MAL-2024-8038 Malicious code in solana-cctp-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f513aced5931ffb63f949f93cc61dfe8ceae696235caee3f926488e16d73de06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Rogue PyPI Library Solana Users, Steals Blockchain Wallet Keys

Cybersecurity researchers have discovered a new malicious package on the Python Package Index PyPI repository that masquerades as a library from the Solana blockchain platform but is actually designed to steal victims' secrets. "The legitimate Solana Python API project is known as 'solana-py' on...

Hackers Distributing Malicious Python Packages via Popular Developer Q&A Platform

In yet another sign that threat actors are always looking out for new ways to trick users into downloading malware, it has come to light that the question-and-answer Q&A platform known as Stack Exchange has been abused to direct unsuspecting developers to bogus Python packages capable of draining...

MAL-2024-4647 Malicious code in Solana (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Solana (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Brave Desktop 1.67.115 Security Fixes

Fixed Brave Wallet WebHID connection prompt for Solana. Upgraded Chromium to 126.0.6478.56 — refer to Google Chrome advisories for inherited CVEs...

@dialectlabs/react (>=0.4.8, <=0.5.1) potentially affected by CVE-2024-30253 via @solana/web3.js (1.38.0)

@solana/web3.js NPM version 1.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @dialectlabs/react =0.4.8, =0.5.1 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@parrotfi/wallets (1.0.0) potentially affected by CVE-2024-30253 via @solana/web3.js (1.2.5)

@solana/web3.js NPM version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @parrotfi/wallets 1.0.0 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@bonfida/sns-reputation (>=0.0.1, <=0.0.7), @levelfinance/keeper (>=0.1.0, <=0.1.2) potentially affected by CVE-2024-30253 via @solana/web3.js (1.30.2)

@solana/web3.js NPM version 1.30.2 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @bonfida/sns-reputation =0.0.1, =0.1.0, =0.1.2 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@alphabatem/metaplex-shadow-drive (>=2.0.4, <=2.0.5), @builderdao/apis (>=0.0.4, <=0.0.8) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.33.0)

@solana/web3.js NPM version 1.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @alphabatem/metaplex-shadow-drive =2.0.4, =0.0.4, =0.0.2, =0.0.3 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J...

@fabric-foundation/sdk (>=0.0.65, <=1.0.2-beta.6), @frakt-protocol/frakt-sdk (>=0.0.7, <=0.0.9) +2 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.34.0)

@solana/web3.js NPM version 1.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @fabric-foundation/sdk =0.0.65, =0.0.7, =3.0.4, =3.0.6 - @toruslabs/solana-embed 0.1.4 Source cves: CVE-2024-30253 Source advisory...

@cremafinance/crema-sdk (>=2.0.11, <=2.0.14), @currie0612/crema-cli (>=0.0.12, <=0.0.42) +9 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.41.0, <=1.41.4)

@solana/web3.js NPM version =1.41.0, =2.0.11, =0.0.12, =2.0.11, =0.2.0-master.0, =1.0.3-beta.1, =1.2.2, =1.0.25, =1.0.1, =2.0.12, =1.0.0, =1.0.7 - winto-sdk 1.0.3 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@glow-app/solana-client (>=0.4.0, <=0.5.1), @zetamarkets/flex-sdk (>=0.6.3, <=0.15.0) +8 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.43.4, <=1.43.6)

@solana/web3.js NPM version =1.43.4, =0.4.0, =0.6.3, =0.1.1, =0.0.1, =1.4.0, =0.1.0, =1.0.4, =1.4.1 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@brbb/bot-farm-ts (>=0.0.1, <=0.0.3), @phantasia/blockchain-interface (>=3.6.10, <=5.0.0) +3 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.47.2, <=1.47.3)

@solana/web3.js NPM version =1.47.2, =0.0.1, =3.6.10, =1.13.2, =1.0.0, =0.3.53, =0.3.54 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@convexitydmcc/wallet-adapter-walletconnect (>=2.0.0-beta.26, <=2.0.0-rc.5), @renec-foundation/gasless-sdk (>=0.2.3, <=0.2.6) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.48.0)

@solana/web3.js NPM version 1.48.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @convexitydmcc/wallet-adapter-walletconnect =2.0.0-beta.26, =0.2.3, =3.0.0-beta.1, =6.3.0-profits-mercurial-rc8 Source cves:...

@chainify/solana (>=1.2.14, <=2.4.1), @liquality/error-parser (>=1.1.0-next.1, <=1.1.4-next.2) +13 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.50.1)

@solana/web3.js NPM version 1.50.1 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @chainify/solana =1.2.14, =1.1.0-next.1, =1.28.2, =0.0.1-rc12, =3.0.0-alpha.16, =3.4.4, =2.0.0, =2.0.0, =0.3.12, =0.3.3, =0.3.3,...

@jup-ag/core (>=3.0.0-beta.0, <=3.0.0-beta.8-eacba78), @jup-ag/react-hook (>=3.0.0-beta.0, <=3.0.0-beta.8-eacba78) +7 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.63.0, <=1.63.1)

@solana/web3.js NPM version =1.63.0, =3.0.0-beta.0, =3.0.0-beta.0, =0.0.1-38592825.0, =0.0.1-0f199db9.0, =4.0.0-maple-1, =0.1.0, =1.4.8, =1.0.0, =1.7.1-alpha.4 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@arb-protocol/core (>=2.0.0-alpha.1, <=2.0.0-alpha.6), @arb-protocol/jupiter-adapter (>=2.0.0-alpha.5, <=2.0.0-alpha.6) +18 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.69.0)

@solana/web3.js NPM version 1.69.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @arb-protocol/core =2.0.0-alpha.1, =2.0.0-alpha.5, =2.0.0-alpha.1, =0.0.0, =1.0.0, =1.0.0, =1.0.0, =0.1.1, =0.1.8, =1.0.63, =1.0.0...

@jup-ag/dca-v2-sdk (>=0.0.0-beta-1, <=0.0.0-beta-9), @jup-ag/smart-wallet (>=0.0.0-beta-1, <=0.0.0-beta-9) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.75.0)

@solana/web3.js NPM version 1.75.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @jup-ag/dca-v2-sdk =0.0.0-beta-1, =0.0.0-beta-1, =0.0.31, =1.0.3 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J...

@beeman/my-anchor-app-anchor (0.0.1), @epplex-xyz/sdk (>=0.1.42, <=0.3.0) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.90.0)

@solana/web3.js NPM version 1.90.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @beeman/my-anchor-app-anchor 0.0.1 - @epplex-xyz/sdk =0.1.42, =0.0.1, =0.1.2 Source cves: CVE-2024-30253 Source advisory:...