Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in openai-pr-reviewer (npm) GHSA-wpv4-wxrh-hvmh, MAL-2026-14434 | Malicious | Not scored | 24 Aug, 2026 | npm openai-pr-reviewer |
Malicious release: Malicious code in consumerweb-serverutils (npm) MAL-2026-14428 | Malicious | Not scored | 24 Aug, 2026 | npm consumerweb-serverutils |
Malicious release: Malicious code in babel-polyfill-plugin-corejs2 (npm) GHSA-9g6r-83hw-6cq2, MAL-2026-14426 | Malicious | Not scored | 24 Aug, 2026 | npm babel-polyfill-plugin-corejs2 |
Malicious release: Malicious code in poly-price-node (npm) MAL-2026-14436 | Malicious | Not scored | 24 Aug, 2026 | npm poly-price-node |
Malicious release: Malicious code in auth-otp (npm) MAL-2026-14425 | Malicious | Not scored | 24 Aug, 2026 | npm auth-otp |
Malicious release: Malicious code in remove-bg-serverless-azure (npm) GHSA-65rf-pp5h-8fw9, MAL-2026-14438 | Malicious | Not scored | 24 Aug, 2026 | npm remove-bg-serverless-azure |
Malicious release: Malicious code in dim-hydration-ui (npm) GHSA-6797-g855-4767, MAL-2026-14429 | Malicious | Not scored | 24 Aug, 2026 | npm dim-hydration-ui |
Malicious release: Malicious code in secret-key-totp (npm) MAL-2026-14439 | Malicious | Not scored | 24 Aug, 2026 | npm secret-key-totp |
Malicious release: Malicious code in paypal-business-sdk (npm) MAL-2026-14435 | Malicious | Not scored | 24 Aug, 2026 | npm paypal-business-sdk |
Malicious release: Malicious code in manticore-log (npm) MAL-2026-14433 | Malicious | Not scored | 24 Aug, 2026 | npm manticore-log |
Malicious release: Malicious code in ppb-manticore (npm) MAL-2026-14437 | Malicious | Not scored | 24 Aug, 2026 | npm ppb-manticore |
Malicious release: Malicious code in @gsas/gsas-sdk (npm) MAL-2026-14420 | Malicious | Not scored | 24 Aug, 2026 | npm @gsas/gsas-sdk |
Malicious release: Malicious code in web-advertising (npm) MAL-2026-14440 | Malicious | Not scored | 24 Aug, 2026 | npm web-advertising |
Malicious release: Malicious code in @yuva2210/htx-poc-skills-rce (npm) MAL-2026-15686 | Malicious | Not scored | 24 Aug, 2026 | npm @yuva2210/htx-poc-skills-rce |
Malicious release: Malicious code in @yuva2210/okx-poc-rce-impact (npm) MAL-2026-15687 | Malicious | Not scored | 24 Aug, 2026 | npm @yuva2210/okx-poc-rce-impact |
Malicious release: Malicious code in @x-team/strapi (npm) MAL-2026-15685 | Malicious | Not scored | 24 Aug, 2026 | npm @x-team/strapi |
Malicious release: Malicious code in hydration-ui-dim (npm) GHSA-79qw-ww45-gpfp, MAL-2026-14431 | Malicious | Not scored | 24 Aug, 2026 | npm hydration-ui-dim |
Malicious release: Malicious code in svelte-ui-dim (npm) GHSA-qvqg-96qf-37vw, MAL-2026-14442 | Malicious | Not scored | 24 Aug, 2026 | npm svelte-ui-dim |
Malicious release: Malicious code in svelte-dim-ui (npm) GHSA-x8x3-xwj6-73vv, MAL-2026-14441 | Malicious | Not scored | 24 Aug, 2026 | npm svelte-dim-ui |
Malicious release: Malicious code in hydration-dim-ui (npm) GHSA-xf2r-j86w-6c3x, MAL-2026-14430 | Malicious | Not scored | 24 Aug, 2026 | npm hydration-dim-ui |
Malicious release: Malicious code in @pimy-b2cweb/common (npm) MAL-2026-15684 | Malicious | Not scored | 24 Aug, 2026 | npm @pimy-b2cweb/common |
Malicious release: Malicious code in @pimy-b2cweb/apiclient-common (npm) MAL-2026-15683 | Malicious | Not scored | 24 Aug, 2026 | npm @pimy-b2cweb/apiclient-common |
Malicious release: Malicious code in @ice-trade-components/common (npm) MAL-2026-15682 | Malicious | Not scored | 24 Aug, 2026 | npm @ice-trade-components/common |
Malicious release: Malicious code in @grab-food/order-sdk-web (npm) MAL-2026-15681 | Malicious | Not scored | 24 Aug, 2026 | npm @grab-food/order-sdk-web |
Malicious release: Malicious code in @cawraytestorg/packagetest2 (npm) MAL-2026-15680 | Malicious | Not scored | 24 Aug, 2026 | npm @cawraytestorg/packagetest2 |
