Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in test890-auth (npm) GHSA-xvpv-wq7p-548c, MAL-2026-16289 | Malicious | Not scored | 18 Sep, 2026 | npm test890-auth |
Malicious release: Malicious code in test8999-auth (npm) GHSA-25wf-vfrc-2r82, MAL-2026-16286 | Malicious | Not scored | 18 Sep, 2026 | npm test8999-auth |
Malicious release: Malicious code in test899-auth (npm) GHSA-jf2q-w77c-99vv, MAL-2026-16285 | Malicious | Not scored | 18 Sep, 2026 | npm test899-auth |
Malicious release: Malicious code in @shared-web/assets (npm) MAL-2026-16283 | Malicious | Not scored | 18 Sep, 2026 | npm @shared-web/assets |
Malicious release: Malicious code in sinful (npm) GHSA-2xjj-r8mc-xpf6, MAL-2026-16284 | Malicious | Not scored | 18 Sep, 2026 | npm sinful |
Malicious release: Malicious code in tailwindcss-form (npm) GHSA-c8m9-qwg6-5cv9, MAL-2026-16282 | Malicious | Not scored | 18 Sep, 2026 | npm tailwindcss-form |
Malicious release: Malicious code in @sanzoffc/baileys (npm) GHSA-w5cc-9p38-q2wq, MAL-2026-16281 | Malicious | Not scored | 18 Sep, 2026 | npm @sanzoffc/baileys |
Malicious release: Malicious code in xzvbailsx (npm) MAL-2026-16279 | Malicious | Not scored | 18 Sep, 2026 | npm xzvbailsx |
Malicious release: Malicious code in xzvbailey (npm) MAL-2026-16278 | Malicious | Not scored | 18 Sep, 2026 | npm xzvbailey |
Malicious release: Malicious code in xa424234657567 (npm) MAL-2026-16277 | Malicious | Not scored | 18 Sep, 2026 | npm xa424234657567 |
Malicious release: Malicious code in zero-baileys (npm) GHSA-v486-jrrq-rhwx, MAL-2026-16280 | Malicious | Not scored | 18 Sep, 2026 | npm zero-baileys |
Malicious release: Malicious code in @lekzo/baileys (npm) GHSA-jv7g-wqqq-m6gm, MAL-2026-16276 | Malicious | Not scored | 18 Sep, 2026 | npm @lekzo/baileys |
Malicious release: Malicious code in requests-auroras (PyPI) MAL-2026-16274 | Malicious | Not scored | 17 Sep, 2026 | PyPI requests-auroras |
Malicious release: Malicious code in blue-string-formatter-utils (npm) MAL-2026-16273 | Malicious | Not scored | 17 Sep, 2026 | npm blue-string-formatter-utils |
Malicious release: Malicious code in @tink/tink-link-core (npm) MAL-2026-16270 | Malicious | Not scored | 17 Sep, 2026 | npm @tink/tink-link-core |
Malicious release: Malicious code in test89078-auth (npm) MAL-2026-16271 | Malicious | Not scored | 17 Sep, 2026 | npm test89078-auth |
Malicious release: Malicious code in requests-triwes (PyPI) MAL-2026-16275 | Malicious | Not scored | 17 Sep, 2026 | PyPI requests-triwes |
Malicious release: Malicious code in requests-asetwe (PyPI) MAL-2026-16269 | Malicious | Not scored | 17 Sep, 2026 | PyPI requests-asetwe |
Malicious release: Malicious code in index-forum (PyPI) MAL-2026-16268 | Malicious | Not scored | 17 Sep, 2026 | PyPI index-forum |
Malicious release: Malicious code in kartykgithub-multiversion-a (npm) GHSA-p957-4pc7-x6hp, MAL-2026-16272 | Malicious | Not scored | 17 Sep, 2026 | npm kartykgithub-multiversion-a |
Malicious release: Malicious code in pyjstat-smooth (PyPI) MAL-2026-16267 | Malicious | Not scored | 17 Sep, 2026 | PyPI pyjstat-smooth |
Malicious release: Malicious code in @kartyk-github-org/takedown-b (npm) GHSA-q83w-3hvr-fgg7, MAL-2026-16266 | Malicious | Not scored | 17 Sep, 2026 | npm @kartyk-github-org/takedown-b |
Malicious release: Malicious code in @kartyk-github-org/takedown-a (npm) GHSA-rx76-mcg9-gqc5, MAL-2026-16265 | Malicious | Not scored | 17 Sep, 2026 | npm @kartyk-github-org/takedown-a |
Malicious release: Malicious code in tailwindcss-form-ui (npm) MAL-2026-16262 | Malicious | Not scored | 17 Sep, 2026 | npm tailwindcss-form-ui |
Malicious release: Malicious code in tailwindcss-form-utils (npm) MAL-2026-16263 | Malicious | Not scored | 17 Sep, 2026 | npm tailwindcss-form-utils |
