1930 matches found
GHSA-4RMQ-MC2C-R495 Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond
Summary A state consistency bug in x/costaking can leave a BTC delegator with non-zero ActiveSatoshis Phatom Stake even after they have fully unbonded their BTC delegation, if their Finality Provider FP drops out of the active set in the exact same babylon block height. This creates a “phantom...
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond
Summary A state consistency bug in x/costaking can leave a BTC delegator with non-zero ActiveSatoshis Phatom Stake even after they have fully unbonded their BTC delegation, if their Finality Provider FP drops out of the active set in the exact same babylon block height. This creates a “phantom...
The Treasury Proof Ledger: A Cryptographic Framework for Accountable Bitcoin Treasuries
Public companies and institutional investors that hold Bitcoin face increasing pressure to show solvency, manage risk, and satisfy regulatory expectations without exposing internal wallet structures or trading strategies. This paper introduces the Treasury Proof Ledger TPL, a Bitcoin-anchored...
Malicious code in btc-transaction-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 291d3fea363888c43824aaaa26f2eb389674822baacb18e5ff7498c9cfc74dee The package btc-transaction-helper was found to contain malicious code. Source: ghsa-malware...
EUVD-2025-200207
Malicious code in btc-transaction-helper npm...
Police Seize Cryptomixer Domains, Infrastructure and 28M Dollars in Bitcoin
Swiss and German police shut down Cryptomixer, seizing servers, domains and 28M dollars in Bitcoin during an Europol backed action targeting crypto laundering...
Malicious Package
Overview bitcoin-lib-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview bitcoin-main-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
EUVD-2025-199807
Malicious code in bitcoin-lib-js npm...
Malicious code in bitcoin-lib-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 480dbd7d7ec801a0212ee78ebb73268cd67ba4fb96b06ec563fbafe31aa10531 The package bitcoin-lib-js was found to contain malicious code. Source: ghsa-malware 95f79207062e8c5db317d3487c20f36927b99e9f0b9bfc2551c22a23d10c020f...
MAL-2025-191478 Malicious code in bitcoin-lib-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 480dbd7d7ec801a0212ee78ebb73268cd67ba4fb96b06ec563fbafe31aa10531 The package bitcoin-lib-js was found to contain malicious code. Source: ghsa-malware 95f79207062e8c5db317d3487c20f36927b99e9f0b9bfc2551c22a23d10c020f...
EUVD-2025-199717
Malicious code in bitcoin-main-lib npm...
Malicious code in bitcoin-main-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f6833ddd073b7c036ec32739e3cb826bd1eda9d3c350eed423548f64f047b2 The package bitcoin-main-lib was found to contain malicious code. Source: ghsa-malware 06ed1aa4aa61f36d953368c74cb3daf102b02842a6a27843021b499b033d71...
MAL-2025-191477 Malicious code in bitcoin-main-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f6833ddd073b7c036ec32739e3cb826bd1eda9d3c350eed423548f64f047b2 The package bitcoin-main-lib was found to contain malicious code. Source: ghsa-malware 06ed1aa4aa61f36d953368c74cb3daf102b02842a6a27843021b499b033d71...
GHSA-XQ4H-WQM2-668W Babylon's BIP322 signature implementation is not fully compliant to the spec
Summary The BIP-322 signature verification does not enforce the SIGHASH value to be SIGHASHALL, and therefore is not strictly following the spec. Impact Non-compliant BIP-322 signatures in proof of possessions can be accepted by the chain...
@avalabs/avalanche-module (>=0.0.0-CP-8940-20240801175729 <=3.9.1), @avalabs/bitcoin-module (>=0.0.0-CP-8940-20240801175729 <=3.9.1) +19 more potentially affected by CVE-2025-64767 via @hpke/core (>=1.2.5 <=1.7.4)
@hpke/core NPM version =1.2.5, =0.0.0-CP-8940-20240801175729, =0.0.0-CP-8940-20240801175729, =2.8.0-canary.a436aaa.0, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-canary.a436aaa.0, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-alpha.197, =2.8.0-canary.a436aaa.0,...
DarkComet Spyware Resurfaces Disguised as Fake Bitcoin Wallet
Old DarkComet RAT spyware is back, hiding inside fake Bitcoin wallets and trading apps to steal credentials via keylogging...
Malicious code in bitcoin-indexer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6c3f96c759562e2a831cfe8886f66f67c9793b45674fcf3a02082b0c658d37e The package bitcoin-indexer was found to contain malicious code...
MAL-2025-49575 Malicious code in bitcoin-indexer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6c3f96c759562e2a831cfe8886f66f67c9793b45674fcf3a02082b0c658d37e The package bitcoin-indexer was found to contain malicious code...