Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in dolyame-ui-clickoutsidehoc (npm) MAL-2026-13558 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-clickoutsidehoc |
Malicious release: Malicious code in dolyame-ui-generateid (npm) MAL-2026-13571 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-generateid |
Malicious release: Malicious code in bnpl-blocks-atom-bnpl-loader (npm) MAL-2026-13530 | Malicious | Not scored | 07 Aug, 2026 | npm bnpl-blocks-atom-bnpl-loader |
Malicious release: Malicious code in dolyame-ui-inputtools (npm) MAL-2026-13587 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputtools |
Malicious release: Malicious code in dolyame-ui-attachfile (npm) MAL-2026-13504 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-attachfile |
Malicious release: Malicious code in dolyame-ui-inputcolor (npm) MAL-2026-13507 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputcolor |
Malicious release: Malicious code in delivery-ci-dpat (npm) MAL-2026-13500 | Malicious | Not scored | 07 Aug, 2026 | npm delivery-ci-dpat |
Malicious release: Malicious code in dolyame-ui-progresscircle (npm) MAL-2026-13510 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-progresscircle |
Malicious release: Malicious code in ded-pwa-ded-pwa-core (npm) MAL-2026-13498 | Malicious | Not scored | 07 Aug, 2026 | npm ded-pwa-ded-pwa-core |
Malicious release: Malicious code in dolyame-ui-inputbox (npm) MAL-2026-13506 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputbox |
Malicious release: Malicious code in dolyame-ui-inputpassword (npm) MAL-2026-13508 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputpassword |
Malicious release: Malicious code in dolyame-ui-tabsblock (npm) MAL-2026-13512 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-tabsblock |
Malicious release: Malicious code in eacq-cdk (npm) MAL-2026-13513 | Malicious | Not scored | 07 Aug, 2026 | npm eacq-cdk |
Malicious release: Malicious code in delivery-ci-codeceptjs-fork (npm) MAL-2026-13499 | Malicious | Not scored | 07 Aug, 2026 | npm delivery-ci-codeceptjs-fork |
Malicious release: Malicious code in dolyame-ui-iconloaderhoc (npm) MAL-2026-13505 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-iconloaderhoc |
Malicious release: Malicious code in delivery-ci-jira-rnd (npm) MAL-2026-13501 | Malicious | Not scored | 07 Aug, 2026 | npm delivery-ci-jira-rnd |
Malicious release: Malicious code in ded-pwa-c-cms (npm) MAL-2026-13496 | Malicious | Not scored | 07 Aug, 2026 | npm ded-pwa-c-cms |
Malicious release: Malicious code in dolyame-ui-lazyrender (npm) MAL-2026-13509 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-lazyrender |
Malicious release: Malicious code in dolyame-ui-stateutils (npm) MAL-2026-13511 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-stateutils |
Malicious release: Malicious code in devplatform-react-mcp (npm) MAL-2026-13502 | Malicious | Not scored | 07 Aug, 2026 | npm devplatform-react-mcp |
Malicious release: Malicious code in eacq-dialog (npm) MAL-2026-13515 | Malicious | Not scored | 07 Aug, 2026 | npm eacq-dialog |
Malicious release: Malicious code in bigops-telephony-mock (npm) MAL-2026-13494 | Malicious | Not scored | 07 Aug, 2026 | npm bigops-telephony-mock |
Malicious release: Malicious code in ded-pwa-c-page-maker-props (npm) MAL-2026-13497 | Malicious | Not scored | 07 Aug, 2026 | npm ded-pwa-c-page-maker-props |
Malicious release: Malicious code in eacq-core (npm) MAL-2026-13514 | Malicious | Not scored | 07 Aug, 2026 | npm eacq-core |
Malicious release: Malicious code in distributorblock (npm) MAL-2026-13503 | Malicious | Not scored | 07 Aug, 2026 | npm distributorblock |
