Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in nf-ui-components (npm) GHSA-9vr2-f57v-r6r2, MAL-2026-3339 | Malicious | Not scored | 05 May, 2026 | npm nf-ui-components |
Malicious release: Malicious code in fanduel (npm) GHSA-mjhc-2rfg-vh93, MAL-2026-3334 | Malicious | Not scored | 04 May, 2026 | npm fanduel |
Malicious release: Malicious code in rogiant-quick-install (PyPI) MAL-2026-3333 | Malicious | Not scored | 04 May, 2026 | PyPI rogiant-quick-install |
Malicious release: Malicious code in rogiant (PyPI) MAL-2026-3332 | Malicious | Not scored | 04 May, 2026 | PyPI rogiant |
Malicious release: Malicious code in lazyhtml-scripts (npm) MAL-2026-3331 | Malicious | Not scored | 04 May, 2026 | npm lazyhtml-scripts |
Malicious release: Malicious code in ms.analytics-web (npm) MAL-2026-3338 | Malicious | Not scored | 04 May, 2026 | npm ms.analytics-web |
Malicious release: Malicious code in api-typings (npm) GHSA-gjx9-hrcc-f6qj, MAL-2026-3329 | Malicious | Not scored | 04 May, 2026 | npm api-typings |
Malicious release: Malicious code in seek-pass (npm) GHSA-q39g-5xh5-89h3, MAL-2026-3330 | Malicious | Not scored | 04 May, 2026 | npm seek-pass |
Malicious release: Malicious code in pocpoc2626 (npm) MAL-2026-3328 | Malicious | Not scored | 04 May, 2026 | npm pocpoc2626 |
Malicious release: Malicious code in capacitor-plugin-service-worker (npm) GHSA-qg5c-9jmq-fpmf, MAL-2026-3327 | Malicious | Not scored | 04 May, 2026 | npm capacitor-plugin-service-worker |
Malicious release: Malicious code in @channel_bot/xa0 (npm) MAL-2026-3336 | Malicious | Not scored | 04 May, 2026 | npm @channel_bot/xa0 |
Malicious release: Malicious code in paychex-common-vendor-lib (npm) GHSA-64fr-896g-cjfw, MAL-2026-3326 | Malicious | Not scored | 04 May, 2026 | npm paychex-common-vendor-lib |
Malicious release: Malicious code in cloudauth-sdk (PyPI) MAL-2026-3325 | Malicious | Not scored | 04 May, 2026 | PyPI cloudauth-sdk |
Malicious release: Malicious code in randomchoicemas (PyPI) MAL-2026-3324 | Malicious | Not scored | 04 May, 2026 | PyPI randomchoicemas |
Malicious release: Malicious code in @t-in-one/save_application_hid_to_storage (npm) GHSA-99m3-vc85-ccc3, MAL-2026-3337 | Malicious | Not scored | 04 May, 2026 | npm @t-in-one/save_application_hid_to_storage |
Malicious release: Malicious code in @bank-widgets/whats-new (npm) MAL-2026-3335 | Malicious | Not scored | 04 May, 2026 | npm @bank-widgets/whats-new |
Malicious release: Malicious code in @b2b_blocker/hide_activation_error (npm) GHSA-97mp-8qgq-v82w, MAL-2026-3318 | Malicious | Not scored | 04 May, 2026 | npm @b2b_blocker/hide_activation_error |
Malicious release: Malicious code in @apple-pay-trust/check-apple-pay (npm) GHSA-c3f2-55m6-q284, MAL-2026-3316 | Malicious | Not scored | 04 May, 2026 | npm @apple-pay-trust/check-apple-pay |
Malicious release: Malicious code in @montanatonytest/app.web (npm) GHSA-g938-5928-2j43, MAL-2026-3321 | Malicious | Not scored | 04 May, 2026 | npm @montanatonytest/app.web |
Malicious release: Malicious code in @google-pay-trust/init-google-pay-result (npm) GHSA-mcg4-68w5-qh5p, MAL-2026-3319 | Malicious | Not scored | 04 May, 2026 | npm @google-pay-trust/init-google-pay-result |
Malicious release: Malicious code in @google-pay-trust/start (npm) GHSA-p2m3-4r92-xj4f, MAL-2026-3320 | Malicious | Not scored | 04 May, 2026 | npm @google-pay-trust/start |
Malicious release: Malicious code in @apple-pay-trust/destroy (npm) GHSA-r239-hc6j-wmm8, MAL-2026-3317 | Malicious | Not scored | 04 May, 2026 | npm @apple-pay-trust/destroy |
Malicious release: Malicious code in accesso-angular-cache-buster (npm) GHSA-66qr-2394-v3r3, MAL-2026-3276 | Malicious | Not scored | 04 May, 2026 | npm accesso-angular-cache-buster |
Malicious release: Malicious code in shopify-draggable (npm) GHSA-223c-5fg7-gqmv, MAL-2026-3282 | Malicious | Not scored | 04 May, 2026 | npm shopify-draggable |
Malicious release: Malicious code in tinfoil-shops (npm) GHSA-7p2r-cm6w-w768, MAL-2026-3284 | Malicious | Not scored | 04 May, 2026 | npm tinfoil-shops |
