Malicious code in apex-html-webpack-plugin-configstore-polaris (npm)

Source: amazon-inspector 775b8b2c4b1d74cbab0589fdfa152118eaaf2aa7aa84d5514a8cd43e5d42bf6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in apex-native-html-webpack-plugin-betelgeuse (npm)

Source: amazon-inspector 849e662d6c1f289915ae6c1d104bbb2ed814a79d59ee65325b40f297d681e3a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in antd-dagda-optimize-css-assets-webpack-plugin-remark (npm)

Source: amazon-inspector 4904d6c2f02b50ea44fe5a7af9560547a704cbe0801ceb932c40c6207413bfba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in antares-interstellarmedium-corvus-css-minimizer-webpack-plugin (npm)

The package antares-interstellarmedium-corvus-css-minimizer-webpack-plugin was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in antares-non-blocking-inflation-html-webpack-plugin (npm)

The package antares-non-blocking-inflation-html-webpack-plugin was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in altair-blaze-html-webpack-plugin-ora (npm)

The package altair-blaze-html-webpack-plugin-ora was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in alphard-aurora-css-minimizer-webpack-plugin-xanthus (npm)

Source: amazon-inspector cadd965cb26d39282845d1f921990c4270984dbf20e54e6ba597fdd8158afe87 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in airbnb-transform-apollo-terser-webpack-plugin (npm)

Source: amazon-inspector 286babe43131b1bc5666a0fb2c46ea3d0a97b51b5aeee903c931463caf7e1f60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in airbnb-antares-terser-webpack-plugin-oauth (npm)

Source: amazon-inspector 621360111310bb1d7dcd6fc7f22631c95a9ca27f7eed5e0424872f4f863ea333 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in aether-mysql-eslint-config-html-webpack-plugin (npm)

Source: amazon-inspector e723bdfeb0ecf0f7b823a7630a67f5018f37e2669440510b547ed98b4e60b807 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in adonis-tool-optimize-css-assets-webpack-plugin-spectron (npm)

Source: amazon-inspector 58cbea89b1590dfaf1c1a7c79d7ddd345b6fe22f88c4bc58a03e5964dffc81fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malware in sme-scripts-shared-library-webpack-plugin

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview sme-scripts-shared-library-webpack-plugin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious code in boxy-global-modules-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce609c23d8c990c21c16692270dbb62589c6f63e716994c31e5ed4f466dcad7 On require of the package's main entry, loader.js immediately fetches a platform-specific opaque binary over HTTPS from hardcoded Cloudflare Workers...

MAL-2026-13050 Malicious code in boxy-global-modules-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce609c23d8c990c21c16692270dbb62589c6f63e716994c31e5ed4f466dcad7 On require of the package's main entry, loader.js immediately fetches a platform-specific opaque binary over HTTPS from hardcoded Cloudflare Workers...

Malicious code in sme-scripts-shared-library-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a07df8d1831729273ad5bbc396191492c36cbf0f4d870af35c1101579ce0c9 [email protected] executes an install/import-time dropper. index.js requires./setup at module load, which selects a...

Malicious Package

Overview javascript-css-minimizer-webpack-plugin-geochronology-foundation is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection...

Malicious Package

Overview hermes-apex-css-minimizer-webpack-plugin-phoebe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

@citrineos/ocpi-server (0.1.1), mockoon-webpack-plugin (>=1.1.0, <=2.0.3) potentially affected by CVE-2026-59149 via @mockoon/cli (>=1.6.2, <=8.4.0)

@mockoon/cli NPM version =1.6.2, =1.1.0, =2.0.3 Source cves: CVE-2026-59149 Source advisory: MEND:CVE-2026-59149...

@citrineos/ocpi-server (0.1.1), mockoon-webpack-plugin (>=1.1.0, <=2.0.3) potentially affected by CVE-2026-59148 via @mockoon/cli (>=1.6.2, <=8.4.0)

@mockoon/cli NPM version =1.6.2, =1.1.0, =2.0.3 Source cves: CVE-2026-59148 Source advisory: MEND:CVE-2026-59148...