Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in bigpyx (PyPI) MAL-2025-192430 | Malicious | Not scored | 10 Dec, 2025 | PyPI bigpyx |
Malicious release: Malicious code in vue2-amis-custom-widget-pro (npm) GHSA-56x8-3f6p-7w9f, MAL-2025-192423 | Malicious | Not scored | 10 Dec, 2025 | npm vue2-amis-custom-widget-pro |
Malicious release: Malicious code in yunxohang3 (npm) GHSA-8h39-jmgp-jp79, MAL-2025-192429 | Malicious | Not scored | 10 Dec, 2025 | npm yunxohang3 |
Malicious release: Malicious code in yunxoahng2 (npm) GHSA-v4mq-xqfq-xcqj, MAL-2025-192428 | Malicious | Not scored | 10 Dec, 2025 | npm yunxoahng2 |
Malicious release: Malicious code in real-time-tweet-streamer (npm) GHSA-r69v-rwfw-jcv6, MAL-2025-192422, SNYK-JS-REALTIMETWEETSTREAMER-14287388 | Malicious | Not scored | 10 Dec, 2025 | npm real-time-tweet-streamer |
Malicious release: Malicious code in near-fast-auth-signer (npm) GHSA-49ww-28p9-h5ww, MAL-2025-192420 | Malicious | Not scored | 10 Dec, 2025 | npm near-fast-auth-signer |
Malicious release: Malicious code in vue2-amis-custom-widget123 (npm) MAL-2025-192421 | Malicious | Not scored | 10 Dec, 2025 | npm vue2-amis-custom-widget123 |
Malicious release: Malicious code in meteor-developer-oauth (npm) GHSA-22p4-hppx-hwrf, MAL-2025-192412 | Malicious | Not scored | 10 Dec, 2025 | npm meteor-developer-oauth |
Malicious release: Malicious code in facts-base (npm) GHSA-372w-hg58-49vx, MAL-2025-192410 | Malicious | Not scored | 10 Dec, 2025 | npm facts-base |
Malicious release: Malicious code in mongo-decimal (npm) GHSA-376f-q7pp-c9wj, MAL-2025-192414 | Malicious | Not scored | 10 Dec, 2025 | npm mongo-decimal |
Malicious release: Malicious code in ddp-common (npm) GHSA-ghw6-6h66-6c38, MAL-2025-192408 | Malicious | Not scored | 10 Dec, 2025 | npm ddp-common |
Malicious release: Malicious code in modules-runtime (npm) GHSA-gw2p-8mmc-wh8m, MAL-2025-192413 | Malicious | Not scored | 10 Dec, 2025 | npm modules-runtime |
Malicious release: Malicious code in allow-deny (npm) GHSA-hpgf-fg4w-q8p3, MAL-2025-192403 | Malicious | Not scored | 10 Dec, 2025 | npm allow-deny |
Malicious release: Malicious code in callback-hook (npm) GHSA-ppjg-6q9j-w45r, MAL-2025-192404 | Malicious | Not scored | 10 Dec, 2025 | npm callback-hook |
Malicious release: Malicious code in ecmascript-runtime-client (npm) GHSA-rp93-xhfx-74w2, MAL-2025-192409 | Malicious | Not scored | 10 Dec, 2025 | npm ecmascript-runtime-client |
Malicious release: Malicious code in pymongo (npm) GHSA-4gv4-3h86-8cpc, MAL-2025-192416 | Malicious | Not scored | 10 Dec, 2025 | npm pymongo |
Malicious release: Malicious code in fastavro (npm) GHSA-85hv-887w-rf37, MAL-2025-192411 | Malicious | Not scored | 10 Dec, 2025 | npm fastavro |
Malicious release: Malicious code in sfdc-abstract-legend (npm) GHSA-fmjv-78v6-3546, MAL-2025-192418 | Malicious | Not scored | 10 Dec, 2025 | npm sfdc-abstract-legend |
Malicious release: Malicious code in datadog-checks-dependency-provider (npm) GHSA-h53r-mc84-8rrv, MAL-2025-192406 | Malicious | Not scored | 10 Dec, 2025 | npm datadog-checks-dependency-provider |
Malicious release: Malicious code in wasm-bindgen (npm) GHSA-hjw6-26cg-2jvr, MAL-2025-192419 | Malicious | Not scored | 10 Dec, 2025 | npm wasm-bindgen |
Malicious release: Malicious code in datadog-checks-downloader (npm) GHSA-q8v3-9jxv-8cfv, MAL-2025-192407 | Malicious | Not scored | 10 Dec, 2025 | npm datadog-checks-downloader |
Malicious release: Malicious code in confluent-kafka (npm) GHSA-rvvf-gwxx-5hw5, MAL-2025-192405 | Malicious | Not scored | 10 Dec, 2025 | npm confluent-kafka |
Malicious release: Malicious code in rum-events-format (npm) GHSA-wxhj-h5c7-c92j, MAL-2025-192417, SNYK-JS-RUMEVENTSFORMAT-14287377 | Malicious | Not scored | 10 Dec, 2025 | npm rum-events-format |
Malicious release: Malicious code in portal-lim (npm) GHSA-2c7g-wjwx-45cr, MAL-2025-192415 | Malicious | Not scored | 10 Dec, 2025 | npm portal-lim |
