Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @fortinet/fortigate-autoscale (npm) GHSA-fph3-6mrp-9v2j, MAL-2026-453 | Malicious | Not scored | 22 Jan, 2026 | npm @fortinet/fortigate-autoscale |
Malicious release: Malicious code in @mailpoet/component (npm) GHSA-h25f-8r9p-7452, MAL-2026-454 | Malicious | Not scored | 22 Jan, 2026 | npm @mailpoet/component |
Malicious release: Malicious code in @brl-laiwb/ng-laiwb-api (npm) GHSA-9mfj-j283-9f88, MAL-2026-452 | Malicious | Not scored | 22 Jan, 2026 | npm @brl-laiwb/ng-laiwb-api |
Malicious release: Malicious code in @alluxio/common-ui (npm) GHSA-w72q-x24f-3gq9, MAL-2026-451 | Malicious | Not scored | 22 Jan, 2026 | npm @alluxio/common-ui |
Malicious release: Malicious code in csv-parsing-xz (npm) GHSA-42cg-2rj4-8h6f, MAL-2026-458 | Malicious | Not scored | 22 Jan, 2026 | npm csv-parsing-xz |
Malicious release: Malicious code in csv-parsing-xx (npm) GHSA-j64q-7vw7-x9pp, MAL-2026-457 | Malicious | Not scored | 22 Jan, 2026 | npm csv-parsing-xx |
Malicious release: Malicious code in sympy-dev (PyPI) MAL-2026-450 | Malicious | Not scored | 22 Jan, 2026 | PyPI sympy-dev |
Malicious release: Malicious code in rank253222 (npm) MAL-2026-448 | Malicious | Not scored | 22 Jan, 2026 | npm rank253222 |
Malicious release: Malicious code in icloudprocessor (PyPI) MAL-2026-449 | Malicious | Not scored | 22 Jan, 2026 | PyPI icloudprocessor |
Malicious release: Malicious code in ttam-ploy (PyPI) MAL-2026-447 | Malicious | Not scored | 21 Jan, 2026 | PyPI ttam-ploy |
Malicious release: Malicious code in code-transfering-3 (PyPI) MAL-2026-445 | Malicious | Not scored | 21 Jan, 2026 | PyPI code-transfering-3 |
Malicious release: Malicious code in code-transfering-4 (PyPI) MAL-2026-446 | Malicious | Not scored | 21 Jan, 2026 | PyPI code-transfering-4 |
Malicious release: Malicious code in terminalbrush (PyPI) MAL-2026-444 | Malicious | Not scored | 21 Jan, 2026 | PyPI terminalbrush |
Malicious release: Malicious code in 1q847 (PyPI) MAL-2026-443 | Malicious | Not scored | 21 Jan, 2026 | PyPI 1q847 |
Malicious release: Malicious code in xadauiom (PyPI) MAL-2026-442 | Malicious | Not scored | 21 Jan, 2026 | PyPI xadauiom |
Malicious release: Malicious code in anduril-lattice-sdk-grpc-python (PyPI) MAL-2026-440 | Malicious | Not scored | 21 Jan, 2026 | PyPI anduril-lattice-sdk-grpc-python |
Malicious release: Malicious code in spellcheckpy (PyPI) MAL-2026-441 | Malicious | Not scored | 21 Jan, 2026 | PyPI spellcheckpy |
Malicious release: Malicious code in tv-admin-commons (npm) GHSA-87xf-ghj4-8h7x, MAL-2026-439 | Malicious | Not scored | 21 Jan, 2026 | npm tv-admin-commons |
Malicious release: Malicious code in ts-tweetnacl-utils (npm) GHSA-hp92-6jf4-773f, MAL-2026-438 | Malicious | Not scored | 21 Jan, 2026 | npm ts-tweetnacl-utils |
Malicious release: Malicious code in lumo-api-client (npm) GHSA-vxqc-gmrh-x7m2, MAL-2026-437 | Malicious | Not scored | 21 Jan, 2026 | npm lumo-api-client |
Malicious release: Malicious code in jquery-ajaxchimp (npm) GHSA-xxq4-gc37-grmh, MAL-2026-436 | Malicious | Not scored | 21 Jan, 2026 | npm jquery-ajaxchimp |
Malicious release: Malicious code in aligntype (npm) GHSA-fp6q-w5hw-mvvx, MAL-2026-435 | Malicious | Not scored | 21 Jan, 2026 | npm aligntype |
Malicious release: Malicious code in chai-async-test (npm) GHSA-wjj4-r47f-m9q8, MAL-2026-409 | Malicious | Not scored | 21 Jan, 2026 | npm chai-async-test |
Malicious release: Malicious code in dotenv-expanded (npm) GHSA-94jw-vmxc-vv4v, MAL-2026-415 | Malicious | Not scored | 21 Jan, 2026 | npm dotenv-expanded |
Malicious release: Malicious code in qdrant-js (npm) GHSA-8p85-84qw-3m2v, MAL-2026-426 | Malicious | Not scored | 21 Jan, 2026 | npm qdrant-js |
