Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @ataslkit/profilecard (npm) GHSA-3m34-94wv-xw5q, MAL-2026-2856 | Malicious | Not scored | 18 Apr, 2026 | npm @ataslkit/profilecard |
Malicious release: Malicious code in react-resource-router-next (npm) GHSA-7hgr-34h5-w2m5, MAL-2026-2855 | Malicious | Not scored | 18 Apr, 2026 | npm react-resource-router-next |
Malicious release: Malicious code in stringhelp (PyPI) MAL-2026-2854 | Malicious | Not scored | 18 Apr, 2026 | PyPI stringhelp |
Malicious release: Malicious code in cktool.core.internal (npm) GHSA-52g9-vwwf-5wm4, MAL-2026-2924 | Malicious | Not scored | 18 Apr, 2026 | npm cktool.core.internal |
Malicious release: Malicious code in cktool.config (npm) GHSA-2rgm-r9mf-qcvf, MAL-2026-2923 | Malicious | Not scored | 18 Apr, 2026 | npm cktool.config |
Malicious release: Malicious code in cktool.api (npm) GHSA-82v9-v4pr-3fv5, MAL-2026-2922 | Malicious | Not scored | 18 Apr, 2026 | npm cktool.api |
Malicious release: Malicious code in cktool.internal (npm) GHSA-49vv-fr4f-qphw, MAL-2026-2925 | Malicious | Not scored | 18 Apr, 2026 | npm cktool.internal |
Malicious release: Malicious code in apple-idms-internal (npm) GHSA-x7r7-7xmr-4v2x, MAL-2026-2919 | Malicious | Not scored | 18 Apr, 2026 | npm apple-idms-internal |
Malicious release: Malicious code in apple-cloudkit-internal (npm) GHSA-phc7-xwvq-32mh, MAL-2026-2918 | Malicious | Not scored | 18 Apr, 2026 | npm apple-cloudkit-internal |
Malicious release: Malicious code in react-hook-form (npm) GHSA-w8j3-qvc3-h56f, MAL-2026-2853 | Malicious | Not scored | 18 Apr, 2026 | npm react-hook-form |
Malicious release: Malicious code in ac-sasskit-internal (npm) GHSA-cxqq-9fj8-v9x8, MAL-2026-2917 | Malicious | Not scored | 18 Apr, 2026 | npm ac-sasskit-internal |
Malicious release: Malicious code in material-ui-plugin-cache-endpoint (npm) GHSA-gcvj-xqr7-rc54, MAL-2026-2926 | Malicious | Not scored | 17 Apr, 2026 | npm material-ui-plugin-cache-endpoint |
Malicious release: Malicious code in aet-test (PyPI) MAL-2026-2852 | Malicious | Not scored | 17 Apr, 2026 | PyPI aet-test |
Malicious release: Malicious code in @indriver-poc/whisperwind (npm) MAL-2026-2851 | Malicious | Not scored | 17 Apr, 2026 | npm @indriver-poc/whisperwind |
Malicious release: Malicious code in value-slider (npm) GHSA-h8m3-pcfp-2jpw, MAL-2026-2850 | Malicious | Not scored | 17 Apr, 2026 | npm value-slider |
Malicious release: Malicious code in @than-xs/libsignal-node (npm) GHSA-5gf4-hf7c-gxxp, MAL-2026-2848 | Malicious | Not scored | 17 Apr, 2026 | npm @than-xs/libsignal-node |
Malicious release: Malicious code in @than1st/baileys (npm) GHSA-hcw6-3v33-4gw3, MAL-2026-2849 | Malicious | Not scored | 17 Apr, 2026 | npm @than1st/baileys |
Malicious release: Malicious code in shan-lib (PyPI) MAL-2026-2847 | Malicious | Not scored | 17 Apr, 2026 | PyPI shan-lib |
Malicious release: Malicious code in eslint-plugin-totara (npm) GHSA-gvr8-64fv-6p2h, MAL-2026-2846 | Malicious | Not scored | 17 Apr, 2026 | npm eslint-plugin-totara |
Malicious release: Malicious code in node-red-contrib-yolo-object-detection (npm) GHSA-rxwg-h367-5qgm, MAL-2026-2845 | Malicious | Not scored | 17 Apr, 2026 | npm node-red-contrib-yolo-object-detection |
Malicious release: Malicious code in shan-lib-poc (PyPI) MAL-2026-2843 | Malicious | Not scored | 17 Apr, 2026 | PyPI shan-lib-poc |
Malicious release: Malicious code in lixxyly (PyPI) MAL-2026-2841 | Malicious | Not scored | 17 Apr, 2026 | PyPI lixxyly |
Malicious release: Malicious code in shelipp (PyPI) MAL-2026-2844 | Malicious | Not scored | 17 Apr, 2026 | PyPI shelipp |
Malicious release: Malicious code in looopiw (PyPI) MAL-2026-2842 | Malicious | Not scored | 17 Apr, 2026 | PyPI looopiw |