Malicious release: Malicious code in database-mongoose-kit (npm) GHSA-3c76-cvvv-7wf5, MAL-2025-192398, SNYK-JS-DATABASEMONGOOSEKIT-14287384 | Malicious | Not scored | 10 Dec, 2025 | npm database-mongoose-kit |
Malicious release: Malicious code in @onlytoodles/crypto-jsa (npm) GHSA-8454-2xp4-m86m, MAL-2025-192397 | Malicious | Not scored | 10 Dec, 2025 | npm @onlytoodles/crypto-jsa |
Malicious release: Malicious code in wartsila-text-csv (npm) GHSA-vvf9-w333-7h9q, MAL-2025-192402, SNYK-JS-WARTSILATEXTCSV-14287379 | Malicious | Not scored | 10 Dec, 2025 | npm wartsila-text-csv |
Malicious release: Malicious code in serval-integrations-common-frontend (npm) GHSA-3j9j-c9rg-f95f, MAL-2025-192401, SNYK-JS-SERVALINTEGRATIONSCOMMONFRONTEND-14287374 | Malicious | Not scored | 10 Dec, 2025 | npm serval-integrations-common-frontend |
Malicious release: Malicious code in node-calculator-0d96 (npm) GHSA-mh7x-j32p-xwvh, MAL-2025-192400, SNYK-JS-NODECALCULATOR0D96-14287386 | Malicious | Not scored | 10 Dec, 2025 | npm node-calculator-0d96 |
Malicious release: Malicious code in malicius-pdf (npm) GHSA-w3m5-47q7-h8m4, MAL-2025-192399 | Malicious | Not scored | 10 Dec, 2025 | npm malicius-pdf |
Malicious release: Malicious code in libxmlrussia (npm) MAL-2025-192395 | Malicious | Not scored | 09 Dec, 2025 | npm libxmlrussia |
Malicious release: Malicious code in helloharry123c (PyPI) MAL-2025-192396 | Malicious | Not scored | 09 Dec, 2025 | PyPI helloharry123c |
Malicious release: Malicious code in libxmlussr2 (npm) MAL-2025-192394 | Malicious | Not scored | 09 Dec, 2025 | npm libxmlussr2 |
Malicious release: Malicious code in libxmlussr1 (npm) MAL-2025-192427 | Malicious | Not scored | 09 Dec, 2025 | npm libxmlussr1 |
Malicious release: Malicious code in ctosec-appsec-wb-xray-adapter (PyPI) MAL-2025-192393 | Malicious | Not scored | 09 Dec, 2025 | PyPI ctosec-appsec-wb-xray-adapter |
Malicious release: Malicious code in ajenti-plugin-testing-pyld (PyPI) MAL-2025-192392 | Malicious | Not scored | 09 Dec, 2025 | PyPI ajenti-plugin-testing-pyld |
Malicious release: Malicious code in libxmljsololo2 (npm) MAL-2025-192426 | Malicious | Not scored | 09 Dec, 2025 | npm libxmljsololo2 |
Malicious release: Malicious code in bignum (PyPI) MAL-2025-192391 | Malicious | Not scored | 09 Dec, 2025 | PyPI bignum |
Malicious release: Malicious code in libxmljs2woter (npm) GHSA-h63c-r25g-p7rw, MAL-2025-192390 | Malicious | Not scored | 09 Dec, 2025 | npm libxmljs2woter |
Malicious release: Malicious code in libxmljs2qwerty (npm) MAL-2025-192389 | Malicious | Not scored | 09 Dec, 2025 | npm libxmljs2qwerty |
Malicious release: Malicious code in libxmlfinal2 (npm) MAL-2025-192425 | Malicious | Not scored | 09 Dec, 2025 | npm libxmlfinal2 |
Malicious release: Malicious code in libxmljs2varaboba (npm) MAL-2025-192388 | Malicious | Not scored | 09 Dec, 2025 | npm libxmljs2varaboba |
Malicious release: Malicious code in baidu-oscp (npm) MAL-2025-192424 | Malicious | Not scored | 09 Dec, 2025 | npm baidu-oscp |
Malicious release: Malicious code in do-not-install-this-package-001 (PyPI) MAL-2025-192387 | Malicious | Not scored | 09 Dec, 2025 | PyPI do-not-install-this-package-001 |
Malicious release: Malicious code in telcoo (PyPI) MAL-2025-192386 | Malicious | Not scored | 09 Dec, 2025 | PyPI telcoo |
Malicious release: Malicious code in graphsync (PyPI) MAL-2025-192385 | Malicious | Not scored | 09 Dec, 2025 | PyPI graphsync |
Malicious release: Malicious code in jsonify-errors (npm) GHSA-4hp4-98m6-767r, MAL-2025-192384, SNYK-JS-JSONIFYERRORS-14235579 | Malicious | Not scored | 09 Dec, 2025 | npm jsonify-errors |
Malicious release: Malicious code in chai-uuids (npm) GHSA-9gvh-rg3c-5gr6, MAL-2025-192383, SNYK-JS-CHAIUUIDS-14235578 | Malicious | Not scored | 09 Dec, 2025 | npm chai-uuids |
Malicious release: Malicious code in raft-dask (PyPI) MAL-2025-192382 | Malicious | Not scored | 09 Dec, 2025 | PyPI raft-dask |
Malicious release: Malicious code in configurator-framework (npm) GHSA-wq4m-xvmv-ch8w, MAL-2025-192381 | Malicious | Not scored | 09 Dec, 2025 | npm configurator-framework |