Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in datdbs (npm) GHSA-gv8r-35vj-8jj4, MAL-2026-11275 | Malicious | Not scored | 30 Jul, 2026 | npm datdbs |
Malicious release: Malicious code in bn.js-4 (npm) GHSA-gvh7-xc8j-qqwc, MAL-2026-11249 | Malicious | Not scored | 30 Jul, 2026 | npm bn.js-4 |
Malicious release: Malicious code in wistia_namespace (npm) GHSA-h3g7-ph94-2mmv, MAL-2026-11410 | Malicious | Not scored | 30 Jul, 2026 | npm wistia_namespace |
Malicious release: Malicious code in canvas-to (npm) GHSA-h56c-5267-9jg9, MAL-2026-11254 | Malicious | Not scored | 30 Jul, 2026 | npm canvas-to |
Malicious release: Malicious code in cocktail-lib (npm) GHSA-h9v8-rj29-grp6, MAL-2026-11265 | Malicious | Not scored | 30 Jul, 2026 | npm cocktail-lib |
Malicious release: Malicious code in bn.js-5 (npm) GHSA-hm53-q84x-f83x, MAL-2026-11250 | Malicious | Not scored | 30 Jul, 2026 | npm bn.js-5 |
Malicious release: Malicious code in d3-bbox (npm) GHSA-hv8h-5xq3-92m8, MAL-2026-11273 | Malicious | Not scored | 30 Jul, 2026 | npm d3-bbox |
Malicious release: Malicious code in pjm-dls (npm) GHSA-j27c-6v4m-m4xv, MAL-2026-11347 | Malicious | Not scored | 30 Jul, 2026 | npm pjm-dls |
Malicious release: Malicious code in page_colors (npm) GHSA-jc34-6355-x2gh, MAL-2026-11343 | Malicious | Not scored | 30 Jul, 2026 | npm page_colors |
Malicious release: Malicious code in broccoli-watcher-siphon (npm) GHSA-jh9r-rrjc-m822, MAL-2026-11251 | Malicious | Not scored | 30 Jul, 2026 | npm broccoli-watcher-siphon |
Malicious release: Malicious code in xp-node-logger (npm) GHSA-m6qc-p4mr-59vf, MAL-2026-11411 | Malicious | Not scored | 30 Jul, 2026 | npm xp-node-logger |
Malicious release: Malicious code in cross-sell (npm) GHSA-q43p-6q68-4g7v, MAL-2026-11271 | Malicious | Not scored | 30 Jul, 2026 | npm cross-sell |
Malicious release: Malicious code in bajkvahzv8allnltvr7x4s5hdxkjvyji (npm) GHSA-rh8g-2jpx-ghwc, MAL-2026-11244 | Malicious | Not scored | 30 Jul, 2026 | npm bajkvahzv8allnltvr7x4s5hdxkjvyji |
Malicious release: Malicious code in apihost (npm) GHSA-rvx2-8wrp-5v4c, MAL-2026-11238 | Malicious | Not scored | 30 Jul, 2026 | npm apihost |
Malicious release: Malicious code in srgb-linear (npm) GHSA-wmqx-fxvf-3549, MAL-2026-11386 | Malicious | Not scored | 30 Jul, 2026 | npm srgb-linear |
Malicious release: Malicious code in ember-cli-deploy-secrets (npm) GHSA-x54g-9vhq-fgjj, MAL-2026-11290 | Malicious | Not scored | 30 Jul, 2026 | npm ember-cli-deploy-secrets |
Malicious release: Malicious code in model-data-cache-service (npm) GHSA-xfhx-rg7q-32mc, MAL-2026-11332 | Malicious | Not scored | 30 Jul, 2026 | npm model-data-cache-service |
Malicious release: Malicious code in unified-help-center-alpha (npm) GHSA-xxxp-m3cp-c8f7, MAL-2026-11406 | Malicious | Not scored | 30 Jul, 2026 | npm unified-help-center-alpha |
Malicious release: Malicious code in ember-livereload-indicator (npm) MAL-2026-11291 | Malicious | Not scored | 30 Jul, 2026 | npm ember-livereload-indicator |
Malicious release: Malicious code in ethers-v6 (npm) MAL-2026-11297 | Malicious | Not scored | 30 Jul, 2026 | npm ethers-v6 |
Malicious release: Malicious code in pullingpackageeeeeeeeee (npm) GHSA-275r-557m-9c6w, MAL-2026-11359 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageeeeeeeeee |
Malicious release: Malicious code in pullingpackageeee (npm) GHSA-49h2-vq5m-22hf, MAL-2026-11355 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageeee |
Malicious release: Malicious code in pullingpackage (npm) GHSA-f2gr-qgm3-wg22, MAL-2026-11351 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackage |
Malicious release: Malicious code in pullingpackageeeeeee (npm) GHSA-hq8m-wmq9-632v, MAL-2026-11356 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageeeeeee |
Malicious release: Malicious code in pullingpackageeeeeeee (npm) GHSA-hvqj-6qw4-pfrf, MAL-2026-11357 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageeeeeeee |
