1523 matches found
Malicious code in aseity (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65d0df302f9fdd618d08a8bc095702f5b6594712ba82205c758c710fee9006e setup.py invokes aseity.compat.ensurecompat, which base64+zlib-decodes the DATA constant shipped in aseity/shimdata.py and passes the resulting Pytho...
Malicious code in coinscan (PyPI)
Source: kam193 d403e54ce25ec07ec9979ba880af4930ded34a3702e9829c69a8e67279c26d59 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data a...
Malicious code in coinscan (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 021da2d8a1de0971203de68e083eeb30efc18b58ebc5b36ecde89eb03b02cf9e setup.py imports coinscan.telemetry and calls check during install. check fetches a JSON manifest from...
MAL-2026-17197 Malicious code in coinscan (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 021da2d8a1de0971203de68e083eeb30efc18b58ebc5b36ecde89eb03b02cf9e setup.py imports coinscan.telemetry and calls check during install. check fetches a JSON manifest from...
Malicious code in claudedashbord (PyPI)
Source: kam193 5a1141a5d4c10d0c58128d6397750ce3fcd2ab16eea32113be3da61d7a16f5a6 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data a...
Malicious code in donutpromotion (PyPI)
Source: kam193 26201e7959d7a736440fa6fb22ba7b9911c269b08460374d0a2db307ba6b0273 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data a...
MAL-2026-17195 Malicious code in claudedashbord (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56 The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls...
Malicious code in claudedashbord (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56 The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls...
Malicious code in donutpromotion (PyPI)
donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...
MAL-2026-17196 Malicious code in donutpromotion (PyPI)
donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...
Malicious code in donutautosellsrc (PyPI)
Source: kam193 2ac1203ac68b4bb062c4dd38f59fd8bd13fef695c5b1c8059160c6a5205717b1 During installation package fetches code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates the...
MAL-2026-17192 Malicious code in donutautosellsrc (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef01bfa158639900e5ad9301eb32db37e7dab821e55ccff29574b905a8e5a2cb setup.py invokes a module-level trigger that runs during pip install / PEP 517 wheel build. The trigger calls donutautosellsrc.build.run, which...
Malicious code in donutautosellsrc (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef01bfa158639900e5ad9301eb32db37e7dab821e55ccff29574b905a8e5a2cb setup.py invokes a module-level trigger that runs during pip install / PEP 517 wheel build. The trigger calls donutautosellsrc.build.run, which...
Resource-Optimized and Energy-Aware Agentic AI Framework Anchored on Blockchain for Secure Software Supply Chains
This paper proposes a blockchain-backed agentic security framework designed to safeguard the complete software development lifecycle SDLC while also securing the agentic AI components responsible for monitoring it. The framework coordinates a set of specialised security agents, covering source...
Verifiable Randomness for Blockchain-Based Lottery Systems
As lotteries and other high-stakes decentralized applications increasingly depend on unpredictable randomness for their operations, the lack of a secure and transparent on-chain random number generator that is verifiable by all participants remains a critical open problem. Various approaches to...
GHSA-W3RP-4CM2-4WGC ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included...
ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included...
CVE-2026-61604
The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...
CVE-2026-61604 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...
EUVD-2026-86330
The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...