious release: Malicious code in distributorblock (npm) MAL-2026-13503 | Malicious | Not scored | 07 Aug, 2026 | npm distributorblock |
Malicious release: Malicious code in streak-kit-map (npm) GHSA-6698-9vj2-cgx8, MAL-2026-13519 | Malicious | Not scored | 07 Aug, 2026 | npm streak-kit-map |
Malicious release: Malicious code in blekit (npm) GHSA-7g22-4x8j-vfg4, MAL-2026-13495 | Malicious | Not scored | 07 Aug, 2026 | npm blekit |
Malicious release: Malicious code in postcss-theme-provider (npm) GHSA-36cv-vvf7-gj75, MAL-2026-13518 | Malicious | Not scored | 07 Aug, 2026 | npm postcss-theme-provider |
Malicious release: Malicious code in forge-gas-diff (npm) MAL-2026-13516 | Malicious | Not scored | 07 Aug, 2026 | npm forge-gas-diff |
Malicious release: Malicious code in gas-diff-core (npm) MAL-2026-13517 | Malicious | Not scored | 07 Aug, 2026 | npm gas-diff-core |
Malicious release: Malicious code in rdfxvela (npm) GHSA-7485-r458-jppf, MAL-2026-13491 | Malicious | Not scored | 07 Aug, 2026 | npm rdfxvela |
Malicious release: Malicious code in rdfxvela-build (npm) GHSA-jw4p-5x7w-fcm4, MAL-2026-13492 | Malicious | Not scored | 07 Aug, 2026 | npm rdfxvela-build |
Malicious release: Malicious code in velabuild (npm) GHSA-q7w3-723m-252j, MAL-2026-13493 | Malicious | Not scored | 07 Aug, 2026 | npm velabuild |
Malicious release: Malicious code in @prototypevip/baileys (npm) MAL-2026-13480 | Malicious | Not scored | 06 Aug, 2026 | npm @prototypevip/baileys |
Malicious release: Malicious code in merge-grid-stats (npm) MAL-2026-13484 | Malicious | Not scored | 06 Aug, 2026 | npm merge-grid-stats |
Malicious release: Malicious code in diezyclutch-baileys (npm) GHSA-89rf-mgch-fg9m, MAL-2026-13482 | Malicious | Not scored | 06 Aug, 2026 | npm diezyclutch-baileys |
Malicious release: Malicious code in cdf-tag-commander-helper (npm) MAL-2026-13481 | Malicious | Not scored | 06 Aug, 2026 | npm cdf-tag-commander-helper |
Malicious release: Malicious code in @cats-cdf/authentication (npm) MAL-2026-13478 | Malicious | Not scored | 06 Aug, 2026 | npm @cats-cdf/authentication |
Malicious release: Malicious code in @cats-cdf/browser-metrics-meter (npm) MAL-2026-13479 | Malicious | Not scored | 06 Aug, 2026 | npm @cats-cdf/browser-metrics-meter |
Malicious release: Malicious code in weight2loss (npm) MAL-2026-13485 | Malicious | Not scored | 06 Aug, 2026 | npm weight2loss |
Malicious release: Malicious code in internallib_v514 (npm) MAL-2026-13483 | Malicious | Not scored | 06 Aug, 2026 | npm internallib_v514 |
node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript CVE-2026-71498, GHSA-j4r3-hg7j-8chg | Medium | 0.2% | 06 Aug, 2026 | npm re2 |
node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length CVE-2026-71430, GHSA-8hcv-x26h-mcgp | Medium | 0.2% | 06 Aug, 2026 | npm re2 |
ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633 GHSA-w9hm-4m3m-fxmm | High | Not scored | 06 Aug, 2026 | npm ngx-extended-pdf-viewer |
PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF CVE-2026-16633, GHSA-hq66-cqwq-w95j | High | Not scored | 06 Aug, 2026 | npm pdfjs-dist |
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported GHSA-5p4m-2wfm-xmqj | High | Not scored | 06 Aug, 2026 | npm js-yaml |
