Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()` BIT-pillow-2026-54060, CVE-2026-54060, GHSA-5x94-69rx-g8h2, PYSEC-2026-2254 | High | 0.4% | 06 Jul, 2026 | PyPI pillow |
Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading BIT-pillow-2026-54059, CVE-2026-54059, GHSA-8v84-f9pq-wr9x, PYSEC-2026-2253 | High | 0.4% | 06 Jul, 2026 | PyPI pillow |
Malicious release: Malicious code in xnder-sdk-js (npm) GHSA-wwv8-px7f-vfq4, MAL-2026-6906 | Malicious | Not scored | 06 Jul, 2026 | npm xnder-sdk-js |
Malicious release: Malicious code in winston-prism (npm) GHSA-3xpg-2wmm-jjj2, MAL-2026-6905 | Malicious | Not scored | 06 Jul, 2026 | npm winston-prism |
Malicious release: Malicious code in wime-zle (npm) GHSA-6474-9f9h-hmwx, MAL-2026-6902 | Malicious | Not scored | 06 Jul, 2026 | npm wime-zle |
Malicious release: Malicious code in vite-plugin-svg-paths (npm) GHSA-7hpm-7845-8cr6, MAL-2026-6901 | Malicious | Not scored | 06 Jul, 2026 | npm vite-plugin-svg-paths |
Malicious release: Malicious code in winston-js-express (npm) GHSA-fhrx-mrfp-3fvg, MAL-2026-6904 | Malicious | Not scored | 06 Jul, 2026 | npm winston-js-express |
Malicious release: Malicious code in tailwindcss-animatecss-latest (npm) GHSA-cjj7-4xf8-fgf8, MAL-2026-6888 | Malicious | Not scored | 06 Jul, 2026 | npm tailwindcss-animatecss-latest |
Malicious release: Malicious code in windrule-utils (npm) GHSA-3qh2-hc9r-frmf, MAL-2026-6903 | Malicious | Not scored | 06 Jul, 2026 | npm windrule-utils |
Malicious release: Malicious code in tailwindcss-fonttypo-inter (npm) GHSA-c37g-65pv-vg82, MAL-2026-6890 | Malicious | Not scored | 06 Jul, 2026 | npm tailwindcss-fonttypo-inter |
Malicious release: Malicious code in twcompose-utils (npm) GHSA-pc7p-pxpj-3cw5, MAL-2026-6899 | Malicious | Not scored | 06 Jul, 2026 | npm twcompose-utils |
Malicious release: Malicious code in renderctx (npm) GHSA-jq76-fhr4-3987, MAL-2026-6871 | Malicious | Not scored | 06 Jul, 2026 | npm renderctx |
Malicious release: Malicious code in txs-data (npm) GHSA-w5pf-vc8f-rv6r, MAL-2026-6900 | Malicious | Not scored | 06 Jul, 2026 | npm txs-data |
Malicious release: Malicious code in ts-lint-builders (npm) GHSA-5mvf-x573-2gv4, MAL-2026-6897 | Malicious | Not scored | 06 Jul, 2026 | npm ts-lint-builders |
Malicious release: Malicious code in ts-eslinter (npm) GHSA-h269-vrf6-9f75, MAL-2026-6896 | Malicious | Not scored | 06 Jul, 2026 | npm ts-eslinter |
Malicious release: Malicious code in rma-utils (npm) GHSA-c633-xc97-ch23, MAL-2026-6872 | Malicious | Not scored | 06 Jul, 2026 | npm rma-utils |
Malicious release: Malicious code in ts-relayer-pub (npm) GHSA-crww-p6q9-g9px, MAL-2026-6898 | Malicious | Not scored | 06 Jul, 2026 | npm ts-relayer-pub |
Malicious release: Malicious code in competion (npm) GHSA-pjm5-4wrj-r328, MAL-2026-6832 | Malicious | Not scored | 06 Jul, 2026 | npm competion |
Malicious release: Malicious code in ts-bigtn (npm) GHSA-7mfc-w2gr-ggj9, MAL-2026-6895 | Malicious | Not scored | 06 Jul, 2026 | npm ts-bigtn |
Malicious release: Malicious code in color-cli-log (npm) GHSA-57f7-j94v-w2hw, MAL-2026-6830 | Malicious | Not scored | 06 Jul, 2026 | npm color-cli-log |
Malicious release: Malicious code in test-prettier (npm) GHSA-6h3j-xcmr-vmwx, MAL-2026-6893 | Malicious | Not scored | 06 Jul, 2026 | npm test-prettier |
Malicious release: Malicious code in tracing-str (npm) GHSA-f25x-c4qf-8xxp, MAL-2026-6894 | Malicious | Not scored | 06 Jul, 2026 | npm tracing-str |
Malicious release: Malicious code in tailwindcss-svg-helper (npm) GHSA-m4rw-xr9m-h8cr, MAL-2026-6892 | Malicious | Not scored | 06 Jul, 2026 | npm tailwindcss-svg-helper |
Malicious release: Malicious code in tailwindcss-fonttype-inter (npm) GHSA-x3c6-5rx7-6c3p, MAL-2026-6889 | Malicious | Not scored | 06 Jul, 2026 | npm tailwindcss-fonttype-inter |
Malicious release: Malicious code in tailwindcss-framer-motion (npm) GHSA-w94v-484j-rqjx, MAL-2026-6891 | Malicious | Not scored | 06 Jul, 2026 | npm tailwindcss-framer-motion |
