weakrng-sweep

weak-rng 扫描（CVE-2026-71851 类） 研究工具：枚举 PRNG 方案 × uint32 种子，派生 BIP39 钱包， 并针对受害者地址集合进行成员资格检查（防御性研究，illbloom 风格）。 方案：0-10（illbloom：MT19937/glibc/Java/LCG/xorshift），11-13（glibc-31 LCG）， 14-15（crypto-js 3.3.0 WordArray.random MWC 移植，已通过字节级验证与 node 对比）。 运行：Actions - mwc-sweep - Run workflow。...

bitcoin-security

bitcoin-security 一项教育性研究，探讨比特币密钥安全性究竟来自哪里 ——以及它不来自哪里。它围绕真实的 BIP39/BIP32 派生构建，包含两个位于同一理念两端的实验： 实验| 搜索空间| 可行？| 它教会我们什么 ---|---|---|--- weakentropy — 枚举弱 RNG 钱包空间| 2³² （糟糕的 RNG）| 是的 ，数天内| 钱包的强弱仅取决于其背后的熵。 blindsearch — 暴力破解一个良好的密钥空间| 2¹⁶⁰ （良好的 RNG）| 不 ，永远不可能| 拥有真实熵时，密钥空间在物理上不可搜索。...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

UBUNTU-CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

Summary CryptoJS.lib.WordArray.random in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small enough to enumerate on commodity hardware...

GHSA-RG76-677X-56Q9 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

Summary CryptoJS.lib.WordArray.random in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small enough to enumerate on commodity hardware...

CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

EUVD-2026-54599

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851

The CVE-2026-71851 entry describes a vulnerability in crypto-js prior to 4.0.0 where CryptoJS.lib.WordArray.random() uses a non-cryptographically secure PRNG seeded from Math.random(), yielding only 2^39–2^47 entropy. This affects downstream wallets using that entropy for BIP39 recovery phrases, ...

Linux Distros Unpatched Vulnerability : CVE-2026-71851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom...

MAL-2026-13349 Malicious code in mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8871a9cd738ee7dbe2245e741d52afb659069bc6fcc7d5aa6cfb87bfad9dbcd On require, index.js serializes the full process.env along with hostname, username, homedir, platform, and cwd, base64-encodes the JSON blob, and...

MAL-2026-12085 Malicious code in @wethenorth12/bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687 Package presents itself as a drop-in replacement for the popular bip39 library but ships a credential stealer in its main entry. On require, the modu...

Malicious code in @zzzgenesis00/bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4029e4462d0c27bbfd619024ba7311a0ecefef1ce551dba08ea57e920047e246 Package @zzzgenesis00/bip39-generator impersonates the bitcoinjs project author field set to 'bitcoinjs', repo URL pointing at...

MAL-2026-11515 Malicious code in @zzzgenesis00/bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4029e4462d0c27bbfd619024ba7311a0ecefef1ce551dba08ea57e920047e246 Package @zzzgenesis00/bip39-generator impersonates the bitcoinjs project author field set to 'bitcoinjs', repo URL pointing at...

MAL-2026-10026 Malicious code in @wagni_bot/hyperliquid-sdk (npm)

The npm package @wagnibot/hyperliquid-sdk is a supply-chain credential stealer disguised as a Hyperliquid SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycl...

Malicious code in exxpress-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 378e423b00c08a371fbae1c77360685d2277e502e9875caa53fb20f58a39f396 The package name exxpress-tool is a one-character edit of the widely-used express package. On npm install, the declared scripts.postinstall runs...

CVE-2026-43992

The CVE describes a vulnerability in JunoClaw where, prior to version 0.x.y-security-1, MCP write tools (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted a mnemonic: string parameter, causing the BIP-39 seed to be embedded in the LLM tool-call JSON. T...

MAL-2026-3383 Malicious code in wallet-utils-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1c6b0bc86ba79fbf578e23fb2eeb78129ba07b9a274e2e8f780b0d427065290e The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - Th...