MAL-2025-46753 Malicious code in yaml-rate-limiter-epimetheus-optimize-css-assets-webpack-plugin (npm)

The package yaml-rate-limiter-epimetheus-optimize-css-assets-webpack-plugin was found to contain malicious code...

MAL-2025-44636 Malicious code in html-webpack-plugin-middleware-plutology-impulse (npm)

The package html-webpack-plugin-middleware-plutology-impulse was found to contain malicious code...

MAL-2025-45299 Malicious code in neutrino-paleontology-html-webpack-plugin-mui (npm)

The package neutrino-paleontology-html-webpack-plugin-mui was found to contain malicious code...

MAL-2025-43788 Malicious code in chromedriver-css-minimizer-webpack-plugin-petrology-on (npm)

The package chromedriver-css-minimizer-webpack-plugin-petrology-on was found to contain malicious code...

Malicious code in spark-webpack-react-app (npm)

The package spark-webpack-react-app was found to contain malicious code...

MAL-2025-46117 Malicious code in spark-webpack-react-app (npm)

The package spark-webpack-react-app was found to contain malicious code...

webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

...

webpack-dev-server users' source code may be stolen when they access a malicious web site

...

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

...

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

...

webpack-dev-middleware Path Traversal vulnerability

...

MAL-2025-41257 Malicious code in @uit-spritesmith/webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 26ec1ae1c565770377c72c56c41c0a0ec1387c318225b2c8b2db2c255c96839c The OpenSSF Package Analysis project identified '@uit-spritesmith/webpack' @ 0.1.3 npm as malicious. It is considered malicious because: - The...

Linux Distros Unpatched Vulnerability : CVE-2023-28154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a propert...

Linux Distros Unpatched Vulnerability : CVE-2022-37603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Regular expression denial of service ReDoS flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable...

Malicious code in cz-conventional-changelog-webpack-meissa-ionosphere (npm)

The package cz-conventional-changelog-webpack-meissa-ionosphere was found to contain malicious code...

Malicious code in blaze-optimize-css-assets-webpack-plugin-cosmogenic-joviology (npm)

The package blaze-optimize-css-assets-webpack-plugin-cosmogenic-joviology was found to contain malicious code...

Malicious code in rollup-dagda-less-loader-optimize-css-assets-webpack-plugin (npm)

The package rollup-dagda-less-loader-optimize-css-assets-webpack-plugin was found to contain malicious code...

Malicious code in webpack-jupiter-nova-graphql (npm)

The package webpack-jupiter-nova-graphql was found to contain malicious code...

Malicious code in webpack-karma-electron-builder-neuromorphic (npm)

The package webpack-karma-electron-builder-neuromorphic was found to contain malicious code...

Malicious code in equinox-child-process-html-webpack-plugin-frontend (npm)

The package equinox-child-process-html-webpack-plugin-frontend was found to contain malicious code...