Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @_wnpm/wnpm-cli (npm) MAL-2026-2420 | Malicious | Not scored | 02 Apr, 2026 | npm @_wnpm/wnpm-cli |
Malicious release: Malicious code in eht-account (PyPI) MAL-2026-2405 | Malicious | Not scored | 01 Apr, 2026 | PyPI eht-account |
Malicious release: Malicious code in ether-account (PyPI) MAL-2026-2404 | Malicious | Not scored | 01 Apr, 2026 | PyPI ether-account |
Malicious release: Malicious code in polymarkets-sdk (PyPI) MAL-2026-2403 | Malicious | Not scored | 01 Apr, 2026 | PyPI polymarkets-sdk |
Malicious release: Malicious code in kube-node-health (PyPI) MAL-2026-2400 | Malicious | Not scored | 01 Apr, 2026 | PyPI kube-node-health |
Malicious release: Malicious code in mcp-server-todo (npm) GHSA-hppm-xxp9-54h7, MAL-2026-2328 | Malicious | Not scored | 01 Apr, 2026 | npm mcp-server-todo |
Malicious release: Malicious code in kube-health-tools (PyPI) MAL-2026-2327 | Malicious | Not scored | 01 Apr, 2026 | PyPI kube-health-tools |
Malicious release: Malicious code in bs58-basic (npm) GHSA-q3vj-r65j-q4x7, MAL-2026-2322 | Malicious | Not scored | 01 Apr, 2026 | npm bs58-basic |
Malicious release: Malicious code in raydium-bs58 (npm) GHSA-qm27-pj7f-f7jh, MAL-2026-2326 | Malicious | Not scored | 01 Apr, 2026 | npm raydium-bs58 |
Malicious release: Malicious code in ethersproject-wallet (npm) GHSA-wq8j-wv4x-xhh8, MAL-2026-2323 | Malicious | Not scored | 01 Apr, 2026 | npm ethersproject-wallet |
Malicious release: Malicious code in base-x-64 (npm) GHSA-x4xx-m9j7-vf6h, MAL-2026-2320 | Malicious | Not scored | 01 Apr, 2026 | npm base-x-64 |
Malicious release: Malicious code in base-or-engine (npm) GHSA-346p-r96j-6qc2, MAL-2026-2319 | Malicious | Not scored | 01 Apr, 2026 | npm base-or-engine |
Malicious release: Malicious code in @logcore/pino-pretty-logger (npm) GHSA-5rhm-2g6h-55jq, MAL-2026-2318 | Malicious | Not scored | 01 Apr, 2026 | npm @logcore/pino-pretty-logger |
Malicious release: Malicious code in jonas-prettier-logger (npm) GHSA-h9fw-29vc-6g89, MAL-2026-2325 | Malicious | Not scored | 01 Apr, 2026 | npm jonas-prettier-logger |
Malicious release: Malicious code in base58-engine (npm) GHSA-mv42-q6hf-h4c7, MAL-2026-2321 | Malicious | Not scored | 01 Apr, 2026 | npm base58-engine |
Malicious release: Malicious code in jellyfi-pino-pretty-logger (npm) GHSA-qxgw-5fgp-28w8, MAL-2026-2324 | Malicious | Not scored | 01 Apr, 2026 | npm jellyfi-pino-pretty-logger |
Malicious release: Malicious code in openai-async-helpers (PyPI) MAL-2026-2316 | Malicious | Not scored | 01 Apr, 2026 | PyPI openai-async-helpers |
Malicious release: Malicious code in pygithub-async-utils (PyPI) MAL-2026-2317 | Malicious | Not scored | 01 Apr, 2026 | PyPI pygithub-async-utils |
Malicious release: Malicious code in latinum-wallet-mcp (PyPI) MAL-2026-2315 | Malicious | Not scored | 31 Mar, 2026 | PyPI latinum-wallet-mcp |
Malicious release: Malicious code in @c8o/nimbus-core (npm) GHSA-6p89-h5mp-9cqp, MAL-2026-2314 | Malicious | Not scored | 31 Mar, 2026 | npm @c8o/nimbus-core |
Malicious release: Malicious code in coredxloader (PyPI) MAL-2026-2313 | Malicious | Not scored | 31 Mar, 2026 | PyPI coredxloader |
Malicious release: Malicious code in tailwindcss-typeface-inter (npm) GHSA-3cx6-7g5g-3hhp, MAL-2026-2312 | Malicious | Not scored | 31 Mar, 2026 | npm tailwindcss-typeface-inter |
Malicious release: Malicious code in officepyai (PyPI) MAL-2026-2311 | Malicious | Not scored | 31 Mar, 2026 | PyPI officepyai |
Malicious release: Malicious code in lakeflow-community-connectors (PyPI) MAL-2026-2310 | Malicious | Not scored | 31 Mar, 2026 | PyPI lakeflow-community-connectors |
