Malicious code in nft-art-generator-nft-collection982 (npm)

The package nft-art-generator-nft-collection982 was found to contain malicious code...

Malicious code in nft-collection-generator-nft-collection383 (npm)

The package nft-collection-generator-nft-collection383 was found to contain malicious code...

Malicious code in nft-collection733 (npm)

The package nft-collection733 was found to contain malicious code...

MAL-2025-14518 Malicious code in angry-apes--nft-collection297 (npm)

The package angry-apes--nft-collection297 was found to contain malicious code...

MAL-2025-27444 Malicious code in nft-generator-art-nft-collection292 (npm)

The package nft-generator-art-nft-collection292 was found to contain malicious code...

Malicious code in nft-art-generator-nft-collection741 (npm)

The package nft-art-generator-nft-collection741 was found to contain malicious code...

Malicious code in nft-art-generator-nft-collection283 (npm)

The package nft-art-generator-nft-collection283 was found to contain malicious code...

MAL-2025-27431 Malicious code in nft-art-generator-nft-collection989 (npm)

The package nft-art-generator-nft-collection989 was found to contain malicious code...

MAL-2025-27441 Malicious code in nft-collection861 (npm)

The package nft-collection861 was found to contain malicious code...

MAL-2025-27432 Malicious code in nft-collection-generator-nft-collection383 (npm)

The package nft-collection-generator-nft-collection383 was found to contain malicious code...

MAL-2025-27454 Malicious code in nft-generatornft-collection586 (npm)

The package nft-generatornft-collection586 was found to contain malicious code...

No Chainlink error handling in case of ethereums gas prices increasing or subscription running out of Link.

Lines of code Vulnerability details Impact Any collections making use of the ChainLink VRF2 randomizer could potentially get 0x0 hashes for their nfts. Due to uint32 public callbackGasLimit = 40000; being hardcoded, any gas fluctuations on Ethereum main net, could potentially not be enough for th...

Attacker can take a loan offer without providing the NFT from requested collection by using function borrowerRefinance()

Lines of code Vulnerability details Impact Function borrowerRefinance allows the borrower to repay the previous loan and take a different loan offer. In the codebase, there is no check to ensure that collateral collection of previous loan and new loan offer are the same. It can be abused by an...

Gas costs will likely result in any fees sent to the Splitter being economically unviable to recover.

Lines of code Vulnerability details Impact Collection owners will likely lose money by claiming fees unless the fees from a single NFT sale outweighs the cost of claiming it not guaranteed. Proof of Concept Consider a new Collection with a RoyaltyVault and Splitter set and a nonzero mint fee. Whe...