Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in polymarket-bot (npm) GHSA-9x4c-gq65-ggmc, MAL-2026-4211 | Malicious | Not scored | 21 May, 2026 | npm polymarket-bot |
Malicious release: Malicious code in polymarket-claude-code (npm) GHSA-hqrj-3257-4cwr, MAL-2026-4212 | Malicious | Not scored | 21 May, 2026 | npm polymarket-claude-code |
Malicious release: Malicious code in polymarket-trader (npm) GHSA-jgmf-qv79-wc9f, MAL-2026-4216 | Malicious | Not scored | 21 May, 2026 | npm polymarket-trader |
Malicious release: Malicious code in polymarket-terminal (npm) GHSA-mhqj-q9r5-99vg, MAL-2026-4214 | Malicious | Not scored | 21 May, 2026 | npm polymarket-terminal |
Malicious release: Malicious code in polymarket-ai-agent (npm) GHSA-pm36-9m37-g548, MAL-2026-4209 | Malicious | Not scored | 21 May, 2026 | npm polymarket-ai-agent |
Malicious release: Malicious code in polymarket-trading-cli (npm) GHSA-q888-mwhg-ccmp, MAL-2026-4217 | Malicious | Not scored | 21 May, 2026 | npm polymarket-trading-cli |
Malicious release: Malicious code in defi-threat-scanner (npm) GHSA-q896-rx3q-5794, MAL-2026-4205 | Malicious | Not scored | 21 May, 2026 | npm defi-threat-scanner |
Malicious release: Malicious code in chain-key-validator (npm) GHSA-vpcq-rhwg-qph4, MAL-2026-4202 | Malicious | Not scored | 21 May, 2026 | npm chain-key-validator |
Malicious release: Malicious code in claude-internal-utils (npm) GHSA-jxg3-fwfv-fjwf, MAL-2026-4525 | Malicious | Not scored | 20 May, 2026 | npm claude-internal-utils |
Malicious release: Malicious code in obs-migrate (PyPI) MAL-2026-4201 | Malicious | Not scored | 20 May, 2026 | PyPI obs-migrate |
Malicious release: Malicious code in deployment-key-auditor (npm) GHSA-m69v-rchm-xjjp, MAL-2026-4206 | Malicious | Not scored | 20 May, 2026 | npm deployment-key-auditor |
Malicious release: Malicious code in defi-env-auditor (npm) GHSA-3wcx-fvrv-6w6w, MAL-2026-4204 | Malicious | Not scored | 20 May, 2026 | npm defi-env-auditor |
Malicious release: Malicious code in solidity-deploy-guard (npm) GHSA-3r5j-pgc5-q23x, MAL-2026-4218 | Malicious | Not scored | 20 May, 2026 | npm solidity-deploy-guard |
Malicious release: Malicious code in supership-scan (npm) GHSA-v62j-7p69-5q4q, MAL-2026-4675 | Malicious | Not scored | 20 May, 2026 | npm supership-scan |
Malicious release: Malicious code in create-kachow (npm) MAL-2026-4539 | Malicious | Not scored | 20 May, 2026 | npm create-kachow |
Malicious release: Malicious code in chain-async-test (npm) MAL-2026-4516 | Malicious | Not scored | 20 May, 2026 | npm chain-async-test |
Malicious release: Malicious code in vite-json-config (npm) MAL-2026-4705 | Malicious | Not scored | 20 May, 2026 | npm vite-json-config |
Malicious release: Malicious code in instal (PyPI) MAL-2026-4195 | Malicious | Not scored | 20 May, 2026 | PyPI instal |
Malicious release: Malicious code in bolt-delivery-menu-app (npm) GHSA-75c2-fw59-mg5f, GHSA-pfrq-994m-rxrr, MAL-2026-4499 | Malicious | Not scored | 20 May, 2026 | npm bolt-delivery-menu-app |
Malicious release: Malicious code in @vivaux/telemetry (npm) GHSA-hq2r-xw8m-v4q8, MAL-2026-4463 | Malicious | Not scored | 20 May, 2026 | npm @vivaux/telemetry |
Malicious release: Malicious code in cb-wallet-http (npm) GHSA-mv3f-92cr-83h7, MAL-2026-4507 | Malicious | Not scored | 20 May, 2026 | npm cb-wallet-http |
Malicious release: Malicious code in ethers-wallet-package (npm) GHSA-7pvf-g7jg-rxpj, MAL-2026-4553 | Malicious | Not scored | 20 May, 2026 | npm ethers-wallet-package |
Malicious release: Malicious code in private-next-pages (npm) MAL-2026-4193 | Malicious | Not scored | 20 May, 2026 | npm private-next-pages |
Malicious release: Malicious code in txdpy (PyPI) MAL-2026-4772 | Malicious | Not scored | 20 May, 2026 | PyPI txdpy |
Malicious release: Malicious code in vlifegram (PyPI) MAL-2026-4773 | Malicious | Not scored | 20 May, 2026 | PyPI vlifegram |