Malicious release: Malicious code in workingitme (PyPI) MAL-2026-2308 | Malicious | Not scored | 31 Mar, 2026 | PyPI workingitme |
Malicious release: Malicious code in zzzzthisisitwantsafecheckitzzzz (PyPI) MAL-2026-2309 | Malicious | Not scored | 31 Mar, 2026 | PyPI zzzzthisisitwantsafecheckitzzzz |
Malicious release: Malicious code in axios (npm) GHSA-fw8c-xr5c-95f9, MAL-2026-2307 | Malicious | Not scored | 31 Mar, 2026 | npm axios |
Malicious release: Malicious code in plain-crypto-js (npm) GHSA-2x9r-6wxq-hrr7, MAL-2026-2306 | Malicious | Not scored | 31 Mar, 2026 | npm plain-crypto-js |
Malicious release: Malicious code in databaseroboats (PyPI) MAL-2026-2305 | Malicious | Not scored | 30 Mar, 2026 | PyPI databaseroboats |
Malicious release: Malicious code in spanner-client (PyPI) MAL-2026-2304 | Malicious | Not scored | 30 Mar, 2026 | PyPI spanner-client |
Malicious release: Malicious code in prodaccess (PyPI) MAL-2026-2303 | Malicious | Not scored | 30 Mar, 2026 | PyPI prodaccess |
Malicious release: Malicious code in dremel (PyPI) MAL-2026-2301 | Malicious | Not scored | 30 Mar, 2026 | PyPI dremel |
Malicious release: Malicious code in loas (PyPI) MAL-2026-2302 | Malicious | Not scored | 30 Mar, 2026 | PyPI loas |
Malicious release: Malicious code in eslint-validator (npm) GHSA-m9ph-m48c-mrq8, MAL-2026-2300 | Malicious | Not scored | 30 Mar, 2026 | npm eslint-validator |
Malicious release: Malicious code in mnemoniclib (PyPI) MAL-2026-2299 | Malicious | Not scored | 30 Mar, 2026 | PyPI mnemoniclib |
Malicious release: Malicious code in hiveos-sdk (PyPI) MAL-2026-2298 | Malicious | Not scored | 30 Mar, 2026 | PyPI hiveos-sdk |
Malicious release: Malicious code in earthengine-api (npm) MAL-2026-2297 | Malicious | Not scored | 30 Mar, 2026 | npm earthengine-api |
Malicious release: Malicious code in bos-decoration-elements (npm) MAL-2026-2296 | Malicious | Not scored | 29 Mar, 2026 | npm bos-decoration-elements |
Malicious release: Malicious code in databaseroboat (PyPI) MAL-2026-2295 | Malicious | Not scored | 29 Mar, 2026 | PyPI databaseroboat |
Malicious release: Malicious code in hiveos (PyPI) MAL-2026-2294 | Malicious | Not scored | 29 Mar, 2026 | PyPI hiveos |
Malicious release: Malicious code in pychatz (PyPI) MAL-2026-2291 | Malicious | Not scored | 29 Mar, 2026 | PyPI pychatz |
Malicious release: Malicious code in safecheckit (PyPI) MAL-2026-2292 | Malicious | Not scored | 29 Mar, 2026 | PyPI safecheckit |
Malicious release: Malicious code in thisismytestnouser (PyPI) MAL-2026-2293 | Malicious | Not scored | 29 Mar, 2026 | PyPI thisismytestnouser |
Malicious release: Malicious code in iwantsafecheckit (PyPI) MAL-2026-2290 | Malicious | Not scored | 29 Mar, 2026 | PyPI iwantsafecheckit |
Malicious release: Malicious code in database-roblox (PyPI) MAL-2026-2289 | Malicious | Not scored | 29 Mar, 2026 | PyPI database-roblox |
Malicious release: Malicious code in f0-state-manager (npm) MAL-2026-2287 | Malicious | Not scored | 29 Mar, 2026 | npm f0-state-manager |
Malicious release: Malicious code in merchservicingnodeserv (npm) MAL-2026-2288 | Malicious | Not scored | 29 Mar, 2026 | npm merchservicingnodeserv |
Malicious release: Malicious code in dial-app-version (npm) MAL-2026-2285 | Malicious | Not scored | 29 Mar, 2026 | npm dial-app-version |
Malicious release: Malicious code in bizsignupnodeweb (npm) MAL-2026-2284 | Malicious | Not scored | 29 Mar, 2026 | npm bizsignupnodeweb |
Malicious release: Malicious code in sn3akysnak3-test (npm) MAL-2026-2286 | Malicious | Not scored | 29 Mar, 2026 | npm sn3akysnak3-test |