252 matches found
CVE-2025-65321
CVE-2025-65321 Il bot Discord Language Sloth è vulnerabile a Directory Traversal nelle funzioni gif e png. Le funzioni costruiscono percorsi di file utilizzando input utente non sanificati per il parametro 'name', consentendo agli attaccanti di fare riferimento a file al di fuori delle directory ...
CVE-2025-45778
CVE-2025-45778 CVE-2025-45778: XSS persistente autenticato. Una vulnerabilità di cross-site scripting XSS persistente autenticato in The Language Sloth Web Application v1.0 consente agli attaccanti di eseguire codice JavaScript o HTML arbitrario iniettando un payload appositamente creato nel camp...
Malicious code in testudo-pack (npm)
The npm package testudo-pack is byte-for-byte identical verified via diff to testis-pack from the same npm publisher ioa2102 [email protected], differing only in its install hook: postinstall: node index.js instead of preinstall. It presents itself as a small binary packing/checksum...
MAL-2026-10074 Malicious code in testis-pack (npm)
The npm package testis-pack presents itself as a small binary packing/checksum utility pack/unpack/checksum/inspect but embeds an obfuscated dropper. It declares a preinstall: node index.js hook. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are...
MAL-2026-10075 Malicious code in testudo-pack (npm)
The npm package testudo-pack is byte-for-byte identical verified via diff to testis-pack from the same npm publisher ioa2102 [email protected], differing only in its install hook: postinstall: node index.js instead of preinstall. It presents itself as a small binary packing/checksum...
📄 Discord Language Sloth Bot Directory Traversal Scanner / Payload Generator
The Language Sloth Discord bot contains a critical directory traversal vulnerability allowing attackers to read arbitrary files on the server hosting the bot through improperly sanitized user input in file path operations. This is an automated scanner with payload generation...
EUVD-2025-117284
Malicious code in juicy-aquamarine-sloth npm...
EUVD-2025-117260
Malicious code in local-aqua-sloth npm...
Malicious code in local-aqua-sloth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78d45c913bbc73a37fd3cba872c5b0b747074cd3806fb01b2ea687136384857c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in horrible_sloth_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83868d2e596126ede29aac8bcab553d135ed9d90666d1b457bff77e88dd296ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in concerned_sloth_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 417da7a6b09ddedfe30ad9fed31cc93beaa2a290c8f66ee1f39c53a43814054f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-100076
Malicious code in detailedslothz3n npm...
EUVD-2025-104078
Malicious code in livingslothz3n npm...
EUVD-2025-95789
Malicious code in physicalslothz3n npm...
Malicious code in condemned_sloth_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c37a00283ae5aeb8e74f56d33f3bd3b8309ee246dec5c996cc0f08a0e9426f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-106043
Malicious code in colouredslothz3n npm...
Malicious code in proper_sloth_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 010f2a1af8f6eb7acfc43ec1852e8f27c62eadaa46963b0901e99e1746440bdb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-89416
Malicious code in properslothz3n npm...