MSC-2026-11394

Malicious cryptocurrency wallet-drainer disguised as a JavaScript utility. index.js auto-executes on require/import, reads the host .env for PRIVATEKEY/SECRET/MNEMONIC values, and attempts to transfer funds to hardcoded attacker-controlled wallets across 26 chains via ethers.Wallet.sendTransactio...

MSC-2026-11393

Malicious cryptocurrency wallet-drainer disguised as a JavaScript utility. index.js auto-executes on require/import, reads the host .env for PRIVATEKEY/SECRET/MNEMONIC values, and attempts to transfer funds to hardcoded attacker-controlled wallets across 26 chains via ethers.Wallet.sendTransactio...

CVE-2026-46681

@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys proto,...