MAL-2025-5960 Malicious code in tailwind-config-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6be9b05ac20a95e479566e244cf4bea92aa77281b365a4deea26727c50e08597 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-34354

CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch...

Malicious code in workfront-tailwind-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e755ef9756545a8b3e89ea6e94f4f0df0add9b9fb3c4721127f2cef9b7324007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @cb-global-design-system-tokens/tailwind (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8f263b2c460c81b4e6f61cc1ce72351cf2f0b2d9ff3b745181715ca4296e22e2 The OpenSSF Package Analysis project identified '@cb-global-design-system-tokens/tailwind' @ 1.0.21 npm as malicious. It is considered malicious...

CVE-2024-34354

CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch...

CVE-2024-34354 CMSaasStarter: JWT Token Not Verified on Server Session

CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch...

CVE-2024-34354 CMSaasStarter: JWT Token Not Verified on Server Session

CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch...

CVE-2024-34354 CMSaasStarter: JWT Token Not Verified on Server Session

CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch...

CVE-2024-34354

CMSaaSStarter JWT token not verified on server session affects forks prior to commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6. Affected software: CMSaaSStarter templates, built with SvelteKit/Tailwind/Supabase. Root cause: user JWT token not validated on the server session. Remediation: apply pat...

Malicious code in misk-tailwind-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 567443deccb6eabc476eeb33858fd2ea51f98ab82ab3a814e02bacda56979a09 The OpenSSF Package Analysis project identified 'misk-tailwind-css' @ 1.0.3 npm as malicious. It is considered malicious because: - The package...

Malicious NPM Package Caught Mimicking Material Tailwind CSS Package

A malicious NPM package has been found masquerading as the legitimate software library for Material Tailwind, once again indicating attempts on the part of threat actors to distribute malicious code in open source software repositories. Material Tailwind is a CSS-based framework advertised by its...

Malicious Package

Overview @cloud-panel/tailwind-base is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...