Malicious code in gulp-jscrambler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7353f50ebadb90b9c561e3e70b53c89712bafd182fdc3eb16e536651b972092 gulp-jscrambler is a Gulp plugin wrapping the Jscrambler code-protection API. No install-time lifecycle scripts, credential harvesting, exfiltration...

MAL-2026-10673 Malicious code in gulp-jscrambler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7353f50ebadb90b9c561e3e70b53c89712bafd182fdc3eb16e536651b972092 gulp-jscrambler is a Gulp plugin wrapping the Jscrambler code-protection API. No install-time lifecycle scripts, credential harvesting, exfiltration...

MAL-2026-10065 Malicious code in nodemon-gulp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18cfb051ae84a8ed00bba3ae1eaf7720ec6479a402ae0540c6d66a7fa304f52a Package is published as nodemon-gulp but its contents are a verbatim copy of the upstream nodemon project: package.json declares author: Remy Sharp,...

@mapbox/vnu-validate-html (=0.1.0), @northernbeat/gulp-tasks (>=1.0.48 <=1.0.50) +32 more potentially affected by CVE-2025-15104 via vnu-jar (>=16.12.27 <=25.12.31)

vnu-jar NPM version =16.12.27, =1.0.48, =1.0.3, =0.9.0, =0.1.1, =0.7.0, =0.1.2, =0.6.0, =8.1.0, =9.1.1, =1.0.0, =1.1.2, =2.0.0 and more Source cves: CVE-2025-15104 Source advisory: OSV:GHSA-FCCG-7W3P-W66F...

CVE-2020-7605

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

Malicious code in gulp-inject-envs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d230a528331dc71aa1fa5cb1d9fd8146d79d7e92f3aae2efd2ce7c177640b337 The package gulp-inject-envs was found to contain malicious code. Source: ghsa-malware 5dafa09839ea07c586670ac1a302805fb65ffaf32d1641dcab2be569a68231...

EUVD-2025-199149

Malicious code in gulp-inject-envs npm...

MAL-2025-191105 Malicious code in gulp-inject-envs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d230a528331dc71aa1fa5cb1d9fd8146d79d7e92f3aae2efd2ce7c177640b337 The package gulp-inject-envs was found to contain malicious code. Source: ghsa-malware 5dafa09839ea07c586670ac1a302805fb65ffaf32d1641dcab2be569a68231...

ff-build (>=2.4.0 <=2.6.1) potentially affected by unknown CVE via gulp-inject-envs (=1.2.0)

gulp-inject-envs NPM version =1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on gulp-inject-envs and may be impacted: - ff-build =2.4.0, =2.6.1 Source cves: unknown CVE Source advisory: SNYK:JS-GULPINJECTENVS-14103633...

EUVD-2025-177711

Malicious code in nashira-dotenv-parse-variables-gulp-lynx npm...

EUVD-2025-177677

Malicious code in nebula-gulp-bootes-kastra npm...

EUVD-2025-177728

Malicious code in mutation-exec-arcturus-gulp npm...

EUVD-2025-180115

Malicious code in bellatrix-gulp-barnard-dagda npm...

EUVD-2025-178625

Malicious code in gulp-yildun-lacerta-webpack npm...

EUVD-2025-177766

Malicious code in mongoose-supernova-transhumanism-gulp npm...

Malicious code in apex-gulp-npm-dione (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5294aad7730d18543319acfe8ea7de730b6de8160892ee5e56072e4c6a5f6a6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187251 Malicious code in gulp-javascript-carpo-markdown-pdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83f3fb31d46de531e486584cf860923fbaef0e8a21f7f9233132af1ea5a5ebc4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187755 Malicious code in less-loader-gulp-yaml-crust (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a37ba6b2766ddc09a8955e32126156706d18cd48cf81fa1da83c4c563b856dfc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187257 Malicious code in gulp-yildun-lacerta-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76a274bdb3d2616b5e76f058c31ebcdd115b7a1c639d4bd9c4736f68f31c0c47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...