Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in kyxhiagent (npm) GHSA-r23r-8c7q-wm92, MAL-2026-1953 | Malicious | Not scored | 20 Mar, 2026 | npm kyxhiagent |
Malicious release: Malicious code in fadlsjf (npm) GHSA-34h2-gr5g-vc3j, MAL-2026-1948 | Malicious | Not scored | 20 Mar, 2026 | npm fadlsjf |
Malicious release: Malicious code in el-icon (npm) GHSA-gfm3-3p4f-m57w, MAL-2026-1947 | Malicious | Not scored | 20 Mar, 2026 | npm el-icon |
Malicious release: Malicious code in mtpmysql (npm) GHSA-7xpm-vmrr-4rrv, MAL-2026-1958 | Malicious | Not scored | 20 Mar, 2026 | npm mtpmysql |
Malicious release: Malicious code in mtpdb (npm) GHSA-8g7v-w2f5-7gw2, MAL-2026-1957 | Malicious | Not scored | 20 Mar, 2026 | npm mtpdb |
Malicious release: Malicious code in parsejson-pro (npm) GHSA-cv8h-5j9m-x3rc, MAL-2026-1962 | Malicious | Not scored | 20 Mar, 2026 | npm parsejson-pro |
Malicious release: Malicious code in safe-json-parsex (npm) GHSA-f6jh-hc8p-xpfx, MAL-2026-1968 | Malicious | Not scored | 20 Mar, 2026 | npm safe-json-parsex |
Malicious release: Malicious code in nodex-db (npm) GHSA-28w8-cpp5-g448, MAL-2026-1960 | Malicious | Not scored | 20 Mar, 2026 | npm nodex-db |
Malicious release: Malicious code in node-business (npm) GHSA-2prc-m9c3-jgwp, MAL-2026-1959 | Malicious | Not scored | 20 Mar, 2026 | npm node-business |
Malicious release: Malicious code in rollup-plugin-polyfill-build (npm) GHSA-49jr-xf59-c296, MAL-2026-1967 | Malicious | Not scored | 20 Mar, 2026 | npm rollup-plugin-polyfill-build |
Malicious release: Malicious code in hackerhacker (npm) GHSA-69jj-c93h-67p2, MAL-2026-1949 | Malicious | Not scored | 20 Mar, 2026 | npm hackerhacker |
Malicious release: Malicious code in trex-proxy-browser-extension-sdk (npm) GHSA-9m98-jvf5-jxx5, MAL-2026-1971 | Malicious | Not scored | 20 Mar, 2026 | npm trex-proxy-browser-extension-sdk |
Malicious release: Malicious code in spstargm (npm) GHSA-x24f-q36q-6pcj, MAL-2026-1969 | Malicious | Not scored | 20 Mar, 2026 | npm spstargm |
Malicious release: Malicious code in llmstash (npm) GHSA-p7pv-mfpq-4rfg, MAL-2026-1956 | Malicious | Not scored | 20 Mar, 2026 | npm llmstash |
Malicious release: Malicious code in @metaplex-foundations/umi-public-keys (npm) GHSA-2rjv-fxjc-xwmv, MAL-2026-1938 | Malicious | Not scored | 20 Mar, 2026 | npm @metaplex-foundations/umi-public-keys |
Malicious release: Malicious code in pretty-loggers (npm) GHSA-6mrh-fqgr-9x68, MAL-2026-1964 | Malicious | Not scored | 20 Mar, 2026 | npm pretty-loggers |
Malicious release: Malicious code in @validates-sdk/v3 (npm) GHSA-6rj6-xwm6-v698, MAL-2026-1940 | Malicious | Not scored | 20 Mar, 2026 | npm @validates-sdk/v3 |
Malicious release: Malicious code in decode-sdk (npm) GHSA-95h8-q9jh-jjwf, MAL-2026-1946 | Malicious | Not scored | 20 Mar, 2026 | npm decode-sdk |
Malicious release: Malicious code in clob-client-sdks (npm) GHSA-9cwp-m29q-hmgr, MAL-2026-1942 | Malicious | Not scored | 20 Mar, 2026 | npm clob-client-sdks |
Malicious release: Malicious code in @solana-launchpads/sdk (npm) GHSA-mrwh-gr28-36wv, MAL-2026-1939 | Malicious | Not scored | 20 Mar, 2026 | npm @solana-launchpads/sdk |
Malicious release: Malicious code in polymarket-onchain (npm) GHSA-qw8c-w97q-7p7p, MAL-2026-1963 | Malicious | Not scored | 20 Mar, 2026 | npm polymarket-onchain |
Malicious release: Malicious code in @dotprompt/promptly-darwin-arm64 (npm) GHSA-52w3-g4x3-xw3h, MAL-2026-1937 | Malicious | Not scored | 20 Mar, 2026 | npm @dotprompt/promptly-darwin-arm64 |
Malicious release: Malicious code in pretty-ts-logger (npm) GHSA-7qv7-jx74-qhx9, MAL-2026-1965 | Malicious | Not scored | 20 Mar, 2026 | npm pretty-ts-logger |
Malicious release: Malicious code in client-hash-sdk (npm) GHSA-7w6q-gfxv-393v, MAL-2026-1941 | Malicious | Not scored | 20 Mar, 2026 | npm client-hash-sdk |
Malicious release: Malicious code in clob-utils-sdks (npm) GHSA-vrqq-pxvj-f2mg, MAL-2026-1943 | Malicious | Not scored | 20 Mar, 2026 | npm clob-utils-sdks |
