Malicious code in lichen-twshi-r04ud-zenith-project (npm)

The package lichen-twshi-r04ud-zenith-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in lagoon-zenith-emv060-project (npm)

The package lagoon-zenith-emv060-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in kronos-sagitta-zenith-ganymede (npm)

Source: amazon-inspector af17388eeeb9c27ab19d91c1e43ff05fa1df5fa0feb3b0b941a1e1e2a5b153d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in koala-zenith-ntb487-project (npm)

The package koala-zenith-ntb487-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in koa-vega-zenith-canopus (npm)

Source: amazon-inspector 64a04af2364592a4dbe9304c1583200538072652b566a0c4367ccac8e31b977f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kite-zenith-ayc406-project (npm)

The package kite-zenith-ayc406-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in kite-zenith-acr160-project (npm)

The package kite-zenith-acr160-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in jungle-zenith-kth084-project (npm)

The package jungle-zenith-kth084-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in jungle-5szeh-bvx05-zenith-project (npm)

The package jungle-5szeh-bvx05-zenith-project was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2025-56563

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

CVE-2025-56563

A Server-Side Request Forgery (SSRF) vulnerability exists in the sat_proxy.php script of Zenith Satellite Tracker 1.0 . The root cause is the script's acceptance of an attacker-controlled address URL parameter and its subsequent pass to curl_setopt(CURLOPT_URL) without performing any host or sche...

PT-2026-93946

A Server-Side Request Forgery vulnerability exists in sat proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl setoptCURLOPT URL without host or scheme validation. An unauthenticated remote attacker can leverage this to...

CVE-2025-56563

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

CVE-2025-56563

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

EUVD-2025-210923

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

CVE-2025-56563: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

Malicious code in iris-y2iti-64tpg-zenith-project (npm)

The package iris-y2iti-64tpg-zenith-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in iris-zenith-iyo103-project (npm)

The package iris-zenith-iyo103-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in iota-node-config-nconf-zenith (npm)

Source: amazon-inspector 776028f8550df0eb3f0612e558293396e665b35add8f207b7c3b8636a9fe1b6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in install-betelgeuse-zenith-nodemon (npm)

Source: amazon-inspector 3a08b8d9f256af66e0829d46984add840408b56494c471b1c80839bea17a9bd3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...