Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in chai-as-attached (npm) MAL-2026-2338 | Malicious | Not scored | 24 Mar, 2026 | npm chai-as-attached |
Malicious release: Malicious code in chai-as-aligned (npm) MAL-2026-2337 | Malicious | Not scored | 24 Mar, 2026 | npm chai-as-aligned |
Malicious release: Malicious code in cdnjavacss (npm) MAL-2026-2336 | Malicious | Not scored | 24 Mar, 2026 | npm cdnjavacss |
Malicious release: Malicious code in azurestack-common (npm) MAL-2026-2335 | Malicious | Not scored | 24 Mar, 2026 | npm azurestack-common |
Malicious release: Malicious code in argon-node (npm) MAL-2026-2334 | Malicious | Not scored | 24 Mar, 2026 | npm argon-node |
Malicious release: Malicious code in @pansycareful/github-helper (npm) MAL-2026-2333 | Malicious | Not scored | 24 Mar, 2026 | npm @pansycareful/github-helper |
Malicious release: Malicious code in @hsbc-mfe/host (npm) MAL-2026-2332 | Malicious | Not scored | 24 Mar, 2026 | npm @hsbc-mfe/host |
Malicious release: Malicious code in @girirajravichandran/corp-build-utils-poc (npm) MAL-2026-2331 | Malicious | Not scored | 24 Mar, 2026 | npm @girirajravichandran/corp-build-utils-poc |
Malicious release: Malicious code in @fyxer-ai/shared (npm) MAL-2026-2330 | Malicious | Not scored | 24 Mar, 2026 | npm @fyxer-ai/shared |
Malicious release: Malicious code in @abi-labs-frontend/standards (npm) GHSA-hqxv-wmmr-v5h3, MAL-2026-2329 | Malicious | Not scored | 24 Mar, 2026 | npm @abi-labs-frontend/standards |
Malicious release: Malicious code in plugin-gem-example (RubyGems) GHSA-xx9m-8846-6fh9, MAL-2026-2402 | Malicious | Not scored | 24 Mar, 2026 | RubyGems plugin-gem-example |
Malicious release: Malicious code in rocketpill (PyPI) MAL-2026-2401 | Malicious | Not scored | 24 Mar, 2026 | PyPI rocketpill |
Malicious release: Malicious code in flycalc (PyPI) MAL-2026-2399 | Malicious | Not scored | 24 Mar, 2026 | PyPI flycalc |
Malicious release: Malicious code in privaton-beacon-img-8f3603448690bdde-png (PyPI) MAL-2026-2201 | Malicious | Not scored | 24 Mar, 2026 | PyPI privaton-beacon-img-8f3603448690bdde-png |
Malicious release: Malicious code in @one-site/europcar (npm) MAL-2026-2137 | Malicious | Not scored | 24 Mar, 2026 | npm @one-site/europcar |
Malicious release: Malicious code in express-session-validator (npm) GHSA-52hw-wvx9-x8pq, MAL-2026-2129 | Malicious | Not scored | 24 Mar, 2026 | npm express-session-validator |
Malicious release: Malicious code in express-session-vailidator (npm) GHSA-hqj8-x2vp-mrp9, MAL-2026-2128 | Malicious | Not scored | 24 Mar, 2026 | npm express-session-vailidator |
Malicious release: Malicious code in sbx-mask (npm) GHSA-r934-qgg3-v7fg, MAL-2026-2132 | Malicious | Not scored | 24 Mar, 2026 | npm sbx-mask |
Malicious release: Malicious code in fancode-web-app (npm) GHSA-f6pq-884h-rjxq, MAL-2026-2130 | Malicious | Not scored | 24 Mar, 2026 | npm fancode-web-app |
Malicious release: Malicious code in agoda-test-poc (npm) GHSA-hfhc-gmgj-9v7v, MAL-2026-2127 | Malicious | Not scored | 24 Mar, 2026 | npm agoda-test-poc |
Malicious release: Malicious code in agoda-dep-confusion (npm) GHSA-px82-m72x-rpj7, MAL-2026-2126 | Malicious | Not scored | 24 Mar, 2026 | npm agoda-dep-confusion |
Malicious release: Malicious code in yelp-react-component-rating (npm) GHSA-xqxf-c9jr-8wx6, MAL-2026-2136 | Malicious | Not scored | 24 Mar, 2026 | npm yelp-react-component-rating |
Malicious release: Malicious code in yelp-react-component-photo-upload (npm) GHSA-7v3c-wxfg-x5fg, MAL-2026-2135 | Malicious | Not scored | 24 Mar, 2026 | npm yelp-react-component-photo-upload |
Malicious release: Malicious code in yelp-biz-action-constants-js-generated (npm) GHSA-mg5x-ww4x-j322, MAL-2026-2134 | Malicious | Not scored | 24 Mar, 2026 | npm yelp-biz-action-constants-js-generated |
