Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in efhthrthrthregerht (npm) MAL-2026-16436 | Malicious | Not scored | 23 Sep, 2026 | npm efhthrthrthregerht |
Malicious release: Malicious code in @vitemirrorte/element-plus-vite-cli (npm) MAL-2026-16433 | Malicious | Not scored | 23 Sep, 2026 | npm @vitemirrorte/element-plus-vite-cli |
Malicious release: Malicious code in @wizloft/harness-file-providers (npm) GHSA-2jrv-g43f-qm7f, MAL-2026-16427 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-file-providers |
Malicious release: Malicious code in @wizloft/harness-commands (npm) GHSA-cv26-mq7q-h5hq, MAL-2026-16425 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-commands |
Malicious release: Malicious code in @wizloft/harness-cli-adapter (npm) GHSA-hmmw-27v2-3qc8, MAL-2026-16424 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-cli-adapter |
Malicious release: Malicious code in @wizloft/harness-project (npm) GHSA-xj44-gx57-mm59, MAL-2026-16432 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-project |
Malicious release: Malicious code in @wizloft/harness-memory (npm) GHSA-3mjw-625p-wvhf, MAL-2026-16428 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-memory |
Malicious release: Malicious code in @wizloft/harness-plugin-file-memory (npm) GHSA-64w5-qg43-54g7, MAL-2026-16430 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-plugin-file-memory |
Malicious release: Malicious code in @wizloft/harness-plugin-file-events (npm) GHSA-6866-wx9h-j2rh, MAL-2026-16429 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-plugin-file-events |
Malicious release: Malicious code in @wizloft/harness-authority (npm) GHSA-8h24-fp89-4cw3, MAL-2026-16423 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-authority |
Malicious release: Malicious code in @wizloft/harness-evidence (npm) GHSA-mjfj-x5qx-p7v8, MAL-2026-16426 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-evidence |
Malicious release: Malicious code in @wizloft/harness-plugin-memory-context (npm) GHSA-r4qq-8p58-gfpv, MAL-2026-16431 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-plugin-memory-context |
Malicious release: Malicious code in @httttt/mcp-npx-fetch-1 (npm) GHSA-q6m6-3rfx-7f62, MAL-2026-16422 | Malicious | Not scored | 23 Sep, 2026 | npm @httttt/mcp-npx-fetch-1 |
Malicious release: Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm) GHSA-mhjf-v53x-7p87, MAL-2026-16476 | Malicious | Not scored | 23 Sep, 2026 | npm @memtensor/memos-cloud-openclaw-plugin |
Malicious release: Malicious code in memoryos (PyPI) MAL-2026-16475, PYSEC-2026-3987 | Malicious | Not scored | 23 Sep, 2026 | PyPI memoryos |
Malicious release: Malicious code in kerokwis (PyPI) MAL-2026-16421 | Malicious | Not scored | 22 Sep, 2026 | PyPI kerokwis |
Malicious release: Malicious code in @gsutevil/hta-stage (npm) MAL-2026-16419 | Malicious | Not scored | 22 Sep, 2026 | npm @gsutevil/hta-stage |
Malicious release: Malicious code in n8n-nodes-data-transformer-utils (npm) MAL-2026-16418 | Malicious | Not scored | 22 Sep, 2026 | npm n8n-nodes-data-transformer-utils |
Malicious release: Malicious code in @tvg-mar/promos-context (npm) GHSA-f42w-v662-25cr, MAL-2026-16412 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/promos-context |
Malicious release: Malicious code in @tvg-mar/promos-gtm (npm) GHSA-8g69-976g-h44g, MAL-2026-16413 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/promos-gtm |
Malicious release: Malicious code in @tvg-mar/storyblok-bridge (npm) GHSA-3wxx-x983-53mg, MAL-2026-16414 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/storyblok-bridge |
Malicious release: Malicious code in @tvg-mar/utils (npm) GHSA-p6w4-mmhj-wc4v, MAL-2026-16416 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/utils |
Malicious release: Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm) GHSA-gj3c-r86r-hr43, MAL-2026-16415 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/tvg-promos-atomic-ui |
