MilkSad-Mnemonic-Generator

Milk Sad Mnemonic Generator This tool is designed to generate BIP-39 mnemonic phrases 24-word seed phrases based on Unix timestamps, specifically exploring phrases that could be generated through the "Milk Sad" vulnerability CVE2023-39910. What This Tool Does The Milk Sad Mnemonic Generator creat...

Malicious code in crypto-mnemonic-tools (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17595 Malicious code in crypto-mnemonic-tools (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

TENET: Telegram Mini App (In)Security

Telegram, with over 450 million daily active users, has introduced Mini Apps---web-based applications running directly within its client. However, this integration introduces notable security risks. As we demonstrate, many Mini Apps store authentication materials---such as session tokens and wall...

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...

Malicious code in wallet-monitor-snap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c50a0acdc6be5b64538f83b0c14c3808ea3a57b963233ba32a2d80c3e4cc2c3 wallet-monitor-snap is a MetaMask Snap whose onRpcRequest handler implements a 'showSecurityAlert' method that opens a snapdialog inside MetaMask's...

Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-13362 Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-13257 Malicious code in bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec957684e0430a139485e6eacb410980ada8b9c9e90c0ba3c6909472f1557339 On module load, index.js JSON-serializes the full process.env together with hostname, username, homedir, platform, and cwd, base64-encodes the blob,...

MAL-2026-13349 Malicious code in mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8871a9cd738ee7dbe2245e741d52afb659069bc6fcc7d5aa6cfb87bfad9dbcd On require, index.js serializes the full process.env along with hostname, username, homedir, platform, and cwd, base64-encodes the JSON blob, and...

Malicious code in @wethenorth12/bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687 Package presents itself as a drop-in replacement for the popular bip39 library but ships a credential stealer in its main entry. On require, the modu...

Malicious code in @wethenorth12/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0b607f30d6abb6d568a9a52ff027cea51c7a1efccc54c2fa59a8acc2d6f0386 On require of the package's main entrypoint, the module collects hostname, username, home directory, platform, cwd, and the entire process.env,...

MAL-2026-12086 Malicious code in @wethenorth12/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0b607f30d6abb6d568a9a52ff027cea51c7a1efccc54c2fa59a8acc2d6f0386 On require of the package's main entrypoint, the module collects hostname, username, home directory, platform, cwd, and the entire process.env,...

Malicious code in @wethenorth12/web3-provider-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f54c89c6e669f4a9e1e2939e09b5ac809507f98df451e239add607d417f394a Package name mimics MetaMask's official web3-provider-engine and its README advertises a drop-in replacement, but the exported API...

Malicious code in mnemonic-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc209736a2c44e541e224030a4c0bd7145bb77a17fa66504cd96beedc75ce6f4 index.js executes an IIFE at require-time that reads installer-owned secret files .env,.npmrc, /.aws/credentials, /.ssh/idrsa, ided25519, idecdsa,...

MAL-2026-12112 Malicious code in mnemonic-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc209736a2c44e541e224030a4c0bd7145bb77a17fa66504cd96beedc75ce6f4 index.js executes an IIFE at require-time that reads installer-owned secret files .env,.npmrc, /.aws/credentials, /.ssh/idrsa, ided25519, idecdsa,...

Malicious Package

Overview @zzzgenesis00/bip39-mnemonic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @zzzgenesis00/mnemonic-to-key is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-12056 Malicious code in @zzzgenesis00/mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3af286f89deaee9dcce3d85f9bd53bc2b03e63dccf0073c74988b3f3a3763e8 On npm install, postinstall.js executes and enumerates installer-side secrets: files under /.ssh non-.pub private keys, /.npmrc, /.gitconfig,...