Malicious release: Malicious code in pullingpackageee (npm) GHSA-m86j-3g6g-q7r7, MAL-2026-11354 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageee |
Malicious release: Malicious code in pullingpackaged (npm) GHSA-vf7m-5f8w-gw69, MAL-2026-11352 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackaged |
Malicious release: Malicious code in pullingpackageeeeeeeeeee (npm) GHSA-wm5v-jh9g-w34v, MAL-2026-11360 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageeeeeeeeeee |
Malicious release: Malicious code in pullingpackageeeeeeeee (npm) GHSA-wrw3-chmv-4qvc, MAL-2026-11358 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackageeeeeeeee |
Malicious release: Malicious code in pullingpackagee (npm) GHSA-x98q-m69m-vp6m, MAL-2026-11353 | Malicious | Not scored | 30 Jul, 2026 | npm pullingpackagee |
Malicious release: Malicious code in @dotconf-pro/dotenv (npm) GHSA-h9vh-7j23-g2jx, MAL-2026-11209 | Malicious | Not scored | 30 Jul, 2026 | npm @dotconf-pro/dotenv |
Malicious release: Malicious code in @dotconf-pro/dotconf-pro (npm) GHSA-mwqq-h3r9-h32w, MAL-2026-11208 | Malicious | Not scored | 30 Jul, 2026 | npm @dotconf-pro/dotconf-pro |
Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII CVE-2026-68501, GHSA-x83g-979r-f5fh | Medium | 0.9% | 30 Jul, 2026 | Packagist sylius/mollie-plugin |
Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook CVE-2026-68500, GHSA-rc52-c4hv-w89p | High | 0.7% | 30 Jul, 2026 | Packagist sylius/mollie-plugin |
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS) CVE-2026-68499, GHSA-6hxr-mr5r-9836 | Medium | 0.2% | 30 Jul, 2026 | npm re2 |
Malicious release: Malicious code in rumjs (npm) GHSA-8xj6-6h67-j7p3, MAL-2026-11375 | Malicious | Not scored | 30 Jul, 2026 | npm rumjs |
Malicious release: Malicious code in @404c3s4r/testxxx (npm) MAL-2026-11207 | Malicious | Not scored | 30 Jul, 2026 | npm @404c3s4r/testxxx |
re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS) CVE-2026-67550, GHSA-ff84-5f28-78qj | Medium | 0.2% | 30 Jul, 2026 | npm re2 |
Malicious release: Malicious code in streak-metrics-math (npm) GHSA-57m5-24x9-2xr5, MAL-2026-11388 | Malicious | Not scored | 30 Jul, 2026 | npm streak-metrics-math |
Malicious release: Malicious code in svelte-metric-map (npm) GHSA-f9p7-g3fg-9695, MAL-2026-11390 | Malicious | Not scored | 30 Jul, 2026 | npm svelte-metric-map |
Malicious release: Malicious code in streak-metrics-core (npm) GHSA-pc2m-7f6m-25cm, MAL-2026-11387 | Malicious | Not scored | 30 Jul, 2026 | npm streak-metrics-core |
Malicious release: Malicious code in svelte-streak-metric (npm) GHSA-ph6j-2jmh-g26m, MAL-2026-11391 | Malicious | Not scored | 30 Jul, 2026 | npm svelte-streak-metric |
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate CVE-2026-59881, GHSA-mq44-7p77-q5h7, PYSEC-2026-3547 | Medium | 0.5% | 30 Jul, 2026 | PyPI aiohttp |
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing CVE-2026-66066, GHSA-xr9x-r78c-5hrm | Critical | 32.9% | 30 Jul, 2026 | RubyGems activestorage |
Malicious release: Malicious code in thedata (npm) GHSA-g67p-r2r2-224w, MAL-2026-11400 | Malicious | Not scored | 30 Jul, 2026 | npm thedata |
Malicious release: Malicious code in consumerweb-risk (npm) GHSA-5439-r8p8-2gmx, MAL-2026-11269 | Malicious | Not scored | 30 Jul, 2026 | npm consumerweb-risk |
Malicious release: Malicious code in switchpaymentsapiserv-paypal (npm) GHSA-rg3f-q822-6rx6, MAL-2026-11392 | Malicious | Not scored | 30 Jul, 2026 | npm switchpaymentsapiserv-paypal |
Malicious release: Malicious code in mcp-search-server (PyPI) MAL-2026-11198 | Malicious | Not scored | 30 Jul, 2026 | PyPI mcp-search-server |
Malicious release: Malicious code in ai-perf-toolkit (PyPI) MAL-2026-11197 | Malicious | Not scored | 30 Jul, 2026 | PyPI ai-perf-toolkit |
Malicious release: Malicious code in create-backend-scaffold (npm) GHSA-p8mm-7vhx-3cr2, MAL-2026-11270 | Malicious | Not scored | 30 Jul, 2026 | npm create-backend-scaffold |