Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @aubea/mars (npm) MAL-2026-13415 | Malicious | Not scored | 06 Aug, 2026 | npm @aubea/mars |
Malicious release: Malicious code in @addai/entity-runtime (npm) MAL-2026-13410 | Malicious | Not scored | 06 Aug, 2026 | npm @addai/entity-runtime |
Malicious release: Malicious code in @addai/node (npm) MAL-2026-13411 | Malicious | Not scored | 06 Aug, 2026 | npm @addai/node |
Malicious release: Malicious code in @addai/ainode (npm) MAL-2026-13409 | Malicious | Not scored | 06 Aug, 2026 | npm @addai/ainode |
Malicious release: Malicious code in @activepieces/piece-base44 (npm) MAL-2026-13408 | Malicious | Not scored | 06 Aug, 2026 | npm @activepieces/piece-base44 |
Malicious release: Malicious code in @0l00000l/auth (npm) MAL-2026-13407 | Malicious | Not scored | 06 Aug, 2026 | npm @0l00000l/auth |
Malicious release: Malicious code in 9remote (npm) MAL-2026-13406 | Malicious | Not scored | 06 Aug, 2026 | npm 9remote |
Malicious release: Malicious code in beautiful-ui-monitoring (npm) MAL-2026-13422 | Malicious | Not scored | 06 Aug, 2026 | npm beautiful-ui-monitoring |
Malicious release: Malicious code in @trackunit/iris-app-sdk-vite (npm) MAL-2026-13421 | Malicious | Not scored | 06 Aug, 2026 | npm @trackunit/iris-app-sdk-vite |
Malicious release: Malicious code in @apicity/meta (npm) MAL-2026-13412 | Malicious | Not scored | 06 Aug, 2026 | npm @apicity/meta |
Malicious release: Malicious code in typst-resume-cli (npm) MAL-2026-13425 | Malicious | Not scored | 06 Aug, 2026 | npm typst-resume-cli |
Malicious release: Malicious code in agenttunnels (npm) MAL-2026-13400 | Malicious | Not scored | 06 Aug, 2026 | npm agenttunnels |
Malicious release: Malicious code in @activepieces/piece-google-bigquery (npm) MAL-2026-13394 | Malicious | Not scored | 06 Aug, 2026 | npm @activepieces/piece-google-bigquery |
Malicious release: Malicious code in @activepieces/piece-google-contacts (npm) MAL-2026-13395 | Malicious | Not scored | 06 Aug, 2026 | npm @activepieces/piece-google-contacts |
Malicious release: Malicious code in @activepieces/piece-google-forms (npm) MAL-2026-13396 | Malicious | Not scored | 06 Aug, 2026 | npm @activepieces/piece-google-forms |
Malicious release: Malicious code in tsihealth-client (npm) GHSA-jcwv-5jc7-grp5, MAL-2026-13404 | Malicious | Not scored | 06 Aug, 2026 | npm tsihealth-client |
Malicious release: Malicious code in @xiaohhhh1/canvas-agent (npm) MAL-2026-13398 | Malicious | Not scored | 06 Aug, 2026 | npm @xiaohhhh1/canvas-agent |
Malicious release: Malicious code in vitest-preview-pro-all (npm) MAL-2026-13405 | Malicious | Not scored | 06 Aug, 2026 | npm vitest-preview-pro-all |
Malicious release: Malicious code in agenthub-multiagent-mcp (npm) MAL-2026-13399 | Malicious | Not scored | 06 Aug, 2026 | npm agenthub-multiagent-mcp |
Malicious release: Malicious code in streak-cache-map (npm) GHSA-wpj4-68w6-w2fh, MAL-2026-13403 | Malicious | Not scored | 06 Aug, 2026 | npm streak-cache-map |
Malicious release: Malicious code in helmet-pro (npm) MAL-2026-13401 | Malicious | Not scored | 06 Aug, 2026 | npm helmet-pro |
Malicious release: Malicious code in wallet-monitor-snap (npm) MAL-2026-13393 | Malicious | Not scored | 06 Aug, 2026 | npm wallet-monitor-snap |
Malicious release: Malicious code in golaaa (npm) MAL-2026-13392 | Malicious | Not scored | 06 Aug, 2026 | npm golaaa |
Malicious release: Malicious code in @voxepay/checkout (npm) GHSA-qgfh-mjq8-m7wx, MAL-2026-13389 | Malicious | Not scored | 06 Aug, 2026 | npm @voxepay/checkout |
Malicious release: Malicious code in @zahlen/checkout (npm) GHSA-vj9r-9wwp-6cfp, MAL-2026-13391 | Malicious | Not scored | 06 Aug, 2026 | npm @zahlen/checkout |