Malicious release: Malicious code in streak-kit-map (npm) GHSA-6698-9vj2-cgx8, MAL-2026-13519 | Malicious | Not scored | 07 Aug, 2026 | npm streak-kit-map |
Malicious release: Malicious code in blekit (npm) GHSA-7g22-4x8j-vfg4, MAL-2026-13495 | Malicious | Not scored | 07 Aug, 2026 | npm blekit |
Malicious release: Malicious code in postcss-theme-provider (npm) GHSA-36cv-vvf7-gj75, MAL-2026-13518 | Malicious | Not scored | 07 Aug, 2026 | npm postcss-theme-provider |
Malicious release: Malicious code in forge-gas-diff (npm) MAL-2026-13516 | Malicious | Not scored | 07 Aug, 2026 | npm forge-gas-diff |
Malicious release: Malicious code in gas-diff-core (npm) MAL-2026-13517 | Malicious | Not scored | 07 Aug, 2026 | npm gas-diff-core |
Malicious release: Malicious code in speed-hashes (PyPI) MAL-2026-13607 | Malicious | Not scored | 07 Aug, 2026 | PyPI speed-hashes |
Malicious release: Malicious code in fast-hashes (PyPI) MAL-2026-13490 | Malicious | Not scored | 07 Aug, 2026 | PyPI fast-hashes |
NLTK downloader allows cross-package resource and model poisoning CVE-2026-12261, GHSA-ffj6-66c4-86gw, PYSEC-2026-3954 | Medium | 0.2% | 07 Aug, 2026 | PyPI nltk |
Malicious release: Malicious code in idnna (PyPI) MAL-2026-13488 | Malicious | Not scored | 07 Aug, 2026 | PyPI idnna |
Malicious release: Malicious code in pydanticc (PyPI) MAL-2026-13489 | Malicious | Not scored | 07 Aug, 2026 | PyPI pydanticc |
Malicious release: Malicious code in fastapii (PyPI) MAL-2026-13486 | Malicious | Not scored | 07 Aug, 2026 | PyPI fastapii |
Malicious release: Malicious code in flasq (PyPI) MAL-2026-13487 | Malicious | Not scored | 07 Aug, 2026 | PyPI flasq |
Malicious release: Malicious code in rdfxvela (npm) GHSA-7485-r458-jppf, MAL-2026-13491 | Malicious | Not scored | 07 Aug, 2026 | npm rdfxvela |
Malicious release: Malicious code in rdfxvela-build (npm) GHSA-jw4p-5x7w-fcm4, MAL-2026-13492 | Malicious | Not scored | 07 Aug, 2026 | npm rdfxvela-build |
Malicious release: Malicious code in velabuild (npm) GHSA-q7w3-723m-252j, MAL-2026-13493 | Malicious | Not scored | 07 Aug, 2026 | npm velabuild |
Malicious release: Malicious code in @prototypevip/baileys (npm) MAL-2026-13480 | Malicious | Not scored | 06 Aug, 2026 | npm @prototypevip/baileys |
Malicious release: Malicious code in merge-grid-stats (npm) MAL-2026-13484 | Malicious | Not scored | 06 Aug, 2026 | npm merge-grid-stats |
Malicious release: Malicious code in diezyclutch-baileys (npm) GHSA-89rf-mgch-fg9m, MAL-2026-13482 | Malicious | Not scored | 06 Aug, 2026 | npm diezyclutch-baileys |
Malicious release: Malicious code in cdf-tag-commander-helper (npm) MAL-2026-13481 | Malicious | Not scored | 06 Aug, 2026 | npm cdf-tag-commander-helper |
Malicious release: Malicious code in @cats-cdf/authentication (npm) MAL-2026-13478 | Malicious | Not scored | 06 Aug, 2026 | npm @cats-cdf/authentication |
Malicious release: Malicious code in @cats-cdf/browser-metrics-meter (npm) MAL-2026-13479 | Malicious | Not scored | 06 Aug, 2026 | npm @cats-cdf/browser-metrics-meter |
Malicious release: Malicious code in weight2loss (npm) MAL-2026-13485 | Malicious | Not scored | 06 Aug, 2026 | npm weight2loss |
Malicious release: Malicious code in internallib_v514 (npm) MAL-2026-13483 | Malicious | Not scored | 06 Aug, 2026 | npm internallib_v514 |
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors CVE-2026-67422, GHSA-gm37-52c6-37mw, PYSEC-2026-3654 | High | 0.6% | 06 Aug, 2026 | PyPI pymdown-extensions |
Apple macOS Improper Authentication Vulnerability CVE-2026-65400 | CriticalExploited | 1.7% | 06 Aug, 2026 |