Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in vip-landing (npm) GHSA-ggp2-gm9g-8q8q, MAL-2026-2661 | Malicious | Not scored | 14 Apr, 2026 | npm vip-landing |
Malicious release: Malicious code in bytefrontier (npm) GHSA-h4w8-m8m7-x8r8, MAL-2026-2639 | Malicious | Not scored | 14 Apr, 2026 | npm bytefrontier |
Malicious release: Malicious code in use-feature-flags-plugin (npm) GHSA-jccf-63c2-rpf3, MAL-2026-2660 | Malicious | Not scored | 14 Apr, 2026 | npm use-feature-flags-plugin |
Malicious release: Malicious code in bytefrontier-core (npm) GHSA-jq5f-344f-grch, MAL-2026-2640 | Malicious | Not scored | 14 Apr, 2026 | npm bytefrontier-core |
Malicious release: Malicious code in one-sdui (npm) GHSA-p4xf-jh26-qq5c, MAL-2026-2650 | Malicious | Not scored | 14 Apr, 2026 | npm one-sdui |
Malicious release: Malicious code in one-translations (npm) GHSA-98c8-24hp-26m9, MAL-2026-2651 | Malicious | Not scored | 14 Apr, 2026 | npm one-translations |
Malicious release: Malicious code in tailwind-lines-clamp (npm) GHSA-5f6w-9x4v-m9gw, MAL-2026-2655 | Malicious | Not scored | 14 Apr, 2026 | npm tailwind-lines-clamp |
Malicious release: Malicious code in percy-cake-docker (npm) GHSA-5wj3-w66f-5wcx, MAL-2026-2634 | Malicious | Not scored | 14 Apr, 2026 | npm percy-cake-docker |
Malicious release: Malicious code in path-internal (npm) GHSA-55cg-pqmh-hh6w, MAL-2026-2930 | Malicious | Not scored | 14 Apr, 2026 | npm path-internal |
Malicious release: Malicious code in gate-apis (PyPI) MAL-2026-2630 | Malicious | Not scored | 14 Apr, 2026 | PyPI gate-apis |
Malicious release: Malicious code in buffer-util-extend (npm) GHSA-g44v-3gq3-j8p6, MAL-2026-2920 | Malicious | Not scored | 14 Apr, 2026 | npm buffer-util-extend |
Malicious release: Malicious code in path-extend (npm) GHSA-qvmc-2hcj-8h4f, MAL-2026-2929 | Malicious | Not scored | 14 Apr, 2026 | npm path-extend |
Malicious release: Malicious code in centralogger (npm) GHSA-wpw7-2rgx-4cfm, MAL-2026-2825 | Malicious | Not scored | 14 Apr, 2026 | npm centralogger |
Malicious release: Malicious code in dom-utils-lite (npm) GHSA-v6fr-pvhf-6rh5, MAL-2026-2826 | Malicious | Not scored | 14 Apr, 2026 | npm dom-utils-lite |
Malicious release: Malicious code in stacks-editor (npm) MAL-2026-2629 | Malicious | Not scored | 14 Apr, 2026 | npm stacks-editor |
Malicious release: Malicious code in svchost (PyPI) MAL-2026-2628 | Malicious | Not scored | 14 Apr, 2026 | PyPI svchost |
Malicious release: Malicious code in pckg-sv (PyPI) MAL-2026-2627 | Malicious | Not scored | 14 Apr, 2026 | PyPI pckg-sv |
Malicious release: Malicious code in getcardslib (npm) GHSA-4xvr-7wr9-qrcg, MAL-2026-2626 | Malicious | Not scored | 14 Apr, 2026 | npm getcardslib |
Malicious release: Malicious code in magentaa11y (npm) GHSA-q8qr-982j-49vc, MAL-2026-2632 | Malicious | Not scored | 13 Apr, 2026 | npm magentaa11y |
Malicious release: Malicious code in robase-install (PyPI) MAL-2026-2625 | Malicious | Not scored | 13 Apr, 2026 | PyPI robase-install |
Malicious release: Malicious code in asciitoart (PyPI) MAL-2026-2624 | Malicious | Not scored | 13 Apr, 2026 | PyPI asciitoart |
Malicious release: Malicious code in hive-setting (PyPI) MAL-2026-2623 | Malicious | Not scored | 13 Apr, 2026 | PyPI hive-setting |
Malicious release: Malicious code in walmart-internal (npm) GHSA-99jf-pgvm-hcgv, MAL-2026-2621 | Malicious | Not scored | 13 Apr, 2026 | npm walmart-internal |
Malicious release: Malicious code in @op-microfrontends/config (npm) GHSA-5wh3-m924-8fcv, MAL-2026-2590 | Malicious | Not scored | 13 Apr, 2026 | npm @op-microfrontends/config |
Malicious release: Malicious code in @sports-api/api-sdk (npm) GHSA-9pvf-233v-3fvc, MAL-2026-2595 | Malicious | Not scored | 13 Apr, 2026 | npm @sports-api/api-sdk |
Malicious release: Malicious code in @ids-alpha/theme (npm) GHSA-c58p-p36f-4c6c, MAL-2026-2586 | Malicious | Not scored | 13 Apr, 2026 | npm @ids-alpha/theme |
