Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @servicetitan/admin-sql-table (npm) GHSA-5grm-2c2q-66hh, MAL-2026-11813 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/admin-sql-table |
Malicious release: Malicious code in @servicetitan/cp-mfe-dev (npm) GHSA-cfwx-66m7-pwp8, MAL-2026-11845 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/cp-mfe-dev |
Malicious release: Malicious code in @servicetitan/lazy-module (npm) GHSA-xf69-mmq3-34gr, MAL-2026-11885 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/lazy-module |
Malicious release: Malicious code in @servicetitan/anvil2-ext-common (npm) GHSA-q2p9-cg4w-wmxp, MAL-2026-11826 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/anvil2-ext-common |
Malicious release: Malicious code in @servicetitan/link-item (npm) GHSA-p25j-87wv-fq84, MAL-2026-11888 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/link-item |
Malicious release: Malicious code in @servicetitan/ko-bridge (npm) GHSA-8vh2-xfpr-vfq5, MAL-2026-11883 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/ko-bridge |
Malicious release: Malicious code in @servicetitan/notifications (npm) GHSA-p99p-5v9w-jv79, MAL-2026-11909 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/notifications |
Malicious release: Malicious code in @servicetitan/mfe-quick-actions (npm) GHSA-4j85-678x-wwpr, MAL-2026-11899 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/mfe-quick-actions |
Malicious release: Malicious code in @servicetitan/carto-charts-react (npm) GHSA-35h6-5mqq-hcj8, MAL-2026-11833 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/carto-charts-react |
Malicious release: Malicious code in @servicetitan/ajax-handlers (npm) GHSA-m4gc-3wwq-vh6c, MAL-2026-11814 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/ajax-handlers |
Malicious release: Malicious code in eslint-plugin-folder-schema (npm) GHSA-5f88-gwm2-m7rw, MAL-2026-11968 | Malicious | Not scored | 04 Aug, 2026 | npm eslint-plugin-folder-schema |
Malicious release: Malicious code in @servicetitan/thoughtspot-theme (npm) GHSA-8j4v-wf47-8qmj, MAL-2026-11933 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/thoughtspot-theme |
Malicious release: Malicious code in @servicetitan/titan-chat-ui-cypress (npm) GHSA-hc3x-j4q8-8qx7, MAL-2026-11938 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/titan-chat-ui-cypress |
Malicious release: Malicious code in @servicetitan/schema-comparison (npm) GHSA-qw53-cr23-328q, MAL-2026-11916 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/schema-comparison |
Malicious release: Malicious code in @servicetitan/carto-charts-core (npm) GHSA-x592-gpm8-xqcp, MAL-2026-11832 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/carto-charts-core |
Malicious release: Malicious code in @or-sdk/tables (npm) GHSA-vhg4-9g6g-g254, MAL-2026-11731 | Malicious | Not scored | 04 Aug, 2026 | npm @or-sdk/tables |
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override CVE-2026-69254, GHSA-3769-jgqc-cxm7 | Critical | 0.7% | 04 Aug, 2026 | npm flowise npm flowise-components |
Malicious release: Malicious code in @or-sdk/users (npm) GHSA-3jgw-9vhq-6mfw, MAL-2026-11735 | Malicious | Not scored | 04 Aug, 2026 | npm @or-sdk/users |
Malicious release: Malicious code in @servicetitan/eslint-plugin-decorators-declare (npm) GHSA-x3q2-g9rx-x885, MAL-2026-11862 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/eslint-plugin-decorators-declare |
Malicious release: Malicious code in @servicetitan/anvil2-ext-charts (npm) GHSA-cq8q-99vp-qjfx, MAL-2026-11825 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/anvil2-ext-charts |
Malicious release: Malicious code in @servicetitan/assist-utils (npm) GHSA-559v-vqrh-229w, MAL-2026-11831 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/assist-utils |
Malicious release: Malicious code in @servicetitan/widget-platform (npm) GHSA-v4w7-xg9f-9jwq, MAL-2026-11950 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/widget-platform |
Malicious release: Malicious code in @servicetitan/acquisition-functions (npm) GHSA-v9p9-cgq5-55jp, MAL-2026-11811 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/acquisition-functions |
Malicious release: Malicious code in @servicetitan/anvil2-ext-mwv (npm) GHSA-f7rr-5r6f-3g54, MAL-2026-11827 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/anvil2-ext-mwv |
Malicious release: Malicious code in @servicetitan/help-center (npm) GHSA-g6fm-r24r-cw47, MAL-2026-11877 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/help-center |
