CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1...

GHSA-VWQ2-JX9Q-9H9F Soft Serve is vulnerable to SSRF through its Webhooks

SUMMARY We have identified and verified an SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. AFFECTED COMPONENTS VERIFIED 1. Webhook Creation...

Soft Serve is vulnerable to SSRF through its Webhooks

SUMMARY We have identified and verified an SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. AFFECTED COMPONENTS VERIFIED 1. Webhook Creation...

Malicious code in tough_gorilla_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d25633888a1c8107a276ec0153368e10a298ed43a317c084e5b42c9586efa40c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in military_swordtail_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2dfb223f6fb14212bb80a94e507835f60ea36b1eea217d011a848863602b790 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in retail_cougar_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25842972e2038d9de46c182b683869d70661ce543d2e2014545853f2d1cb16b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in marginal_wildebeest_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4ca760d717fe57b218d6c97c765c88b67c669fc00d2d808e2817c1ab4d6671d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in communist_dragonfly_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81a7012f8230c1ca253c3a73a80e192a1b3d583b4fd41a9149ffe887653b8bbf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in smooth_mink_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4a33a4ab0bf14e3fe07586552ea09fd44a0294046c2a0ab8983f18d0abe8cf7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in individual_galliform_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80106ecbde271e31981a3391c965d9cf6bba5bd75e7ed2b06cb7febb6ce3aa59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dangerous_cow_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87ee675a940c3bb3e396f1105ab192e7fe5d601f29eb932014b1a701ca5ddedc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in big_krill_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a31fca84eaeb23864d1e74ab2d9e4b1a17a27619b07c942e52dbd2205ccf33b0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in normal_otter_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fb36a883674a5caea611ebdc65cdd809c8edc2e88b8b7dc4f5dc68bc0af084b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in poor_leopon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b04348b7e703e796bdcd1eb3e8d2744848cea56eb3fd8b39667afce92836193f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-61393 Malicious code in strong_lemming_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24bdce26e5efffcb64409354c045372bee1f8662260f6684589d8a8afd30afc0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60171 Malicious code in constitutional_quail_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629e3f0a2ac3c8643759d9c1d282359236b5533e35d69b1894e212c1f0cadc03 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60079 Malicious code in characteristic_iguana_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5fd9df43e705351e03c571e25df043e208d3cd0c0924b975215f9cc464eb148 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60947 Malicious code in nuclear_tiger_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab1b38e2ba8965ddc6f29d77328d89d68fc272179c274b92adb800deeef8ed52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in flexible_nightingale_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab85d36067a2d950615a8e61c1153c64f18e35d0f230105a2da1ccee1eadb706 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in outer_asp_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d1d1783d31756dc2cd3d80a94e57385e7b533bfa1ef96a66acb37945936bd73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...