Malicious release: Malicious code in @mx-shared/utils (npm) GHSA-cgm3-286g-f28r, MAL-2026-2589 | Malicious | Not scored | 13 Apr, 2026 | npm @mx-shared/utils |
Malicious release: Malicious code in @dtc-campaign-wizard/campaign-wizard (npm) GHSA-grww-phc3-vfc4, MAL-2026-2581 | Malicious | Not scored | 13 Apr, 2026 | npm @dtc-campaign-wizard/campaign-wizard |
Malicious release: Malicious code in @sage-active/ui (npm) GHSA-jrjx-8vfw-xg4h, MAL-2026-2593 | Malicious | Not scored | 13 Apr, 2026 | npm @sage-active/ui |
Malicious release: Malicious code in @kucoin-gbiz-next/tools (npm) GHSA-mq43-24p4-jg9f, MAL-2026-2587 | Malicious | Not scored | 13 Apr, 2026 | npm @kucoin-gbiz-next/tools |
Malicious release: Malicious code in @zgny/onboarding-consumer (npm) GHSA-pr9f-7wph-jc3x, MAL-2026-2597 | Malicious | Not scored | 13 Apr, 2026 | npm @zgny/onboarding-consumer |
Malicious release: Malicious code in @spreadjs/js-calc (npm) GHSA-qm3m-hmcx-f8x4, MAL-2026-2596 | Malicious | Not scored | 13 Apr, 2026 | npm @spreadjs/js-calc |
Malicious release: Malicious code in @spoonflower/ui (npm) GHSA-rj3m-9925-f57q, MAL-2026-2594 | Malicious | Not scored | 13 Apr, 2026 | npm @spoonflower/ui |
Malicious release: Malicious code in @relxui/react (npm) GHSA-wpp4-q8gj-wfv9, MAL-2026-2592 | Malicious | Not scored | 13 Apr, 2026 | npm @relxui/react |
Malicious release: Malicious code in @pes-ui/components (npm) GHSA-ww6q-42qg-c93c, MAL-2026-2591 | Malicious | Not scored | 13 Apr, 2026 | npm @pes-ui/components |
Malicious release: Malicious code in @hrb-web/nuxt (npm) GHSA-xqfw-gvgh-hp79, MAL-2026-2585 | Malicious | Not scored | 13 Apr, 2026 | npm @hrb-web/nuxt |
Malicious release: Malicious code in wm-plugin-wm-smart-tip-dont-embed-tooltip (npm) GHSA-463v-xhcf-mqpw, MAL-2026-2622 | Malicious | Not scored | 13 Apr, 2026 | npm wm-plugin-wm-smart-tip-dont-embed-tooltip |
Malicious release: Malicious code in @guards-lib/auth (npm) GHSA-649h-jv39-hh5v, MAL-2026-2582 | Malicious | Not scored | 13 Apr, 2026 | npm @guards-lib/auth |
Malicious release: Malicious code in @bookiply/core (npm) GHSA-8mf9-v5mc-4ch3, MAL-2026-2579 | Malicious | Not scored | 13 Apr, 2026 | npm @bookiply/core |
Malicious release: Malicious code in @amplify-js/datastore (npm) GHSA-cqpc-xhmp-qr76, MAL-2026-2574 | Malicious | Not scored | 13 Apr, 2026 | npm @amplify-js/datastore |
Malicious release: Malicious code in @hpcc/js-api (npm) GHSA-fgh2-xw72-9637, MAL-2026-2584 | Malicious | Not scored | 13 Apr, 2026 | npm @hpcc/js-api |
Malicious release: Malicious code in @bokehjs/core (npm) GHSA-j77c-vj44-wvq4, MAL-2026-2578 | Malicious | Not scored | 13 Apr, 2026 | npm @bokehjs/core |
Malicious release: Malicious code in @hmm-app/api (npm) GHSA-j8vp-wwjq-48wg, MAL-2026-2583 | Malicious | Not scored | 13 Apr, 2026 | npm @hmm-app/api |
Malicious release: Malicious code in @ascend-ops/web-client (npm) GHSA-pqfr-rjg4-pjg3, MAL-2026-2575 | Malicious | Not scored | 13 Apr, 2026 | npm @ascend-ops/web-client |
Malicious release: Malicious code in @aircall-ecosystem/integrations-msteams-frontend (npm) GHSA-rcxh-h57p-p3vc, MAL-2026-2573 | Malicious | Not scored | 13 Apr, 2026 | npm @aircall-ecosystem/integrations-msteams-frontend |
Malicious release: Malicious code in @cash-web/no-hardcoded-font-styles (npm) GHSA-vr8g-rf3p-m3gw, MAL-2026-2580 | Malicious | Not scored | 13 Apr, 2026 | npm @cash-web/no-hardcoded-font-styles |
Malicious release: Malicious code in stats-api-js-client (npm) GHSA-7vg9-wgj5-3cpj, MAL-2026-2607 | Malicious | Not scored | 13 Apr, 2026 | npm stats-api-js-client |
Malicious release: Malicious code in twilio-video.js (npm) GHSA-j373-p8fj-3gfq, MAL-2026-2610 | Malicious | Not scored | 13 Apr, 2026 | npm twilio-video.js |
Malicious release: Malicious code in trade-in-lib (npm) GHSA-m6r9-8g63-rpqp, MAL-2026-2609 | Malicious | Not scored | 13 Apr, 2026 | npm trade-in-lib |
Malicious release: Malicious code in ih-icon (npm) GHSA-mgvv-m58f-pv4w, MAL-2026-2604 | Malicious | Not scored | 13 Apr, 2026 | npm ih-icon |