Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in tronwebpy (PyPI) MAL-2025-2003 | Malicious | Not scored | 03 Mar, 2025 | PyPI tronwebpy |
Malicious release: Malicious code in tronpyweb (PyPI) MAL-2025-2002 | Malicious | Not scored | 03 Mar, 2025 | PyPI tronpyweb |
Malicious release: Malicious code in tronpynet (PyPI) MAL-2025-2001 | Malicious | Not scored | 03 Mar, 2025 | PyPI tronpynet |
Malicious release: Malicious code in tronlinkpy (PyPI) MAL-2025-1999 | Malicious | Not scored | 03 Mar, 2025 | PyPI tronlinkpy |
Malicious release: Malicious code in tronnetpy (PyPI) MAL-2025-2000 | Malicious | Not scored | 03 Mar, 2025 | PyPI tronnetpy |
Malicious release: Malicious code in trongridpy (PyPI) MAL-2025-1998 | Malicious | Not scored | 03 Mar, 2025 | PyPI trongridpy |
Malicious release: Malicious code in randomuseragent (PyPI) MAL-2025-1987 | Malicious | Not scored | 03 Mar, 2025 | PyPI randomuseragent |
Malicious release: Malicious code in ransomware (PyPI) MAL-2025-1988 | Malicious | Not scored | 03 Mar, 2025 | PyPI ransomware |
Malicious release: Malicious code in maliciouspkg (PyPI) MAL-2025-1979 | Malicious | Not scored | 03 Mar, 2025 | PyPI maliciouspkg |
Malicious release: Malicious code in fakeuseragent (PyPI) MAL-2025-1974 | Malicious | Not scored | 03 Mar, 2025 | PyPI fakeuseragent |
Malicious release: Malicious code in envvenuma (PyPI) MAL-2025-1972 | Malicious | Not scored | 03 Mar, 2025 | PyPI envvenuma |
Malicious release: Malicious code in aurm-desktop-client (PyPI) MAL-2025-1966 | Malicious | Not scored | 03 Mar, 2025 | PyPI aurm-desktop-client |
Malicious release: Malicious code in aurm-python-sdk (PyPI) MAL-2025-1967 | Malicious | Not scored | 03 Mar, 2025 | PyPI aurm-python-sdk |
Apache StreamPipes has improper privilege management in a REST interface CVE-2024-24778, GHSA-vm7w-2724-5m23, PYSEC-2025-66 | Medium | 0.7% | 03 Mar, 2025 | Maven org.apache.streampipes:streampipes-parent PyPI streampipes |
Malicious release: Malicious code in mirage-rce (PyPI) MAL-2025-2975 | Malicious | Not scored | 02 Mar, 2025 | PyPI mirage-rce |
Malicious release: Malicious code in ctf-aio-tool (PyPI) MAL-2025-2952 | Malicious | Not scored | 02 Mar, 2025 | PyPI ctf-aio-tool |
Malicious release: Malicious code in marinff-test (PyPI) MAL-2025-2973 | Malicious | Not scored | 02 Mar, 2025 | PyPI marinff-test |
Malicious release: Malicious code in pydefender (PyPI) MAL-2025-191833 | Malicious | Not scored | 01 Mar, 2025 | PyPI pydefender |
Malicious release: Malicious code in piedefender (PyPI) MAL-2025-3454 | Malicious | Not scored | 01 Mar, 2025 | PyPI piedefender |
CodeChecker open redirect when URL contains multiple slashes after the product name CVE-2025-1300, GHSA-g839-x3p3-g5fm, PYSEC-2026-1259 | Medium | 0.3% | 28 Feb, 2025 | PyPI codechecker |
Spotipy's cache file, containing spotify auth token, is created with overly broad permissions CVE-2025-27154, GHSA-pwhh-q4h6-w599, PYSEC-2026-1936 | High | 0.6% | 27 Feb, 2025 | PyPI spotipy |
Posts scraped data to IP address associated with other malware distribution attacks. PYSEC-2025-7 | Not scored | 26 Feb, 2025 | PyPI imblog | |
Exfiltrates cookies to hardcoded IP address PYSEC-2025-6 | Not scored | 26 Feb, 2025 | PyPI colabrun | |
Exfiltrates user cookies to hardcoded server endpoint during normal operations PYSEC-2025-5 | Not scored | 26 Feb, 2025 | PyPI browsercmdhbt2 | |
When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server. PYSEC-2025-3 | Not scored | 26 Feb, 2025 | PyPI autodzee | |
When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server. PYSEC-2025-4 | Not scored | 26 Feb, 2025 | PyPI automslc | |
Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis CVE-2025-1716, CVE-2025-1889, GHSA-655q-fx9r-782v, GHSA-769v-p64c-89pr, PYSEC-2025-18, PYSEC-2025-19 | Medium | 1.7% | 26 Feb, 2025 | PyPI picklescan |
Malicious release: Malicious code in kgmicolors (PyPI) MAL-2025-2969 | Malicious | Not scored | 25 Feb, 2025 | PyPI kgmicolors |
Malicious release: Malicious code in aclient-sdk (PyPI) MAL-2025-191671 | Malicious | Not scored | 25 Feb, 2025 | PyPI aclient-sdk |
Malicious release: Malicious code in acloud-client-uses (PyPI) MAL-2025-191672 | Malicious | Not scored | 25 Feb, 2025 | PyPI acloud-client-uses |
Malicious release: Malicious code in acloud-clients (PyPI) MAL-2025-191673 | Malicious | Not scored | 25 Feb, 2025 | PyPI acloud-clients |
Malicious release: Malicious code in alicloud-client (PyPI) MAL-2025-191676 | Malicious | Not scored | 25 Feb, 2025 | PyPI alicloud-client |
Malicious release: Malicious code in alicloud-client-sdk (PyPI) MAL-2025-191677 | Malicious | Not scored | 25 Feb, 2025 | PyPI alicloud-client-sdk |
Malicious release: Malicious code in amzclients-sdk (PyPI) MAL-2025-191679 | Malicious | Not scored | 25 Feb, 2025 | PyPI amzclients-sdk |
Malicious release: Malicious code in awscloud-clients-core (PyPI) MAL-2025-191687 | Malicious | Not scored | 25 Feb, 2025 | PyPI awscloud-clients-core |
Malicious release: Malicious code in enumer-iam (PyPI) MAL-2025-191721 | Malicious | Not scored | 25 Feb, 2025 | PyPI enumer-iam |
Malicious release: Malicious code in snapshot-photo (PyPI) MAL-2025-191871 | Malicious | Not scored | 25 Feb, 2025 | PyPI snapshot-photo |
Malicious release: Malicious code in tclients-sdk (PyPI) MAL-2025-191886 | Malicious | Not scored | 25 Feb, 2025 | PyPI tclients-sdk |
Malicious release: Malicious code in tcloud-python-sdks (PyPI) MAL-2025-191887 | Malicious | Not scored | 25 Feb, 2025 | PyPI tcloud-python-sdks |
Malicious release: Malicious code in time-check-server (PyPI) MAL-2025-191900 | Malicious | Not scored | 25 Feb, 2025 | PyPI time-check-server |
Malicious release: Malicious code in time-check-server-get (PyPI) MAL-2025-191901 | Malicious | Not scored | 25 Feb, 2025 | PyPI time-check-server-get |
Malicious release: Malicious code in time-server-analysis (PyPI) MAL-2025-191902 | Malicious | Not scored | 25 Feb, 2025 | PyPI time-server-analysis |
Malicious release: Malicious code in time-server-analyzer (PyPI) MAL-2025-191903 | Malicious | Not scored | 25 Feb, 2025 | PyPI time-server-analyzer |
Malicious release: Malicious code in time-server-test (PyPI) MAL-2025-191904 | Malicious | Not scored | 25 Feb, 2025 | PyPI time-server-test |
Malicious release: Malicious code in time-service-checker (PyPI) MAL-2025-191905 | Malicious | Not scored | 25 Feb, 2025 | PyPI time-service-checker |
Malicious release: Malicious code in acloud-client (PyPI) MAL-2025-2929, SNYK-PYTHON-ACLOUDCLIENT-12201342 | Malicious | Not scored | 25 Feb, 2025 | PyPI acloud-client |
Malicious release: Malicious code in credential-python-sdk (PyPI) MAL-2025-2950, SNYK-PYTHON-CREDENTIALPYTHONSDK-12201349 | Malicious | Not scored | 25 Feb, 2025 | PyPI credential-python-sdk |
Malicious release: Malicious code in tcloud-python-test (PyPI) MAL-2025-3006, SNYK-PYTHON-TCLOUDPYTHONTEST-12201353 | Malicious | Not scored | 25 Feb, 2025 | PyPI tcloud-python-test |
Malicious release: Malicious code in timekeeper-verifier (PyPI) MAL-2025-3475 | Malicious | Not scored | 25 Feb, 2025 | PyPI timekeeper-verifier |
Malicious release: Malicious code in serverkeeper-verifier (PyPI) MAL-2025-6583 | Malicious | Not scored | 25 Feb, 2025 | PyPI serverkeeper-verifier |