961 matches found
postcss: PostCSS: Information disclosure via crafted sourceMappingURL
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...
Malicious code in post-css-transfer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f62ccc235772a34a28d870f349489698c167e3d636a196f310fe24c1ce1d4ef4 post-css-transfer is a typosquat of postcss whose main entry lib/postcss.js has an obfuscated IIFE appended after the legitimate module code. On...
MAL-2026-12417 Malicious code in post-css-transfer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f62ccc235772a34a28d870f349489698c167e3d636a196f310fe24c1ce1d4ef4 post-css-transfer is a typosquat of postcss whose main entry lib/postcss.js has an obfuscated IIFE appended after the legitimate module code. On...
Malicious code in postcss-animate-css-vars (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e40aa4b6595789e4ba4b39f82e63526286b36a64ffad2be27536c69c8207590 src/normalize-options.js is heavily obfuscated RC4-decoded string array, hex-numeric literals, rotating string-array shuffler, dead-code comparison...
MAL-2026-12418 Malicious code in postcss-animate-css-vars (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e40aa4b6595789e4ba4b39f82e63526286b36a64ffad2be27536c69c8207590 src/normalize-options.js is heavily obfuscated RC4-decoded string array, hex-numeric literals, rotating string-array shuffler, dead-code comparison...
postcss: PostCSS: Information disclosure via crafted sourceMappingURL
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...
postcss: PostCSS: Information disclosure via path traversal in source map auto-loading
A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted sourceMappingURL values in untrusted CSS files. This allows the attacker to disclose sensitive sourcesContent from arbitrary .map files accessible on the system, leading to informati...
postcss: PostCSS: Information disclosure via crafted sourceMappingURL
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...
MAL-2026-11622 Malicious code in @onereach/postcss-scoped-selector (npm)
npm/@onereach/postcss-scoped-selector is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...
Malicious code in @ornikar/postcss-config (npm)
npm/@ornikar/postcss-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
CLSA-2026-1785291205 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 7.0.39-tuxcare.4...
CLSA-2026-1785204576 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.5-tuxcare.2...
CLSA-2026-1785204444 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.2.13-tuxcare.1...
CLSA-2026-1785117457 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.3.6-tuxcare.3...
CLSA-2026-1784943201 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.31-tuxcare.2...
CLSA-2026-1784943315 TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.4.14-tuxcare.3...
CLSA-2026-1785117465 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.2.15-tuxcare.2...
CLSA-2026-1784856189 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.5.6-tuxcare.2...