398 matches found
rcc-solana (=0.1.0) potentially affected by unknown CVE via spl-token-swap (=3.0.0)
spl-token-swap CARGO version =3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on spl-token-swap and may be impacted: - rcc-solana =0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0426...
PT-2024-40969 · Solana · Solana Program Library
Name of the Vulnerable Software and Affected Versions: Solana Program Library affected versions not specified Description: The issue arises from the unpack function in the library, which can lead to undefined behavior when casting a u8 array to arbitrary types. This is due to the potential for...
Malicious code in solana-account-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-11710 Malicious code in solana-account-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=-...
Modified package published to npm, containing malware that exfiltrates private key material
Earlier today, a publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from...
GHSA-JCXM-7WVP-G6P5 Modified package published to npm, containing malware that exfiltrates private key material
Earlier today, a publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from...
CVE-2024-54134
A publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots,...
CVE-2024-54134
CVE-2024-54134 affects the Solana JavaScript library solana/web3.js, specifically versions 1.95.6 and 1.95.7. A publish-access account was compromised, enabling attackers to publish unauthorized malicious packages that could exfiltrate private key material and drain funds from dapps that handle p...
CVE-2024-54134 @solana/web3.js modified package published to npm, containing malware that exfiltrates private key material
A publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots,...
CVE-2024-54134 @solana/web3.js modified package published to npm, containing malware that exfiltrates private key material
A publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots,...
CVE-2024-54134 @solana/web3.js modified package published to npm, containing malware that exfiltrates private key material
A publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots,...
Researchers Uncover Backdoor in Solana's Popular Web3.js npm Library
Cybersecurity researchers are alerting to a software supply chain attack targeting the popular @solana/web3.js npm library that involved pushing two malicious versions capable of harvesting users' private keys with an aim to drain their cryptocurrency wallets. The attack has been detected in...
solana/web3.js 信息泄露漏洞
solana/web3.js is a JavaScript library from Solana Labs. An information disclosure vulnerability exists in solana/web3.js versions 1.95.6 and 1.95.7, which stems from a vulnerability that allows an attacker to distribute unauthorized malicious packages that have been modified to steal private key...
MAL-2024-11183 Malicious code in @solana/web3.js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 507e136eb7d13bd9c88a5e20d692768a759c2ae382d1ab54ba66c196b560cacb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @solana/web3.js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 507e136eb7d13bd9c88a5e20d692768a759c2ae382d1ab54ba66c196b560cacb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2024-9247 · Solana · @Solana/Web3.Js
Name of the Vulnerable Software and Affected Versions: @solana/web3.js versions 1.95.6 through 1.95.7 Description: A publish-access account was compromised for @solana/web3.js, a JavaScript library commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious...
Malicious code in solana-web3-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcf9d5b7aec80f6f8909d8b65170940ecf00b096f922f111da7848b86257088c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-10622 Malicious code in solana-web3-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcf9d5b7aec80f6f8909d8b65170940ecf00b096f922f111da7848b86257088c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Researchers Uncover Python Package Targeting Crypto Wallets with Malicious Code
Cybersecurity researchers have discovered a new malicious Python package that masquerades as a cryptocurrency trading tool but harbors functionality designed to steal sensitive data and drain assets from victims' crypto wallets. The package, named "CryptoAITools," is said to have been distributed...