Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in legendevil1 (PyPI) MAL-2026-256 | Malicious | Not scored | 14 Jan, 2026 | PyPI legendevil1 |
Malicious release: Malicious code in hairest (PyPI) MAL-2026-254 | Malicious | Not scored | 14 Jan, 2026 | PyPI hairest |
Malicious release: Malicious code in webmd-page-common (npm) GHSA-j3m8-jhfm-w3qc, MAL-2026-258 | Malicious | Not scored | 14 Jan, 2026 | npm webmd-page-common |
Malicious release: Malicious code in clipcord (PyPI) MAL-2026-253 | Malicious | Not scored | 14 Jan, 2026 | PyPI clipcord |
Malicious release: Malicious code in solana-program (PyPI) MAL-2026-252 | Malicious | Not scored | 14 Jan, 2026 | PyPI solana-program |
Malicious release: Malicious code in soupclaw (PyPI) MAL-2026-251 | Malicious | Not scored | 14 Jan, 2026 | PyPI soupclaw |
Malicious release: Malicious code in silvermine (npm) GHSA-g37j-jvxp-qrjv, MAL-2026-257 | Malicious | Not scored | 14 Jan, 2026 | npm silvermine |
Malicious release: Malicious code in transitive-req (PyPI) MAL-2026-250 | Malicious | Not scored | 14 Jan, 2026 | PyPI transitive-req |
Malicious release: Malicious code in ts-tweetnacl (npm) GHSA-vj23-9g2p-fvww, MAL-2026-247 | Malicious | Not scored | 13 Jan, 2026 | npm ts-tweetnacl |
Malicious release: Malicious code in admin1001 (npm) GHSA-j48w-xpqc-jv3w, MAL-2026-246 | Malicious | Not scored | 13 Jan, 2026 | npm admin1001 |
Malicious release: Malicious code in dify-api (PyPI) MAL-2026-248 | Malicious | Not scored | 13 Jan, 2026 | PyPI dify-api |
Malicious release: Malicious code in @flipster/utils (npm) GHSA-6r97-q2pc-v98m, MAL-2026-249 | Malicious | Not scored | 13 Jan, 2026 | npm @flipster/utils |
Malicious release: Malicious code in cnamts-captcha-component (npm) GHSA-p55f-fh32-33wx, MAL-2026-245 | Malicious | Not scored | 13 Jan, 2026 | npm cnamts-captcha-component |
Malicious release: Malicious code in helium-module (npm) GHSA-v72c-68qv-fq35, MAL-2026-244 | Malicious | Not scored | 13 Jan, 2026 | npm helium-module |
Malicious release: Malicious code in francium-utils (npm) GHSA-45m3-pf6h-c243, MAL-2026-242 | Malicious | Not scored | 13 Jan, 2026 | npm francium-utils |
Malicious release: Malicious code in francium-ui (npm) GHSA-4x69-gp4j-mpm5, MAL-2026-241 | Malicious | Not scored | 13 Jan, 2026 | npm francium-ui |
Malicious release: Malicious code in francium-web-visitors (npm) GHSA-5c69-2ppp-w4fv, MAL-2026-243 | Malicious | Not scored | 13 Jan, 2026 | npm francium-web-visitors |
Malicious release: Malicious code in extended-path (npm) GHSA-3j82-vrp8-g357, MAL-2026-240 | Malicious | Not scored | 13 Jan, 2026 | npm extended-path |
Malicious release: Malicious code in chai-as-enhanced (npm) GHSA-5572-pgc4-7mjf, MAL-2026-239 | Malicious | Not scored | 13 Jan, 2026 | npm chai-as-enhanced |
Malicious release: Malicious code in paytmsiddlewaree (npm) GHSA-w8jh-cww6-w5qq, MAL-2026-238 | Malicious | Not scored | 13 Jan, 2026 | npm paytmsiddlewaree |
Malicious release: Malicious code in formater (PyPI) MAL-2026-237 | Malicious | Not scored | 12 Jan, 2026 | PyPI formater |
Malicious release: Malicious code in graponater (PyPI) MAL-2026-236 | Malicious | Not scored | 12 Jan, 2026 | PyPI graponater |
Malicious release: Malicious code in tailwindcss-animate-tool (npm) GHSA-p7pp-v2qj-hwpq, MAL-2026-235 | Malicious | Not scored | 12 Jan, 2026 | npm tailwindcss-animate-tool |
Malicious release: Malicious code in express-sessions-id (npm) GHSA-fj4q-29wj-89xc, MAL-2026-218 | Malicious | Not scored | 12 Jan, 2026 | npm express-sessions-id |
Malicious release: Malicious code in cors-base (npm) GHSA-r6wm-7hr4-f9mh, MAL-2026-216 | Malicious | Not scored | 12 Jan, 2026 | npm cors-base |
Malicious release: Malicious code in simple-string-utils3 (npm) GHSA-25cq-qhpp-pxcx, MAL-2026-233 | Malicious | Not scored | 12 Jan, 2026 | npm simple-string-utils3 |
