Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in code-tool-langfuse (npm) MAL-2026-4532 | Malicious | Not scored | 20 May, 2026 | npm code-tool-langfuse |
Malicious release: Malicious code in hpsetup (npm) MAL-2026-4579 | Malicious | Not scored | 20 May, 2026 | npm hpsetup |
Malicious release: Malicious code in etherjs-utils (npm) GHSA-3c7w-4xp2-7963, MAL-2026-4239 | Malicious | Not scored | 20 May, 2026 | npm etherjs-utils |
Malicious release: Malicious code in jsonbson (npm) GHSA-44rg-m26f-r36f, MAL-2026-4591 | Malicious | Not scored | 20 May, 2026 | npm jsonbson |
Malicious release: Malicious code in hardhat-gas-profiler-plugin (npm) GHSA-w4rg-p3x5-fv42, MAL-2026-4244 | Malicious | Not scored | 20 May, 2026 | npm hardhat-gas-profiler-plugin |
Malicious release: Malicious code in chainlink-price-feed-aggregator (npm) GHSA-88p4-x24p-x2j9, MAL-2026-4233 | Malicious | Not scored | 20 May, 2026 | npm chainlink-price-feed-aggregator |
Malicious release: Malicious code in @rocketreach/rr-components (npm) GHSA-7v8q-r297-95jx, MAL-2026-4427 | Malicious | Not scored | 20 May, 2026 | npm @rocketreach/rr-components |
Malicious release: Malicious code in crypto-javascript (npm) GHSA-v8fq-265h-rcw5, MAL-2026-4542 | Malicious | Not scored | 20 May, 2026 | npm crypto-javascript |
Malicious release: Malicious code in ganache-cli-provider (npm) GHSA-hfp4-5fx7-5mwm, MAL-2026-4243 | Malicious | Not scored | 20 May, 2026 | npm ganache-cli-provider |
Malicious release: Malicious code in solna-web3 (npm) GHSA-39j5-93x5-73hc, MAL-2026-4248 | Malicious | Not scored | 20 May, 2026 | npm solna-web3 |
Malicious release: Malicious code in solana-pda-helper (npm) GHSA-jrx8-mvj8-9gq2, MAL-2026-4247 | Malicious | Not scored | 20 May, 2026 | npm solana-pda-helper |
Malicious release: Malicious code in foundry-deploy-helper (npm) GHSA-xhp8-r3hh-j47p, MAL-2026-4241 | Malicious | Not scored | 20 May, 2026 | npm foundry-deploy-helper |
Malicious release: Malicious code in ethers-multicall-utils (npm) GHSA-r83q-qx5h-cjqm, MAL-2026-4240 | Malicious | Not scored | 20 May, 2026 | npm ethers-multicall-utils |
Malicious release: Malicious code in to-cms (npm) GHSA-789x-j439-qx3f, MAL-2026-4693 | Malicious | Not scored | 19 May, 2026 | npm to-cms |
Malicious release: Malicious code in martinez-polygon-clipping-tony (npm) GHSA-64jc-f3r5-gp74, MAL-2026-4606 | Malicious | Not scored | 19 May, 2026 | npm martinez-polygon-clipping-tony |
Malicious release: Malicious code in morin (PyPI) MAL-2026-4757 | Malicious | Not scored | 19 May, 2026 | PyPI morin |
Malicious release: Malicious code in did-0091 (npm) MAL-2026-4177 | Malicious | Not scored | 19 May, 2026 | npm did-0091 |
Malicious release: Malicious code in aurafarmer (PyPI) MAL-2026-4741 | Malicious | Not scored | 19 May, 2026 | PyPI aurafarmer |
Malicious release: Malicious code in silly-logger (PyPI) MAL-2026-4767 | Malicious | Not scored | 19 May, 2026 | PyPI silly-logger |
Malicious release: Malicious code in eplang (PyPI) MAL-2026-4748 | Malicious | Not scored | 19 May, 2026 | PyPI eplang |
Malicious release: Malicious code in pycalendar-api (PyPI) MAL-2026-4764 | Malicious | Not scored | 19 May, 2026 | PyPI pycalendar-api |
Malicious release: Malicious code in glass-of-water (PyPI) MAL-2026-4751 | Malicious | Not scored | 19 May, 2026 | PyPI glass-of-water |
Malicious release: Malicious code in nebulix-ai (PyPI) MAL-2026-4758 | Malicious | Not scored | 19 May, 2026 | PyPI nebulix-ai |
Malicious release: Malicious code in zod-to-js (npm) GHSA-8cm2-vv7w-4c27, MAL-2026-4740 | Malicious | Not scored | 19 May, 2026 | npm zod-to-js |
Malicious release: Malicious code in soundsource (PyPI) MAL-2026-4769 | Malicious | Not scored | 19 May, 2026 | PyPI soundsource |
