Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in undicy-http (npm) GHSA-26cf-6cvr-mv4x, MAL-2026-3013 | Malicious | Not scored | 23 Apr, 2026 | npm undicy-http |
Malicious release: Malicious code in separadordeinfocc (npm) GHSA-8p9h-5jx3-gx7v, MAL-2026-3010 | Malicious | Not scored | 23 Apr, 2026 | npm separadordeinfocc |
Malicious release: Malicious code in vime-azl (npm) GHSA-3r8p-pjjh-h967, MAL-2026-3014 | Malicious | Not scored | 23 Apr, 2026 | npm vime-azl |
Malicious release: Malicious code in ts-bing (npm) GHSA-8fcp-g97g-6pwj, MAL-2026-3011 | Malicious | Not scored | 23 Apr, 2026 | npm ts-bing |
Malicious release: Malicious code in rollup-plugin-polyfill-route (npm) GHSA-9f4f-7957-69m9, MAL-2026-3009 | Malicious | Not scored | 23 Apr, 2026 | npm rollup-plugin-polyfill-route |
Malicious release: Malicious code in @amsterdam-local/forms-component-library (npm) GHSA-7w6c-9hfw-6385, MAL-2026-3003 | Malicious | Not scored | 23 Apr, 2026 | npm @amsterdam-local/forms-component-library |
Malicious release: Malicious code in ts-moduler (npm) GHSA-mq2j-jgm4-q5vv, MAL-2026-3012 | Malicious | Not scored | 23 Apr, 2026 | npm ts-moduler |
Malicious release: Malicious code in lyrox (PyPI) MAL-2026-3002 | Malicious | Not scored | 23 Apr, 2026 | PyPI lyrox |
Malicious release: Malicious code in process-support (PyPI) MAL-2026-3001 | Malicious | Not scored | 22 Apr, 2026 | PyPI process-support |
Malicious release: Malicious code in xinference (PyPI) MAL-2026-3000 | Malicious | Not scored | 22 Apr, 2026 | PyPI xinference |
Malicious release: Malicious code in @spinstorm/shared (npm) MAL-2026-2998 | Malicious | Not scored | 22 Apr, 2026 | npm @spinstorm/shared |
Malicious release: Malicious code in pypdf-fork (PyPI) MAL-2026-2999 | Malicious | Not scored | 22 Apr, 2026 | PyPI pypdf-fork |
Malicious release: Malicious code in @stlm/common-ui (npm) GHSA-694m-qj2w-cp8j, MAL-2026-2997 | Malicious | Not scored | 22 Apr, 2026 | npm @stlm/common-ui |
Malicious release: Malicious code in sparkling-sdk (npm) GHSA-hw2r-2jh6-9mqr, MAL-2026-2996 | Malicious | Not scored | 22 Apr, 2026 | npm sparkling-sdk |
Malicious release: Malicious code in color-studio (npm) GHSA-qcph-mvf5-hgf2, MAL-2026-2995 | Malicious | Not scored | 22 Apr, 2026 | npm color-studio |
Malicious release: Malicious code in @openwebconcept/design-tokens (npm) GHSA-gj25-264w-qww3, MAL-2026-2993 | Malicious | Not scored | 22 Apr, 2026 | npm @openwebconcept/design-tokens |
Malicious release: Malicious code in @openwebconcept/theme-owc (npm) GHSA-wqjr-fc46-m68m, MAL-2026-2994 | Malicious | Not scored | 22 Apr, 2026 | npm @openwebconcept/theme-owc |
Malicious release: Malicious code in @automagik/genie (npm) GHSA-ppw4-42v6-538v, MAL-2026-2992 | Malicious | Not scored | 22 Apr, 2026 | npm @automagik/genie |
Malicious release: Malicious code in pgserve (npm) GHSA-v892-cmx2-hjq8, MAL-2026-2991 | Malicious | Not scored | 22 Apr, 2026 | npm pgserve |
Malicious release: Malicious code in @bmg-web/bmg-dialog (npm) MAL-2026-2985 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-dialog |
Malicious release: Malicious code in @bmg-web/bmg-checkbox (npm) MAL-2026-2983 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-checkbox |
Malicious release: Malicious code in etsyapp (npm) MAL-2026-2990 | Malicious | Not scored | 22 Apr, 2026 | npm etsyapp |
Malicious release: Malicious code in @bmg-web/bmg-collapse (npm) MAL-2026-2984 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-collapse |
Malicious release: Malicious code in @bmg-web/bmg-grid (npm) MAL-2026-2988 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-grid |
Malicious release: Malicious code in @bmg-web/bmg-button (npm) MAL-2026-2981 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-button |
Malicious release: Malicious code in @bmg-web/bmg-dropdown (npm) MAL-2026-2986 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-dropdown |
