PT-2026-3410

Summary Since 2017, the default webpack plugins have passed the entire process.env to EnvironmentPlugin. This pattern exposed ALL build environment variables to client-side JavaScript bundles whenever application code or any dependency referenced process.env.VARIABLE NAME. This is not a regressio...

Malicious code in @tezign/html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 437929a07e5bc4e0e6dfe545fa858db027aa2ba4e6fa87701a09d5b07277b543 The package @tezign/html-webpack-plugin was found to contain malicious code...

EUVD-2025-198960

Malicious code in @tezign/html-webpack-plugin npm...

MAL-2025-190916 Malicious code in @tezign/html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 437929a07e5bc4e0e6dfe545fa858db027aa2ba4e6fa87701a09d5b07277b543 The package @tezign/html-webpack-plugin was found to contain malicious code...

EUVD-2025-178004

Malicious code in luna-local-optimize-css-assets-webpack-plugin-postgres npm...

Malicious code in bunyan-redis-capella-html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56b9ec0c5fa82205dee259b73ad694a1c72663bb5a0d4d0e23c5bbbfbe461f40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179459

Malicious code in css-minimizer-webpack-plugin-phoebe-biogeochemistry-lint npm...

EUVD-2025-179808

Malicious code in ceres-redis-umbra-terser-webpack-plugin npm...

EUVD-2025-178507

Malicious code in html-webpack-plugin-multiverse-proteomics-blackhole npm...

EUVD-2025-177618

Malicious code in nextjs-html-webpack-plugin-express-gemini npm...

EUVD-2025-180327

Malicious code in ariel-markdown-arcturus-terser-webpack-plugin npm...

EUVD-2025-180072

Malicious code in biogeochemistry-test-express-css-minimizer-webpack-plugin npm...

Malicious code in ariel-markdown-arcturus-terser-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f906563d9aed4a7980a31a32bfc6ae14daf13ed46d446a279c6169602dc258e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188685 Malicious code in phoenix-perseus-mocha-html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab6606c12f1d8a31b4ffa60bdd8a08643e40c577af49e628586123bd9d36ae0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189878 Malicious code in terser-webpack-plugin-spectron-webdriver-sirius-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d806205b74b56ad6447e53075cc4a8f467cf38ad549070b55924b5674f905531 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in html-webpack-plugin-deimos-toml-command (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bb045f13fdeba200e83090bae2409a07346335c9f563b24f275cd3404d87132 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179411

Malicious code in dagda-non-blocking-html-webpack-plugin-astrophysics npm...

EUVD-2025-177433

Malicious code in optimize-css-assets-webpack-plugin-pm2-lyra-miranda npm...

EUVD-2025-179458

Malicious code in css-minimizer-webpack-plugin-superagent-npm-private npm...

EUVD-2025-180273

Malicious code in async-css-minimizer-webpack-plugin-heka-redgiant npm...