Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @stageflight-testbed/a (npm) MAL-2026-13365 | Malicious | Not scored | 05 Aug, 2026 | npm @stageflight-testbed/a |
Malicious release: Malicious code in clawtrl-wallet (npm) MAL-2026-13367 | Malicious | Not scored | 05 Aug, 2026 | npm clawtrl-wallet |
Malicious release: Malicious code in @workoscalif/sudoku (npm) MAL-2026-13366 | Malicious | Not scored | 05 Aug, 2026 | npm @workoscalif/sudoku |
Electron: Sandboxed iframes can launch external protocol handlers CVE-2026-70612, GHSA-p2rr-rvmm-c5fp | Medium | 0.4% | 05 Aug, 2026 | npm electron |
Electron: DevTools embedder handler executes arbitrary files via shell open CVE-2026-70611, GHSA-f2r8-jv7c-xqmp | Medium | 0.2% | 05 Aug, 2026 | npm electron |
Electron: contextBridge object copy honors prototype setters CVE-2026-70610, GHSA-ff2p-hmqr-hxm4 | Medium | 0.6% | 05 Aug, 2026 | npm electron |
Malicious release: Malicious code in uzair-rajput-new (npm) MAL-2026-13360 | Malicious | Not scored | 05 Aug, 2026 | npm uzair-rajput-new |
Malicious release: Malicious code in test-dev-config (npm) MAL-2026-13359 | Malicious | Not scored | 05 Aug, 2026 | npm test-dev-config |
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter CVE-2026-70609, GHSA-4f78-qhmw-8j8m | Medium | 0.5% | 05 Aug, 2026 | npm electron |
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path CVE-2026-70608, GHSA-9f4c-93c8-jc8g | High | 0.4% | 05 Aug, 2026 | npm electron |
Malicious release: Malicious code in app-kst-engine (npm) MAL-2026-13358 | Malicious | Not scored | 05 Aug, 2026 | npm app-kst-engine |
Malicious release: Malicious code in app-hsu-layer (npm) MAL-2026-13357 | Malicious | Not scored | 05 Aug, 2026 | npm app-hsu-layer |
Malicious release: Malicious code in @astralcore/sl-aura (npm) MAL-2026-13355 | Malicious | Not scored | 05 Aug, 2026 | npm @astralcore/sl-aura |
Electron: window.open features string controls some window options considered privileged CVE-2026-70607, GHSA-v93f-fgjr-hjrj | Medium | 0.6% | 05 Aug, 2026 | npm electron |
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session CVE-2026-70606, GHSA-r4w5-6pfg-jxp5 | Medium | 0.3% | 05 Aug, 2026 | npm electron |
Electron: HTTP redirect followed into local file loader CVE-2026-70605, GHSA-v64r-4m7r-3mvq | Medium | 0.3% | 05 Aug, 2026 | npm electron |
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads CVE-2026-70604, GHSA-v3j7-r9gq-3gjw | High | 0.4% | 05 Aug, 2026 | npm electron |
Electron: Extension tab APIs operate across session boundaries CVE-2026-70602, GHSA-m55f-7gqj-fr98 | Medium | 0.3% | 05 Aug, 2026 | npm electron |
Electron: shell.openPath path validation bypass via embedded null byte CVE-2026-70603, GHSA-5c9j-mhmv-5xgx | Medium | 0.1% | 05 Aug, 2026 | npm electron |
Malicious release: Malicious code in @ohos-ports/codex (npm) MAL-2026-13210 | Malicious | Not scored | 05 Aug, 2026 | npm @ohos-ports/codex |
Malicious release: Malicious code in stellarfixer (npm) MAL-2026-13353 | Malicious | Not scored | 05 Aug, 2026 | npm stellarfixer |
Malicious release: Malicious code in ezfnfix (npm) MAL-2026-13344 | Malicious | Not scored | 05 Aug, 2026 | npm ezfnfix |
Malicious release: Malicious code in encrypt-string-safe (npm) MAL-2026-13342 | Malicious | Not scored | 05 Aug, 2026 | npm encrypt-string-safe |
Malicious release: Malicious code in @guangnao/claude-cli (npm) MAL-2026-13209 | Malicious | Not scored | 05 Aug, 2026 | npm @guangnao/claude-cli |
Malicious release: Malicious code in native-hello-plugin (npm) MAL-2026-13350 | Malicious | Not scored | 05 Aug, 2026 | npm native-hello-plugin |
