Malicious Package

Overview nrql-tutorial is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in nrql-tutorial (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c05f09c8ffa1c0d481983b42dad8d40299cd5eb0b37e0f1d61685cd349a12c58 The OpenSSF Package Analysis project identified 'nrql-tutorial' @ 1.7.5 npm as malicious. It is considered malicious because: - The package...

MAL-2024-11871 Malicious code in nrql-tutorial (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c05f09c8ffa1c0d481983b42dad8d40299cd5eb0b37e0f1d61685cd349a12c58 The OpenSSF Package Analysis project identified 'nrql-tutorial' @ 1.7.5 npm as malicious. It is considered malicious because: - The package...

New Relic: Stored XSS Via NRQL chartbuilder JSON view

I've found another stored XSS that can affect other users through the JSON chart type in one.newrelic.com Steps to Reproduce: 2. Navigate to the chart builder in one.newrelic.com 3. Within the chart builder, perform the following NRQL query: SELECT “ "' Style=position FROM SyntheticCheck 4. Paylo...

New Relic: Stored XSS via "my recent queries" selector in NRQL dashboard builder

This is a pretty simple one. Within NR One, there is a stored XSS via the dashboard builder. It appears in the "My recent queries" dropdown. You can attack other users with this bug by having them navigate to the link, I'll show an example below. Steps to Reproduce: 1. From NR1, navigate to the...

New Relic: NRQL Query allows restricted user to pull all data from Synthetics monitors without having read permissions enabled

@jonbottarini identified an issue where our permissions for Synthetics didn't match the permissions elsewhere in our product. This eventually led to a change in our underlying permissions code to unify our products and prevent issues like this...