Malicious release: Malicious code in @railone/image-utils (npm) MAL-2026-16261 | Malicious | Not scored | 17 Sep, 2026 | npm @railone/image-utils |
Malicious release: Malicious code in aiosendletter (PyPI) MAL-2026-16264 | Malicious | Not scored | 17 Sep, 2026 | PyPI aiosendletter |
Malicious release: Malicious code in confx1789550882 (npm) MAL-2026-16260 | Malicious | Not scored | 17 Sep, 2026 | npm confx1789550882 |
Malicious release: Malicious code in randompkga (npm) GHSA-532p-c872-3926, MAL-2026-16255 | Malicious | Not scored | 17 Sep, 2026 | npm randompkga |
Malicious release: Malicious code in randompkgd (npm) GHSA-cqc9-f5fp-r45q, MAL-2026-16258 | Malicious | Not scored | 17 Sep, 2026 | npm randompkgd |
Malicious release: Malicious code in randompkgc (npm) GHSA-p8m5-fmxm-99f6, MAL-2026-16257 | Malicious | Not scored | 17 Sep, 2026 | npm randompkgc |
Malicious release: Malicious code in randompkge (npm) GHSA-rc4q-v4pf-8j7x, MAL-2026-16259 | Malicious | Not scored | 17 Sep, 2026 | npm randompkge |
Malicious release: Malicious code in randompkgb (npm) GHSA-vxvv-gh3g-35pj, MAL-2026-16256 | Malicious | Not scored | 17 Sep, 2026 | npm randompkgb |
Malicious release: Malicious code in pulse-pwn-9f3a2 (npm) GHSA-fwr5-cj49-cq4h, MAL-2026-16254 | Malicious | Not scored | 17 Sep, 2026 | npm pulse-pwn-9f3a2 |
Malicious release: Malicious code in ragacateslikodi (npm) GHSA-mjhw-5x2v-v3wg, MAL-2026-16252 | Malicious | Not scored | 17 Sep, 2026 | npm ragacateslikodi |
Malicious release: Malicious code in tailwindcss-contact-form (npm) MAL-2026-16251 | Malicious | Not scored | 17 Sep, 2026 | npm tailwindcss-contact-form |
Malicious release: Malicious code in marketing-mcp (PyPI) MAL-2026-16250 | Malicious | Not scored | 17 Sep, 2026 | PyPI marketing-mcp |
Malicious release: Malicious code in kartykgithub-takedown-b (npm) GHSA-f8wr-9w83-7gmw, MAL-2026-16249 | Malicious | Not scored | 17 Sep, 2026 | npm kartykgithub-takedown-b |
Malicious release: Malicious code in kartykgithub-takedown-a (npm) GHSA-5r64-rpvg-q9rr, MAL-2026-16248 | Malicious | Not scored | 17 Sep, 2026 | npm kartykgithub-takedown-a |
Malicious release: Malicious code in laycot (npm) MAL-2026-16253 | Malicious | Not scored | 16 Sep, 2026 | npm laycot |
Malicious release: Malicious code in kartyk-github-token-pkg (npm) GHSA-4rmp-vchm-9gvg, MAL-2026-16246 | Malicious | Not scored | 16 Sep, 2026 | npm kartyk-github-token-pkg |
Malicious release: Malicious code in kartyk-github-single-ver-pkg (npm) GHSA-4vpr-3r9p-p9fh, MAL-2026-16245 | Malicious | Not scored | 16 Sep, 2026 | npm kartyk-github-single-ver-pkg |
Malicious release: Malicious code in pkg-rollback-dreed-viced-sonic-ponds (npm) GHSA-63f3-rmrf-6m9q, MAL-2026-16247 | Malicious | Not scored | 16 Sep, 2026 | npm pkg-rollback-dreed-viced-sonic-ponds |
Malicious release: Malicious code in kartyk-github-oidc-test-pkg (npm) GHSA-4vxh-7998-9h4g, MAL-2026-16244 | Malicious | Not scored | 16 Sep, 2026 | npm kartyk-github-oidc-test-pkg |
Malicious release: Malicious code in trongappy (PyPI) MAL-2026-16242 | Malicious | Not scored | 16 Sep, 2026 | PyPI trongappy |
Malicious release: Malicious code in rak-lab-yoav-orca-zrktd2cp5hjmo4x7 (PyPI) MAL-2026-16241 | Malicious | Not scored | 16 Sep, 2026 | PyPI rak-lab-yoav-orca-zrktd2cp5hjmo4x7 |
Malicious release: Malicious code in praetorian-mind-rce-test-2026 (PyPI) MAL-2026-16240 | Malicious | Not scored | 16 Sep, 2026 | PyPI praetorian-mind-rce-test-2026 |
Malicious release: Malicious code in idx_form_script (npm) MAL-2026-16243 | Malicious | Not scored | 16 Sep, 2026 | npm idx_form_script |
Malicious release: Malicious code in @traktis/core (npm) MAL-2026-16222 | Malicious | Not scored | 16 Sep, 2026 | npm @traktis/core |
Malicious release: Malicious code in @traktis/environment (npm) MAL-2026-16223 | Malicious | Not scored | 16 Sep, 2026 | npm @traktis/environment |