tplmap

Tplmap This project is no longer maintained. I'm happy to merge new PRs as long they don't break the test suite. Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operatin...

The Same Zero: Why Identical ASR Can Imply Different Guarantees in LLM-Agent Security

LLM-agent security has produced a dense landscape of defenses - prompt hardening, content filters, permission gates, sandboxes - yet no framework tells a deployer what a defense actually guarantees, or where that guarantee comes from. We apply Verification Autonomy Levels VAL - L0: LLM...

Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors

The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the information technology IT services industry, once again highlighting how the adversary continues to target developers to breach target networks. Cybersecuri...

EUVD-2025-120030

Malicious code in bright-jade-baboon npm...

Malicious code in strict-jade-muskox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68604dd963ae18ba2aabf6cd072036bb3fcdd5a087756f0902a02d96c1967bfd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117152

Malicious code in protestant-jade-penguin npm...

EUVD-2025-117516

Malicious code in alright-jade-armadillo npm...

MAL-2025-139048 Malicious code in strict-jade-muskox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68604dd963ae18ba2aabf6cd072036bb3fcdd5a087756f0902a02d96c1967bfd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117392

Malicious code in faithful-jade-amphibian npm...

Malicious code in protestant-jade-penguin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae2bc1fe0efb377fe5fc0af8141ff8658b9d9ff3a6bb2392dc1f008206ae9a33 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117324

Malicious code in holy-jade-silverfish npm...

EUVD-2025-117367

Malicious code in frantic-jade-warbler npm...

Malicious code in rear-jade-tuna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7ff5f6c2b1d082d322b30ed31d53b39e64ff3afc70bb76f822256e0a908b79 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117054

Malicious code in strict-jade-muskox npm...

EUVD-2025-116984

Malicious code in worthy-jade-crow npm...

EUVD-2025-117252

Malicious code in lucky-jade-clownfish npm...

EUVD-2025-117169

Malicious code in personal-jade-parrotfish npm...

EUVD-2025-117431

Malicious code in due-jade-dinosaur npm...

EUVD-2025-117109

Malicious code in scornful-jade-shrew npm...

Malicious code in scornful-jade-shrew (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 579714306228154cf3109f2a3d285fccbc11425974d58c8bf2abbd4c41d458f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...