Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @cr-invested-ui-components/chart (npm) GHSA-8g97-c5r5-8hjr, MAL-2026-11435 | Malicious | Not scored | 31 Jul, 2026 | npm @cr-invested-ui-components/chart |
Malicious release: Malicious code in metrics-ui (npm) GHSA-g4m5-r29v-w7gh, MAL-2026-11473 | Malicious | Not scored | 31 Jul, 2026 | npm metrics-ui |
Malicious release: Malicious code in @finance-ui/snackbar-ifpe (npm) GHSA-rcgh-7xjx-4rh6, MAL-2026-11437 | Malicious | Not scored | 31 Jul, 2026 | npm @finance-ui/snackbar-ifpe |
Malicious release: Malicious code in telerape (PyPI) MAL-2026-11424 | Malicious | Not scored | 31 Jul, 2026 | PyPI telerape |
Malicious release: Malicious code in refbase-mcp (npm) GHSA-5xcj-w4qg-g78g, MAL-2026-11477 | Malicious | Not scored | 31 Jul, 2026 | npm refbase-mcp |
Malicious release: Malicious code in hit-mcp (npm) GHSA-fmvj-j52v-97x4, MAL-2026-11466 | Malicious | Not scored | 31 Jul, 2026 | npm hit-mcp |
Malicious release: Malicious code in allurectl (npm) GHSA-gpj6-4r9m-prh8, MAL-2026-11455 | Malicious | Not scored | 31 Jul, 2026 | npm allurectl |
Malicious release: Malicious code in mcp-server-boilerplate (npm) GHSA-694g-9jgf-5566, MAL-2026-11472 | Malicious | Not scored | 31 Jul, 2026 | npm mcp-server-boilerplate |
Malicious release: Malicious code in iwomm-mcp (npm) GHSA-8cvf-hpjg-mf2j, MAL-2026-11469 | Malicious | Not scored | 31 Jul, 2026 | npm iwomm-mcp |
Malicious release: Malicious code in paraglide-js (npm) GHSA-433p-gj42-fh44, MAL-2026-11474 | Malicious | Not scored | 31 Jul, 2026 | npm paraglide-js |
Malicious release: Malicious code in community-published (npm) GHSA-cr3h-6mq7-f6q9, MAL-2026-11459 | Malicious | Not scored | 31 Jul, 2026 | npm community-published |
Malicious release: Malicious code in chaos-mcp (npm) GHSA-8whv-6hc5-4wpr, MAL-2026-11458 | Malicious | Not scored | 31 Jul, 2026 | npm chaos-mcp |
Malicious release: Malicious code in gtm-mcp-auth (npm) GHSA-4ch5-wcxv-58j5, MAL-2026-11464 | Malicious | Not scored | 31 Jul, 2026 | npm gtm-mcp-auth |
Malicious release: Malicious code in create-remotion (npm) GHSA-947j-5gjp-7968, MAL-2026-11460 | Malicious | Not scored | 31 Jul, 2026 | npm create-remotion |
Malicious release: Malicious code in sap-mcp-facilitator (npm) GHSA-fvh4-59gv-h4qp, MAL-2026-11482 | Malicious | Not scored | 31 Jul, 2026 | npm sap-mcp-facilitator |
Malicious release: Malicious code in maximumsats-mcp (npm) GHSA-mr5v-ffrr-c4h3, MAL-2026-11471 | Malicious | Not scored | 31 Jul, 2026 | npm maximumsats-mcp |
Malicious release: Malicious code in adpanel-core (npm) GHSA-jhrx-465c-725f, MAL-2026-11453 | Malicious | Not scored | 31 Jul, 2026 | npm adpanel-core |
Malicious release: Malicious code in sap-mcp-config (npm) GHSA-4j2q-gh4v-v729, MAL-2026-11481 | Malicious | Not scored | 31 Jul, 2026 | npm sap-mcp-config |
Malicious release: Malicious code in attio-discover (npm) GHSA-h74v-846x-863c, MAL-2026-11456 | Malicious | Not scored | 31 Jul, 2026 | npm attio-discover |
Malicious release: Malicious code in capacitor-assets (npm) GHSA-8v58-g8f8-2gpp, MAL-2026-11457 | Malicious | Not scored | 31 Jul, 2026 | npm capacitor-assets |
Malicious release: Malicious code in hazmat-cfr (npm) GHSA-g8cx-prcq-676p, MAL-2026-11465 | Malicious | Not scored | 31 Jul, 2026 | npm hazmat-cfr |
Malicious release: Malicious code in kip-mcp-http (npm) GHSA-993p-762h-628r, MAL-2026-11470 | Malicious | Not scored | 31 Jul, 2026 | npm kip-mcp-http |
Malicious release: Malicious code in pm-claude-skills-mcp (npm) GHSA-87v2-285p-xhrr, MAL-2026-11475 | Malicious | Not scored | 31 Jul, 2026 | npm pm-claude-skills-mcp |
Malicious release: Malicious code in fast-csv-helper (npm) GHSA-c65v-4v4c-jcpr, MAL-2026-11462 | Malicious | Not scored | 31 Jul, 2026 | npm fast-csv-helper |
Malicious release: Malicious code in install-native-host (npm) GHSA-4wvg-prm7-99h4, MAL-2026-11468 | Malicious | Not scored | 31 Jul, 2026 | npm install-native-host |