Malicious release: Malicious code in server-fpti (npm) GHSA-8w5j-p4jv-8rmq, MAL-2026-2133 | Malicious | Not scored | 24 Mar, 2026 | npm server-fpti |
Malicious release: Malicious code in nemo-fpti (npm) GHSA-hmv2-22ff-cxh8, MAL-2026-2131 | Malicious | Not scored | 24 Mar, 2026 | npm nemo-fpti |
Malicious release: Malicious code in litellm (PyPI) MAL-2026-2144, PYSEC-2026-2 | Malicious | Not scored | 24 Mar, 2026 | PyPI litellm |
Malicious release: Malicious code in customerdigital-ui-components-lib (npm) GHSA-3m3c-wc3h-m5mr, MAL-2026-2125 | Malicious | Not scored | 24 Mar, 2026 | npm customerdigital-ui-components-lib |
Malicious release: Malicious code in @wame/ngx-frf-utilities (npm) MAL-2026-2412 | Malicious | Not scored | 24 Mar, 2026 | npm @wame/ngx-frf-utilities |
Malicious release: Malicious code in @wame/ngx-adfs (npm) MAL-2026-2411 | Malicious | Not scored | 24 Mar, 2026 | npm @wame/ngx-adfs |
Malicious release: Malicious code in tombac-chronos (npm) MAL-2026-2418 | Malicious | Not scored | 24 Mar, 2026 | npm tombac-chronos |
Malicious release: Malicious code in @the-coca-cola-company/ngps-global-common-utils (npm) MAL-2026-2410 | Malicious | Not scored | 24 Mar, 2026 | npm @the-coca-cola-company/ngps-global-common-utils |
Malicious release: Malicious code in @phonos/types (npm) MAL-2026-2409 | Malicious | Not scored | 24 Mar, 2026 | npm @phonos/types |
Malicious release: Malicious code in oc-navbar-module-client (npm) MAL-2026-2417 | Malicious | Not scored | 24 Mar, 2026 | npm oc-navbar-module-client |
Malicious release: Malicious code in oc-ccp-module-client (npm) MAL-2026-2416 | Malicious | Not scored | 24 Mar, 2026 | npm oc-ccp-module-client |
Malicious release: Malicious code in oc-aa-module-client (npm) MAL-2026-2415 | Malicious | Not scored | 24 Mar, 2026 | npm oc-aa-module-client |
Malicious release: Malicious code in ftapi-core (npm) MAL-2026-2414 | Malicious | Not scored | 24 Mar, 2026 | npm ftapi-core |
Malicious release: Malicious code in cr-static-shared-components (npm) GHSA-c39r-4xjc-wrcv, MAL-2026-2223 | Malicious | Not scored | 24 Mar, 2026 | npm cr-static-shared-components |
Malicious release: Malicious code in @cloudsop/hmoment (npm) MAL-2026-2408 | Malicious | Not scored | 24 Mar, 2026 | npm @cloudsop/hmoment |
Malicious release: Malicious code in @ceeferenderer/itg-renderer-sdk (npm) GHSA-3v4h-w4g3-h6r2, MAL-2026-2407 | Malicious | Not scored | 24 Mar, 2026 | npm @ceeferenderer/itg-renderer-sdk |
Malicious release: Malicious code in @ceeferenderer/fe-renderer-sdk (npm) GHSA-mw7m-6vvq-q69p, MAL-2026-2406 | Malicious | Not scored | 24 Mar, 2026 | npm @ceeferenderer/fe-renderer-sdk |
Malicious release: Malicious code in cclr-component-resources (npm) MAL-2026-2413 | Malicious | Not scored | 24 Mar, 2026 | npm cclr-component-resources |
Malicious release: Malicious code in mgrcfg (PyPI) MAL-2026-2124 | Malicious | Not scored | 24 Mar, 2026 | PyPI mgrcfg |
Malicious release: Malicious code in yelp-mobile-site-common (npm) GHSA-xmfj-5j3f-gx7x, MAL-2026-2123 | Malicious | Not scored | 24 Mar, 2026 | npm yelp-mobile-site-common |
Malicious release: Malicious code in rowrapee (PyPI) MAL-2026-2122 | Malicious | Not scored | 23 Mar, 2026 | PyPI rowrapee |
Malicious release: Malicious code in roboat (PyPI) MAL-2026-2121 | Malicious | Not scored | 23 Mar, 2026 | PyPI roboat |
Malicious release: Malicious code in logutilkit (PyPI) MAL-2026-2120 | Malicious | Not scored | 23 Mar, 2026 | PyPI logutilkit |
Malicious release: Malicious code in apachelicense (PyPI) MAL-2026-2119 | Malicious | Not scored | 23 Mar, 2026 | PyPI apachelicense |
Malicious release: Malicious code in hash-utils-py (PyPI) MAL-2026-2118 | Malicious | Not scored | 23 Mar, 2026 | PyPI hash-utils-py |
Malicious release: Malicious code in apply-hive-table (PyPI) MAL-2026-2112 | Malicious | Not scored | 23 Mar, 2026 | PyPI apply-hive-table |