Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in axis-notification (npm) GHSA-2fp7-j74x-chvv, MAL-2026-3078 | Malicious | Not scored | 25 Apr, 2026 | npm axis-notification |
Malicious release: Malicious code in axis-charts (npm) MAL-2026-3077 | Malicious | Not scored | 25 Apr, 2026 | npm axis-charts |
Malicious release: Malicious code in js-component-explorer (npm) MAL-2026-3032 | Malicious | Not scored | 25 Apr, 2026 | npm js-component-explorer |
Malicious release: Malicious code in @tochka-ui/foundation (npm) GHSA-hf3j-mx5g-jc8r, MAL-2026-3069 | Malicious | Not scored | 24 Apr, 2026 | npm @tochka-ui/foundation |
Malicious release: Malicious code in elementary-data (PyPI) MAL-2026-3083 | Malicious | Not scored | 24 Apr, 2026 | PyPI elementary-data |
Malicious release: Malicious code in @frengki0707/google-cloud-clone (npm) MAL-2026-3060 | Malicious | Not scored | 24 Apr, 2026 | npm @frengki0707/google-cloud-clone |
Malicious release: Malicious code in @alfa.life.mapp/app.web (npm) GHSA-68cm-x784-c9gw, MAL-2026-3052 | Malicious | Not scored | 24 Apr, 2026 | npm @alfa.life.mapp/app.web |
Malicious release: Malicious code in swampo (PyPI) MAL-2026-3031 | Malicious | Not scored | 24 Apr, 2026 | PyPI swampo |
Malicious release: Malicious code in @m0ntana/app.web (npm) GHSA-m6jr-4x3f-2ph2, MAL-2026-3065 | Malicious | Not scored | 24 Apr, 2026 | npm @m0ntana/app.web |
Malicious release: Malicious code in model-poc-suhail (npm) GHSA-cpqg-wgv2-g29r, MAL-2026-3030 | Malicious | Not scored | 24 Apr, 2026 | npm model-poc-suhail |
Malicious release: Malicious code in auth0-ui-components-docs (npm) GHSA-78cj-64p5-2wh5, MAL-2026-3024 | Malicious | Not scored | 24 Apr, 2026 | npm auth0-ui-components-docs |
Malicious release: Malicious code in next-rwa (npm) GHSA-qr67-r552-v99q, MAL-2026-3025 | Malicious | Not scored | 24 Apr, 2026 | npm next-rwa |
Malicious release: Malicious code in wrapped-logger-utils (npm) GHSA-wm52-75j2-vmr3, MAL-2026-3027 | Malicious | Not scored | 24 Apr, 2026 | npm wrapped-logger-utils |
Malicious release: Malicious code in sagat-core (npm) GHSA-53hj-4c4g-2wqq, MAL-2026-3026 | Malicious | Not scored | 24 Apr, 2026 | npm sagat-core |
Malicious release: Malicious code in amplitude-ma-ts (npm) GHSA-987f-7782-4mjj, MAL-2026-3028 | Malicious | Not scored | 24 Apr, 2026 | npm amplitude-ma-ts |
Malicious release: Malicious code in test-pkg-jie (PyPI) MAL-2026-3023 | Malicious | Not scored | 23 Apr, 2026 | PyPI test-pkg-jie |
Malicious release: Malicious code in lightspark-js (npm) MAL-2026-3021 | Malicious | Not scored | 23 Apr, 2026 | npm lightspark-js |
Malicious release: Malicious code in jie-utility-package (PyPI) MAL-2026-3022 | Malicious | Not scored | 23 Apr, 2026 | PyPI jie-utility-package |
Malicious release: Malicious code in @bitwarden/cli (npm) GHSA-g98r-qjhg-4fmr, MAL-2026-3020 | Malicious | Not scored | 23 Apr, 2026 | npm @bitwarden/cli |
Malicious release: Malicious code in microsoft-employee-experience (npm) MAL-2026-3018 | Malicious | Not scored | 23 Apr, 2026 | npm microsoft-employee-experience |
Malicious release: Malicious code in hls.js (npm) GHSA-pq9g-f2rr-m4hw, MAL-2026-3019 | Malicious | Not scored | 23 Apr, 2026 | npm hls.js |
Malicious release: Malicious code in react-spa-npm (npm) GHSA-5w76-h44f-4xfp, MAL-2026-3017 | Malicious | Not scored | 23 Apr, 2026 | npm react-spa-npm |
Malicious release: Malicious code in amazon-q-developer-streaming-client (npm) MAL-2026-3016 | Malicious | Not scored | 23 Apr, 2026 | npm amazon-q-developer-streaming-client |
Malicious release: Malicious code in lyroxcoder (PyPI) MAL-2026-3015 | Malicious | Not scored | 23 Apr, 2026 | PyPI lyroxcoder |
Malicious release: Malicious code in eth-logger (npm) GHSA-fxxj-hw8x-wvvh, MAL-2026-3029 | Malicious | Not scored | 23 Apr, 2026 | npm eth-logger |
