Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @bx-ui-framework/microfrontend (npm) MAL-2026-15868 | Malicious | Not scored | 04 Sep, 2026 | npm @bx-ui-framework/microfrontend |
Malicious release: Malicious code in @bx-ui-framework/common (npm) MAL-2026-15867 | Malicious | Not scored | 04 Sep, 2026 | npm @bx-ui-framework/common |
Malicious release: Malicious code in orbitron-tui (npm) MAL-2026-16011 | Malicious | Not scored | 04 Sep, 2026 | npm orbitron-tui |
Malicious release: Malicious code in orbitron-cli (npm) MAL-2026-16012 | Malicious | Not scored | 04 Sep, 2026 | npm orbitron-cli |
Malicious release: Malicious code in agent-free (npm) MAL-2026-16013 | Malicious | Not scored | 04 Sep, 2026 | npm agent-free |
Malicious release: Malicious code in prime-coding-agent (npm) MAL-2026-16014 | Malicious | Not scored | 04 Sep, 2026 | npm prime-coding-agent |
Malicious release: Malicious code in tsshare (PyPI) MAL-2026-16044 | Malicious | Not scored | 04 Sep, 2026 | PyPI tsshare |
Malicious release: Malicious code in @avigilon/node-webrtc (npm) MAL-2026-15865 | Malicious | Not scored | 03 Sep, 2026 | npm @avigilon/node-webrtc |
Malicious release: Malicious code in 1nestjs (npm) MAL-2026-15909 | Malicious | Not scored | 03 Sep, 2026 | npm 1nestjs |
Malicious release: Malicious code in 0nestjs (npm) MAL-2026-15908 | Malicious | Not scored | 03 Sep, 2026 | npm 0nestjs |
node-csv: Prototype replacement still reachable via columns path CVE-2026-85063, GHSA-8cw4-87c7-c6xx | Medium | 0.6% | 03 Sep, 2026 | npm csv-parse |
Colord: Slow rejection of oversized malformed color strings CVE-2026-85062, GHSA-2wm5-q62r-hmrv | Medium | 0.5% | 03 Sep, 2026 | npm colord |
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip CVE-2026-85061, GHSA-jrc7-96c5-q579 | Critical | 0.5% | 03 Sep, 2026 | npm maplibre-gl |
toml-node: Uncontrolled Recursion CVE-2026-77465, GHSA-82x6-q7mm-w9cf | High | 0.6% | 03 Sep, 2026 | npm toml |
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization CVE-2026-63376, GHSA-v5mp-jgw5-2x6j | High | 0.7% | 03 Sep, 2026 | npm toml |
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS) CVE-2026-71429, GHSA-528h-pc64-c93x | Medium | 0.2% | 03 Sep, 2026 | npm stream-json |
Google Chromium V8 Type Confusion Vulnerability CVE-2026-85046 | HighExploited | 1.8% | 03 Sep, 2026 | |
Malicious release: Malicious code in asti (PyPI) MAL-2026-15864 | Malicious | Not scored | 03 Sep, 2026 | PyPI asti |
Malicious release: Malicious code in @modss/baileys (npm) GHSA-4c9v-m7qm-2mpr, MAL-2026-15918 | Malicious | Not scored | 03 Sep, 2026 | npm @modss/baileys |
Malicious release: Malicious code in @crysnovax/baileys (npm) GHSA-c34p-4828-cg5g, MAL-2026-15917 | Malicious | Not scored | 03 Sep, 2026 | npm @crysnovax/baileys |
Malicious release: Malicious code in megan-baileys (npm) MAL-2026-15919 | Malicious | Not scored | 03 Sep, 2026 | npm megan-baileys |
Malicious release: Malicious code in py-1requests (PyPI) MAL-2026-15861 | Malicious | Not scored | 03 Sep, 2026 | PyPI py-1requests |
Malicious release: Malicious code in py-2equests (PyPI) MAL-2026-15862 | Malicious | Not scored | 03 Sep, 2026 | PyPI py-2equests |
Malicious release: Malicious code in py-0requests (PyPI) MAL-2026-15860 | Malicious | Not scored | 03 Sep, 2026 | PyPI py-0requests |
Malicious release: Malicious code in 0requests (PyPI) MAL-2026-15859 | Malicious | Not scored | 03 Sep, 2026 | PyPI 0requests |
Malicious release: Malicious code in html_vue (npm) GHSA-3j85-w3wg-w28x, MAL-2026-15887 | Malicious | Not scored | 03 Sep, 2026 | npm html_vue |
