EUVD-2026-118085

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects...

CVE-2026-123321

The JetBrains WebStorm IDE (versions prior to 2026.3 and 2026.2.3 ) is vulnerable to code execution when loading Grunt and Gulp tasks from untrusted projects . This vulnerability is caused by the inclusion of functionality from an untrusted control sphere (CWE-829 ). An attacker could potentially...

retire.js

Retire.js Retire Status What you require you must also retire There are a plethora of JavaScript libraries for use on the Web and in Node.JS apps out there. This greatly simplifies development, but we need to stay up-to-date on security fixes. "Using Components with Known Vulnerabilities" is now ...

Malicious code in library-petrology-grunt-sedna (npm)

The package library-petrology-grunt-sedna was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in kronos-grunt-sadr-event (npm)

Source: amazon-inspector a77e858e6d1a107decdeeaae11b5f3cac7d091cbd8cf3627ffeb3de7918adf8d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jwt-grunt-got-module (npm)

Source: amazon-inspector 69f92db31be8d8aacb71a303179e8998324068ab7cb29bfda9f025c82c1f1216 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jsonp-cross-env-terser-webpack-plugin-grunt (npm)

Source: amazon-inspector 06c1914fb248efd5238e86553ad01dcc8e761e3df13dc3ba91bea0927460f079 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Astra Linux – Vulnerability in Grunt

Path traversal in the GitHub repository gruntjs/grunt before version 1.5.2...

Astra Linux – Vulnerability in Grunt

The file.copy operations in GruntJS are vulnerable to a TOCTOU race condition, which can lead to arbitrary file writes in the GitHub repository gruntjs/grunt before version 1.5.3. This vulnerability allows for arbitrary file writes that can lead to local privilege escalation to the GruntJS user...

Malicious code in janus-grunt-gatsby-lynx (npm)

Source: amazon-inspector a924f0426ddf06b8ef2466546109dd481e0454ec09d04bba7947208e692a7a4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in impulse-holography-grunt-sequelize (npm)

Source: amazon-inspector c9c28c8183009a08a11188523afcf95bf4a90b317d6e72e29db3fb3800beef2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ig-grunt-release (npm)

--- Credit: OpenSSF source...

Malicious code in ig-grunt-file-list (npm)

--- Credit: OpenSSF source...

Malicious code in humanapi-grunt-tasks (npm)

The package humanapi-grunt-tasks was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in heka-relay-grunt-gammarayburst (npm)

Source: amazon-inspector 2a34c9f4c51f9fbb8b1a6af7224378de5173d0150c7a5c3399e7e8ddb1e5c9e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in halley-grunt-firebase-nebula (npm)

Source: amazon-inspector ec5e454e8b008901ff203e87ca9d360f5d4997b95763ed04d15c985c2691ac69 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in grunt-yonder-deimos-aether (npm)

Source: amazon-inspector 657c6e0b8ba9c37ed100526ce7ab1585a7dbf6b20cf7500fef47c4c6d1dd1625 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in grunt-zeptojs (npm)

The package grunt-zeptojs was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in grunt-promise-vuetify-middleware (npm)

Source: amazon-inspector 5b7391023fb97db27e60952bee597e73cca8d4958978321dea8fc85e8695ad64 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in grunt-sails-astro-rigel (npm)

Source: amazon-inspector 118a3909898666efc110e25978ce2c8ebec152db2edc41191d6cd9849fc4c0c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...