MAL-2023-690 Malicious code in postcss-file-match (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 416239cd07c736ee9cda1661d413016b66a35ccd99054f13c8fb5b81fefa02dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview postcss-toc is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

MAL-2022-5423 Malicious code in postcss-fleexbugs-fixs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e1b9d652e96c357326a2bbdd94a69349443c42ed9a6d7115745a02db3e3cb47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in postcss-fleexbugs-fixs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e1b9d652e96c357326a2bbdd94a69349443c42ed9a6d7115745a02db3e3cb47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5424 Malicious code in postcss-lazy-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3af0b17a0cca4f52c02b138fec9e69ba2c506346ef1a6b57cbf893a03b7b5c46 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in postcss-lazy-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3af0b17a0cca4f52c02b138fec9e69ba2c506346ef1a6b57cbf893a03b7b5c46 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Regular Expression Denial of Service in postcss

The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service ReDoS via getAnnotationURL and loadAnnotation in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern regex /\s sourceMappingURL=. PoC js var...

@100mslive/hms-video-react (>=0.3.27, <=0.3.125), @aagames-fe/google-translate (>=0.0.2, <=0.0.14) +534 more potentially affected by CVE-2021-23382 via postcss (>=8.0.0, <=8.2.12)

postcss NPM version =8.0.0, =0.3.27, =0.0.2, =1.1.0, =0.0.0-dev-4fb73016-20210914-1634176750976, =0.0.3, =0.5.4, =2.0.0-alpha.0, =2.8.0-canary.4, =2.7.5, =2.8.0-canary.5, =0.1101.0-next.0, =12.0.0-rc.0 - @arnosaine/react-scripts 4.0.3 - @astuteo/build-config 5.4.5 - @babytian/openinula-repl-next...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0x0.icu.anima (0.1.0) +9361 more potentially affected by CVE-2021-23382 via postcss (>=7.0.0, <=7.0.35)

postcss NPM version =7.0.0, =1.0.1, =1.0.1, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.1, =1.0.0, =3.4.2 and more Source cves: CVE-2021-23382 Source advisory: OSV:GHSA-566M-QJ78-RWW5...

@100mslive/hms-video-react (>=0.3.27, <=0.3.125), @aagames-fe/google-translate (>=0.0.2, <=0.0.14) +534 more potentially affected by CVE-2021-23382 via postcss (>=8.0.0, <=8.2.12)

postcss NPM version =8.0.0, =0.3.27, =0.0.2, =1.1.0, =0.0.0-dev-4fb73016-20210914-1634176750976, =0.0.3, =0.5.4, =2.0.0-alpha.0, =2.8.0-canary.4, =2.7.5, =2.8.0-canary.5, =0.1101.0-next.0, =12.0.0-rc.0 - @arnosaine/react-scripts 4.0.3 - @astuteo/build-config 5.4.5 - @babytian/openinula-repl-next...

GHSA-566M-QJ78-RWW5 Regular Expression Denial of Service in postcss

The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service ReDoS via getAnnotationURL and loadAnnotation in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern regex /\s sourceMappingURL=. PoC js var...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0x0.icu.anima (0.1.0) +9361 more potentially affected by CVE-2021-23382 via postcss (>=7.0.0, <=7.0.35)

postcss NPM version =7.0.0, =1.0.1, =1.0.1, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.1, =1.0.0, =3.4.2 and more Source cves: CVE-2021-23382 Source advisory: GHSA-566M-QJ78-RWW5...

PostCSS Aurora Application Software Resource Consumption

The vulnerability of the PostCSS application library in Aurora Software Center, related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Regular Expression Denial of Service

Overview postcss from 7.0.0 and before version 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service ReDoS during source map parsing. Recommendation Upgrade to version 8.2.10 or later References - CVE - GitHub Advisory...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0x0.icu.anima (0.1.0) +9361 more potentially affected by CVE-2021-23368 via postcss (>=7.0.0, <=7.0.35)

postcss NPM version =7.0.0, =1.0.1, =1.0.1, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.1, =1.0.0, =3.4.2 and more Source cves: CVE-2021-23368 Source advisory: GHSA-HWJ9-H5MP-3PM3...

@100mslive/hms-video-react (>=0.3.27, <=0.3.59), @aagames-fe/google-translate (>=0.0.2, <=0.0.14) +519 more potentially affected by CVE-2021-23368 via postcss (>=8.0.0, <=8.2.9)

postcss NPM version =8.0.0, =0.3.27, =0.0.2, =1.1.0, =0.0.0-dev-4fb73016-20210914-1634176750976, =0.0.3, =0.5.4, =2.0.0-alpha.0, =2.8.0-canary.4, =2.7.5, =2.8.0-canary.5, =0.1101.0-next.0, =0.1200.0-next.8 - @arnosaine/react-scripts 4.0.3 - @astuteo/build-config 5.4.5 -...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0x0.icu.anima (0.1.0) +9361 more potentially affected by CVE-2021-23368 via postcss (>=7.0.0, <=7.0.35)

postcss NPM version =7.0.0, =1.0.1, =1.0.1, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.1, =1.0.0, =3.4.2 and more Source cves: CVE-2021-23368 Source advisory: OSV:GHSA-HWJ9-H5MP-3PM3...

Regular Expression Denial of Service in postcss

The npm package postcss from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service ReDoS during source map parsing...

GHSA-HWJ9-H5MP-3PM3 Regular Expression Denial of Service in postcss

The npm package postcss from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service ReDoS during source map parsing...

@100mslive/hms-video-react (>=0.3.27, <=0.3.59), @aagames-fe/google-translate (>=0.0.2, <=0.0.14) +519 more potentially affected by CVE-2021-23368 via postcss (>=8.0.0, <=8.2.9)

postcss NPM version =8.0.0, =0.3.27, =0.0.2, =1.1.0, =0.0.0-dev-4fb73016-20210914-1634176750976, =0.0.3, =0.5.4, =2.0.0-alpha.0, =2.8.0-canary.4, =2.7.5, =2.8.0-canary.5, =0.1101.0-next.0, =0.1200.0-next.8 - @arnosaine/react-scripts 4.0.3 - @astuteo/build-config 5.4.5 -...