Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in hardhat-zet (npm) GHSA-mw8r-6m3f-qmg8, MAL-2026-17234 | Malicious | Not scored | 28 Sep, 2026 | npm hardhat-zet |
Malicious release: Malicious code in hardhat-lock (npm) MAL-2026-17233 | Malicious | Not scored | 28 Sep, 2026 | npm hardhat-lock |
Malicious release: Malicious code in mini-hardhat (npm) MAL-2026-17236 | Malicious | Not scored | 28 Sep, 2026 | npm mini-hardhat |
Malicious release: Malicious code in native-env (npm) MAL-2026-17237 | Malicious | Not scored | 28 Sep, 2026 | npm native-env |
Malicious release: Malicious code in dotenv-native (npm) MAL-2026-17231 | Malicious | Not scored | 28 Sep, 2026 | npm dotenv-native |
Malicious release: Malicious code in fabric-native-loader (npm) MAL-2026-17232 | Malicious | Not scored | 28 Sep, 2026 | npm fabric-native-loader |
Malicious release: Malicious code in items-validator (npm) GHSA-rpgc-c7g7-g8fh, MAL-2026-17235 | Malicious | Not scored | 28 Sep, 2026 | npm items-validator |
Malicious release: Malicious code in test-agency-assignment (npm) MAL-2026-17239 | Malicious | Not scored | 28 Sep, 2026 | npm test-agency-assignment |
Malicious release: Malicious code in aseitylab (PyPI) MAL-2026-17240 | Malicious | Not scored | 28 Sep, 2026 | PyPI aseitylab |
Malicious release: Malicious code in llm-nebula (npm) GHSA-w7wp-5j6j-rgg5, MAL-2026-17230 | Malicious | Not scored | 28 Sep, 2026 | npm llm-nebula |
Malicious release: Malicious code in simple-date-formatter-new-12 (npm) MAL-2026-17229 | Malicious | Not scored | 28 Sep, 2026 | npm simple-date-formatter-new-12 |
Malicious release: Malicious code in nebulaai-sdk (npm) MAL-2026-17228 | Malicious | Not scored | 28 Sep, 2026 | npm nebulaai-sdk |
Malicious release: Malicious code in figlet-chalk-render (npm) MAL-2026-17226 | Malicious | Not scored | 28 Sep, 2026 | npm figlet-chalk-render |
Malicious release: Malicious code in chalk-figlet (npm) MAL-2026-17223 | Malicious | Not scored | 28 Sep, 2026 | npm chalk-figlet |
Malicious release: Malicious code in nebula-llm (npm) MAL-2026-17227 | Malicious | Not scored | 28 Sep, 2026 | npm nebula-llm |
Malicious release: Malicious code in fabric-render-bridge (npm) MAL-2026-17225 | Malicious | Not scored | 28 Sep, 2026 | npm fabric-render-bridge |
Malicious release: Malicious code in fabric-asset-pipeline (npm) MAL-2026-17224 | Malicious | Not scored | 28 Sep, 2026 | npm fabric-asset-pipeline |
Malicious release: Malicious code in img-to-native (npm) GHSA-pv7p-ghgv-268x, MAL-2026-17216 | Malicious | Not scored | 28 Sep, 2026 | npm img-to-native |
Malicious release: Malicious code in native-runner (npm) GHSA-jxw5-69p3-hpm4, MAL-2026-17218 | Malicious | Not scored | 28 Sep, 2026 | npm native-runner |
Malicious release: Malicious code in nebulajs-api (npm) GHSA-2gr6-gxvx-3594, MAL-2026-17220 | Malicious | Not scored | 28 Sep, 2026 | npm nebulajs-api |
Malicious release: Malicious code in nebula-sdk (npm) GHSA-fm5g-6rr8-p9vq, MAL-2026-17219 | Malicious | Not scored | 28 Sep, 2026 | npm nebula-sdk |
Malicious release: Malicious code in vite-plugin-crypto (npm) GHSA-mh9w-qr45-6wrq, MAL-2026-17222 | Malicious | Not scored | 28 Sep, 2026 | npm vite-plugin-crypto |
Malicious release: Malicious code in tailwindcss-form-kit (npm) GHSA-cxrh-669r-w2g9, MAL-2026-17221 | Malicious | Not scored | 28 Sep, 2026 | npm tailwindcss-form-kit |
Malicious release: Malicious code in my-skibidi (npm) GHSA-w4g6-rgx4-2wjf, MAL-2026-17217 | Malicious | Not scored | 28 Sep, 2026 | npm my-skibidi |
Malicious release: Malicious code in eslint-plugin-skywagon-web (npm) MAL-2026-17215 | Malicious | Not scored | 28 Sep, 2026 | npm eslint-plugin-skywagon-web |
