MAL-2025-2555 Malicious code in ethereum-cryptoshanye (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be8742e1d67fb9ff1c7a9bd22ac10cb8a783d566b7fab4834e661b94e0210ec3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 42 Update: vyper-0.4.1-1.fc42

Pythonic Smart Contract Language for the EVM...

This Malicious PyPI Package Stole Ethereum Private Keys via Polygon RPC Transactions

Cybersecurity researchers have discovered a malicious Python package on the Python Package Index PyPI repository that's equipped to steal a victim's Ethereum private keys by impersonating popular libraries. The package in question is set-utils, which has received 1,077 downloads to date. It's no...

Malicious code in ethereum-producer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ad34d841dff398c9fc38a86363950e59b3c5a6a3af2fb02d596472a11878d11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1582 Malicious code in ethereum-producer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ad34d841dff398c9fc38a86363950e59b3c5a6a3af2fb02d596472a11878d11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

API Armor: How Bybit’s Real-Time Blacklisting Is Thwarting a $1.5B Crypto Heist

APIs present a security risk—that much is a given. Attacks on APIs have caused some of the most significant security incidents of the past decades. But the question now is: How can we flip the script and leverage their power to enhance security? Bybit might just have the answer. Bybit—one of the...

Bybit Confirms Record-Breaking $1.5 Billion Crypto Heist in Sophisticated Cold Wallet Attack

Cryptocurrency exchange Bybit on Friday revealed that a "sophisticated" attack led to the theft of over $1.5 billion worth of cryptocurrency from one of its Ethereum cold offline wallets, making it the largest ever single crypto heist in history. "The incident occurred when our ETH multisig cold...

Vyper 安全漏洞

Vyper is a Pythonic smart contract language for EVM open sourced by vyperlang. A security vulnerability exists in Vyper that stems from multiple evaluations of an iterator expression, which could lead to abnormal program behavior...

SUSE CVE-2025-24883

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.14.13...

CVE-2022-29219

Lodestar is a TypeScript implementation of the Ethereum Consensus specification. Prior to version 0.36.0, there is a possible consensus split given maliciously-crafted AttesterSlashing or ProposerSlashing being included on-chain. Because the developers represent uint64 values as native javascript...

CVE-2024-32972

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. Prior to 1.13.15, a vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix has been included in geth version 1.13.15...

CVE-2024-22419

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The concat built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the buildIR for concat doesn't properly adhere to the API of co...

GO-2025-3436 Go Ethereum vulnerable to DoS via malicious p2p message in github.com/ethereum/go-ethereum

Go Ethereum vulnerable to DoS via malicious p2p message in github.com/ethereum/go-ethereum...

Malicious code in ethereum-node-crawler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9059050ba1bb06c1571d7f0b513b58f373f35a6c437a14344acd72a1a01872d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1118 Malicious code in ethereum-node-crawler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9059050ba1bb06c1571d7f0b513b58f373f35a6c437a14344acd72a1a01872d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Denial Of Service (DoS)

github.com/ethereum/go-ethereum is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of incoming messages, which allows a specially crafted message to trigger a crash or shutdown of the node...

GHSA-Q26P-9CQ4-7FC2 Go Ethereum vulnerable to DoS via malicious p2p message

Impact A vulnerable node can be forced to shutdown/crash using a specially crafted message. During the peer-to-peer connection handshake, a shared secret key is computed. The implementation did not verify whether the EC public key provided by the remote party is a valid point on the secp256k1...

Go Ethereum vulnerable to DoS via malicious p2p message

Impact A vulnerable node can be forced to shutdown/crash using a specially crafted message. During the peer-to-peer connection handshake, a shared secret key is computed. The implementation did not verify whether the EC public key provided by the remote party is a valid point on the secp256k1...

CVE-2025-24883

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.14.13...

Malicious code in hardhat-configs (npm)

This package exfiltrates sensitive Ethereum-related data such as mnemonics and private keys to an attacker-controlled server. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98317ddb2bbad731c7576eb5f64b3a91f7e6f7bd135fa5ef05b7a2ad3da15992 Any computer that has this...