Malicious release: Malicious code in json-dec (npm) GHSA-3wh6-59mv-jpvw, MAL-2026-3007 | Malicious | Not scored | 23 Apr, 2026 | npm json-dec |
Malicious release: Malicious code in json-spacer (npm) GHSA-hp4j-fxr5-4x88, MAL-2026-3008 | Malicious | Not scored | 23 Apr, 2026 | npm json-spacer |
Malicious release: Malicious code in changelog-cli-logger (npm) GHSA-43cm-q339-rpw7, MAL-2026-3005 | Malicious | Not scored | 23 Apr, 2026 | npm changelog-cli-logger |
Malicious release: Malicious code in changelog-utils-structured-logger (npm) GHSA-668m-2g35-3g72, MAL-2026-3006 | Malicious | Not scored | 23 Apr, 2026 | npm changelog-utils-structured-logger |
Malicious release: Malicious code in @nklkas/hyperliquid (npm) GHSA-p9qm-9r6f-v25r, MAL-2026-3004 | Malicious | Not scored | 23 Apr, 2026 | npm @nklkas/hyperliquid |
Malicious release: Malicious code in undicy-http (npm) GHSA-26cf-6cvr-mv4x, MAL-2026-3013 | Malicious | Not scored | 23 Apr, 2026 | npm undicy-http |
Malicious release: Malicious code in separadordeinfocc (npm) GHSA-8p9h-5jx3-gx7v, MAL-2026-3010 | Malicious | Not scored | 23 Apr, 2026 | npm separadordeinfocc |
Malicious release: Malicious code in vime-azl (npm) GHSA-3r8p-pjjh-h967, MAL-2026-3014 | Malicious | Not scored | 23 Apr, 2026 | npm vime-azl |
Malicious release: Malicious code in ts-bing (npm) GHSA-8fcp-g97g-6pwj, MAL-2026-3011 | Malicious | Not scored | 23 Apr, 2026 | npm ts-bing |
Malicious release: Malicious code in rollup-plugin-polyfill-route (npm) GHSA-9f4f-7957-69m9, MAL-2026-3009 | Malicious | Not scored | 23 Apr, 2026 | npm rollup-plugin-polyfill-route |
Malicious release: Malicious code in @amsterdam-local/forms-component-library (npm) GHSA-7w6c-9hfw-6385, MAL-2026-3003 | Malicious | Not scored | 23 Apr, 2026 | npm @amsterdam-local/forms-component-library |
Malicious release: Malicious code in ts-moduler (npm) GHSA-mq2j-jgm4-q5vv, MAL-2026-3012 | Malicious | Not scored | 23 Apr, 2026 | npm ts-moduler |
Malicious release: Malicious code in lyrox (PyPI) MAL-2026-3002 | Malicious | Not scored | 23 Apr, 2026 | PyPI lyrox |
Malicious release: Malicious code in process-support (PyPI) MAL-2026-3001 | Malicious | Not scored | 22 Apr, 2026 | PyPI process-support |
Malicious release: Malicious code in xinference (PyPI) MAL-2026-3000 | Malicious | Not scored | 22 Apr, 2026 | PyPI xinference |
Malicious release: Malicious code in @spinstorm/shared (npm) MAL-2026-2998 | Malicious | Not scored | 22 Apr, 2026 | npm @spinstorm/shared |
Malicious release: Malicious code in pypdf-fork (PyPI) MAL-2026-2999 | Malicious | Not scored | 22 Apr, 2026 | PyPI pypdf-fork |
Malicious release: Malicious code in @stlm/common-ui (npm) GHSA-694m-qj2w-cp8j, MAL-2026-2997 | Malicious | Not scored | 22 Apr, 2026 | npm @stlm/common-ui |
Malicious release: Malicious code in sparkling-sdk (npm) GHSA-hw2r-2jh6-9mqr, MAL-2026-2996 | Malicious | Not scored | 22 Apr, 2026 | npm sparkling-sdk |
Malicious release: Malicious code in color-studio (npm) GHSA-qcph-mvf5-hgf2, MAL-2026-2995 | Malicious | Not scored | 22 Apr, 2026 | npm color-studio |
Malicious release: Malicious code in @openwebconcept/design-tokens (npm) GHSA-gj25-264w-qww3, MAL-2026-2993 | Malicious | Not scored | 22 Apr, 2026 | npm @openwebconcept/design-tokens |
Malicious release: Malicious code in @openwebconcept/theme-owc (npm) GHSA-wqjr-fc46-m68m, MAL-2026-2994 | Malicious | Not scored | 22 Apr, 2026 | npm @openwebconcept/theme-owc |
Malicious release: Malicious code in @automagik/genie (npm) GHSA-ppw4-42v6-538v, MAL-2026-2992 | Malicious | Not scored | 22 Apr, 2026 | npm @automagik/genie |
Malicious release: Malicious code in pgserve (npm) GHSA-v892-cmx2-hjq8, MAL-2026-2991 | Malicious | Not scored | 22 Apr, 2026 | npm pgserve |
Malicious release: Malicious code in @bmg-web/bmg-dialog (npm) MAL-2026-2985 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-dialog |