Malicious code in helios-css-loader-kastra-transform (npm)

Source: amazon-inspector 633c687aa376abebf8cfe06e2dc3aaa0c30eb2065e0fdf8373b6e67332e7882b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in heliophysics-sedimentology-paleoclimatology-css-minimizer-webpack-plugin (npm)

The package heliophysics-sedimentology-paleoclimatology-css-minimizer-webpack-plugin was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in heka-mini-css-extract-plugin-xenos-prompts (npm)

Source: amazon-inspector b17a7f1db0e8cf65d171b6b053a9b54a88580fcb443ea927debda2adbfaa55a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in halley-eclipse-mini-css-extract-plugin-nightwatch (npm)

The package halley-eclipse-mini-css-extract-plugin-nightwatch was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in gulp-css-colorseur (npm)

The package gulp-css-colorseur was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in grus-css-loader-ophiuchus-scripts (npm)

Source: amazon-inspector e043e95921a55127e5b044bc5645fc12d9eb1beb32ebd5b8c02459a6243966a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in grus-css-loader-javascript-elektra (npm)

The package grus-css-loader-javascript-elektra was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in grunt-geckodriver-puppeteer-optimize-css-assets-webpack-plugin (npm)

Source: amazon-inspector 57bc6f143e9582b48754cf9d7909df4b782c45d7c78a1fd54b06833089bb3c88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in gridsome-css-minimizer-webpack-plugin-graphql-cors (npm)

Source: amazon-inspector ae26c88c181d9c55babee3d7420ebd9761f1cc23f179a381d9b81d8f747c8c1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in gridsome-optimize-css-assets-webpack-plugin-request-aurora (npm)

Source: amazon-inspector f976666400c8581d9105dfe0fb7da5ae6fb7131a6b527569a93b206d34a4c7e7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in gravity-got-xenos-css-minimizer-webpack-plugin (npm)

Source: amazon-inspector 569720695da2349549e200d3557858a4c5638b7ab11fa2c1782e3b7fc1ce2bf6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in gravity-optimize-css-assets-webpack-plugin-selenium-rollup-plugin (npm)

The package gravity-optimize-css-assets-webpack-plugin-selenium-rollup-plugin was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in graphql-transport-umbriel-mini-css-extract-plugin (npm)

Source: amazon-inspector c1bb8670d8ed0f388f28b5c9a8c799311b88f450a89ecdaf4c938060e8c2d37b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in graphql-nightmare-css-loader-abiogenesis (npm)

Source: amazon-inspector 827a1eab8ee4f7a8518854247fd592f6a76ba721ba6900d144ce9f687b27a255 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in got-ursa-css-minimizer-webpack-plugin-redis (npm)

Source: amazon-inspector 5efd654fe96c6a67d87c933eca18ad2b34cf456480a67150d1a51d0b71d116c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

ROS-20260911-73-0242

The vulnerability of the CSS component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to manipulate data integrity through a specially crafted HTML page...

ROS-20260911-73-0241

The vulnerability of the CSS component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to manipulate data integrity through a specially crafted HTML page...

ROS-20260911-73-0240

The vulnerability of the CSS component in Google Chrome and Microsoft Edge relates to the improper presentation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially created HTML page...

@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name

Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...

GHSA-X7M8-JRM8-HPVX @eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name

Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...