Malicious release: Malicious code in @bpa-internal/bpa-utils (npm) MAL-2026-15679 | Malicious | Not scored | 24 Aug, 2026 | npm @bpa-internal/bpa-utils |
Malicious release: Malicious code in @bpa-internal/bpa-common (npm) MAL-2026-15677 | Malicious | Not scored | 24 Aug, 2026 | npm @bpa-internal/bpa-common |
Malicious release: Malicious code in @bpa-internal/bpa-types (npm) MAL-2026-15678 | Malicious | Not scored | 24 Aug, 2026 | npm @bpa-internal/bpa-types |
Malicious release: Malicious code in @bpa-internal/bpa-auth (npm) MAL-2026-15676 | Malicious | Not scored | 24 Aug, 2026 | npm @bpa-internal/bpa-auth |
Malicious release: Malicious code in @b2b-frontend/store (npm) MAL-2026-15675 | Malicious | Not scored | 24 Aug, 2026 | npm @b2b-frontend/store |
Malicious release: Malicious code in py-devoli-common (PyPI) MAL-2026-15693 | Malicious | Not scored | 24 Aug, 2026 | PyPI py-devoli-common |
Malicious release: Malicious code in dotish (npm) GHSA-5xvx-37p2-x7j9, MAL-2026-14418 | Malicious | Not scored | 24 Aug, 2026 | npm dotish |
Malicious release: Malicious code in dims-svelte-ui (npm) GHSA-3jcp-rjh9-wq99, MAL-2026-14417 | Malicious | Not scored | 24 Aug, 2026 | npm dims-svelte-ui |
Malicious release: Malicious code in dims-hydration-ui (npm) GHSA-5hwv-w72c-55qw, MAL-2026-14416 | Malicious | Not scored | 24 Aug, 2026 | npm dims-hydration-ui |
Malicious release: Malicious code in tkyoussef-hb (npm) GHSA-g95w-qwf7-2h4p, MAL-2026-14419 | Malicious | Not scored | 24 Aug, 2026 | npm tkyoussef-hb |
Malicious release: Malicious code in @elc-online/up-analytics (npm) MAL-2026-14443 | Malicious | Not scored | 24 Aug, 2026 | npm @elc-online/up-analytics |
Malicious release: Malicious code in react-dynamic-parser (npm) GHSA-r8wh-m45c-f35g, MAL-2026-14415 | Malicious | Not scored | 24 Aug, 2026 | npm react-dynamic-parser |
Malicious release: Malicious code in livemcp (npm) GHSA-rxwc-v5gg-9hhw, MAL-2026-14413 | Malicious | Not scored | 24 Aug, 2026 | npm livemcp |
Malicious release: Malicious code in mcp-real-chrome (npm) GHSA-vqm6-238c-g856, MAL-2026-14414 | Malicious | Not scored | 24 Aug, 2026 | npm mcp-real-chrome |
Malicious release: Malicious code in @deepaksilaych/sess (npm) GHSA-wxfm-64xv-2h3m, MAL-2026-14412 | Malicious | Not scored | 24 Aug, 2026 | npm @deepaksilaych/sess |
Malicious release: Malicious code in @medisend/webview-bridge (npm) GHSA-j743-3xjm-x63m, MAL-2026-14424 | Malicious | Not scored | 24 Aug, 2026 | npm @medisend/webview-bridge |
Malicious release: Malicious code in dpg-media-7ehemel (npm) MAL-2026-14411 | Malicious | Not scored | 24 Aug, 2026 | npm dpg-media-7ehemel |
Malicious release: Malicious code in msrcpoc (PyPI) MAL-2026-14444 | Malicious | Not scored | 24 Aug, 2026 | PyPI msrcpoc |
Malicious release: Malicious code in @temptation.js/utils (npm) MAL-2026-14410 | Malicious | Not scored | 24 Aug, 2026 | npm @temptation.js/utils |
Malicious release: Malicious code in dext-crate-video (npm) GHSA-299m-84fp-94p9, MAL-2026-14408 | Malicious | Not scored | 24 Aug, 2026 | npm dext-crate-video |
Malicious release: Malicious code in dext-crate-check (npm) GHSA-9m4w-p72c-cqwq, MAL-2026-14406 | Malicious | Not scored | 24 Aug, 2026 | npm dext-crate-check |
Malicious release: Malicious code in create-json-client (npm) GHSA-9m88-8qj5-73j8, MAL-2026-14405 | Malicious | Not scored | 24 Aug, 2026 | npm create-json-client |
Malicious release: Malicious code in dext-crate-image (npm) GHSA-mj2f-654h-x283, MAL-2026-14407 | Malicious | Not scored | 24 Aug, 2026 | npm dext-crate-image |
Malicious release: Malicious code in polis-diraja (npm) GHSA-6rrq-x6hp-4xcm, MAL-2026-14409 | Malicious | Not scored | 24 Aug, 2026 | npm polis-diraja |
Malicious release: Malicious code in @blurrydespair/libsignal-node (npm) GHSA-rw8r-gxqp-rwfh, MAL-2026-14404 | Malicious | Not scored | 24 Aug, 2026 | npm @blurrydespair/libsignal-node |