Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @activepieces/piece-google-bigquery (npm) MAL-2026-13394 | Malicious | Not scored | 06 Aug, 2026 | npm @activepieces/piece-google-bigquery |
Malicious release: Malicious code in @activepieces/piece-google-contacts (npm) MAL-2026-13395 | Malicious | Not scored | 06 Aug, 2026 | npm @activepieces/piece-google-contacts |
Malicious release: Malicious code in @activepieces/piece-google-forms (npm) MAL-2026-13396 | Malicious | Not scored | 06 Aug, 2026 | npm @activepieces/piece-google-forms |
Malicious release: Malicious code in tsihealth-client (npm) GHSA-jcwv-5jc7-grp5, MAL-2026-13404 | Malicious | Not scored | 06 Aug, 2026 | npm tsihealth-client |
Malicious release: Malicious code in @xiaohhhh1/canvas-agent (npm) MAL-2026-13398 | Malicious | Not scored | 06 Aug, 2026 | npm @xiaohhhh1/canvas-agent |
Malicious release: Malicious code in vitest-preview-pro-all (npm) MAL-2026-13405 | Malicious | Not scored | 06 Aug, 2026 | npm vitest-preview-pro-all |
Malicious release: Malicious code in agenthub-multiagent-mcp (npm) MAL-2026-13399 | Malicious | Not scored | 06 Aug, 2026 | npm agenthub-multiagent-mcp |
Malicious release: Malicious code in streak-cache-map (npm) GHSA-wpj4-68w6-w2fh, MAL-2026-13403 | Malicious | Not scored | 06 Aug, 2026 | npm streak-cache-map |
Malicious release: Malicious code in helmet-pro (npm) MAL-2026-13401 | Malicious | Not scored | 06 Aug, 2026 | npm helmet-pro |
Malicious release: Malicious code in wallet-monitor-snap (npm) MAL-2026-13393 | Malicious | Not scored | 06 Aug, 2026 | npm wallet-monitor-snap |
Malicious release: Malicious code in golaaa (npm) MAL-2026-13392 | Malicious | Not scored | 06 Aug, 2026 | npm golaaa |
Malicious release: Malicious code in @voxepay/checkout (npm) GHSA-qgfh-mjq8-m7wx, MAL-2026-13389 | Malicious | Not scored | 06 Aug, 2026 | npm @voxepay/checkout |
Malicious release: Malicious code in @zahlen/checkout (npm) GHSA-vj9r-9wwp-6cfp, MAL-2026-13391 | Malicious | Not scored | 06 Aug, 2026 | npm @zahlen/checkout |
Malicious release: Malicious code in @simplipayng/checkout (npm) GHSA-cvhm-4vf7-gq9p, MAL-2026-13388 | Malicious | Not scored | 06 Aug, 2026 | npm @simplipayng/checkout |
Malicious release: Malicious code in @afasinatickets/common (npm) GHSA-m2g7-6r7x-29p9, MAL-2026-13387 | Malicious | Not scored | 06 Aug, 2026 | npm @afasinatickets/common |
Malicious release: Malicious code in @xsat10/baileys-xsat (npm) GHSA-fj9m-r2qx-cc39, MAL-2026-13390 | Malicious | Not scored | 06 Aug, 2026 | npm @xsat10/baileys-xsat |
Malicious release: Malicious code in @united-airlines-org/atmos-design-system (npm) MAL-2026-13435 | Malicious | Not scored | 06 Aug, 2026 | npm @united-airlines-org/atmos-design-system |
Malicious release: Malicious code in svelte-mapped-metrics (npm) GHSA-pqjj-j4gr-x575, MAL-2026-13383 | Malicious | Not scored | 05 Aug, 2026 | npm svelte-mapped-metrics |
Malicious release: Malicious code in svelte-mapping-core (npm) GHSA-qq27-fv34-9cm7, MAL-2026-13384 | Malicious | Not scored | 05 Aug, 2026 | npm svelte-mapping-core |
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation CVE-2026-71321, GHSA-9pgf-384g-p7mv | High | 0.7% | 05 Aug, 2026 | npm nuxt |
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props CVE-2026-71320, GHSA-9473-5f9j-94wq | High | 0.7% | 05 Aug, 2026 | npm nuxt |
Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host CVE-2026-71319, GHSA-279x-mwfv-vcqv | Critical | 0.6% | 05 Aug, 2026 | npm @nuxt/devtools |
Malicious release: Malicious code in @chnayser/server (npm) MAL-2026-13374 | Malicious | Not scored | 05 Aug, 2026 | npm @chnayser/server |
Nuxt: Unauthorized Component Instantiation via Server Island Props CVE-2026-71318, GHSA-48hr-524c-v5w3 | Medium | 0.3% | 05 Aug, 2026 | npm nuxt |