Malicious release: Malicious code in buddyme (PyPI) MAL-2026-4743 | Malicious | Not scored | 19 May, 2026 | PyPI buddyme |
Malicious release: Malicious code in collected-forms-embed-js (npm) GHSA-9j37-8wjm-pcxq, MAL-2026-4175 | Malicious | Not scored | 19 May, 2026 | npm collected-forms-embed-js |
Malicious release: Malicious code in clsx-js (npm) GHSA-8jmh-pvvx-wjrf, MAL-2026-4531 | Malicious | Not scored | 19 May, 2026 | npm clsx-js |
Malicious release: Malicious code in dabrius-utils (PyPI) MAL-2026-4176 | Malicious | Not scored | 19 May, 2026 | PyPI dabrius-utils |
Malicious release: Malicious code in btd-smart (npm) GHSA-m4m6-q4p8-3vjv, MAL-2026-4501 | Malicious | Not scored | 19 May, 2026 | npm btd-smart |
Malicious release: Malicious code in crypto-hash-sdk (npm) GHSA-hr6r-2xx8-mrh9, MAL-2026-4541 | Malicious | Not scored | 19 May, 2026 | npm crypto-hash-sdk |
Malicious release: Malicious code in xorma-js (npm) GHSA-h7mc-23rp-vpj6, MAL-2026-4734 | Malicious | Not scored | 19 May, 2026 | npm xorma-js |
Malicious release: Malicious code in qr-code-styling-temp (npm) GHSA-m7q2-jqhj-4f3q, GHSA-pp2c-4x5r-7h8j, MAL-2026-4655, SNYK-JS-QRCODESTYLINGTEMP-19161484 | Malicious | Not scored | 19 May, 2026 | npm qr-code-styling-temp |
Malicious release: Malicious code in whiteboard-agent (npm) MAL-2026-4729 | Malicious | Not scored | 19 May, 2026 | npm whiteboard-agent |
Malicious release: Malicious code in claude-all-config (npm) MAL-2026-4522 | Malicious | Not scored | 19 May, 2026 | npm claude-all-config |
Malicious release: Malicious code in corelia (npm) GHSA-fg63-2vqh-93xf, MAL-2026-4536 | Malicious | Not scored | 19 May, 2026 | npm corelia |
Malicious release: Malicious code in superacli (npm) MAL-2026-4674 | Malicious | Not scored | 19 May, 2026 | npm superacli |
Malicious release: Malicious code in prettier-sdk (npm) GHSA-hwr7-qq29-qrf2, MAL-2026-4645 | Malicious | Not scored | 19 May, 2026 | npm prettier-sdk |
Malicious release: Malicious code in cheaty-sync-bot (npm) MAL-2026-4518 | Malicious | Not scored | 19 May, 2026 | npm cheaty-sync-bot |
Malicious release: Malicious code in bytecore (npm) GHSA-x73m-hgh7-64q2, MAL-2026-4503 | Malicious | Not scored | 19 May, 2026 | npm bytecore |
Malicious release: Malicious code in durabletask (PyPI) MAL-2026-4174, PYSEC-2026-207 | Malicious | Not scored | 19 May, 2026 | PyPI durabletask |
Malicious release: Malicious code in @mc-xp/mc-monolith-js-src-package (npm) GHSA-58vg-vvv2-vr42, MAL-2026-4171 | Malicious | Not scored | 19 May, 2026 | npm @mc-xp/mc-monolith-js-src-package |
Malicious release: Malicious code in @piewasm/pie-web-npm-package (npm) GHSA-jvrm-qr5x-5wfx, MAL-2026-4172 | Malicious | Not scored | 19 May, 2026 | npm @piewasm/pie-web-npm-package |
Malicious release: Malicious code in is-really-odd (npm) GHSA-jjv2-fjq3-2ggj, MAL-2026-4173 | Malicious | Not scored | 19 May, 2026 | npm is-really-odd |
Malicious release: Malicious code in psxjson (npm) GHSA-cjgp-rvr9-v9w4, MAL-2026-4170 | Malicious | Not scored | 19 May, 2026 | npm psxjson |
Malicious release: Malicious code in paysafe-gbp-virtual-assistant-lib-fe (npm) MAL-2026-4169 | Malicious | Not scored | 19 May, 2026 | npm paysafe-gbp-virtual-assistant-lib-fe |
Malicious release: Malicious code in chai-as-attracted (npm) GHSA-f6hv-jpgr-c835, MAL-2026-4167 | Malicious | Not scored | 19 May, 2026 | npm chai-as-attracted |
Malicious release: Malicious code in chai-as-vec (npm) GHSA-g2hx-wqmp-2fhg, MAL-2026-4168 | Malicious | Not scored | 19 May, 2026 | npm chai-as-vec |
Malicious release: Malicious code in paysafe-gbp-virtual-terminal-lib-fe (npm) MAL-2026-4165 | Malicious | Not scored | 19 May, 2026 | npm paysafe-gbp-virtual-terminal-lib-fe |
Malicious release: Malicious code in tarpackage (PyPI) MAL-2026-4166 | Malicious | Not scored | 19 May, 2026 | PyPI tarpackage |