Malicious release: Malicious code in wildhunter (npm) GHSA-mqvj-42pf-qv58, MAL-2026-1972 | Malicious | Not scored | 20 Mar, 2026 | npm wildhunter |
Malicious release: Malicious code in supportgameapp (npm) GHSA-87mp-vrm9-h8r5, MAL-2026-1970 | Malicious | Not scored | 20 Mar, 2026 | npm supportgameapp |
Malicious release: Malicious code in restaking-apy-module (npm) GHSA-4gc2-gg24-6qf6, MAL-2026-1966 | Malicious | Not scored | 20 Mar, 2026 | npm restaking-apy-module |
Malicious release: Malicious code in json-parse-genie (npm) GHSA-mwq7-2fm8-vc4q, MAL-2026-1952 | Malicious | Not scored | 20 Mar, 2026 | npm json-parse-genie |
Malicious release: Malicious code in interface-builder-kit (npm) GHSA-82f5-93r9-hhwq, MAL-2026-1951 | Malicious | Not scored | 20 Mar, 2026 | npm interface-builder-kit |
Malicious release: Malicious code in jsonify-bundler (npm) GHSA-wv5m-jqq3-c22x, MAL-2026-1935 | Malicious | Not scored | 20 Mar, 2026 | npm jsonify-bundler |
Malicious release: Malicious code in lint-builder (npm) GHSA-5p7c-2c97-fjpm, MAL-2026-1936 | Malicious | Not scored | 20 Mar, 2026 | npm lint-builder |
Malicious release: Malicious code in big-nunber (npm) GHSA-jq28-7779-5hp9, MAL-2026-1934 | Malicious | Not scored | 20 Mar, 2026 | npm big-nunber |
Malicious release: Malicious code in libavcodec-extra (PyPI) MAL-2026-1933 | Malicious | Not scored | 19 Mar, 2026 | PyPI libavcodec-extra |
Malicious release: Malicious code in react-native-country-select (npm) GHSA-vf6p-p33f-3cjv, MAL-2026-1931 | Malicious | Not scored | 19 Mar, 2026 | npm react-native-country-select |
Malicious release: Malicious code in react-native-international-phone-number (npm) GHSA-69cx-hr8r-mc9j, MAL-2026-1932 | Malicious | Not scored | 19 Mar, 2026 | npm react-native-international-phone-number |
Malicious release: Malicious code in @iflow-mcp/watercrawl-watercrawl-mcp (npm) GHSA-rg84-r52h-2rgw, MAL-2026-1930 | Malicious | Not scored | 19 Mar, 2026 | npm @iflow-mcp/watercrawl-watercrawl-mcp |
Malicious release: Malicious code in @aifabrix/miso-client (npm) GHSA-5w47-93jc-5w3g, MAL-2026-1929 | Malicious | Not scored | 19 Mar, 2026 | npm @aifabrix/miso-client |
Malicious release: Malicious code in changelog-logger-wrap (npm) GHSA-59ff-98r4-m9mp, MAL-2026-1928 | Malicious | Not scored | 19 Mar, 2026 | npm changelog-logger-wrap |
Malicious release: Malicious code in changelog-logger-utils (npm) GHSA-7fr9-gw6v-q3mw, MAL-2026-1927 | Malicious | Not scored | 19 Mar, 2026 | npm changelog-logger-utils |
Malicious release: Malicious code in tokenshower (npm) GHSA-jcwx-28x8-jf6f, MAL-2026-1926 | Malicious | Not scored | 19 Mar, 2026 | npm tokenshower |
Malicious release: Malicious code in jsonify-parser (npm) GHSA-hqf3-9jfp-qgh9, MAL-2026-1925 | Malicious | Not scored | 19 Mar, 2026 | npm jsonify-parser |
Malicious release: Malicious code in nflx-release (npm) MAL-2026-1580 | Malicious | Not scored | 19 Mar, 2026 | npm nflx-release |
Malicious release: Malicious code in wn-idv-persona-client (npm) MAL-2026-1584 | Malicious | Not scored | 19 Mar, 2026 | npm wn-idv-persona-client |
Malicious release: Malicious code in whatnot-web (npm) MAL-2026-1583 | Malicious | Not scored | 19 Mar, 2026 | npm whatnot-web |
Malicious release: Malicious code in whatnot-events (npm) MAL-2026-1581 | Malicious | Not scored | 19 Mar, 2026 | npm whatnot-events |
Malicious release: Malicious code in whatnot-manifests (npm) MAL-2026-1582 | Malicious | Not scored | 19 Mar, 2026 | npm whatnot-manifests |
Malicious release: Malicious code in browser-gaming-client (npm) MAL-2026-1578 | Malicious | Not scored | 19 Mar, 2026 | npm browser-gaming-client |
Malicious release: Malicious code in nf-cl-ls (npm) MAL-2026-1579 | Malicious | Not scored | 19 Mar, 2026 | npm nf-cl-ls |
Malicious release: Malicious code in ropie (PyPI) MAL-2026-1577 | Malicious | Not scored | 18 Mar, 2026 | PyPI ropie |