Nx: Zip-Slip in the self-hosted remote cache CVE-2026-71476, GHSA-vp3h-ghgh-jr7g | High | 0.9% | 06 Aug, 2026 | npm @nx/azure-cache npm @nx/gcs-cache npm @nx/powerpack-azure-cache npm @nx/powerpack-gcs-cache +5 more |
Mermaid radar diagrams are vulnerable to DoS CVE-2026-71439, GHSA-rhh3-jpg6-66xh | Medium | 0.5% | 06 Aug, 2026 | npm mermaid |
Mermaid configuration APIs allow prototype pollution CVE-2026-71438, GHSA-c4c3-pg64-4m4v | Low | 0.4% | 06 Aug, 2026 | npm mermaid |
Malicious release: Malicious code in remote-claude-daemon (npm) MAL-2026-13455 | Malicious | Not scored | 06 Aug, 2026 | npm remote-claude-daemon |
Mermaid allows CSS injection applying to sibling elements of the diagram CVE-2026-50159, GHSA-6x64-9x62-f2gx | Medium | 0.6% | 06 Aug, 2026 | npm mermaid |
Mermaid Architecture diagrams are vulnerable to prototype pollution CVE-2026-71437, GHSA-3rrr-jr9j-h3q3 | Medium | 0.5% | 06 Aug, 2026 | npm mermaid |
Mermaid XY Charts are vulnerable to an infinite loop DoS CVE-2026-71436, GHSA-2v8p-3f2j-5mp7 | Medium | 0.6% | 06 Aug, 2026 | npm mermaid |
Malicious release: Malicious code in santana-baileys (npm) GHSA-g55h-m33r-qg9r, MAL-2026-13456 | Malicious | Not scored | 06 Aug, 2026 | npm santana-baileys |
Malicious release: Malicious code in shadowx-fca (npm) MAL-2026-13457 | Malicious | Not scored | 06 Aug, 2026 | npm shadowx-fca |
Malicious release: Malicious code in squeez (npm) MAL-2026-13458 | Malicious | Not scored | 06 Aug, 2026 | npm squeez |
Malicious release: Malicious code in supersig (npm) GHSA-vjp6-7fgj-3cgm, MAL-2026-13461 | Malicious | Not scored | 06 Aug, 2026 | npm supersig |
Malicious release: Malicious code in trimprompt (npm) MAL-2026-13462 | Malicious | Not scored | 06 Aug, 2026 | npm trimprompt |
Malicious release: Malicious code in vite-plugin-cleaner (npm) GHSA-rx9h-69c4-qhq5, MAL-2026-13463 | Malicious | Not scored | 06 Aug, 2026 | npm vite-plugin-cleaner |
Malicious release: Malicious code in vite-svg-parse (npm) GHSA-v7x8-w6xp-6mv4, MAL-2026-13464 | Malicious | Not scored | 06 Aug, 2026 | npm vite-svg-parse |
Malicious release: Malicious code in vite-vue-path-map (npm) MAL-2026-13465 | Malicious | Not scored | 06 Aug, 2026 | npm vite-vue-path-map |
Malicious release: Malicious code in xdaxx (npm) MAL-2026-13468 | Malicious | Not scored | 06 Aug, 2026 | npm xdaxx |
Malicious release: Malicious code in xxdxax (npm) MAL-2026-13469 | Malicious | Not scored | 06 Aug, 2026 | npm xxdxax |
Malicious release: Malicious code in ynastore-baileys (npm) MAL-2026-13470 | Malicious | Not scored | 06 Aug, 2026 | npm ynastore-baileys |
Malicious release: Malicious code in zyr-agent (npm) MAL-2026-13471 | Malicious | Not scored | 06 Aug, 2026 | npm zyr-agent |
Malicious release: Malicious code in elephant-tusk-runner (npm) MAL-2026-13445 | Malicious | Not scored | 06 Aug, 2026 | npm elephant-tusk-runner |
Malicious release: Malicious code in opencode-optimised-toolings (npm) MAL-2026-13452 | Malicious | Not scored | 06 Aug, 2026 | npm opencode-optimised-toolings |
Malicious release: Malicious code in dpdgroup-css (npm) MAL-2026-13444 | Malicious | Not scored | 06 Aug, 2026 | npm dpdgroup-css |
Malicious release: Malicious code in gpt-terminal-cli (npm) MAL-2026-13447 | Malicious | Not scored | 06 Aug, 2026 | npm gpt-terminal-cli |
Malicious release: Malicious code in express-chai (npm) MAL-2026-13446 | Malicious | Not scored | 06 Aug, 2026 | npm express-chai |