Malicious release: Malicious code in @servicetitan/contentful (npm) GHSA-qqwx-wf44-jv7f, MAL-2026-11841 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/contentful |
Malicious release: Malicious code in @servicetitan/widget-platform-monolith (npm) GHSA-gvcw-wg5r-hjwg, MAL-2026-11951 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/widget-platform-monolith |
Malicious release: Malicious code in @servicetitan/eh-module-communication (npm) GHSA-xhv5-4v3v-vc3v, MAL-2026-11858 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/eh-module-communication |
Malicious release: Malicious code in @servicetitan/marketing-route (npm) GHSA-4jmc-r9mf-fp8q, MAL-2026-11895 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/marketing-route |
Malicious release: Malicious code in @servicetitan/html-sketchapp (npm) GHSA-97vr-59jg-x83f, MAL-2026-11878 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/html-sketchapp |
Malicious release: Malicious code in @servicetitan/anvil-token (npm) GHSA-g9jv-9f6h-x82w, MAL-2026-11821 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/anvil-token |
Malicious release: Malicious code in @servicetitan/kendo-theme (npm) GHSA-mxvj-vqgw-8rfg, MAL-2026-11882 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/kendo-theme |
Malicious release: Malicious code in @servicetitan/quick-actions (npm) GHSA-phfr-qh27-2c82, MAL-2026-11911 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/quick-actions |
Malicious release: Malicious code in @servicetitan/carto-tokens (npm) GHSA-28qx-rhw7-pmgg, MAL-2026-11837 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/carto-tokens |
Malicious release: Malicious code in @servicetitan/startup-jest (npm) GHSA-2w9r-jxr5-frfq, MAL-2026-11924 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/startup-jest |
Malicious release: Malicious code in @servicetitan/eslint-plugin-mobx-6 (npm) GHSA-rwgv-m36w-4qqx, MAL-2026-11864 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/eslint-plugin-mobx-6 |
Malicious release: Malicious code in @servicetitan/startup-utils (npm) GHSA-fvrx-phjq-p76r, MAL-2026-11926 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/startup-utils |
Malicious release: Malicious code in @servicetitan/marketing-form (npm) GHSA-652j-h45f-c8p7, MAL-2026-11892 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/marketing-form |
Malicious release: Malicious code in @servicetitan/react-hooks (npm) GHSA-6wxq-gmqp-pqx8, MAL-2026-11912 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/react-hooks |
Malicious release: Malicious code in verdaccio-tarball-local-storage (npm) GHSA-9gjj-ggwr-8h6x, MAL-2026-11991 | Malicious | Not scored | 04 Aug, 2026 | npm verdaccio-tarball-local-storage |
Malicious release: Malicious code in @servicetitan/marketing-global-route (npm) GHSA-rf64-3f84-8frq, MAL-2026-11893 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/marketing-global-route |
Malicious release: Malicious code in @servicetitan/document-title (npm) GHSA-jgrf-cwx4-q9cq, MAL-2026-11855 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/document-title |
Malicious release: Malicious code in verdaccio-okta-oauth (npm) GHSA-wf98-jfcg-4vch, MAL-2026-11990 | Malicious | Not scored | 04 Aug, 2026 | npm verdaccio-okta-oauth |
Malicious release: Malicious code in @servicetitan/measure-sheet-data (npm) GHSA-5pgw-jhw4-3q3x, MAL-2026-11898 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/measure-sheet-data |
Malicious release: Malicious code in @onereach/ui-components (npm) GHSA-942v-37mw-mwm8, MAL-2026-11660 | Malicious | Not scored | 04 Aug, 2026 | npm @onereach/ui-components |
Malicious release: Malicious code in @onereach/orest-vue-demi-vue2 (npm) GHSA-vwgj-f76c-wrj3, MAL-2026-11617 | Malicious | Not scored | 04 Aug, 2026 | npm @onereach/orest-vue-demi-vue2 |
Malicious release: Malicious code in @servicetitan/docs-anvil-uikit-contrib (npm) GHSA-h9gm-pg7x-wvrw, MAL-2026-11853 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/docs-anvil-uikit-contrib |
Malicious release: Malicious code in @onereach/or-browser (npm) GHSA-jxq6-h2qr-qjr6, MAL-2026-11608 | Malicious | Not scored | 04 Aug, 2026 | npm @onereach/or-browser |
Malicious release: Malicious code in @servicetitan/json-render-react (npm) GHSA-3jcp-gg2p-6mvq, MAL-2026-11881 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/json-render-react |
Malicious release: Malicious code in @onereach/idw-sdk (npm) GHSA-j2wg-xm9r-vfmf, MAL-2026-11604 | Malicious | Not scored | 04 Aug, 2026 | npm @onereach/idw-sdk |