Malicious release: Malicious code in claude-remote-agent (npm) MAL-2026-13376 | Malicious | Not scored | 05 Aug, 2026 | npm claude-remote-agent |
Malicious release: Malicious code in ezdiscordbots (npm) MAL-2026-13377 | Malicious | Not scored | 05 Aug, 2026 | npm ezdiscordbots |
Malicious release: Malicious code in npm-dc-dev (npm) MAL-2026-13378 | Malicious | Not scored | 05 Aug, 2026 | npm npm-dc-dev |
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients CVE-2026-71316, GHSA-wm8w-6qjm-cv43 | High | 0.5% | 05 Aug, 2026 | npm nuxt |
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) CVE-2026-71315, GHSA-hxvh-4h3w-prp9 | High | 0.5% | 05 Aug, 2026 | npm nuxt |
Malicious release: Malicious code in app-api-sdk (npm) MAL-2026-13375 | Malicious | Not scored | 05 Aug, 2026 | npm app-api-sdk |
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering CVE-2026-71314, GHSA-hxcr-hm88-mpq6 | High | 0.9% | 05 Aug, 2026 | npm nuxt |
Malicious release: Malicious code in statist-browser-typed-client-sme.rko.tariffs.web (npm) GHSA-4wxq-w9rr-6pcg, MAL-2026-13379 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-sme.rko.tariffs.web |
Malicious release: Malicious code in llm-interceptor (npm) MAL-2026-13370 | Malicious | Not scored | 05 Aug, 2026 | npm llm-interceptor |
Malicious release: Malicious code in kepler (npm) GHSA-4h56-85v2-4qj4, MAL-2026-13369 | Malicious | Not scored | 05 Aug, 2026 | npm kepler |
Malicious release: Malicious code in multi-acct (npm) MAL-2026-13371 | Malicious | Not scored | 05 Aug, 2026 | npm multi-acct |
Malicious release: Malicious code in express-dever (npm) MAL-2026-13368 | Malicious | Not scored | 05 Aug, 2026 | npm express-dever |
Malicious release: Malicious code in @cliphijack/santaclaude (npm) MAL-2026-13363 | Malicious | Not scored | 05 Aug, 2026 | npm @cliphijack/santaclaude |
Malicious release: Malicious code in @ikbal_fadilah_vanexa01/vanexa-agent (npm) MAL-2026-13364 | Malicious | Not scored | 05 Aug, 2026 | npm @ikbal_fadilah_vanexa01/vanexa-agent |
Malicious release: Malicious code in @stageflight-testbed/a (npm) MAL-2026-13365 | Malicious | Not scored | 05 Aug, 2026 | npm @stageflight-testbed/a |
Malicious release: Malicious code in clawtrl-wallet (npm) MAL-2026-13367 | Malicious | Not scored | 05 Aug, 2026 | npm clawtrl-wallet |
Malicious release: Malicious code in @workoscalif/sudoku (npm) MAL-2026-13366 | Malicious | Not scored | 05 Aug, 2026 | npm @workoscalif/sudoku |
Electron: Sandboxed iframes can launch external protocol handlers CVE-2026-70612, GHSA-p2rr-rvmm-c5fp | Medium | 0.4% | 05 Aug, 2026 | npm electron |
Electron: DevTools embedder handler executes arbitrary files via shell open CVE-2026-70611, GHSA-f2r8-jv7c-xqmp | Medium | 0.2% | 05 Aug, 2026 | npm electron |
Electron: contextBridge object copy honors prototype setters CVE-2026-70610, GHSA-ff2p-hmqr-hxm4 | Medium | 0.6% | 05 Aug, 2026 | npm electron |
Malicious release: Malicious code in uzair-rajput-new (npm) MAL-2026-13360 | Malicious | Not scored | 05 Aug, 2026 | npm uzair-rajput-new |
Malicious release: Malicious code in test-dev-config (npm) MAL-2026-13359 | Malicious | Not scored | 05 Aug, 2026 | npm test-dev-config |
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter CVE-2026-70609, GHSA-4f78-qhmw-8j8m | Medium | 0.5% | 05 Aug, 2026 | npm electron |
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path CVE-2026-70608, GHSA-9f4c-93c8-jc8g | High | 0.4% | 05 Aug, 2026 | npm electron |
Malicious release: Malicious code in app-kst-engine (npm) MAL-2026-13358 | Malicious | Not scored | 05 Aug, 2026 | npm app-kst-engine |
Malicious release: Malicious code in app-hsu-layer (npm) MAL-2026-13357 | Malicious | Not scored | 05 Aug, 2026 | npm app-hsu-layer |