260 matches found
CVE-2025-45778
CVE-2025-45778 CVE-2025-45778: Authenticated Stored XSS. An authenticated stored cross-site scripting XSS vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary JavaScript or HTML code via injecting a crafted payload into the "Description" text field when...
CVE-2025-65321
CVE-2025-65321 The Language Sloth Discord bot is vulnerable to Directory Traversal in the gif and png functions. The functions build file paths using unsanitized user input for the 'name' parameter, allowing attackers to reference files outside the intended resource directories. The functions "gi...
Malicious code in just-gray-sloth (npm)
Source: amazon-inspector a7873cdf2493f3e62b43adef4234795dcaed3b9b8d92ce960566ef96efd436dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in juicy-aquamarine-sloth (npm)
Source: amazon-inspector 2770327b4cddcfc3f0d28b8bc9d216c1b16feefdfd65922b461308fa69ff0ff2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in cheerful-aquamarine-sloth (npm)
Source: amazon-inspector 60cfc7cb0001d675984f0440aab1a70b3219b828efa85832dc98e1f3613d9846 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in testis-pack (npm)
The npm package testis-pack presents itself as a small binary packing/checksum utility pack/unpack/checksum/inspect but embeds an obfuscated dropper. It declares a preinstall: node index.js hook. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are...
Malicious code in testudo-pack (npm)
The npm package testudo-pack is byte-for-byte identical verified via diff to testis-pack from the same npm publisher ioa2102 [email protected], differing only in its install hook: postinstall: node index.js instead of preinstall. It presents itself as a small binary packing/checksum...
MAL-2026-10075 Malicious code in testudo-pack (npm)
The npm package testudo-pack is byte-for-byte identical verified via diff to testis-pack from the same npm publisher ioa2102 [email protected], differing only in its install hook: postinstall: node index.js instead of preinstall. It presents itself as a small binary packing/checksum...
Malicious code in testudo-pack (npm)
The npm package testudo-pack is byte-for-byte identical verified via diff to testis-pack from the same npm publisher ioa2102 [email protected], differing only in its install hook: postinstall: node index.js instead of preinstall. It presents itself as a small binary packing/checksum...
MAL-2026-10074 Malicious code in testis-pack (npm)
The npm package testis-pack presents itself as a small binary packing/checksum utility pack/unpack/checksum/inspect but embeds an obfuscated dropper. It declares a preinstall: node index.js hook. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are...
📄 Discord Language Sloth Bot Directory Traversal Scanner / Payload Generator
The Language Sloth Discord bot contains a critical directory traversal vulnerability allowing attackers to read arbitrary files on the server hosting the bot through improperly sanitized user input in file path operations. This is an automated scanner with payload generation...
Malicious code in local-aqua-sloth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78d45c913bbc73a37fd3cba872c5b0b747074cd3806fb01b2ea687136384857c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-117284
Malicious code in juicy-aquamarine-sloth npm...
EUVD-2025-117260
Malicious code in local-aqua-sloth npm...
Malicious code in concerned_sloth_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 417da7a6b09ddedfe30ad9fed31cc93beaa2a290c8f66ee1f39c53a43814054f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in horrible_sloth_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83868d2e596126ede29aac8bcab553d135ed9d90666d1b457bff77e88dd296ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-100076
Malicious code in detailedslothz3n npm...
EUVD-2025-104078
Malicious code in livingslothz3n npm...
EUVD-2025-95789
Malicious code in physicalslothz3n npm...
Malicious code in condemned_sloth_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c37a00283ae5aeb8e74f56d33f3bd3b8309ee246dec5c996cc0f08a0e9426f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...