0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
postcss-semantic-themes
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting postcss-semantic-themes, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-18334 | Unknown | Malicious code in postcss-semantic-themes (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (21c91b39929f03c30e501726fc2d1c1fa43f17bf2ed77bda52380e563c1171e0) The package advertises itself as a zero-runtime CSS theming kit but on require/import executes a chain of obfuscated JavaScript modules. lib.mjs imports tokens.mjs, which top-level imports cache-warm.mjs — a ~279KB single-line file consisting of a hex-named string array of XOR/base64-encoded blobs decoded at runtime. Three additional sibling modules of the same shape (build-cache.mjs ~203KB, cache-sweep.mjs ~295KB, workspaces.js ~290KB) are |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (21c91b39929f03c30e501726fc2d1c1fa43f17bf2ed77bda52380e563c1171e0) The package advertises itself as a zero-runtime CSS theming kit but on require/import executes a chain of obfuscated JavaScript modules. lib.mjs imports tokens.mjs, which top-level imports cache-warm.mjs — a ~279KB single-line file consisting of a hex-named string array of XOR/base64-encoded blobs decoded at runtime. Three additional sibling modules of the same shape (build-cache.mjs ~203KB, cache-sweep.mjs ~295KB, workspaces.js ~290KB) are