Malicious code in tailwindcss-animate-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c51002139fd978b564f7449840b2aafe85ba738c2e392f497f44951070f3643c On require of tailwindcss-animate-styles, index.js runs evalatob... on a payload appended to the Tailwind plugin. The decoded loader queries public...

MAL-2026-15906 Malicious code in tailwindcss-animate-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c51002139fd978b564f7449840b2aafe85ba738c2e392f497f44951070f3643c On require of tailwindcss-animate-styles, index.js runs evalatob... on a payload appended to the Tailwind plugin. The decoded loader queries public...

Cross-site Scripting (XSS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS via the SVG SMIL animation handling in...

CVE-2026-84371: Improper Neutralization of Input During Web Page Generation

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

PT-2026-84509

Name of the Vulnerable Software and Affected Versions sanitize-html versions 1.9.0 through 2.17.6 Description In configurations that allow animate, animateColor, animateMotion, animateTransform, or set elements, the packages/sanitize-html/index.js file fails to correctly validate the values...

Malicious code in tailwindcss-3d-animate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc554005eb9004f33d22597b929261d865d4bfe991d0b99d148dc25fffb7e97c index.js re-exports the legitimate tailwindcss-3d plugin and then appends evalatob"..." at module top level, so the payload runs on any...

MAL-2026-14567 Malicious code in tailwindcss-3d-animate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc554005eb9004f33d22597b929261d865d4bfe991d0b99d148dc25fffb7e97c index.js re-exports the legitimate tailwindcss-3d plugin and then appends evalatob"..." at module top level, so the payload runs on any...

Malicious Package

Overview tailwindcss-3d-animate is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview postcss-animate-css-vars is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview tailwind-animate-css-plugin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-14352 Malicious code in tailwind-animate-css-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a4ac9c32887fff975dd06912302125d243af4f0bb2567714ef69ec763997e0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tailwind-animate-css-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a4ac9c32887fff975dd06912302125d243af4f0bb2567714ef69ec763997e0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious Package

Overview animate-css-vite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in animate-css-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d6c86a03c6106e799d0817676fcc92f022b64790aab209aa9fe663c085c4e6 plugin.js contains an RC4/base64 string-array obfuscated function invoked from the exported createPlugin factory. When a consumer's build instantiate...

MAL-2026-14226 Malicious code in animate-css-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d6c86a03c6106e799d0817676fcc92f022b64790aab209aa9fe663c085c4e6 plugin.js contains an RC4/base64 string-array obfuscated function invoked from the exported createPlugin factory. When a consumer's build instantiate...

Linux Distros Unpatched Vulnerability : CVE-2026-75000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate by attribute may lead to remote image blocking...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

CVE-2026-75000

Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3 fails to sanitize the SVG animate "by" attribute, allowing attackers to bypass remote image blocking and potentially disclose information or escalate privileges. Patches are available in releases 1.6.18 and 1.7.3. No active exploitation is re...