Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @yoannchb/tokenize (npm) GHSA-4qx6-wqw8-r2qr, MAL-2026-15966 | Malicious | Not scored | 05 Sep, 2026 | npm @yoannchb/tokenize |
Malicious release: Malicious code in fast-html-dom-parser (npm) GHSA-4wcx-wjq9-25cr, MAL-2026-15983 | Malicious | Not scored | 05 Sep, 2026 | npm fast-html-dom-parser |
Malicious release: Malicious code in jimg (npm) GHSA-53xc-j4p4-52q3, MAL-2026-15989 | Malicious | Not scored | 05 Sep, 2026 | npm jimg |
Malicious release: Malicious code in onetime-rnd (npm) GHSA-55h6-2qxg-jvqv, MAL-2026-15998 | Malicious | Not scored | 05 Sep, 2026 | npm onetime-rnd |
Malicious release: Malicious code in tempjs-template (npm) GHSA-5x3v-r6fj-vf2p, MAL-2026-16002 | Malicious | Not scored | 05 Sep, 2026 | npm tempjs-template |
Malicious release: Malicious code in memov (npm) GHSA-6q78-8863-ww8m, MAL-2026-15994 | Malicious | Not scored | 05 Sep, 2026 | npm memov |
Malicious release: Malicious code in btn-particles (npm) GHSA-6w56-62pq-vhph, MAL-2026-15971 | Malicious | Not scored | 05 Sep, 2026 | npm btn-particles |
Malicious release: Malicious code in discord-phub (npm) GHSA-7693-gh38-7wmj, MAL-2026-15976 | Malicious | Not scored | 05 Sep, 2026 | npm discord-phub |
Malicious release: Malicious code in @yoannchb/cattract (npm) GHSA-76pv-jq47-p439, MAL-2026-15964 | Malicious | Not scored | 05 Sep, 2026 | npm @yoannchb/cattract |
Malicious release: Malicious code in @yoannchb/wtf-json (npm) GHSA-82x7-44x9-7295, MAL-2026-15967 | Malicious | Not scored | 05 Sep, 2026 | npm @yoannchb/wtf-json |
Malicious release: Malicious code in @yoannchb/langy (npm) GHSA-92qv-fgvj-ccf4, MAL-2026-15965 | Malicious | Not scored | 05 Sep, 2026 | npm @yoannchb/langy |
Malicious release: Malicious code in puppeteer-obscura (npm) GHSA-cxwq-q9c5-424v, MAL-2026-16001 | Malicious | Not scored | 05 Sep, 2026 | npm puppeteer-obscura |
Malicious release: Malicious code in @domyjs/domy (npm) GHSA-f553-q356-4cmc, MAL-2026-15950 | Malicious | Not scored | 05 Sep, 2026 | npm @domyjs/domy |
Malicious release: Malicious code in anime-vostfr (npm) GHSA-f6c5-36x2-p79p, MAL-2026-15968 | Malicious | Not scored | 05 Sep, 2026 | npm anime-vostfr |
Malicious release: Malicious code in card3d (npm) GHSA-gggp-h9vj-pw3p, MAL-2026-15972 | Malicious | Not scored | 05 Sep, 2026 | npm card3d |
Malicious release: Malicious code in iframe-to-video (npm) GHSA-hh9g-3hm5-vcch, MAL-2026-15986 | Malicious | Not scored | 05 Sep, 2026 | npm iframe-to-video |
Malicious release: Malicious code in parallaxy-img (npm) GHSA-mhp3-rpvj-vrpx, MAL-2026-15999 | Malicious | Not scored | 05 Sep, 2026 | npm parallaxy-img |
Malicious release: Malicious code in google-img-scrap (npm) GHSA-mwh7-p59x-2f4g, MAL-2026-15985 | Malicious | Not scored | 05 Sep, 2026 | npm google-img-scrap |
Malicious release: Malicious code in lazy-attr (npm) GHSA-pm6r-2g8f-89qh, MAL-2026-15992 | Malicious | Not scored | 05 Sep, 2026 | npm lazy-attr |
Malicious release: Malicious code in pipipe (npm) GHSA-pmm9-p62g-hvp5, MAL-2026-16000 | Malicious | Not scored | 05 Sep, 2026 | npm pipipe |
Malicious release: Malicious code in @domyjs/debounce (npm) GHSA-pp6m-2fxr-qjhf, MAL-2026-15949 | Malicious | Not scored | 05 Sep, 2026 | npm @domyjs/debounce |
Malicious release: Malicious code in inner-svg-ts (npm) GHSA-rx43-xhjx-3xq6, MAL-2026-15988 | Malicious | Not scored | 05 Sep, 2026 | npm inner-svg-ts |
Malicious release: Malicious code in linkpreview-simple (npm) GHSA-w9q9-gr86-rr73, MAL-2026-15993 | Malicious | Not scored | 05 Sep, 2026 | npm linkpreview-simple |
Malicious release: Malicious code in chrome-speech-recognition (npm) GHSA-wvfg-ghw3-64q7, MAL-2026-15973 | Malicious | Not scored | 05 Sep, 2026 | npm chrome-speech-recognition |
