CLSA-2026-1790950461 TuxCare security update for terser (1 CVE)

TuxCare rebuilt terser to address 1 CVE. Fixed in 4.8.0-tuxcare.1...

PT-2026-110848

TuxCare rebuilt terser to address 1 CVE. Fixed in 4.8.0-tuxcare.1...

Malicious code in lint-staged-lint-staged-auth-terser-webpack-plugin (npm)

Source: amazon-inspector 03253bd76fedc24d55504b970d032ee47ad508a341ba8a5531490b0b9ae15ee3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lint-staged-terser-chakra-ui-node-config (npm)

Source: amazon-inspector 0555aa83a6752f98aa45cf50f95aab2be0bb0f5156ba979089b0af5a64a3f030 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in library-quasar-andromeda-terser-webpack-plugin (npm)

Source: amazon-inspector 9782604e3784bcb5e592be57c38e46ddb5fed0911cb299819acd350f717316cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in less-loader-terser-umbra-regulus (npm)

Source: amazon-inspector d2e0130e99b103ea34fd14f21dae9f7697b1ec917b81b17040f86befcb6a844b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in leda-terser-element-ui-sails (npm)

Source: amazon-inspector 6c4b332cc457db25bf8e8aa2fc3e3adfa7721e1fea397195ddb25fab1ccfa75e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lacerta-eris-altair-terser-webpack-plugin (npm)

The package lacerta-eris-altair-terser-webpack-plugin was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in kronos-fornax-terser-dotenv (npm)

Source: amazon-inspector 0f8362755930a3cf4a26b1bc94e15abf929162cddfd7dca4381c2381381116dc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kronos-terser-carpo-nconf (npm)

Source: amazon-inspector 870c1b95dbbb3935fb4d72663c39242940aa9a912600163528e7cb70ebc29a22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in koa-rate-limiter-terser-sedna (npm)

Source: amazon-inspector 1be96c07650b670c76bd394a0fd674f3357b792a7afc500f19b9fefa6e8625b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jupiter-grus-terser-mysql (npm)

Source: amazon-inspector df5e2407d2886b9fa89ef1a60c04e21b16194b41a1d72bd49c5379ff019f32b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jsonp-cross-env-terser-webpack-plugin-grunt (npm)

Source: amazon-inspector 06c1914fb248efd5238e86553ad01dcc8e761e3df13dc3ba91bea0927460f079 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in json-docusaurus-terser-aurora (npm)

Source: amazon-inspector e2a92e7f61c80858f54bd20a3fd7e937f27f7d9ed09ec3e392e39a2ab47a204e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in json-development-publish-terser-webpack-plugin (npm)

Source: amazon-inspector 7a13ea91c3e39772484aa02c1e2b6604be57894e72701604e225fe0423043eaf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jovian-loopback-terser-webpack-plugin-protractor (npm)

Source: amazon-inspector b260282c7f1867e1238bd604cf0bbcfd10833a0a3d62ed9c36ba1dcae09ca209 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jekyll-aurora-superagent-terser-webpack-plugin (npm)

Source: amazon-inspector 362fa7b5a08f46655c55595aea85b8d947c2a6c1f7c51f727943c991c11c8ad1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jasmine-nuxtjs-terser-webpack-plugin-sirius (npm)

Source: amazon-inspector 122079d9ca0cc4f5bf4c3860f735fbcb36bfc6b3b7d1bd0a7dfed0b6c375c88d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jasmine-fetch-standard-terser-webpack-plugin (npm)

Source: amazon-inspector 83c5b2a64e133eb436cf9d493d5f98ad2e3d60e9c56f7f4bbe9dd7a9bedb5315 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jabbah-terser-webpack-plugin-achernar-radiant (npm)

Source: amazon-inspector dc1e454a3b4f4d5c66dba0bfc9697d1034ffa85bf2cdc3a171bffaa936b9ac57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...