Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in advanced-svg-fetcher (npm) GHSA-qr98-w5xw-vjrx, MAL-2026-353 | Malicious | Not scored | 20 Jan, 2026 | npm advanced-svg-fetcher |
Malicious release: Malicious code in dux-portal (npm) GHSA-5hr4-9hqr-m4wv, MAL-2026-354 | Malicious | Not scored | 20 Jan, 2026 | npm dux-portal |
Malicious release: Malicious code in dux-portal-privacy (npm) GHSA-f3fp-v63j-533v, MAL-2026-355 | Malicious | Not scored | 20 Jan, 2026 | npm dux-portal-privacy |
Malicious release: Malicious code in react-server-dom-unbundled (npm) GHSA-mq7q-f9vp-f9qx, MAL-2026-356 | Malicious | Not scored | 20 Jan, 2026 | npm react-server-dom-unbundled |
Malicious release: Malicious code in medifile (PyPI) MAL-2026-352 | Malicious | Not scored | 19 Jan, 2026 | PyPI medifile |
Malicious release: Malicious code in nanoinstaller (PyPI) MAL-2026-351 | Malicious | Not scored | 19 Jan, 2026 | PyPI nanoinstaller |
Malicious release: Malicious code in bnanainstaller (PyPI) MAL-2026-350 | Malicious | Not scored | 19 Jan, 2026 | PyPI bnanainstaller |
Malicious release: Malicious code in tutor_table (npm) GHSA-hfhc-f96x-2fm6, MAL-2026-349 | Malicious | Not scored | 19 Jan, 2026 | npm tutor_table |
Malicious release: Malicious code in react-native-webview-forked (npm) GHSA-gfr9-mcfv-qqvc, MAL-2026-348 | Malicious | Not scored | 19 Jan, 2026 | npm react-native-webview-forked |
Malicious release: Malicious code in @bingads-webui-theme-2018/theme-fluent (npm) GHSA-xxhf-h8wv-fvxf, MAL-2026-347 | Malicious | Not scored | 19 Jan, 2026 | npm @bingads-webui-theme-2018/theme-fluent |
Malicious release: Malicious code in internallib_v355 (npm) GHSA-w4wq-pc2v-rw4r, MAL-2026-339 | Malicious | Not scored | 19 Jan, 2026 | npm internallib_v355 |
Malicious release: Malicious code in ofjaaah-auth-module (npm) GHSA-58p8-pqhg-w25w, MAL-2026-341 | Malicious | Not scored | 19 Jan, 2026 | npm ofjaaah-auth-module |
Malicious release: Malicious code in ofjaaah-security-lib (npm) GHSA-6vhq-9rv5-4fhh, MAL-2026-344 | Malicious | Not scored | 19 Jan, 2026 | npm ofjaaah-security-lib |
Malicious release: Malicious code in ofjaaah-build-tools (npm) GHSA-6w58-gfqh-9m8f, MAL-2026-342 | Malicious | Not scored | 19 Jan, 2026 | npm ofjaaah-build-tools |
Malicious release: Malicious code in private-payment-lib (npm) GHSA-cj92-mmxc-m23c, MAL-2026-345 | Malicious | Not scored | 19 Jan, 2026 | npm private-payment-lib |
Malicious release: Malicious code in ofjaaah-internal-utils (npm) GHSA-f477-h27j-73mq, MAL-2026-343 | Malicious | Not scored | 19 Jan, 2026 | npm ofjaaah-internal-utils |
Malicious release: Malicious code in internal-company-sdk (npm) GHSA-gjfx-xc74-r6gx, MAL-2026-338 | Malicious | Not scored | 19 Jan, 2026 | npm internal-company-sdk |
Malicious release: Malicious code in @cda-apps/source (npm) GHSA-6gqx-gcxc-q57c, MAL-2026-336 | Malicious | Not scored | 19 Jan, 2026 | npm @cda-apps/source |
Malicious release: Malicious code in chai-as-executed (npm) GHSA-v4xj-7hwf-8j5p, MAL-2026-337 | Malicious | Not scored | 19 Jan, 2026 | npm chai-as-executed |
Malicious release: Malicious code in libsignal-yazxzcode (npm) GHSA-7f3f-f4mw-rcrm, MAL-2026-340 | Malicious | Not scored | 19 Jan, 2026 | npm libsignal-yazxzcode |
Malicious release: Malicious code in zod-js (npm) GHSA-6h2f-4qcq-99fr, MAL-2026-346 | Malicious | Not scored | 19 Jan, 2026 | npm zod-js |
Malicious release: Malicious code in wac-react-relay (npm) GHSA-h56r-m52j-p8mj, MAL-2026-335 | Malicious | Not scored | 19 Jan, 2026 | npm wac-react-relay |
Malicious release: Malicious code in @brokenzzz/garfish (npm) GHSA-vxcp-cr2c-vq4r, MAL-2026-329 | Malicious | Not scored | 19 Jan, 2026 | npm @brokenzzz/garfish |
Malicious release: Malicious code in 1231dai (npm) GHSA-7v67-7g8x-pph4, MAL-2026-328 | Malicious | Not scored | 19 Jan, 2026 | npm 1231dai |
Malicious release: Malicious code in viem-js (npm) GHSA-257w-wr4p-5rxp, MAL-2026-334 | Malicious | Not scored | 19 Jan, 2026 | npm viem-js |