Malicious release: Malicious code in vscode-vue (npm) GHSA-5vjf-q259-p82j, MAL-2026-15894 | Malicious | Not scored | 03 Sep, 2026 | npm vscode-vue |
Malicious release: Malicious code in @a23842/dsh-notifier (npm) GHSA-995p-9xmc-j7v3, MAL-2026-15872 | Malicious | Not scored | 03 Sep, 2026 | npm @a23842/dsh-notifier |
Malicious release: Malicious code in dsh-waste-market (npm) GHSA-h4p9-qw93-r884, MAL-2026-15879 | Malicious | Not scored | 03 Sep, 2026 | npm dsh-waste-market |
Malicious release: Malicious code in uvhttp-custom (PyPI) MAL-2026-15863 | Malicious | Not scored | 03 Sep, 2026 | PyPI uvhttp-custom |
Malicious release: Malicious code in trongridi (PyPI) MAL-2026-15858 | Malicious | Not scored | 03 Sep, 2026 | PyPI trongridi |
Malicious release: Malicious code in @quantixfinance/config (npm) MAL-2026-15850 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/config |
Malicious release: Malicious code in @quantixfinance/tron (npm) MAL-2026-15855 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/tron |
Malicious release: Malicious code in @quantixfinance/common (npm) MAL-2026-15849 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/common |
Malicious release: Malicious code in @quantixfinance/sdk (npm) MAL-2026-15852 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/sdk |
Malicious release: Malicious code in @quantixfinance/contracts (npm) MAL-2026-15851 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/contracts |
Malicious release: Malicious code in @quantixfinance/ui (npm) MAL-2026-15856 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/ui |
Malicious release: Malicious code in @quantixfinance/wallet (npm) MAL-2026-15857 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/wallet |
Malicious release: Malicious code in @quantixfinance/token (npm) MAL-2026-15854 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/token |
Malicious release: Malicious code in @quantixfinance/supabase (npm) MAL-2026-15853 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/supabase |
Malicious release: Malicious code in @quantixfinance/api (npm) MAL-2026-15848 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/api |
Malicious release: Malicious code in fieldbase-webapplication-buildtools (npm) MAL-2026-15847 | Malicious | Not scored | 03 Sep, 2026 | npm fieldbase-webapplication-buildtools |
Malicious release: Malicious code in btree-range-store (npm) GHSA-5p9f-98mr-w2hr, MAL-2026-15876 | Malicious | Not scored | 03 Sep, 2026 | npm btree-range-store |
Malicious release: Malicious code in priority-slot-queue (npm) GHSA-7gh9-f2pq-8vf3, MAL-2026-15892 | Malicious | Not scored | 03 Sep, 2026 | npm priority-slot-queue |
Malicious release: Malicious code in btree-time-index (npm) GHSA-7r97-jh52-2rx8, MAL-2026-15877 | Malicious | Not scored | 03 Sep, 2026 | npm btree-time-index |
Malicious release: Malicious code in sliding-score-window (npm) GHSA-7wm7-mj8v-49f7, MAL-2026-15893 | Malicious | Not scored | 03 Sep, 2026 | npm sliding-score-window |
Malicious release: Malicious code in neighbor-key-map (npm) GHSA-c7w5-hg7j-94q4, MAL-2026-15889 | Malicious | Not scored | 03 Sep, 2026 | npm neighbor-key-map |
Malicious release: Malicious code in btree-leaderboard (npm) GHSA-jj56-73wg-7pff, MAL-2026-15874 | Malicious | Not scored | 03 Sep, 2026 | npm btree-leaderboard |
Malicious release: Malicious code in btree-lru-cache (npm) GHSA-p5xg-f96c-j538, MAL-2026-15875 | Malicious | Not scored | 03 Sep, 2026 | npm btree-lru-cache |
Malicious release: Malicious code in ordered-kv-index (npm) GHSA-r948-p23m-ffg3, MAL-2026-15891 | Malicious | Not scored | 03 Sep, 2026 | npm ordered-kv-index |