Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @gfe/lx-watcher (npm) GHSA-wg37-hw83-hqwf, MAL-2026-14353 | Malicious | Not scored | 21 Aug, 2026 | npm @gfe/lx-watcher |
Malicious release: Malicious code in totp-utils (npm) GHSA-m72r-95xc-q6g8, MAL-2026-14379 | Malicious | Not scored | 21 Aug, 2026 | npm totp-utils |
Malicious release: Malicious code in tailwind-animate-css-plugin (npm) GHSA-5w98-j73p-rv7m, MAL-2026-14352 | Malicious | Not scored | 21 Aug, 2026 | npm tailwind-animate-css-plugin |
Malicious release: Malicious code in requests-crypt (PyPI) MAL-2026-14351 | Malicious | Not scored | 21 Aug, 2026 | PyPI requests-crypt |
Malicious release: Malicious code in scrambleeer (PyPI) MAL-2026-14350 | Malicious | Not scored | 21 Aug, 2026 | PyPI scrambleeer |
Malicious release: Malicious code in boto4 (PyPI) MAL-2026-14349 | Malicious | Not scored | 21 Aug, 2026 | PyPI boto4 |
Malicious release: Malicious code in @next-fonts/font (npm) MAL-2026-14346 | Malicious | Not scored | 21 Aug, 2026 | npm @next-fonts/font |
Malicious release: Malicious code in mcq-session (npm) MAL-2026-14347 | Malicious | Not scored | 21 Aug, 2026 | npm mcq-session |
Malicious release: Malicious code in moidevy (npm) MAL-2026-14348 | Malicious | Not scored | 21 Aug, 2026 | npm moidevy |
Malicious release: Malicious code in express-session-handler (npm) MAL-2026-14345 | Malicious | Not scored | 21 Aug, 2026 | npm express-session-handler |
Malicious release: Malicious code in @js-lib-team/env-parser (npm) MAL-2026-14344 | Malicious | Not scored | 21 Aug, 2026 | npm @js-lib-team/env-parser |
Malicious release: Malicious code in chai-as-soul (npm) MAL-2026-14343 | Malicious | Not scored | 21 Aug, 2026 | npm chai-as-soul |
Malicious release: Malicious code in coin-fees (npm) MAL-2026-14342 | Malicious | Not scored | 21 Aug, 2026 | npm coin-fees |
Malicious release: Malicious code in reqcrypts (PyPI) MAL-2026-14341 | Malicious | Not scored | 21 Aug, 2026 | PyPI reqcrypts |
Malicious release: Malicious code in exam-kit (npm) GHSA-3g8c-37c3-75vv, MAL-2026-14331 | Malicious | Not scored | 20 Aug, 2026 | npm exam-kit |
Malicious release: Malicious code in @pablo_clueless/sniffr (npm) GHSA-2gvc-mrh5-885x, MAL-2026-14330 | Malicious | Not scored | 20 Aug, 2026 | npm @pablo_clueless/sniffr |
Malicious release: Malicious code in @pablo_clueless/printr (npm) GHSA-3jxq-xch2-6hpm, MAL-2026-14329 | Malicious | Not scored | 20 Aug, 2026 | npm @pablo_clueless/printr |
Malicious release: Malicious code in ethereum-validator (npm) GHSA-f4c6-m557-c5qf, MAL-2026-14327 | Malicious | Not scored | 20 Aug, 2026 | npm ethereum-validator |
Malicious release: Malicious code in goldstar-api-server (npm) GHSA-w5wj-pp55-835w, MAL-2026-14328 | Malicious | Not scored | 20 Aug, 2026 | npm goldstar-api-server |
Malicious release: Malicious code in create-react-app-text (npm) GHSA-9324-2pfx-4w9r, MAL-2026-14324 | Malicious | Not scored | 20 Aug, 2026 | npm create-react-app-text |
Malicious release: Malicious code in create-react-app-ui (npm) GHSA-qvrq-vg6m-5cr8, MAL-2026-14325 | Malicious | Not scored | 20 Aug, 2026 | npm create-react-app-ui |
Malicious release: Malicious code in create-react-app-ux (npm) GHSA-rxpg-3mx3-fwqm, MAL-2026-14326 | Malicious | Not scored | 20 Aug, 2026 | npm create-react-app-ux |
Malicious release: Malicious code in cig-data-patcher (npm) GHSA-wvvc-v5v3-7mcx, MAL-2026-14323 | Malicious | Not scored | 20 Aug, 2026 | npm cig-data-patcher |
Malicious release: Malicious code in debug-fnt (npm) GHSA-qpp9-fwpx-39f8, MAL-2026-14322 | Malicious | Not scored | 20 Aug, 2026 | npm debug-fnt |
Malicious release: Malicious code in test-flow-entire6 (npm) GHSA-34c9-jfcv-757f, MAL-2026-14320 | Malicious | Not scored | 20 Aug, 2026 | npm test-flow-entire6 |
