oxo v2.9.29

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. It is open source and maintained by Ostorlab. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and...

Denial Of Service

Spring for GraphQL is vulnerable to Denial of Service. The vulnerability is due to improper handling of the WebSocket client keepAlive feature, where the client maintains persistent connections without adequate limits and an attacker can trigger excessive resource consumption to cause a denial of...

Integrity Check Bypass

Spring for GraphQL is vulnerable to an integrity check bypass. The vulnerability is due to loading JavaScript libraries from a public CDN without Subresource Integrity checks, where an attacker can inject malicious code into those scripts and execute arbitrary code on the browser loading the...

Unsafe Deserialization

Spring for GraphQL is vulnerable to Unsafe Deserialization. The vulnerability is due to unsafe deserialization of paginated GraphQL query data, where crafted serialized objects can be supplied and deserialized without proper validation, allowing attackers to execute arbitrary code...

Malicious code in cypress-graphql (npm)

The package cypress-graphql was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in csrf-cressida-graphql-rest (npm)

Source: amazon-inspector 3f0f8102da823f1598bea95658a11ba091cd8ae0d45480aba1cafb8d24307920 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cryptography-biohacking-xml-graphql (npm)

Source: amazon-inspector d3742fabb4b698020842cbed0bd7abe0eebdb846a73d8daec377a871c4d2a63d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cross-env-yakutsk-octans-graphql (npm)

Source: amazon-inspector 3ec258cbc55d95a4aa0c35968e62956f226510e7535d823debd9ec5c976ed91e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cressida-graphql-apollo-gacrux (npm)

Source: amazon-inspector b3f4f524b48207e104601e6b13d2a0dce840d80d495500feae7448978e6eb474 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cordelia-sass-loader-ignite-graphql (npm)

The package cordelia-sass-loader-ignite-graphql was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in configstore-graphql-pm2-virgo (npm)

Source: amazon-inspector 0df4450f2fb42c74059bdf2515b13d9ec227be42735da764c21f0c090c58f9c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in concurrently-async-graphql-triton (npm)

Source: amazon-inspector e423d178b25c621093439cac9ee66381edc17e5d3f4a0cd24bb4303865868754 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in commitlint-got-graphql-blaze (npm)

Source: amazon-inspector ba0e5b4a97cfce89e6a9b2a47f4c4ad3400f6d303f0c4361be1512f951a1c88d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in commitlint-config-angular-graphql-ursa-yakutsk (npm)

Source: amazon-inspector dd57c25c7dc8e5c5e65fec44158bf31a22298db16e48f9ab0afbce4c61fbb2da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cluster-upgrade-graphql-quantum (npm)

Source: amazon-inspector 4c639cd0d7b8b69e23e078c6ddede7e447c6521c2b535b4b9f8efa3d1b50e6d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cli-quantum-graphql-phoebe (npm)

Source: amazon-inspector c35c34e4b2d30dd543ede618927dae46a55b153b44a3735d4cc905a98f4652f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cli-plugin-graphql (npm)

The package cli-plugin-graphql was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in child-process-graphql-unuk-bootstrap (npm)

Source: amazon-inspector f6a73489e36ef579389cba8cf836adf942eed3cb3bb7dd3b3e2c1489719875a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious Package

Overview egstore-graphql-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

hulak v0.3.33

Hulak Your messenger in the terminal. Quick Start • GraphQL Explorer • Project Layout • Documentation Run one request, a whole directory, or stay interactive hulak run ./requests/ Hulak runs request files directly from your project. It supports concurrent directory execution. It falls back to an...