Malicious release: Malicious code in weaviate-js (npm) GHSA-hwmx-j3gv-65mh, MAL-2026-434 | Malicious | Not scored | 21 Jan, 2026 | npm weaviate-js |
Malicious release: Malicious code in replicate-js (npm) GHSA-qfp4-ffv5-3xrg, MAL-2026-427 | Malicious | Not scored | 21 Jan, 2026 | npm replicate-js |
Malicious release: Malicious code in nanoid-js (npm) GHSA-5fj2-vwp3-544j, MAL-2026-418 | Malicious | Not scored | 21 Jan, 2026 | npm nanoid-js |
Malicious release: Malicious code in storage-types (npm) GHSA-f8wv-3jjp-qw4w, MAL-2026-430 | Malicious | Not scored | 21 Jan, 2026 | npm storage-types |
Malicious release: Malicious code in plugin-vue (npm) GHSA-hxxj-55p6-h93r, MAL-2026-425 | Malicious | Not scored | 21 Jan, 2026 | npm plugin-vue |
Malicious release: Malicious code in babel-js (npm) GHSA-qg2h-qpcj-f7c2, MAL-2026-407 | Malicious | Not scored | 21 Jan, 2026 | npm babel-js |
Malicious release: Malicious code in plugin-react-swc (npm) GHSA-w743-w2hh-6f23, MAL-2026-424 | Malicious | Not scored | 21 Jan, 2026 | npm plugin-react-swc |
Malicious release: Malicious code in aws-crt-nodejs (npm) GHSA-jpvg-2xxh-xxvh, MAL-2026-406 | Malicious | Not scored | 21 Jan, 2026 | npm aws-crt-nodejs |
Malicious release: Malicious code in debox-rn (npm) GHSA-87pg-vff6-6494, MAL-2026-414 | Malicious | Not scored | 21 Jan, 2026 | npm debox-rn |
Malicious release: Malicious code in testpkg-yilider690 (npm) GHSA-m3mx-92hq-fgm8, MAL-2026-431 | Malicious | Not scored | 21 Jan, 2026 | npm testpkg-yilider690 |
Malicious release: Malicious code in connect-web (npm) GHSA-2wv3-j8p3-gcmm, MAL-2026-412 | Malicious | Not scored | 21 Jan, 2026 | npm connect-web |
Malicious release: Malicious code in oce-icons (npm) GHSA-72g5-9m6h-j5f9, MAL-2026-422 | Malicious | Not scored | 21 Jan, 2026 | npm oce-icons |
Malicious release: Malicious code in oce-components (npm) GHSA-9h78-r65j-hjrj, MAL-2026-420 | Malicious | Not scored | 21 Jan, 2026 | npm oce-components |
Malicious release: Malicious code in oce-collaborate (npm) GHSA-9vff-q7rf-xvxw, MAL-2026-419 | Malicious | Not scored | 21 Jan, 2026 | npm oce-collaborate |
Malicious release: Malicious code in collaborate (npm) GHSA-g57h-gf4v-9mvh, MAL-2026-411 | Malicious | Not scored | 21 Jan, 2026 | npm collaborate |
Malicious release: Malicious code in oce-validate (npm) GHSA-h69m-f63v-crpg, MAL-2026-423 | Malicious | Not scored | 21 Jan, 2026 | npm oce-validate |
Malicious release: Malicious code in oce-freecoin (npm) GHSA-mc7q-fxfg-4c65, MAL-2026-421 | Malicious | Not scored | 21 Jan, 2026 | npm oce-freecoin |
Malicious release: Malicious code in shroom-kit (npm) GHSA-rhcw-7jjc-v2rq, MAL-2026-428 | Malicious | Not scored | 21 Jan, 2026 | npm shroom-kit |
Malicious release: Malicious code in clerk-js (npm) GHSA-vr7m-h7j3-rxq6, MAL-2026-410 | Malicious | Not scored | 21 Jan, 2026 | npm clerk-js |
Malicious release: Malicious code in kanban-webcomponent (npm) GHSA-9934-hp5h-qv2g, MAL-2026-417 | Malicious | Not scored | 21 Jan, 2026 | npm kanban-webcomponent |
Malicious release: Malicious code in bitbot (npm) GHSA-hg44-4gm2-crmv, MAL-2026-408 | Malicious | Not scored | 21 Jan, 2026 | npm bitbot |
Malicious release: Malicious code in coopshares-webcomponent (npm) GHSA-pv7x-9f66-mjm7, MAL-2026-413 | Malicious | Not scored | 21 Jan, 2026 | npm coopshares-webcomponent |
Malicious release: Malicious code in wallet-adapter-react (npm) GHSA-wpmx-5pw3-796j, MAL-2026-433 | Malicious | Not scored | 21 Jan, 2026 | npm wallet-adapter-react |
Malicious release: Malicious code in hw-app-eth (npm) GHSA-8frc-jmg6-9xvq, MAL-2026-416 | Malicious | Not scored | 21 Jan, 2026 | npm hw-app-eth |
Malicious release: Malicious code in sign-client (npm) GHSA-h5ch-v4cm-8vfg, MAL-2026-429 | Malicious | Not scored | 21 Jan, 2026 | npm sign-client |