Malicious release: Malicious code in passport-google-auth-token (npm) GHSA-cj6c-5gcc-8xr5, MAL-2026-230 | Malicious | Not scored | 12 Jan, 2026 | npm passport-google-auth-token |
Malicious release: Malicious code in @maxcointech/simple-string-utils (npm) GHSA-rj99-vmg6-c6f8, MAL-2026-213 | Malicious | Not scored | 12 Jan, 2026 | npm @maxcointech/simple-string-utils |
Malicious release: Malicious code in jz-test-npm (npm) GHSA-xxv7-j7jp-phx8, MAL-2026-226 | Malicious | Not scored | 12 Jan, 2026 | npm jz-test-npm |
Malicious release: Malicious code in framer-motion-js (npm) GHSA-38xp-pcxg-58xm, MAL-2026-220 | Malicious | Not scored | 12 Jan, 2026 | npm framer-motion-js |
Malicious release: Malicious code in inquirer-js (npm) GHSA-3922-g725-hr6c, MAL-2026-224 | Malicious | Not scored | 12 Jan, 2026 | npm inquirer-js |
Malicious release: Malicious code in jsdom-js (npm) GHSA-3pxr-wwfp-6g73, MAL-2026-225 | Malicious | Not scored | 12 Jan, 2026 | npm jsdom-js |
Malicious release: Malicious code in immer-js (npm) GHSA-p865-gwfh-48x2, MAL-2026-223 | Malicious | Not scored | 12 Jan, 2026 | npm immer-js |
Malicious release: Malicious code in luxon-js (npm) GHSA-phgx-7qqx-fxcj, MAL-2026-228 | Malicious | Not scored | 12 Jan, 2026 | npm luxon-js |
Malicious release: Malicious code in react-hook-form-js (npm) GHSA-xgrq-mjjc-672q, MAL-2026-232 | Malicious | Not scored | 12 Jan, 2026 | npm react-hook-form-js |
Malicious release: Malicious code in huggingface-js (npm) GHSA-5fpx-j295-mggf, MAL-2026-222 | Malicious | Not scored | 12 Jan, 2026 | npm huggingface-js |
Malicious release: Malicious code in llamaindex-js (npm) GHSA-675f-h4p7-2vp4, MAL-2026-227 | Malicious | Not scored | 12 Jan, 2026 | npm llamaindex-js |
Malicious release: Malicious code in milvus-js (npm) GHSA-j947-h9rh-h2jr, MAL-2026-229 | Malicious | Not scored | 12 Jan, 2026 | npm milvus-js |
Malicious release: Malicious code in pinecone-js (npm) GHSA-vrwr-h8hh-fj7r, MAL-2026-231 | Malicious | Not scored | 12 Jan, 2026 | npm pinecone-js |
Malicious release: Malicious code in xml2js-js (npm) GHSA-3j4r-78pf-4g5h, MAL-2026-234 | Malicious | Not scored | 12 Jan, 2026 | npm xml2js-js |
Malicious release: Malicious code in auth-types (npm) GHSA-5484-6hqr-7386, MAL-2026-215 | Malicious | Not scored | 12 Jan, 2026 | npm auth-types |
Malicious release: Malicious code in analytics-browser (npm) GHSA-67vh-wg5g-567j, MAL-2026-214 | Malicious | Not scored | 12 Jan, 2026 | npm analytics-browser |
Malicious release: Malicious code in firestore-types (npm) GHSA-757j-rhvg-2fh2, MAL-2026-219 | Malicious | Not scored | 12 Jan, 2026 | npm firestore-types |
Malicious release: Malicious code in experimental-utils (npm) GHSA-pg6r-j522-h6w7, MAL-2026-217 | Malicious | Not scored | 12 Jan, 2026 | npm experimental-utils |
Malicious release: Malicious code in gradle-plugin (npm) GHSA-q63w-ghjp-qx4j, MAL-2026-221 | Malicious | Not scored | 12 Jan, 2026 | npm gradle-plugin |
Malicious release: Malicious code in @workleap-ai/shared (npm) GHSA-3594-6cm3-gmrr, MAL-2026-210 | Malicious | Not scored | 12 Jan, 2026 | npm @workleap-ai/shared |
Malicious release: Malicious code in @workleap-widgets/client (npm) GHSA-55gm-94x9-jg2r, MAL-2026-211 | Malicious | Not scored | 12 Jan, 2026 | npm @workleap-widgets/client |
Malicious release: Malicious code in lyonscg (npm) GHSA-p8xh-97x2-qrcm, MAL-2026-212 | Malicious | Not scored | 12 Jan, 2026 | npm lyonscg |
Malicious release: Malicious code in @t4i-cms-components/contact-card (npm) GHSA-r269-vxj8-7hg5, MAL-2026-209 | Malicious | Not scored | 12 Jan, 2026 | npm @t4i-cms-components/contact-card |
Malicious release: Malicious code in @gwp-gtmt-components/event-listener (npm) GHSA-x4fv-rfjv-fmxg, MAL-2026-208 | Malicious | Not scored | 12 Jan, 2026 | npm @gwp-gtmt-components/event-listener |