Malicious release: Malicious code in iv-stubborn (npm) GHSA-g54w-82gq-9mwp, MAL-2026-4192 | Malicious | Not scored | 20 May, 2026 | npm iv-stubborn |
Malicious release: Malicious code in @doctolib-apps/native-personalized-services (npm) GHSA-hgpx-hj7x-3cx9, MAL-2026-4186 | Malicious | Not scored | 20 May, 2026 | npm @doctolib-apps/native-personalized-services |
Malicious release: Malicious code in iv-bloomfilter (npm) GHSA-wxq4-7mxh-8jpq, MAL-2026-4191 | Malicious | Not scored | 20 May, 2026 | npm iv-bloomfilter |
Malicious release: Malicious code in uolcs-host-uol-anuncios-fe (npm) GHSA-p4vr-mx6g-r574, MAL-2026-4185 | Malicious | Not scored | 20 May, 2026 | npm uolcs-host-uol-anuncios-fe |
Malicious release: Malicious code in stripe-internal-utils (npm) MAL-2026-4184 | Malicious | Not scored | 20 May, 2026 | npm stripe-internal-utils |
Malicious release: Malicious code in @limebike/frontend-core-api (npm) GHSA-89wg-7gqg-72xf, MAL-2026-4187 | Malicious | Not scored | 20 May, 2026 | npm @limebike/frontend-core-api |
Malicious release: Malicious code in mamadoos-test (npm) GHSA-qwhw-2wfv-rv3r, MAL-2026-4605 | Malicious | Not scored | 20 May, 2026 | npm mamadoos-test |
Malicious release: Malicious code in randomlogs (npm) GHSA-6x8j-5cx8-5qv6, MAL-2026-4657 | Malicious | Not scored | 20 May, 2026 | npm randomlogs |
Malicious release: Malicious code in @limebike/supreme-data-grid (npm) GHSA-5jxw-6cjm-j5cf, MAL-2026-4189 | Malicious | Not scored | 20 May, 2026 | npm @limebike/supreme-data-grid |
Malicious release: Malicious code in gator-client (npm) GHSA-jrf3-vfx4-8vqh, GHSA-r569-8mc4-rfp6, MAL-2026-4569 | Malicious | Not scored | 20 May, 2026 | npm gator-client |
Malicious release: Malicious code in rendezvous-js (npm) GHSA-cj5p-rpr4-5cvh, GHSA-q26f-8xxj-pwwf, MAL-2026-4662 | Malicious | Not scored | 20 May, 2026 | npm rendezvous-js |
Malicious release: Malicious code in banana-stand (npm) GHSA-m27g-5q57-x86r, GHSA-x4gx-rrjg-5rrh, MAL-2026-4495 | Malicious | Not scored | 20 May, 2026 | npm banana-stand |
Malicious release: Malicious code in @limebike/supreme-date-pickers (npm) GHSA-9r56-r4mm-h4p3, MAL-2026-4190 | Malicious | Not scored | 20 May, 2026 | npm @limebike/supreme-date-pickers |
Malicious release: Malicious code in lynx-keeper (npm) GHSA-x7hr-g7qr-7j7p, MAL-2026-4603 | Malicious | Not scored | 20 May, 2026 | npm lynx-keeper |
Malicious release: Malicious code in @limebike/supreme (npm) GHSA-9x95-pwr5-8g32, MAL-2026-4188 | Malicious | Not scored | 20 May, 2026 | npm @limebike/supreme |
Malicious release: Malicious code in web3-secrets-detector (npm) GHSA-qc99-w9r4-jrg5, MAL-2026-4220 | Malicious | Not scored | 20 May, 2026 | npm web3-secrets-detector |
Malicious release: Malicious code in wallet-backup-verifier (npm) GHSA-jq6x-r6vm-vwrx, MAL-2026-4250 | Malicious | Not scored | 20 May, 2026 | npm wallet-backup-verifier |
Malicious release: Malicious code in encrata-cli (npm) MAL-2026-4551 | Malicious | Not scored | 20 May, 2026 | npm encrata-cli |
Malicious release: Malicious code in libhmac (PyPI) MAL-2026-4194 | Malicious | Not scored | 20 May, 2026 | PyPI libhmac |
Malicious release: Malicious code in bitrix24-tasks-mcp-server (npm) MAL-2026-4498 | Malicious | Not scored | 20 May, 2026 | npm bitrix24-tasks-mcp-server |
Malicious release: Malicious code in yessir-node (npm) MAL-2026-4736 | Malicious | Not scored | 20 May, 2026 | npm yessir-node |
Malicious release: Malicious code in svharness (npm) MAL-2026-4676 | Malicious | Not scored | 20 May, 2026 | npm svharness |
Malicious release: Malicious code in gm-kilo (npm) MAL-2026-4574 | Malicious | Not scored | 20 May, 2026 | npm gm-kilo |
Malicious release: Malicious code in nw-demo (npm) GHSA-hmxw-6c9h-v2h2, MAL-2026-4624 | Malicious | Not scored | 20 May, 2026 | npm nw-demo |
Malicious release: Malicious code in nolimit-x (npm) GHSA-cp8c-2xwh-q227, MAL-2026-4621 | Malicious | Not scored | 20 May, 2026 | npm nolimit-x |