Malicious code in async-css-minimizer-webpack-plugin-heka-redgiant (npm)

Source: amazon-inspector 33b0f9fca81fca86a14b33c7bfac2d72987607fea039001a9568eff34c879063 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in astrobiology-sedna-archaeogenetics-css-minimizer-webpack-plugin (npm)

Source: amazon-inspector 3df4d0495e148fbcdcc1cda0675903dbfcb6d71102f2cf4a590110f50a21230d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in astro-cache-ablation-css-loader (npm)

The package astro-cache-ablation-css-loader was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-19698

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous...

CVE-2026-19698

CVE-2026-19698 affects the GutenKit WordPress plugin in versions before 2.5.1 . The root cause is the absence of validation or escaping on style settings saved against a post before they are used to build the CSS output on the front end. This allows users with the Contributor role or above to inj...

EUVD-2026-70036

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous...

CVE-2026-19698 GutenKit < 2.5.1 - Contributor+ Stored CSS Injection

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous...

CVE-2026-19698 GutenKit < 2.5.1 - Contributor+ Stored CSS Injection

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous...

Malicious code in ariel-backend-css-loader-aldebaran (npm)

Source: amazon-inspector 8985f6f4b26a752bfd23a32fbbf39c2aab5c6b48f599eb0f46f6398a6833b115 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ariel-semantic-release-optimize-css-assets-webpack-plugin-prettier-plugin-markdown (npm)

Source: amazon-inspector e92e6e415fb780ecd55df704c9df844b75061c1af180a3ad3f6e2d6c0321a3b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in arcturus-chakra-ui-css-loader-gemini (npm)

Source: amazon-inspector e569838e764acfb421a87734a9bce1aadf35ce79e570ec2f763d256404265852 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in apex-electron-protractor-mini-css-extract-plugin (npm)

Source: amazon-inspector 779cc6c8c43d7168deaf2cb7d9acad1a4f866432756bf35644ea6160de97ecfd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in apachecn-html-css-zh-pt3 (npm)

The package apachecn-html-css-zh-pt3 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in apachecn-html-css-zh-pt2 (npm)

The package apachecn-html-css-zh-pt2 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in antd-dagda-optimize-css-assets-webpack-plugin-remark (npm)

Source: amazon-inspector 4904d6c2f02b50ea44fe5a7af9560547a704cbe0801ceb932c40c6207413bfba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in antares-interstellarmedium-corvus-css-minimizer-webpack-plugin (npm)

The package antares-interstellarmedium-corvus-css-minimizer-webpack-plugin was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in altair-css-loader-fornax-nightmare (npm)

Source: amazon-inspector 3a93c6bec6b6bc86ae43ec926c92e2d9fa530b1816ac58f2a4e6aa10ef83170c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in alphard-aurora-css-minimizer-webpack-plugin-xanthus (npm)

Source: amazon-inspector cadd965cb26d39282845d1f921990c4270984dbf20e54e6ba597fdd8158afe87 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious Package

Overview bellatrix-protractor-fomalhaut-css-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

CSS Component Access Sensitive Data

The CSS component vulnerability in Google Chrome and Microsoft Edge web browsers is related to information disclosure. Exploitation of this vulnerability may allow a remote attacker to gain access to sensitive data via a specially crafted HTML page...