Malicious release: Malicious code in cyrpto (npm) GHSA-4pxr-pch5-8x98, MAL-2026-331 | Malicious | Not scored | 19 Jan, 2026 | npm cyrpto |
Malicious release: Malicious code in tailwin (npm) GHSA-vfm7-jg7w-6mwv, MAL-2026-332 | Malicious | Not scored | 19 Jan, 2026 | npm tailwin |
Malicious release: Malicious code in tronweb-tool (npm) GHSA-6w7h-3h2q-h6qm, MAL-2026-333 | Malicious | Not scored | 19 Jan, 2026 | npm tronweb-tool |
Malicious release: Malicious code in @daffadeveloper/signal-node (npm) GHSA-m9wr-f6xx-j3p9, MAL-2026-330 | Malicious | Not scored | 19 Jan, 2026 | npm @daffadeveloper/signal-node |
Malicious release: Malicious code in urlssser (PyPI) MAL-2026-326 | Malicious | Not scored | 18 Jan, 2026 | PyPI urlssser |
Malicious release: Malicious code in marshel (PyPI) MAL-2026-325 | Malicious | Not scored | 18 Jan, 2026 | PyPI marshel |
Malicious release: Malicious code in typedoc-plugin-fuel-variants (npm) MAL-2026-324 | Malicious | Not scored | 17 Jan, 2026 | npm typedoc-plugin-fuel-variants |
Malicious release: Malicious code in eslint-plugin-fuel-react (npm) MAL-2026-323 | Malicious | Not scored | 17 Jan, 2026 | npm eslint-plugin-fuel-react |
Malicious release: Malicious code in mapkit-example-vanillajs (npm) GHSA-w856-vp94-4mqj, MAL-2026-327 | Malicious | Not scored | 17 Jan, 2026 | npm mapkit-example-vanillajs |
Malicious release: Malicious code in uitil (PyPI) MAL-2026-1036 | Malicious | Not scored | 16 Jan, 2026 | PyPI uitil |
Malicious release: Malicious code in admin10001 (npm) GHSA-m8m9-h738-g5fh, MAL-2026-322 | Malicious | Not scored | 16 Jan, 2026 | npm admin10001 |
Malicious release: Malicious code in flip-prx (npm) GHSA-vj8r-7f53-45wq, MAL-2026-321 | Malicious | Not scored | 16 Jan, 2026 | npm flip-prx |
Malicious release: Malicious code in eniram-web-common-ui (npm) GHSA-2pxv-3xpq-wmmp, MAL-2026-281 | Malicious | Not scored | 16 Jan, 2026 | npm eniram-web-common-ui |
Malicious release: Malicious code in base-ui-vue3 (npm) GHSA-356f-2x7m-qhjf, MAL-2026-270 | Malicious | Not scored | 16 Jan, 2026 | npm base-ui-vue3 |
Malicious release: Malicious code in tailwind-merge-v3 (npm) GHSA-3679-84c2-v5xm, MAL-2026-316 | Malicious | Not scored | 16 Jan, 2026 | npm tailwind-merge-v3 |
Malicious release: Malicious code in styled-system-old (npm) GHSA-3cw5-pw8h-7898, MAL-2026-314 | Malicious | Not scored | 16 Jan, 2026 | npm styled-system-old |
Malicious release: Malicious code in victim-package-a (npm) GHSA-3m8q-mh4q-7gpp, MAL-2026-318 | Malicious | Not scored | 16 Jan, 2026 | npm victim-package-a |
Malicious release: Malicious code in js-observability (npm) GHSA-3rq2-4j48-hmc8, MAL-2026-289 | Malicious | Not scored | 16 Jan, 2026 | npm js-observability |
Malicious release: Malicious code in chakra-ui-2--react (npm) GHSA-43qp-8jjq-hf74, MAL-2026-272 | Malicious | Not scored | 16 Jan, 2026 | npm chakra-ui-2--react |
Malicious release: Malicious code in lusha-micro-app-messages (npm) GHSA-4wfw-629m-j5p5, MAL-2026-293 | Malicious | Not scored | 16 Jan, 2026 | npm lusha-micro-app-messages |
Malicious release: Malicious code in tailwind-merge-v2 (npm) GHSA-53q4-wj32-3vv9, MAL-2026-315 | Malicious | Not scored | 16 Jan, 2026 | npm tailwind-merge-v2 |
Malicious release: Malicious code in textual-sorter-lib (npm) GHSA-549c-jw4c-3272, MAL-2026-317 | Malicious | Not scored | 16 Jan, 2026 | npm textual-sorter-lib |
Malicious release: Malicious code in presentation-test-utilities (npm) GHSA-69rc-rc78-5qhg, MAL-2026-300 | Malicious | Not scored | 16 Jan, 2026 | npm presentation-test-utilities |
Malicious release: Malicious code in auc-2-lib (npm) GHSA-6vm3-3pq3-vx34, MAL-2026-269 | Malicious | Not scored | 16 Jan, 2026 | npm auc-2-lib |
Malicious release: Malicious code in sd-conversation-history-module-client (npm) GHSA-755j-r4m2-g4fm, MAL-2026-307 | Malicious | Not scored | 16 Jan, 2026 | npm sd-conversation-history-module-client |