255 matches found
CVE-2025-45778
CVE-2025-45778 CVE-2025-45778: Authenticated Stored XSS. An authenticated stored cross-site scripting XSS vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary JavaScript or HTML code via injecting a crafted payload into the "Description" text field when...
CVE-2025-65321
CVE-2025-65321 The Language Sloth Discord bot is vulnerable to Directory Traversal in the gif and png functions. The functions build file paths using unsanitized user input for the 'name' parameter, allowing attackers to reference files outside the intended resource directories. The functions "gi...
Malicious code in testudo-pack (npm)
The npm package testudo-pack is byte-for-byte identical verified via diff to testis-pack from the same npm publisher ioa2102 [email protected], differing only in its install hook: postinstall: node index.js instead of preinstall. It presents itself as a small binary packing/checksum...
MAL-2026-10075 Malicious code in testudo-pack (npm)
The npm package testudo-pack is byte-for-byte identical verified via diff to testis-pack from the same npm publisher ioa2102 [email protected], differing only in its install hook: postinstall: node index.js instead of preinstall. It presents itself as a small binary packing/checksum...
MAL-2026-10074 Malicious code in testis-pack (npm)
The npm package testis-pack presents itself as a small binary packing/checksum utility pack/unpack/checksum/inspect but embeds an obfuscated dropper. It declares a preinstall: node index.js hook. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are...
📄 Discord Language Sloth Bot Directory Traversal Scanner / Payload Generator
The Language Sloth Discord bot contains a critical directory traversal vulnerability allowing attackers to read arbitrary files on the server hosting the bot through improperly sanitized user input in file path operations. This is an automated scanner with payload generation...
EUVD-2025-117284
Malicious code in juicy-aquamarine-sloth npm...
Malicious code in local-aqua-sloth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78d45c913bbc73a37fd3cba872c5b0b747074cd3806fb01b2ea687136384857c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-117260
Malicious code in local-aqua-sloth npm...
Malicious code in horrible_sloth_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83868d2e596126ede29aac8bcab553d135ed9d90666d1b457bff77e88dd296ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in concerned_sloth_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 417da7a6b09ddedfe30ad9fed31cc93beaa2a290c8f66ee1f39c53a43814054f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-100076
Malicious code in detailedslothz3n npm...
EUVD-2025-104078
Malicious code in livingslothz3n npm...
Malicious code in condemned_sloth_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c37a00283ae5aeb8e74f56d33f3bd3b8309ee246dec5c996cc0f08a0e9426f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-95789
Malicious code in physicalslothz3n npm...
EUVD-2025-106043
Malicious code in colouredslothz3n npm...
Malicious code in proper_sloth_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 010f2a1af8f6eb7acfc43ec1852e8f27c62eadaa46963b0901e99e1746440bdb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-89416
Malicious code in properslothz3n npm...