MAL-2025-17520 Malicious code in contracts-plugins (npm)

The package contracts-plugins was found to contain malicious code...

Malicious code in decentage-ico-contracts (npm)

The package decentage-ico-contracts was found to contain malicious code...

Malicious code in contracts-plugins (npm)

The package contracts-plugins was found to contain malicious code...

MAL-2025-20672 Malicious code in flare-smart-contracts (npm)

The package flare-smart-contracts was found to contain malicious code...

The Dark Side of Upgrades: Uncovering Security Risks in Smart Contract Upgrades

Smart contract upgrades are increasingly common due to their flexibility in modifying deployed contracts, such as fixing bugs or adding new functionalities. Meanwhile, upgrades compromise the immutability of contracts, introducing significant security concerns. While existing research has explore...

Attackers Use Fake OAuth Apps with Tycoon Kit to Breach Microsoft 365 Accounts

Cybersecurity researchers have detailed a new cluster of activity where threat actors are impersonating enterprises with fake Microsoft OAuth applications to facilitate credential harvesting as part of account takeover attacks. "The fake Microsoft 365 applications impersonate various companies,...

CVE-2025-54429

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable by certain types of accounts for...

Malicious Package

Overview axr-smart-contracts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in axr-smart-contracts

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Program Analysis for High-Value Smart Contract Vulnerabilities: Techniques

A widespread belief in the blockchain security community is that automated techniques are only good for detecting shallow bugs, typically of small value. In this paper, we present the techniques and insights that have led us to repeatable success in automatically discovering high-value smart...

CVE-2025-54429 Polkadot Frontier's constructing smart contract can bypass precompile address bounding

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable by certain types of accounts for...

CVE-2025-54429 Polkadot Frontier's constructing smart contract can bypass precompile address bounding

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable by certain types of accounts for...

CVE-2025-54429

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable by certain types of accounts for...

Program Analysis for High-Value Smart Contract Vulnerabilities: Techniques and Insights

A widespread belief in the blockchain security community is that automated techniques are only good for detecting shallow bugs, typically of small value. In this paper, we present the techniques and insights that have led us to repeatable success in automatically discovering high-value smart...

CVE-2025-54429: Incorrect Type Conversion or Cast

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable by certain types of accounts for...

Duplicate Advisory: CosmWasm affected by arithmetic overflows

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8724-5xmm-w5xq. This link is maintained to preserve external references. Original Description The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations...

PT-2025-30549 · Undefined · Undefined

@FBI @CISAgov Federal systems remained unpatched against CVE-2025-35824—a critical SharePoint flaw exploited since July 19—when CISA’s emergency directive dropped 72 hours ago. Now the same agencies warning about ransomware can’t secure their own networks storing defense contracts and health...

Malicious code in axr-smart-contracts (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6f40c0f14910689109d5feee0e22e6d1c1ce158eea34d5d4f95e7209c5dd425 Any computer that has this package installed or running should be considered...

MAL-2025-6073 Malicious code in axr-smart-contracts (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6f40c0f14910689109d5feee0e22e6d1c1ce158eea34d5d4f95e7209c5dd425 Any computer that has this package installed or running should be considered...

Out-of-bounds Read

@openzeppelin/contracts and @openzeppelin/contracts-upgradeable are vulnerable to Out-of-bounds Read. The vulnerability is due to improper bounds checking caused by the lastIndexOf function in Bytes.sol accessing uninitialized memory when given an empty buffer and a non-maximum position,...