Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in agentenact (npm) GHSA-7p7m-8jmq-qp93, MAL-2026-18346 | Malicious | Not scored | 1 day ago | npm agentenact |
Malicious release: Malicious code in dsh-vm-tester (npm) GHSA-84fw-gj66-p5v3, MAL-2026-18345 | Malicious | Not scored | 2 days ago | npm dsh-vm-tester |
Malicious release: Malicious code in @webapp-shared/login-vmok (npm) MAL-2026-18356 | Malicious | Not scored | 2 days ago | npm @webapp-shared/login-vmok |
Malicious release: Malicious code in numprint (PyPI) MAL-2026-18343 | Malicious | Not scored | 2 days ago | PyPI numprint |
Malicious release: Malicious code in adyen-web-v6 (npm) GHSA-r77r-rw3m-rjh5, MAL-2026-18344 | Malicious | Not scored | 2 days ago | npm adyen-web-v6 |
Malicious release: Malicious code in buttoncontent (npm) GHSA-6crh-vwr2-4qfp, MAL-2026-18339 | Malicious | Not scored | 2 days ago | npm buttoncontent |
Malicious release: Malicious code in macro-kernel-record-reader (npm) GHSA-32g3-f74c-pcxq, MAL-2026-18341 | Malicious | Not scored | 2 days ago | npm macro-kernel-record-reader |
Malicious release: Malicious code in fetch-hash-cache-atomic (npm) GHSA-w9mp-cvjp-jfqp, MAL-2026-18340 | Malicious | Not scored | 2 days ago | npm fetch-hash-cache-atomic |
Malicious release: Malicious code in string-target-mapper-hash (npm) GHSA-wfcx-722r-fg5h, MAL-2026-18342 | Malicious | Not scored | 2 days ago | npm string-target-mapper-hash |
Malicious release: Malicious code in @azure-growth/signup-ux-components (npm) MAL-2026-18338 | Malicious | Not scored | 2 days ago | npm @azure-growth/signup-ux-components |
Malicious release: Malicious code in @camera.ui/camera-ui-nvr-windows-amd64 (npm) GHSA-2w7v-jwxh-w7wc, MAL-2026-18337 | Malicious | Not scored | 2 days ago | npm @camera.ui/camera-ui-nvr-windows-amd64 |
Malicious release: Malicious code in h13t0ry-hello-demo (PyPI) MAL-2026-18336 | Malicious | Not scored | 2 days ago | PyPI h13t0ry-hello-demo |
Malicious release: Malicious code in ctf-agent (npm) GHSA-2j3v-rjgw-5wgg, MAL-2026-18335 | Malicious | Not scored | 2 days ago | npm ctf-agent |
Malicious release: Malicious code in csvflow-schema (npm) MAL-2026-18357 | Malicious | Not scored | 3 days ago | npm csvflow-schema |
Malicious release: Malicious code in @iobandamwer/native-helper (npm) GHSA-g457-v22r-g8j3, MAL-2026-18330 | Malicious | Not scored | 3 days ago | npm @iobandamwer/native-helper |
Malicious release: Malicious code in path-stream-utils-testmetest (npm) GHSA-7pvr-f92m-6fwg, MAL-2026-18333 | Malicious | Not scored | 3 days ago | npm path-stream-utils-testmetest |
Malicious release: Malicious code in @iobandamwer/cache-helper (npm) GHSA-j83w-xhgf-7m58, MAL-2026-18329 | Malicious | Not scored | 3 days ago | npm @iobandamwer/cache-helper |
Malicious release: Malicious code in postcss-semantic-themes (npm) GHSA-fh55-fq5h-h352, MAL-2026-18334 | Malicious | Not scored | 3 days ago | npm postcss-semantic-themes |
Malicious release: Malicious code in birch-css-utils (npm) GHSA-p597-2ggw-c82r, MAL-2026-18331 | Malicious | Not scored | 3 days ago | npm birch-css-utils |
Malicious release: Malicious code in harlow-css-mixer (npm) GHSA-j658-c56g-qxh4, MAL-2026-18332 | Malicious | Not scored | 3 days ago | npm harlow-css-mixer |
Malicious release: Malicious code in netweavex (PyPI) MAL-2026-18328 | Malicious | Not scored | 3 days ago | PyPI netweavex |
Malicious release: Malicious code in zagents-framework (PyPI) MAL-2026-18327 | Malicious | Not scored | 3 days ago | PyPI zagents-framework |
Malicious release: Malicious code in changes-lxc-wrapper (PyPI) MAL-2026-18326 | Malicious | Not scored | 3 days ago | PyPI changes-lxc-wrapper |
Malicious release: Malicious code in @worca/app (npm) GHSA-rmc5-cxrx-5fh9, MAL-2026-18325 | Malicious | Not scored | 3 days ago | npm @worca/app |
Malicious release: Malicious code in publish-poc-base (npm) MAL-2026-18323 | Malicious | Not scored | 3 days ago | npm publish-poc-base |
