OLo Uni-CLI input validation error vulnerability

A security vulnerability exists in OLo Uni-CLI versions prior to 0.225.2. This vulnerability arises because when old JSON-RPC-over-HTTP MCP transmissions are exposed to the loopback address, the browser Origin header is not validated prior to routing requests. As a result, malicious web pages can...

Malicious code in ksaki-kaisoim-olo (npm)

Source: amazon-inspector e7d735e5d22f9c03270a63e6b2200d84dd6c5f2620a73e466007bf761daff20f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ksai-kaisom-olo (npm)

Source: amazon-inspector bbdd41dc2ba67667801750cb855f458b774e5625817165773e819bdb755bca29 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

clickpaas-toolkit (>=0.0.1, <=0.0.4), dqpy (1.3.2) +1 more potentially affected by CVE-2024-36039 via pymysql (0.9.1)

pymysql PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymysql and may be impacted: - clickpaas-toolkit =0.0.1, =0.1.7, =0.4.0 Source cves: CVE-2024-36039 Source advisory: OSV:PYSEC-2026-502...

EUVD-2025-140655

Malicious code in ksai-kaisom-olo npm...

EUVD-2025-140611

Malicious code in ksaki-kaisoim-olo npm...

MAL-2025-175653 Malicious code in ksaki-kaisoim-olo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7d735e5d22f9c03270a63e6b2200d84dd6c5f2620a73e466007bf761daff20f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

clickpaas-toolkit (>=0.0.1, <=0.0.4), dqpy (1.3.2) +1 more potentially affected by CVE-2024-36039 via pymysql (0.9.1)

pymysql PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymysql and may be impacted: - clickpaas-toolkit =0.0.1, =0.1.7, =0.4.0 Source cves: CVE-2024-36039 Source advisory: OSV:GHSA-V9HF-5J83-6XPP...

Malicious Package

Overview suncorp-olo-utils is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Upserve : OLO Total price manipulation using negative quantities

Manipulating an order request JSON object, containing an additional item with a negative quantity directly manipulates the total amount of the order. In the following JSON request, an order is submitted for 2 ChickenBurgers $12 each, as well as -1 BreadPuddings $9 each. The total price after tax...