Malicious release: Malicious code in st-biginteger (npm) GHSA-2652-pqcw-rfg5, MAL-2026-6880 | Malicious | Not scored | 06 Jul, 2026 | npm st-biginteger |
Malicious release: Malicious code in sleek-pretty (npm) GHSA-38w9-552m-96hh, MAL-2026-6878 | Malicious | Not scored | 06 Jul, 2026 | npm sleek-pretty |
Malicious release: Malicious code in stacknova (npm) GHSA-5cpm-r2cm-wpjc, MAL-2026-6882 | Malicious | Not scored | 06 Jul, 2026 | npm stacknova |
Malicious release: Malicious code in sol-sdk (npm) GHSA-j3cf-6g4r-crmv, MAL-2026-6879 | Malicious | Not scored | 06 Jul, 2026 | npm sol-sdk |
Malicious release: Malicious code in tailwind-fonttype-inter (npm) GHSA-4h59-rc9x-8g35, MAL-2026-6886 | Malicious | Not scored | 06 Jul, 2026 | npm tailwind-fonttype-inter |
Malicious release: Malicious code in tailstyle-core (npm) GHSA-6wvg-r7v4-jm68, MAL-2026-6885 | Malicious | Not scored | 06 Jul, 2026 | npm tailstyle-core |
Malicious release: Malicious code in syncora (npm) GHSA-2xgm-25c8-fggh, MAL-2026-6884 | Malicious | Not scored | 06 Jul, 2026 | npm syncora |
Malicious release: Malicious code in styled-text-logger (npm) GHSA-676w-w872-57p4, MAL-2026-6883 | Malicious | Not scored | 06 Jul, 2026 | npm styled-text-logger |
Malicious release: Malicious code in tailwind-scroller (npm) GHSA-x935-j33v-9678, MAL-2026-6887 | Malicious | Not scored | 06 Jul, 2026 | npm tailwind-scroller |
Malicious release: Malicious code in secure-box (npm) GHSA-q75v-v55m-r6v2, MAL-2026-6875 | Malicious | Not scored | 06 Jul, 2026 | npm secure-box |
Malicious release: Malicious code in st-bigintr (npm) GHSA-vvxr-vc6m-w98j, MAL-2026-6881 | Malicious | Not scored | 06 Jul, 2026 | npm st-bigintr |
Malicious release: Malicious code in sjs-builder (npm) GHSA-27jm-f99f-wqr4, MAL-2026-6876 | Malicious | Not scored | 06 Jul, 2026 | npm sjs-builder |
Malicious release: Malicious code in sjs-builders (npm) GHSA-55q4-68jc-wrgw, MAL-2026-6877 | Malicious | Not scored | 06 Jul, 2026 | npm sjs-builders |
Malicious release: Malicious code in router-kit (npm) GHSA-fgc2-8wjr-56hg, MAL-2026-6873 | Malicious | Not scored | 06 Jul, 2026 | npm router-kit |
Malicious release: Malicious code in safe-validate (npm) GHSA-xvj3-jjxg-v74h, MAL-2026-6874 | Malicious | Not scored | 06 Jul, 2026 | npm safe-validate |
Malicious release: Malicious code in react-svg-render (npm) GHSA-h2hr-f82c-f7h5, MAL-2026-6870 | Malicious | Not scored | 06 Jul, 2026 | npm react-svg-render |
Malicious release: Malicious code in react-native-template-my-starter (npm) GHSA-7p9r-785r-fg9p, MAL-2026-6869 | Malicious | Not scored | 06 Jul, 2026 | npm react-native-template-my-starter |
Malicious release: Malicious code in pretty-pino-logger (npm) GHSA-9vrr-rpr8-7hfj, MAL-2026-6867 | Malicious | Not scored | 06 Jul, 2026 | npm pretty-pino-logger |
Malicious release: Malicious code in pretty-pino-loggers (npm) GHSA-vhw2-mvjh-m4gr, MAL-2026-6868 | Malicious | Not scored | 06 Jul, 2026 | npm pretty-pino-loggers |
Malicious release: Malicious code in prettier-logger (npm) GHSA-6wq6-hvcw-xmcx, MAL-2026-6866 | Malicious | Not scored | 06 Jul, 2026 | npm prettier-logger |
Malicious release: Malicious code in polymarket-onchain-plugin (npm) GHSA-29mh-pwqh-6586, MAL-2026-6864 | Malicious | Not scored | 06 Jul, 2026 | npm polymarket-onchain-plugin |
Malicious release: Malicious code in pino-utils (npm) GHSA-jwwm-v6rr-f5cv, MAL-2026-6863 | Malicious | Not scored | 06 Jul, 2026 | npm pino-utils |
Malicious release: Malicious code in pino-pretty-logs (npm) GHSA-7cfh-3cj9-3fc3, MAL-2026-6862 | Malicious | Not scored | 06 Jul, 2026 | npm pino-pretty-logs |
Malicious release: Malicious code in polymarket-onchain-sdk (npm) GHSA-89w2-qgj2-9f2w, MAL-2026-6865 | Malicious | Not scored | 06 Jul, 2026 | npm polymarket-onchain-sdk |
Malicious release: Malicious code in picocolor-logger (npm) GHSA-jp9j-33xg-wvpq, MAL-2026-6861 | Malicious | Not scored | 06 Jul, 2026 | npm picocolor-logger |