Malicious release: Malicious code in @bmg-web/bmg-ajax (npm) MAL-2026-2980 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-ajax |
Malicious release: Malicious code in @bmg-web-features/bmg-user-interaction-tracker (npm) MAL-2026-2989 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web-features/bmg-user-interaction-tracker |
Malicious release: Malicious code in @bmg-web/bmg-card (npm) MAL-2026-2982 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-card |
Malicious release: Malicious code in @bmg-web/bmg-external-link (npm) MAL-2026-2987 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-external-link |
Malicious release: Malicious code in tsdoc-build-rig (npm) MAL-2026-2979 | Malicious | Not scored | 22 Apr, 2026 | npm tsdoc-build-rig |
Malicious release: Malicious code in @oec-settlement/react-router (npm) GHSA-qqc6-xp57-98h7, MAL-2026-2978 | Malicious | Not scored | 22 Apr, 2026 | npm @oec-settlement/react-router |
Malicious release: Malicious code in crypto-keccak-js (npm) GHSA-gqj4-7gpv-6w6w, MAL-2026-2975 | Malicious | Not scored | 22 Apr, 2026 | npm crypto-keccak-js |
Malicious release: Malicious code in gleb-js (npm) GHSA-gxf7-922p-wp6q, MAL-2026-2976 | Malicious | Not scored | 22 Apr, 2026 | npm gleb-js |
Malicious release: Malicious code in ts-utils-dev (npm) GHSA-p95c-73jf-8362, MAL-2026-2977 | Malicious | Not scored | 22 Apr, 2026 | npm ts-utils-dev |
Malicious release: Malicious code in claudcode-mcp (npm) GHSA-5v3x-g9r5-vvhg, MAL-2026-2974 | Malicious | Not scored | 22 Apr, 2026 | npm claudcode-mcp |
Malicious release: Malicious code in claudcode-cli (npm) GHSA-65j6-qgfm-6486, MAL-2026-2973 | Malicious | Not scored | 22 Apr, 2026 | npm claudcode-cli |
Malicious release: Malicious code in @usealloy/component-library (npm) GHSA-4g37-2m9h-2w95, MAL-2026-2970 | Malicious | Not scored | 22 Apr, 2026 | npm @usealloy/component-library |
Malicious release: Malicious code in @usealloy/api-contract (npm) GHSA-733p-5g7w-hh7w, MAL-2026-2969 | Malicious | Not scored | 22 Apr, 2026 | npm @usealloy/api-contract |
Malicious release: Malicious code in @bitunix/test (npm) GHSA-mhwj-ggc3-5228, MAL-2026-2968 | Malicious | Not scored | 22 Apr, 2026 | npm @bitunix/test |
Malicious release: Malicious code in @usealloy/typegen (npm) GHSA-qmfv-9964-cvf2, MAL-2026-2971 | Malicious | Not scored | 22 Apr, 2026 | npm @usealloy/typegen |
Malicious release: Malicious code in aven_types (npm) GHSA-r8xm-rx8q-xmr3, MAL-2026-2972 | Malicious | Not scored | 22 Apr, 2026 | npm aven_types |
Malicious release: Malicious code in 6161test1234 (npm) GHSA-r9qx-xcg2-7wcc, MAL-2026-2967 | Malicious | Not scored | 21 Apr, 2026 | npm 6161test1234 |
Malicious release: Malicious code in com.tencent.puerts.agent (npm) GHSA-xjh5-rr2q-3382, MAL-2026-2966 | Malicious | Not scored | 21 Apr, 2026 | npm com.tencent.puerts.agent |
Malicious release: Malicious code in build-metadata-logger (PyPI) MAL-2026-2965 | Malicious | Not scored | 21 Apr, 2026 | PyPI build-metadata-logger |
Malicious release: Malicious code in buildenv-collector (PyPI) MAL-2026-2964 | Malicious | Not scored | 21 Apr, 2026 | PyPI buildenv-collector |
Malicious release: Malicious code in typelimagic (PyPI) MAL-2026-2963 | Malicious | Not scored | 21 Apr, 2026 | PyPI typelimagic |
Malicious release: Malicious code in my-package-jiecub3 (PyPI) MAL-2026-2962 | Malicious | Not scored | 21 Apr, 2026 | PyPI my-package-jiecub3 |
Malicious release: Malicious code in apple-internal-security-poc-frank (npm) GHSA-84p7-7qvg-vhvf, MAL-2026-2961 | Malicious | Not scored | 21 Apr, 2026 | npm apple-internal-security-poc-frank |
Malicious release: Malicious code in apple-auth-internal (npm) GHSA-m39f-fr86-j7f7, MAL-2026-2960 | Malicious | Not scored | 21 Apr, 2026 | npm apple-auth-internal |