Malicious release: Malicious code in publish-poc-test3 (npm) MAL-2026-18324 | Malicious | Not scored | 3 days ago | npm publish-poc-test3 |
Malicious release: Malicious code in @apexacc/cli (npm) MAL-2026-17924 | Malicious | Not scored | 3 days ago | npm @apexacc/cli |
Malicious release: Malicious code in numbors (npm) GHSA-682c-pwqm-7gxv, MAL-2026-18322 | Malicious | Not scored | 3 days ago | npm numbors |
Malicious release: Malicious code in dsh-native (npm) GHSA-x94m-hxm5-m298, MAL-2026-18315 | Malicious | Not scored | 3 days ago | npm dsh-native |
Malicious release: Malicious code in bow-test (npm) GHSA-w53j-w72q-2f32, MAL-2026-18311 | Malicious | Not scored | 3 days ago | npm bow-test |
Malicious release: Malicious code in css-hnhxwd-polyfill (npm) GHSA-r2cx-wgxm-g93q, MAL-2026-18314 | Malicious | Not scored | 3 days ago | npm css-hnhxwd-polyfill |
Malicious release: Malicious code in util-foriepft (npm) GHSA-rc7p-6p9r-rfj9, MAL-2026-17878 | Malicious | Not scored | 3 days ago | npm util-foriepft |
Malicious release: Malicious code in css-flexgap-shim (npm) GHSA-xv83-g4vx-88wf, MAL-2026-18312 | Malicious | Not scored | 3 days ago | npm css-flexgap-shim |
Malicious release: Malicious code in @regex33-hackerone/tb-compat (npm) GHSA-vwp8-h222-46p8, MAL-2026-18310 | Malicious | Not scored | 3 days ago | npm @regex33-hackerone/tb-compat |
Malicious release: Malicious code in css-grid-snap-util (npm) GHSA-ww37-mhpw-cm3q, MAL-2026-18313 | Malicious | Not scored | 3 days ago | npm css-grid-snap-util |
Malicious release: Malicious code in @walknpm/todo-cli (npm) GHSA-p6gj-69gx-r376, MAL-2026-18320 | Malicious | Not scored | 3 days ago | npm @walknpm/todo-cli |
Malicious release: Malicious code in dsh-plugin-blender-3d (npm) GHSA-hw9g-f63g-4c8x, MAL-2026-18321 | Malicious | Not scored | 3 days ago | npm dsh-plugin-blender-3d |
Malicious release: Malicious code in @s4yhiitestpoc/scan-echo-b (npm) GHSA-2wfm-2q62-f937, MAL-2026-18308 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/scan-echo-b |
Malicious release: Malicious code in @s4yhiitestpoc/scan-https-dualuse-e (npm) GHSA-5957-rhph-hx5p, MAL-2026-18309 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/scan-https-dualuse-e |
Malicious release: Malicious code in @s4yhiitestpoc/r2-echo (npm) GHSA-gcfx-vpjf-86m9, MAL-2026-18304 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/r2-echo |
Malicious release: Malicious code in @s4yhiitestpoc/r2-dns (npm) GHSA-jr92-v3rg-vg3w, MAL-2026-18303 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/r2-dns |
Malicious release: Malicious code in @s4yhiitestpoc/scan-control-a (npm) GHSA-m9p6-4pgh-6gqx, MAL-2026-18306 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/scan-control-a |
Malicious release: Malicious code in @s4yhiitestpoc/r2-control (npm) GHSA-mgmq-xcr7-2945, MAL-2026-18302 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/r2-control |
Malicious release: Malicious code in @s4yhiitestpoc/r2-https-dualuse (npm) GHSA-mv2r-j9qg-322h, MAL-2026-18305 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/r2-https-dualuse |
Malicious release: Malicious code in @s4yhiitestpoc/scan-dns-c (npm) GHSA-vhw8-ph25-jc87, MAL-2026-18307 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/scan-dns-c |
Malicious release: Malicious code in dictmerge-lite (PyPI) MAL-2026-18301 | Malicious | Not scored | 3 days ago | PyPI dictmerge-lite |
Malicious release: Malicious code in claudeopuseni (PyPI) MAL-2026-18299 | Malicious | Not scored | 3 days ago | PyPI claudeopuseni |
Malicious release: Malicious code in claudeopusenifile (PyPI) MAL-2026-18300 | Malicious | Not scored | 3 days ago | PyPI claudeopusenifile |
Malicious release: Malicious code in claudeopusfile (PyPI) MAL-2026-18298 | Malicious | Not scored | 3 days ago | PyPI claudeopusfile |
Malicious release: Malicious code in nebulallm (PyPI) MAL-2026-18297 | Malicious | Not scored | 4 days ago | PyPI nebulallm |