Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads CVE-2026-70604, GHSA-v3j7-r9gq-3gjw | High | 0.4% | 05 Aug, 2026 | npm electron |
Electron: Extension tab APIs operate across session boundaries CVE-2026-70602, GHSA-m55f-7gqj-fr98 | Medium | 0.3% | 05 Aug, 2026 | npm electron |
Electron: shell.openPath path validation bypass via embedded null byte CVE-2026-70603, GHSA-5c9j-mhmv-5xgx | Medium | 0.1% | 05 Aug, 2026 | npm electron |
Malicious release: Malicious code in @ohos-ports/codex (npm) MAL-2026-13210 | Malicious | Not scored | 05 Aug, 2026 | npm @ohos-ports/codex |
Malicious release: Malicious code in stellarfixer (npm) MAL-2026-13353 | Malicious | Not scored | 05 Aug, 2026 | npm stellarfixer |
Malicious release: Malicious code in ezfnfix (npm) MAL-2026-13344 | Malicious | Not scored | 05 Aug, 2026 | npm ezfnfix |
Malicious release: Malicious code in encrypt-string-safe (npm) MAL-2026-13342 | Malicious | Not scored | 05 Aug, 2026 | npm encrypt-string-safe |
Malicious release: Malicious code in @guangnao/claude-cli (npm) MAL-2026-13209 | Malicious | Not scored | 05 Aug, 2026 | npm @guangnao/claude-cli |
Malicious release: Malicious code in native-hello-plugin (npm) MAL-2026-13350 | Malicious | Not scored | 05 Aug, 2026 | npm native-hello-plugin |
Malicious release: Malicious code in akamai-sensorv2 (npm) MAL-2026-13217 | Malicious | Not scored | 05 Aug, 2026 | npm akamai-sensorv2 |
Malicious release: Malicious code in akamai-sensorv1 (npm) MAL-2026-13216 | Malicious | Not scored | 05 Aug, 2026 | npm akamai-sensorv1 |
Malicious release: Malicious code in stellar-api-core (npm) MAL-2026-13352 | Malicious | Not scored | 05 Aug, 2026 | npm stellar-api-core |
Electron: Context isolation bypass via Function.prototype.bind hijack CVE-2026-70601, GHSA-h7rp-cf8h-j98x | High | 0.3% | 05 Aug, 2026 | npm electron |
Malicious release: Malicious code in javas-crypto (npm) MAL-2026-13347 | Malicious | Not scored | 05 Aug, 2026 | npm javas-crypto |
Malicious release: Malicious code in bitcoinjs-wallet (npm) MAL-2026-13258 | Malicious | Not scored | 05 Aug, 2026 | npm bitcoinjs-wallet |
Electron: Cross-origin iframe can position native autofill popup CVE-2026-70600, GHSA-x8rc-wpg4-grpf | Medium | 0.2% | 05 Aug, 2026 | npm electron |
Malicious release: Malicious code in dlab_workshop (npm) MAL-2026-13277 | Malicious | Not scored | 05 Aug, 2026 | npm dlab_workshop |
Malicious release: Malicious code in ethers-signer (npm) MAL-2026-13343 | Malicious | Not scored | 05 Aug, 2026 | npm ethers-signer |
Malicious release: Malicious code in hd-key-generator (npm) MAL-2026-13345 | Malicious | Not scored | 05 Aug, 2026 | npm hd-key-generator |
Malicious release: Malicious code in hdkey-wallet (npm) MAL-2026-13346 | Malicious | Not scored | 05 Aug, 2026 | npm hdkey-wallet |
Malicious release: Malicious code in web3-utils-crypto (npm) MAL-2026-13354 | Malicious | Not scored | 05 Aug, 2026 | npm web3-utils-crypto |
Malicious release: Malicious code in bip39-generator (npm) MAL-2026-13257 | Malicious | Not scored | 05 Aug, 2026 | npm bip39-generator |
Malicious release: Malicious code in mnemonic-to-key (npm) MAL-2026-13349 | Malicious | Not scored | 05 Aug, 2026 | npm mnemonic-to-key |
Malicious release: Malicious code in spl-token-utils (npm) MAL-2026-13351 | Malicious | Not scored | 05 Aug, 2026 | npm spl-token-utils |
Malicious release: Malicious code in chatcc-agent (npm) MAL-2026-13259 | Malicious | Not scored | 05 Aug, 2026 | npm chatcc-agent |
Malicious release: Malicious code in bigops-insite (npm) MAL-2026-13219 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-insite |
Malicious release: Malicious code in bigops-legacy-telephony-panel (npm) MAL-2026-13221 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-legacy-telephony-panel |
Malicious release: Malicious code in bigops-legacy-utils (npm) MAL-2026-13222 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-legacy-utils |
Malicious release: Malicious code in bigops-jsonpath-mapper (npm) MAL-2026-13220 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-jsonpath-mapper |
Malicious release: Malicious code in bigops-logs-player (npm) MAL-2026-13223 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-logs-player |
Malicious release: Malicious code in bigops-notes (npm) MAL-2026-13227 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-notes |
Malicious release: Malicious code in bigops-nitro-events-table (npm) MAL-2026-13226 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-nitro-events-table |
Malicious release: Malicious code in bigops-nitro-client (npm) MAL-2026-13225 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-nitro-client |
Malicious release: Malicious code in bigops-outgoing-call (npm) MAL-2026-13231 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-outgoing-call |
Malicious release: Malicious code in bigops-microfrontend (npm) MAL-2026-13224 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-microfrontend |
Malicious release: Malicious code in bigops-offers (npm) MAL-2026-13228 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-offers |
Malicious release: Malicious code in bigops-opening-file-handler (npm) MAL-2026-13229 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-opening-file-handler |
Malicious release: Malicious code in bigops-operator-status (npm) MAL-2026-13230 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-operator-status |
Malicious release: Malicious code in bigops-product-list (npm) MAL-2026-13235 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-product-list |
Malicious release: Malicious code in bigops-plugin-notification-builder (npm) MAL-2026-13232 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-plugin-notification-builder |
Malicious release: Malicious code in bigops-procedure-file-handlers (npm) MAL-2026-13233 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-procedure-file-handlers |
Malicious release: Malicious code in bigops-products (npm) MAL-2026-13236 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-products |
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin CVE-2026-70599, GHSA-9pf5-hg6p-4pwp | Medium | 0.2% | 05 Aug, 2026 | npm electron |
Malicious release: Malicious code in bigops-procedure-player (npm) MAL-2026-13234 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-procedure-player |
Malicious release: Malicious code in bigops-products-bnpl (npm) MAL-2026-13238 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-products-bnpl |
Malicious release: Malicious code in bigops-products-deposits (npm) MAL-2026-13239 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-products-deposits |
Malicious release: Malicious code in bigops-products-insurance (npm) MAL-2026-13240 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-products-insurance |
Malicious release: Malicious code in bigops-products-timeline (npm) GHSA-9f9c-qwvh-f45q, MAL-2026-13245 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-products-timeline |
Malicious release: Malicious code in bigops-products-timeline-commons (npm) MAL-2026-13246 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-products-timeline-commons |
Malicious release: Malicious code in bigops-products-investment (npm) MAL-2026-13241 | Malicious | Not scored | 05 Aug, 2026 | npm bigops-products-investment |