Malicious release: Malicious code in pos-next-react-native (npm) GHSA-9x65-cvfj-9vmq, MAL-2026-3281 | Malicious | Not scored | 04 May, 2026 | npm pos-next-react-native |
Malicious release: Malicious code in temhe-dev (npm) GHSA-f9jj-rhcp-rhf6, MAL-2026-3283 | Malicious | Not scored | 04 May, 2026 | npm temhe-dev |
Malicious release: Malicious code in pi-exa-mcp (npm) GHSA-fpc5-w8c8-3mhv, MAL-2026-3280 | Malicious | Not scored | 04 May, 2026 | npm pi-exa-mcp |
Malicious release: Malicious code in honcho-theme (npm) GHSA-gmrq-2vx2-vm67, MAL-2026-3278 | Malicious | Not scored | 04 May, 2026 | npm honcho-theme |
Malicious release: Malicious code in @kills_sh/bootstrap (npm) GHSA-gxfc-h756-8jpg, MAL-2026-3275 | Malicious | Not scored | 04 May, 2026 | npm @kills_sh/bootstrap |
Malicious release: Malicious code in wagner-horizon (npm) GHSA-mpqc-8h6h-24pr, MAL-2026-3286 | Malicious | Not scored | 04 May, 2026 | npm wagner-horizon |
Malicious release: Malicious code in muenxo (npm) GHSA-v98c-r2px-c675, MAL-2026-3279 | Malicious | Not scored | 04 May, 2026 | npm muenxo |
Malicious release: Malicious code in edj-shopify-theme (npm) GHSA-wwp3-h2pr-7cjh, MAL-2026-3277 | Malicious | Not scored | 04 May, 2026 | npm edj-shopify-theme |
Malicious release: Malicious code in vpi-guides (npm) GHSA-wx4g-457v-96wq, MAL-2026-3285 | Malicious | Not scored | 04 May, 2026 | npm vpi-guides |
Malicious release: Malicious code in @w3m-app/switch_network (npm) GHSA-f39p-99x4-7fwv, MAL-2026-3274 | Malicious | Not scored | 04 May, 2026 | npm @w3m-app/switch_network |
Malicious release: Malicious code in @w3m-app/is_connected (npm) GHSA-fc7c-vh37-8m3q, MAL-2026-3273 | Malicious | Not scored | 04 May, 2026 | npm @w3m-app/is_connected |
Malicious release: Malicious code in @w3m-app/get_chain_id (npm) GHSA-ww67-vcwg-gjgm, MAL-2026-3272 | Malicious | Not scored | 04 May, 2026 | npm @w3m-app/get_chain_id |
Malicious release: Malicious code in @bcs-ui/theme (npm) GHSA-8x45-chjj-3fxx, MAL-2026-3271 | Malicious | Not scored | 04 May, 2026 | npm @bcs-ui/theme |
Malicious release: Malicious code in @bcs-react-ui/select (npm) GHSA-xqh5-v77f-g2w5, MAL-2026-3270 | Malicious | Not scored | 04 May, 2026 | npm @bcs-react-ui/select |
Malicious release: Malicious code in @bcs-bank/init (npm) GHSA-25g7-hch5-h5fr, MAL-2026-3266 | Malicious | Not scored | 04 May, 2026 | npm @bcs-bank/init |
Malicious release: Malicious code in @bcs-bank/common-constants (npm) GHSA-2vjv-p4jc-hmm6, MAL-2026-3265 | Malicious | Not scored | 04 May, 2026 | npm @bcs-bank/common-constants |
Malicious release: Malicious code in @bcs-react-ui/context-menu (npm) GHSA-9jqj-3jch-6xg4, MAL-2026-3269 | Malicious | Not scored | 04 May, 2026 | npm @bcs-react-ui/context-menu |
Malicious release: Malicious code in @bcs-bank-react-ui/swiper-slider (npm) GHSA-f96m-p93j-fxrm, MAL-2026-3267 | Malicious | Not scored | 04 May, 2026 | npm @bcs-bank-react-ui/swiper-slider |
Malicious release: Malicious code in @bcs-mi/store (npm) GHSA-q5fm-gcgr-2rjj, MAL-2026-3268 | Malicious | Not scored | 04 May, 2026 | npm @bcs-mi/store |
Malicious release: Malicious code in @bcs-adapters/keycloak-api-adapter (npm) GHSA-6w89-ghw9-qmhr, MAL-2026-3264 | Malicious | Not scored | 04 May, 2026 | npm @bcs-adapters/keycloak-api-adapter |
Malicious release: Malicious code in @bcs-adapters/core-adapter (npm) GHSA-9243-mwpj-5j2h, MAL-2026-3263 | Malicious | Not scored | 04 May, 2026 | npm @bcs-adapters/core-adapter |
Malicious release: Malicious code in paypal-payouts-bridge (npm) GHSA-fpch-j6rr-8r63, MAL-2026-3323 | Malicious | Not scored | 04 May, 2026 | npm paypal-payouts-bridge |
Malicious release: Malicious code in microsoft-agents-auth-service (npm) MAL-2026-3322 | Malicious | Not scored | 04 May, 2026 | npm microsoft-agents-auth-service |
Malicious release: Malicious code in feature-flag-service (npm) MAL-2026-3253 | Malicious | Not scored | 03 May, 2026 | npm feature-flag-service |
Malicious release: Malicious code in gauth-client (PyPI) MAL-2026-3252 | Malicious | Not scored | 03 May, 2026 | PyPI gauth-client |