Malicious release: Malicious code in auclean (PyPI) MAL-2026-16410 | Malicious | Not scored | 22 Sep, 2026 | PyPI auclean |
Malicious release: Malicious code in ubiquiti-agents-link-mcp (npm) GHSA-rqpx-hw2h-g3hc, MAL-2026-16409 | Malicious | Not scored | 22 Sep, 2026 | npm ubiquiti-agents-link-mcp |
Malicious release: Malicious code in snap-queue (PyPI) MAL-2026-16408 | Malicious | Not scored | 22 Sep, 2026 | PyPI snap-queue |
Malicious release: Malicious code in poly-check-b (PyPI) MAL-2026-16407 | Malicious | Not scored | 22 Sep, 2026 | PyPI poly-check-b |
Malicious release: Malicious code in crypto-trader-py (PyPI) MAL-2026-16406 | Malicious | Not scored | 22 Sep, 2026 | PyPI crypto-trader-py |
Malicious release: Malicious code in tailwind-form-styles (npm) GHSA-h48r-xx59-h44r, MAL-2026-16405 | Malicious | Not scored | 22 Sep, 2026 | npm tailwind-form-styles |
Malicious release: Malicious code in node-env-buffer (npm) GHSA-2g29-f3qp-c7gf, MAL-2026-16403 | Malicious | Not scored | 22 Sep, 2026 | npm node-env-buffer |
Malicious release: Malicious code in envforge3 (npm) GHSA-7chm-5cxc-2wx2, MAL-2026-16393 | Malicious | Not scored | 22 Sep, 2026 | npm envforge3 |
Malicious release: Malicious code in envforge2 (npm) GHSA-h8xg-3hfp-rx6q, MAL-2026-16392 | Malicious | Not scored | 22 Sep, 2026 | npm envforge2 |
Malicious release: Malicious code in envparse2 (npm) GHSA-q747-c2cv-gfhj, MAL-2026-16394 | Malicious | Not scored | 22 Sep, 2026 | npm envparse2 |
Malicious release: Malicious code in envparse3 (npm) GHSA-vq77-3r62-c2cx, MAL-2026-16395 | Malicious | Not scored | 22 Sep, 2026 | npm envparse3 |
Malicious release: Malicious code in sysverify (npm) GHSA-jpfv-9923-q8rq, MAL-2026-16404 | Malicious | Not scored | 22 Sep, 2026 | npm sysverify |
Malicious release: Malicious code in cloudndmcedu (npm) GHSA-3r7g-wjh4-5228, MAL-2026-16391 | Malicious | Not scored | 22 Sep, 2026 | npm cloudndmcedu |
Malicious release: Malicious code in ndmcjcxiebysfdb (npm) GHSA-8344-w2r2-rxp2, MAL-2026-16400 | Malicious | Not scored | 22 Sep, 2026 | npm ndmcjcxiebysfdb |
Malicious release: Malicious code in ndmcmsujey (npm) GHSA-fjp4-jprr-4jp6, MAL-2026-16402 | Malicious | Not scored | 22 Sep, 2026 | npm ndmcmsujey |
Malicious release: Malicious code in ndmckauxuoincv (npm) GHSA-q5vm-6mhj-qq8c, MAL-2026-16401 | Malicious | Not scored | 22 Sep, 2026 | npm ndmckauxuoincv |
Malicious release: Malicious code in fdhcxvnwhjiofv (npm) GHSA-299v-cwvm-ffx4, MAL-2026-16396 | Malicious | Not scored | 22 Sep, 2026 | npm fdhcxvnwhjiofv |
Malicious release: Malicious code in luftmvfiwgxydes (npm) GHSA-j2f6-x53f-2qqf, MAL-2026-16398 | Malicious | Not scored | 22 Sep, 2026 | npm luftmvfiwgxydes |
Malicious release: Malicious code in kambxjowhdsgyw (npm) GHSA-pmhv-gqr9-wrgr, MAL-2026-16397 | Malicious | Not scored | 22 Sep, 2026 | npm kambxjowhdsgyw |
Malicious release: Malicious code in lufxchwmxwyps (npm) GHSA-xvmw-wchq-f7p8, MAL-2026-16399 | Malicious | Not scored | 22 Sep, 2026 | npm lufxchwmxwyps |
Malicious release: Malicious code in oracle-redis (npm) MAL-2026-16390 | Malicious | Not scored | 22 Sep, 2026 | npm oracle-redis |
Malicious release: Malicious code in noverojava (npm) MAL-2026-16389 | Malicious | Not scored | 22 Sep, 2026 | npm noverojava |
Malicious release: Malicious code in nodetokyo (npm) MAL-2026-16388 | Malicious | Not scored | 22 Sep, 2026 | npm nodetokyo |
Malicious release: Malicious code in zeal-utils (npm) MAL-2026-16542 | Malicious | Not scored | 22 Sep, 2026 | npm zeal-utils |
Malicious release: Malicious code in zeal-util-hooks (npm) MAL-2026-16541 | Malicious | Not scored | 22 Sep, 2026 | npm zeal-util-hooks |
Malicious release: Malicious code in style-class-utils (npm) MAL-2026-16540 | Malicious | Not scored | 22 Sep, 2026 | npm style-class-utils |
Malicious release: Malicious code in spark-rpc (npm) MAL-2026-16538 | Malicious | Not scored | 22 Sep, 2026 | npm spark-rpc |