Malicious release: Malicious code in git-en-boite-logging (npm) MAL-2026-17214 | Malicious | Not scored | 28 Sep, 2026 | npm git-en-boite-logging |
Malicious release: Malicious code in godsplan (npm) MAL-2026-17315 | Malicious | Not scored | 28 Sep, 2026 | npm godsplan |
Malicious release: Malicious code in azure-langchain-example (PyPI) MAL-2026-17213 | Malicious | Not scored | 28 Sep, 2026 | PyPI azure-langchain-example |
Malicious release: Malicious code in wbnr-probe-visible-check (npm) GHSA-65gf-jmp3-4wrc, MAL-2026-17212 | Malicious | Not scored | 28 Sep, 2026 | npm wbnr-probe-visible-check |
Malicious release: Malicious code in @wbnr/design-kit (npm) GHSA-865f-pwj5-p2c5, MAL-2026-17204 | Malicious | Not scored | 28 Sep, 2026 | npm @wbnr/design-kit |
Malicious release: Malicious code in @wbnr/lottiefiles-loader (npm) GHSA-94r6-cxjq-fq4r, MAL-2026-17205 | Malicious | Not scored | 28 Sep, 2026 | npm @wbnr/lottiefiles-loader |
Malicious release: Malicious code in kalasnik-npm-simple-test (npm) GHSA-pm4h-xrhq-vh62, MAL-2026-17206 | Malicious | Not scored | 28 Sep, 2026 | npm kalasnik-npm-simple-test |
Malicious release: Malicious code in kjj81 (npm) GHSA-9f7c-6fp7-9g6x, MAL-2026-17207 | Malicious | Not scored | 28 Sep, 2026 | npm kjj81 |
Malicious release: Malicious code in uuid-date (npm) GHSA-pqvc-prrc-mv45, MAL-2026-17210 | Malicious | Not scored | 28 Sep, 2026 | npm uuid-date |
Malicious release: Malicious code in riot-private (npm) GHSA-qgpm-ggcf-4fqm, MAL-2026-17208 | Malicious | Not scored | 28 Sep, 2026 | npm riot-private |
Malicious release: Malicious code in vinzzsync-wacli (npm) GHSA-rmcq-f7vh-v86v, MAL-2026-17211 | Malicious | Not scored | 28 Sep, 2026 | npm vinzzsync-wacli |
Malicious release: Malicious code in tanksync (npm) GHSA-47j4-w95p-wjp7, MAL-2026-17209 | Malicious | Not scored | 28 Sep, 2026 | npm tanksync |
Malicious release: Malicious code in @consts/links (npm) GHSA-5rp9-7r4x-3fqp, MAL-2026-17202 | Malicious | Not scored | 28 Sep, 2026 | npm @consts/links |
Malicious release: Malicious code in @digi-kernel/digi-kernel-constrains (npm) GHSA-h37m-2c3q-82j8, MAL-2026-17203 | Malicious | Not scored | 28 Sep, 2026 | npm @digi-kernel/digi-kernel-constrains |
Malicious release: Malicious code in @bb1ptest23/test-paket (npm) MAL-2026-17201 | Malicious | Not scored | 28 Sep, 2026 | npm @bb1ptest23/test-paket |
Malicious release: Malicious code in scrapetools2 (PyPI) MAL-2026-17199 | Malicious | Not scored | 27 Sep, 2026 | PyPI scrapetools2 |
Malicious release: Malicious code in aseity (PyPI) MAL-2026-17200 | Malicious | Not scored | 27 Sep, 2026 | PyPI aseity |
Malicious release: Malicious code in caracas4check (PyPI) MAL-2026-17198 | Malicious | Not scored | 27 Sep, 2026 | PyPI caracas4check |
Malicious release: Malicious code in coinscan (PyPI) MAL-2026-17197 | Malicious | Not scored | 27 Sep, 2026 | PyPI coinscan |
Malicious release: Malicious code in claudedashbord (PyPI) MAL-2026-17195 | Malicious | Not scored | 27 Sep, 2026 | PyPI claudedashbord |
Malicious release: Malicious code in donutpromotion (PyPI) MAL-2026-17196 | Malicious | Not scored | 27 Sep, 2026 | PyPI donutpromotion |
Malicious release: Malicious code in metrics-sdk (PyPI) MAL-2026-17194 | Malicious | Not scored | 27 Sep, 2026 | PyPI metrics-sdk |
Malicious release: Malicious code in metrio (PyPI) MAL-2026-17193 | Malicious | Not scored | 27 Sep, 2026 | PyPI metrio |
Malicious release: Malicious code in donutautosellsrc (PyPI) MAL-2026-17192 | Malicious | Not scored | 27 Sep, 2026 | PyPI donutautosellsrc |
Malicious release: Malicious code in requests-cache-utils (PyPI) MAL-2026-17191 | Malicious | Not scored | 26 Sep, 2026 | PyPI requests-cache-utils |