Malicious release: Malicious code in sher-server-tool (PyPI) MAL-2026-2840 | Malicious | Not scored | 17 Apr, 2026 | PyPI sher-server-tool |
Malicious release: Malicious code in sher-net (PyPI) MAL-2026-2839 | Malicious | Not scored | 17 Apr, 2026 | PyPI sher-net |
Malicious release: Malicious code in koa-v3 (npm) GHSA-975w-34c4-77hm, MAL-2026-2838 | Malicious | Not scored | 17 Apr, 2026 | npm koa-v3 |
Malicious release: Malicious code in solanakit (PyPI) MAL-2026-2837 | Malicious | Not scored | 17 Apr, 2026 | PyPI solanakit |
Malicious release: Malicious code in procoder (PyPI) MAL-2026-2835 | Malicious | Not scored | 17 Apr, 2026 | PyPI procoder |
Malicious release: Malicious code in azure-ai-agentserver-githubcopilot (PyPI) MAL-2026-2831 | Malicious | Not scored | 17 Apr, 2026 | PyPI azure-ai-agentserver-githubcopilot |
Malicious release: Malicious code in ixosrestinterface (PyPI) MAL-2026-2832 | Malicious | Not scored | 17 Apr, 2026 | PyPI ixosrestinterface |
Malicious release: Malicious code in keystackutilities (PyPI) MAL-2026-2833 | Malicious | Not scored | 17 Apr, 2026 | PyPI keystackutilities |
Malicious release: Malicious code in loadcoremwassistant (PyPI) MAL-2026-2834 | Malicious | Not scored | 17 Apr, 2026 | PyPI loadcoremwassistant |
Malicious release: Malicious code in restasv3 (PyPI) MAL-2026-2836 | Malicious | Not scored | 17 Apr, 2026 | PyPI restasv3 |
Malicious release: Malicious code in express-security-policy (npm) GHSA-3hxc-wppf-m25r, MAL-2026-2828 | Malicious | Not scored | 17 Apr, 2026 | npm express-security-policy |
Malicious release: Malicious code in renovate-config-doctolib (npm) GHSA-8327-2h3c-rm8g, MAL-2026-2830 | Malicious | Not scored | 17 Apr, 2026 | npm renovate-config-doctolib |
Malicious release: Malicious code in paddle-internal-scripts (npm) MAL-2026-2829 | Malicious | Not scored | 17 Apr, 2026 | npm paddle-internal-scripts |
Malicious release: Malicious code in ing-web-v5 (npm) GHSA-5c9h-x827-2v9f, MAL-2026-2822 | Malicious | Not scored | 17 Apr, 2026 | npm ing-web-v5 |
Malicious release: Malicious code in robase-quick-install (PyPI) MAL-2026-2821 | Malicious | Not scored | 16 Apr, 2026 | PyPI robase-quick-install |
Malicious release: Malicious code in chainutils (PyPI) MAL-2026-2820 | Malicious | Not scored | 16 Apr, 2026 | PyPI chainutils |
Malicious release: Malicious code in chai-as-ide (npm) GHSA-53p3-r84h-8pj3, MAL-2026-2890 | Malicious | Not scored | 16 Apr, 2026 | npm chai-as-ide |
Malicious release: Malicious code in chai-as-init (npm) GHSA-7cq2-px9f-cq3g, MAL-2026-2891 | Malicious | Not scored | 16 Apr, 2026 | npm chai-as-init |
Malicious release: Malicious code in chai-as-optimized (npm) GHSA-g99c-rjxw-f6jg, MAL-2026-2895 | Malicious | Not scored | 16 Apr, 2026 | npm chai-as-optimized |
Malicious release: Malicious code in pynosist (PyPI) MAL-2026-2819 | Malicious | Not scored | 16 Apr, 2026 | PyPI pynosist |
Malicious release: Malicious code in genosys (PyPI) MAL-2026-2818 | Malicious | Not scored | 16 Apr, 2026 | PyPI genosys |
Malicious release: Malicious code in lightweight-charts-4.1 (npm) MAL-2026-2817 | Malicious | Not scored | 16 Apr, 2026 | npm lightweight-charts-4.1 |
Malicious release: Malicious code in modern-events (npm) GHSA-wwr2-883g-52c2, MAL-2026-2914 | Malicious | Not scored | 16 Apr, 2026 | npm modern-events |
Malicious release: Malicious code in emergentintegrations (PyPI) MAL-2026-2702 | Malicious | Not scored | 16 Apr, 2026 | PyPI emergentintegrations |
Malicious release: Malicious code in sanitize-url (npm) MAL-2026-2701 | Malicious | Not scored | 16 Apr, 2026 | npm sanitize-url |
Malicious release: Malicious code in conventional-changelog-dash (npm) MAL-2026-2700 | Malicious | Not scored | 16 Apr, 2026 | npm conventional-changelog-dash |