Malicious release: Malicious code in goldenflow-js (npm) GHSA-7gxf-x4v3-6vq7, MAL-2026-11463 | Malicious | Not scored | 31 Jul, 2026 | npm goldenflow-js |
Malicious release: Malicious code in smart-npv-mcp (npm) GHSA-972c-x84x-rm4f, MAL-2026-11486 | Malicious | Not scored | 31 Jul, 2026 | npm smart-npv-mcp |
Malicious release: Malicious code in polyprompt (npm) GHSA-h574-ghq2-gh4p, MAL-2026-11476 | Malicious | Not scored | 31 Jul, 2026 | npm polyprompt |
Malicious release: Malicious code in routerbase-mcp (npm) GHSA-rxc6-q384-2wrx, MAL-2026-11480 | Malicious | Not scored | 31 Jul, 2026 | npm routerbase-mcp |
Malicious release: Malicious code in ai-backup-script (npm) GHSA-34m8-mhm4-w3q4, MAL-2026-11454 | Malicious | Not scored | 31 Jul, 2026 | npm ai-backup-script |
Malicious release: Malicious code in iac-scanner (npm) GHSA-69pc-2883-mff3, MAL-2026-11467 | Malicious | Not scored | 31 Jul, 2026 | npm iac-scanner |
Malicious release: Malicious code in @404c3s4r/lodash (npm) GHSA-3357-xmhq-8r86, MAL-2026-11434 | Malicious | Not scored | 31 Jul, 2026 | npm @404c3s4r/lodash |
Malicious release: Malicious code in asdk-plugin-ai-platform (PyPI) MAL-2026-11421 | Malicious | Not scored | 31 Jul, 2026 | PyPI asdk-plugin-ai-platform |
Malicious release: Malicious code in asdk-plugin-alphagen (PyPI) MAL-2026-11422 | Malicious | Not scored | 31 Jul, 2026 | PyPI asdk-plugin-alphagen |
Malicious release: Malicious code in asdk-plugin-legacy (PyPI) MAL-2026-11423 | Malicious | Not scored | 31 Jul, 2026 | PyPI asdk-plugin-legacy |
Malicious release: Malicious code in eth-bridge (npm) GHSA-5hj6-99cc-g84q, MAL-2026-11461 | Malicious | Not scored | 31 Jul, 2026 | npm eth-bridge |
Malicious release: Malicious code in vite-tsconfig-svg (npm) GHSA-3w4v-4hp3-9934, MAL-2026-11497 | Malicious | Not scored | 31 Jul, 2026 | npm vite-tsconfig-svg |
Malicious release: Malicious code in rollup-plugin-polyfill-hold (npm) GHSA-7p2c-jxw4-jxvv, MAL-2026-11479 | Malicious | Not scored | 31 Jul, 2026 | npm rollup-plugin-polyfill-hold |
Malicious release: Malicious code in @0xlr/question-types (npm) GHSA-3x4g-gcc2-3jrc, MAL-2026-11432 | Malicious | Not scored | 31 Jul, 2026 | npm @0xlr/question-types |
Malicious release: Malicious code in @0xlr/test-callback (npm) GHSA-p6vh-r7p3-72r9, MAL-2026-11433 | Malicious | Not scored | 31 Jul, 2026 | npm @0xlr/test-callback |
Malicious release: Malicious code in @0xlr/dep-confusion-poc (npm) GHSA-r4wg-xfm2-45qv, MAL-2026-11431 | Malicious | Not scored | 31 Jul, 2026 | npm @0xlr/dep-confusion-poc |
Malicious release: Malicious code in aiprepkit (PyPI) MAL-2026-11417 | Malicious | Not scored | 31 Jul, 2026 | PyPI aiprepkit |
Malicious release: Malicious code in ailaunchkit (PyPI) MAL-2026-11416 | Malicious | Not scored | 31 Jul, 2026 | PyPI ailaunchkit |
Malicious release: Malicious code in walmart-genai-trace (PyPI) MAL-2026-11420 | Malicious | Not scored | 31 Jul, 2026 | PyPI walmart-genai-trace |
Malicious release: Malicious code in catalogai (PyPI) MAL-2026-11418 | Malicious | Not scored | 31 Jul, 2026 | PyPI catalogai |
Malicious release: Malicious code in cognikit (PyPI) MAL-2026-11419 | Malicious | Not scored | 31 Jul, 2026 | PyPI cognikit |
Malicious release: Malicious code in aiassistcore (PyPI) MAL-2026-11414 | Malicious | Not scored | 31 Jul, 2026 | PyPI aiassistcore |
Malicious release: Malicious code in aichannel (PyPI) MAL-2026-11415 | Malicious | Not scored | 31 Jul, 2026 | PyPI aichannel |
Malicious release: Malicious code in rollup-plugin-polyfill-helper (npm) GHSA-583c-qcpm-pcw6, MAL-2026-11478 | Malicious | Not scored | 31 Jul, 2026 | npm rollup-plugin-polyfill-helper |
Malicious release: Malicious code in vite-config-svg (npm) GHSA-qhvp-2j38-vcxv, MAL-2026-11496 | Malicious | Not scored | 31 Jul, 2026 | npm vite-config-svg |