npm - OSV

MAL-2026-14261

npm/postcss-initialize-provider

Malicious code in postcss-initialize-provider (npm) 19 Aug

No fix available

MAL-2026-13957

npm/postcss-initialize-plugin

Malicious code in postcss-initialize-plugin (npm) 13 Aug

No fix available

MAL-2026-13696

npm/postcss-initial-provider

Malicious code in postcss-initial-provider (npm) 10 Aug

No fix available

MAL-2026-13518

npm/postcss-theme-provider

Malicious code in postcss-theme-provider (npm) 07 Aug

No fix available

MAL-2026-12418

npm/postcss-animate-css-vars

Malicious code in postcss-animate-css-vars (npm) 05 Aug

No fix available

MAL-2026-11622

npm/@onereach/postcss-scoped-selector

Malicious code in @onereach/postcss-scoped-selector (npm) 04 Aug

No fix available

MAL-2026-11775

npm/@ornikar/rollup-plugin-postcss

Malicious code in @ornikar/rollup-plugin-postcss (npm) 04 Aug

No fix available

MAL-2026-11765

npm/@ornikar/postcss-config

Malicious code in @ornikar/postcss-config (npm) 04 Aug

No fix available

GHSA-fxqj-rqcc-2cmp

npm/postcss

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset 03 Aug

Fix available
Severity - 6.3 (Medium)

MAL-2026-11168

npm/postcss-motion-utils

Malicious code in postcss-motion-utils (npm) 28 Jul

No fix available

GHSA-r28c-9q8g-f849

npm/postcss

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure 24 Jul

Fix available
Severity - 7.5 (High)

GHSA-6g55-p6wh-862q

npm/postcss

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments 23 Jul

Fix available
Severity - 7.5 (High)

MAL-2026-10614

npm/postcss-selector-minify

Malicious code in postcss-selector-minify (npm) 14 Jul

No fix available

MAL-2026-10540

npm/postcss-processor-utils

Malicious code in postcss-processor-utils (npm) 14 Jul

No fix available

MAL-2026-10539

npm/postcss-animatecss

Malicious code in postcss-animatecss (npm) 14 Jul

No fix available

MAL-2026-6684

npm/postcss-property-rollup

Malicious code in postcss-property-rollup (npm) 30 Jun

No fix available

Vulnerabilities