Malicious release: Malicious code in akamai-sensorv2 (npm) MAL-2026-13217 | Malicious | Not scored | 05 Aug, 2026 | npm akamai-sensorv2 |
Malicious release: Malicious code in akamai-sensorv1 (npm) MAL-2026-13216 | Malicious | Not scored | 05 Aug, 2026 | npm akamai-sensorv1 |
Malicious release: Malicious code in stellar-api-core (npm) MAL-2026-13352 | Malicious | Not scored | 05 Aug, 2026 | npm stellar-api-core |
Electron: Context isolation bypass via Function.prototype.bind hijack CVE-2026-70601, GHSA-h7rp-cf8h-j98x | High | 0.3% | 05 Aug, 2026 | npm electron |
Malicious release: Malicious code in javas-crypto (npm) MAL-2026-13347 | Malicious | Not scored | 05 Aug, 2026 | npm javas-crypto |
Malicious release: Malicious code in bitcoinjs-wallet (npm) MAL-2026-13258 | Malicious | Not scored | 05 Aug, 2026 | npm bitcoinjs-wallet |
Electron: Cross-origin iframe can position native autofill popup CVE-2026-70600, GHSA-x8rc-wpg4-grpf | Medium | 0.2% | 05 Aug, 2026 | npm electron |
Malicious release: Malicious code in dlab_workshop (npm) MAL-2026-13277 | Malicious | Not scored | 05 Aug, 2026 | npm dlab_workshop |
Malicious release: Malicious code in ethers-signer (npm) MAL-2026-13343 | Malicious | Not scored | 05 Aug, 2026 | npm ethers-signer |
Malicious release: Malicious code in hd-key-generator (npm) MAL-2026-13345 | Malicious | Not scored | 05 Aug, 2026 | npm hd-key-generator |
Malicious release: Malicious code in hdkey-wallet (npm) MAL-2026-13346 | Malicious | Not scored | 05 Aug, 2026 | npm hdkey-wallet |
Malicious release: Malicious code in web3-utils-crypto (npm) MAL-2026-13354 | Malicious | Not scored | 05 Aug, 2026 | npm web3-utils-crypto |
Malicious release: Malicious code in bip39-generator (npm) MAL-2026-13257 | Malicious | Not scored | 05 Aug, 2026 | npm bip39-generator |
Malicious release: Malicious code in mnemonic-to-key (npm) MAL-2026-13349 | Malicious | Not scored | 05 Aug, 2026 | npm mnemonic-to-key |
Malicious release: Malicious code in spl-token-utils (npm) MAL-2026-13351 | Malicious | Not scored | 05 Aug, 2026 | npm spl-token-utils |
Malicious release: Malicious code in chatcc-agent (npm) MAL-2026-13259 | Malicious | Not scored | 05 Aug, 2026 | npm chatcc-agent |
Malicious release: Malicious code in bigops-insite (npm) MAL-2026-13219 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-insite |
Malicious release: Malicious code in bigops-legacy-telephony-panel (npm) MAL-2026-13221 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-legacy-telephony-panel |
Malicious release: Malicious code in bigops-legacy-utils (npm) MAL-2026-13222 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-legacy-utils |
Malicious release: Malicious code in bigops-jsonpath-mapper (npm) MAL-2026-13220 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-jsonpath-mapper |
Malicious release: Malicious code in bigops-logs-player (npm) MAL-2026-13223 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-logs-player |
Malicious release: Malicious code in bigops-notes (npm) MAL-2026-13227 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-notes |
Malicious release: Malicious code in bigops-nitro-events-table (npm) MAL-2026-13226 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-nitro-events-table |
Malicious release: Malicious code in bigops-nitro-client (npm) MAL-2026-13225 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-nitro-client |
Malicious release: Malicious code in bigops-outgoing-call (npm) MAL-2026-13231 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-outgoing-call |