Malicious code in koko-poke3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75f0a4e8a8add22b8d8eead9e1af3ca221d1599ad221facbd5cf636f739838bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-140726

Malicious code in koko-poke11 npm...

Malicious code in koko-poke13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10f99ad31ed4279b2b152f3f5307d8961ede4dbcb570c028125297fd41117916 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in koko-poke16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91bef030ad27df3369de229a3d84232471cefcbda3d480f6ff9e99d41765f7de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-140721

Malicious code in koko-poke16 npm...

MAL-2025-175546 Malicious code in koko-poke19 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a6b6dab458b424c38b2faa0e37861b31e11228fa0666a58d8634b3970e81820 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-175550 Malicious code in koko-poke22 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 596df8167e09a8fa7f6c81f63e65b4d1686b8d39479f4b6b638914347d63754f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-175545 Malicious code in koko-poke18 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03a951b7d6c9342f4e7e291705fd7506aeb5724fee4322ac933b48e2129ad8d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-175543 Malicious code in koko-poke16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91bef030ad27df3369de229a3d84232471cefcbda3d480f6ff9e99d41765f7de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-175541 Malicious code in koko-poke14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bb97353977aab825d1915a9a79b94a97e0fe0c73e1550b8b9bc7c97ef345342 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2023-31828

Malicious code in bioql PyPI...

EUVD-2024-49332

Malicious code in bioql PyPI...

SUSE CVE-2023-42818

JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via a vulnerable LeeEirc\crypto dependency. An attacker can utilize a disclosed public key to attempt brute-force authentication against the SSH service. Note: While the vulnerability exists in...

CVE-2024-8662

The Koko Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3.12. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2023-28110

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the...

The vulnerability of the component “koko” in the security audit system for the operation and maintenance of JumpServer, which allows a perpetrator to obtain a cluster token from Kubernetes.

The vulnerability of the koko component in the system for auditing security operations and maintenance of JumpServer is related to improper privilege assignment. Exploiting this vulnerability allows a malicious actor, operating remotely, to obtain a Kubernetes cluster token...

CVE-2024-8662

The Koko Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3.12. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-8662

The Koko Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3.12. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-8662 Koko Analytics <= 1.3.12 - Reflected Cross-Site Scripting

The Koko Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3.12. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...