Malicious release: Malicious code in @domyjs/anchor (npm) GHSA-x2rm-5qrx-62mg, MAL-2026-15947 | Malicious | Not scored | 05 Sep, 2026 | npm @domyjs/anchor |
Malicious release: Malicious code in discord-tqr (npm) GHSA-xp88-72h6-mw9r, MAL-2026-15977 | Malicious | Not scored | 05 Sep, 2026 | npm discord-tqr |
Malicious release: Malicious code in json-into-html (npm) GHSA-xvrp-hmjm-74qr, MAL-2026-15990 | Malicious | Not scored | 05 Sep, 2026 | npm json-into-html |
Malicious release: Malicious code in drive-album (npm) GHSA-xwpg-4hvv-jxjq, MAL-2026-15978 | Malicious | Not scored | 05 Sep, 2026 | npm drive-album |
Malicious release: Malicious code in trading-bot-utils (npm) GHSA-2h3c-rw6j-mpq7, MAL-2026-16003 | Malicious | Not scored | 05 Sep, 2026 | npm trading-bot-utils |
Malicious release: Malicious code in eth-query-utils (npm) GHSA-c33f-ppxr-8r7j, MAL-2026-15982 | Malicious | Not scored | 05 Sep, 2026 | npm eth-query-utils |
Malicious release: Malicious code in gas-price-checker (npm) GHSA-fw8f-xwq4-q3v8, MAL-2026-15984 | Malicious | Not scored | 05 Sep, 2026 | npm gas-price-checker |
Malicious release: Malicious code in eth-lib-helpers (npm) GHSA-h3xf-4f7r-v9xf, MAL-2026-15981 | Malicious | Not scored | 05 Sep, 2026 | npm eth-lib-helpers |
Malicious release: Malicious code in ens-namehash-utils (npm) GHSA-qfrg-2m38-35gp, MAL-2026-15980 | Malicious | Not scored | 05 Sep, 2026 | npm ens-namehash-utils |
Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit GHSA-3xjw-9qpc-53mh, PYSEC-2026-4010 | Not scored | 05 Sep, 2026 | PyPI local-operator | |
Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator GHSA-22mg-8gw7-636x, PYSEC-2026-4009 | Not scored | 05 Sep, 2026 | PyPI local-operator | |
Malicious release: Malicious code in proxycer (PyPI) MAL-2026-15935 | Malicious | Not scored | 05 Sep, 2026 | PyPI proxycer |
Malicious release: Malicious code in dbt-sa-cli (PyPI) MAL-2026-15934 | Malicious | Not scored | 05 Sep, 2026 | PyPI dbt-sa-cli |
Malicious release: Malicious code in houdus (PyPI) MAL-2026-15933 | Malicious | Not scored | 04 Sep, 2026 | PyPI houdus |
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop GHSA-7q9c-hpx7-9cwm | High | Not scored | 04 Sep, 2026 | npm @typespec/spector |
Malicious release: Malicious code in chartkit-core (PyPI) MAL-2026-15932 | Malicious | Not scored | 04 Sep, 2026 | PyPI chartkit-core |
Malicious release: Malicious code in ulid-intel (npm) GHSA-h48j-674x-299v, MAL-2026-16004 | Malicious | Not scored | 04 Sep, 2026 | npm ulid-intel |
Malicious release: Malicious code in metricboxlite (PyPI) MAL-2026-15931 | Malicious | Not scored | 04 Sep, 2026 | PyPI metricboxlite |
undici vulnerable to Denial of Service via unbounded decompression of compressed responses CVE-2026-84890, GHSA-3xpg-4rpp-hhhm | Medium | 0.4% | 04 Sep, 2026 | npm undici |
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol CVE-2026-19534, GHSA-rfgv-xxqx-mfg5 | High | 0.4% | 04 Sep, 2026 | npm undici |
undici vulnerable to downstream response splitting via retry interceptor CVE-2026-18540, GHSA-r53p-7pc4-xj5r | Low | 0.3% | 04 Sep, 2026 | npm undici |
undici vulnerable to Denial of Service via orphaned RetryHandler response body CVE-2026-18149, GHSA-pmjh-fq2x-6v4x | Medium | 0.5% | 04 Sep, 2026 | npm undici |
SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor GHSA-6hxq-p678-4hr2 | Low | Not scored | 04 Sep, 2026 | npm @simplewebauthn/server |
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors CVE-2026-85152, GHSA-vp8m-p9jh-q5pm | High | 0.2% | 04 Sep, 2026 | npm undici |
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression CVE-2026-85024, GHSA-3wwx-pv8p-q78v | Medium | 0.4% | 04 Sep, 2026 | npm undici |
undici vulnerable to Denial of Service via WebSocketStream unclean close CVE-2026-85014, GHSA-rx4f-c7p8-82vq | High | 0.4% | 04 Sep, 2026 | npm undici |