Malicious release: Malicious code in @simplipayng/checkout (npm) GHSA-cvhm-4vf7-gq9p, MAL-2026-13388 | Malicious | Not scored | 06 Aug, 2026 | npm @simplipayng/checkout |
Malicious release: Malicious code in @afasinatickets/common (npm) GHSA-m2g7-6r7x-29p9, MAL-2026-13387 | Malicious | Not scored | 06 Aug, 2026 | npm @afasinatickets/common |
Malicious release: Malicious code in @xsat10/baileys-xsat (npm) GHSA-fj9m-r2qx-cc39, MAL-2026-13390 | Malicious | Not scored | 06 Aug, 2026 | npm @xsat10/baileys-xsat |
Malicious release: Malicious code in @united-airlines-org/atmos-design-system (npm) MAL-2026-13435 | Malicious | Not scored | 06 Aug, 2026 | npm @united-airlines-org/atmos-design-system |
Malicious release: Malicious code in svelte-mapped-metrics (npm) GHSA-pqjj-j4gr-x575, MAL-2026-13383 | Malicious | Not scored | 05 Aug, 2026 | npm svelte-mapped-metrics |
Malicious release: Malicious code in svelte-mapping-core (npm) GHSA-qq27-fv34-9cm7, MAL-2026-13384 | Malicious | Not scored | 05 Aug, 2026 | npm svelte-mapping-core |
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation CVE-2026-71321, GHSA-9pgf-384g-p7mv | High | 0.7% | 05 Aug, 2026 | npm nuxt |
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props CVE-2026-71320, GHSA-9473-5f9j-94wq | High | 0.7% | 05 Aug, 2026 | npm nuxt |
Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host CVE-2026-71319, GHSA-279x-mwfv-vcqv | Critical | 0.6% | 05 Aug, 2026 | npm @nuxt/devtools |
Malicious release: Malicious code in @chnayser/server (npm) MAL-2026-13374 | Malicious | Not scored | 05 Aug, 2026 | npm @chnayser/server |
Nuxt: Unauthorized Component Instantiation via Server Island Props CVE-2026-71318, GHSA-48hr-524c-v5w3 | Medium | 0.3% | 05 Aug, 2026 | npm nuxt |
Malicious release: Malicious code in claude-remote-agent (npm) MAL-2026-13376 | Malicious | Not scored | 05 Aug, 2026 | npm claude-remote-agent |
Malicious release: Malicious code in ezdiscordbots (npm) MAL-2026-13377 | Malicious | Not scored | 05 Aug, 2026 | npm ezdiscordbots |
Malicious release: Malicious code in npm-dc-dev (npm) MAL-2026-13378 | Malicious | Not scored | 05 Aug, 2026 | npm npm-dc-dev |
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients CVE-2026-71316, GHSA-wm8w-6qjm-cv43 | High | 0.5% | 05 Aug, 2026 | npm nuxt |
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) CVE-2026-71315, GHSA-hxvh-4h3w-prp9 | High | 0.5% | 05 Aug, 2026 | npm nuxt |
Malicious release: Malicious code in app-api-sdk (npm) MAL-2026-13375 | Malicious | Not scored | 05 Aug, 2026 | npm app-api-sdk |
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering CVE-2026-71314, GHSA-hxcr-hm88-mpq6 | High | 0.9% | 05 Aug, 2026 | npm nuxt |
Malicious release: Malicious code in statist-browser-typed-client-sme.rko.tariffs.web (npm) GHSA-4wxq-w9rr-6pcg, MAL-2026-13379 | Malicious | Not scored | 05 Aug, 2026 | npm statist-browser-typed-client-sme.rko.tariffs.web |
Malicious release: Malicious code in llm-interceptor (npm) MAL-2026-13370 | Malicious | Not scored | 05 Aug, 2026 | npm llm-interceptor |
Malicious release: Malicious code in kepler (npm) GHSA-4h56-85v2-4qj4, MAL-2026-13369 | Malicious | Not scored | 05 Aug, 2026 | npm kepler |
Malicious release: Malicious code in multi-acct (npm) MAL-2026-13371 | Malicious | Not scored | 05 Aug, 2026 | npm multi-acct |
Malicious release: Malicious code in express-dever (npm) MAL-2026-13368 | Malicious | Not scored | 05 Aug, 2026 | npm express-dever |
Malicious release: Malicious code in @cliphijack/santaclaude (npm) MAL-2026-13363 | Malicious | Not scored | 05 Aug, 2026 | npm @cliphijack/santaclaude |
Malicious release: Malicious code in @ikbal_fadilah_vanexa01/vanexa-agent (npm) MAL-2026-13364 | Malicious | Not scored | 05 Aug, 2026 | npm @ikbal_fadilah_vanexa01/vanexa-agent |