Malicious release: Malicious code in test-flow-1 (npm) GHSA-4cwc-wpx2-j752, MAL-2026-14319 | Malicious | Not scored | 20 Aug, 2026 | npm test-flow-1 |
Malicious release: Malicious code in test-flow-entire7 (npm) GHSA-c7wg-wr5p-3pw9, MAL-2026-14321 | Malicious | Not scored | 20 Aug, 2026 | npm test-flow-entire7 |
Malicious release: Malicious code in frenchworldcupwin (npm) GHSA-hp4f-wg89-v3fg, MAL-2026-14318 | Malicious | Not scored | 20 Aug, 2026 | npm frenchworldcupwin |
Malicious release: Malicious code in fetch-webjs-script (npm) GHSA-qpx8-cvmq-8jh7, MAL-2026-14317 | Malicious | Not scored | 20 Aug, 2026 | npm fetch-webjs-script |
Malicious release: Malicious code in @httttt/mcp-demo (npm) GHSA-phcp-xhhf-xcvq, MAL-2026-14315 | Malicious | Not scored | 20 Aug, 2026 | npm @httttt/mcp-demo |
Malicious release: Malicious code in expect-dotenv (npm) GHSA-h7q6-7chv-cgh2, MAL-2026-14316 | Malicious | Not scored | 20 Aug, 2026 | npm expect-dotenv |
Malicious release: Malicious code in libasync (PyPI) MAL-2026-14308 | Malicious | Not scored | 19 Aug, 2026 | PyPI libasync |
Malicious release: Malicious code in express-route-engine (npm) MAL-2026-14307 | Malicious | Not scored | 19 Aug, 2026 | npm express-route-engine |
Malicious release: Malicious code in rc4-secure (PyPI) MAL-2026-14306 | Malicious | Not scored | 19 Aug, 2026 | PyPI rc4-secure |
Malicious release: Malicious code in mc-provider (npm) GHSA-8r2v-hr8v-g7hw, MAL-2026-14305 | Malicious | Not scored | 19 Aug, 2026 | npm mc-provider |
Malicious release: Malicious code in base99-85x (npm) MAL-2026-14304 | Malicious | Not scored | 19 Aug, 2026 | npm base99-85x |
Malicious release: Malicious code in x6842179305 (npm) MAL-2026-14303 | Malicious | Not scored | 19 Aug, 2026 | npm x6842179305 |
Malicious release: Malicious code in ai-texts-utils (npm) GHSA-3p3q-38q9-rr37, MAL-2026-14302 | Malicious | Not scored | 19 Aug, 2026 | npm ai-texts-utils |
Malicious release: Malicious code in node-runtime-utils (npm) GHSA-c436-rrhg-m984, MAL-2026-14313 | Malicious | Not scored | 19 Aug, 2026 | npm node-runtime-utils |
Malicious release: Malicious code in webpack-cdn-fetcher (npm) GHSA-gjvp-mjhq-rfwc, MAL-2026-14314 | Malicious | Not scored | 19 Aug, 2026 | npm webpack-cdn-fetcher |
Malicious release: Malicious code in eslint-config-consumerweb (npm) GHSA-2pxg-969f-jc3q, MAL-2026-14311 | Malicious | Not scored | 19 Aug, 2026 | npm eslint-config-consumerweb |
Malicious release: Malicious code in griffin-transliterator (npm) GHSA-4hcm-p7x4-q9h9, MAL-2026-14312 | Malicious | Not scored | 19 Aug, 2026 | npm griffin-transliterator |
Malicious release: Malicious code in bunnyhijack-test-0x00 (npm) GHSA-8x5v-wf85-xhj5, MAL-2026-14310 | Malicious | Not scored | 19 Aug, 2026 | npm bunnyhijack-test-0x00 |
Malicious release: Malicious code in @idanefraim/my-ui-kit (npm) GHSA-hwmr-jv5f-67q9, MAL-2026-14309 | Malicious | Not scored | 19 Aug, 2026 | npm @idanefraim/my-ui-kit |
Malicious release: Malicious code in evm-validation (npm) GHSA-gvxq-2rq2-f7x6, MAL-2026-14301 | Malicious | Not scored | 19 Aug, 2026 | npm evm-validation |
Malicious release: Malicious code in eth-react-provider (npm) GHSA-rr86-r66c-qc54, MAL-2026-14300 | Malicious | Not scored | 19 Aug, 2026 | npm eth-react-provider |
Malicious release: Malicious code in emoji-prints-fancy (npm) GHSA-m523-mggx-3fgr, MAL-2026-14298 | Malicious | Not scored | 19 Aug, 2026 | npm emoji-prints-fancy |
Malicious release: Malicious code in gear-composer (npm) MAL-2026-14299 | Malicious | Not scored | 19 Aug, 2026 | npm gear-composer |
Malicious release: Malicious code in gfff5 (npm) MAL-2026-14296 | Malicious | Not scored | 19 Aug, 2026 | npm gfff5 |
Malicious release: Malicious code in homekit-mcp (npm) MAL-2026-14297 | Malicious | Not scored | 19 Aug, 2026 | npm homekit-mcp |