CVE-2025-69893

A side-channel vulnerability exists in the implementation of BIP-39 mnemonic processing, as observed in Trezor One v1.13.0 to v1.14.0, Trezor T v1.13.0 to v1.14.0, and Trezor Safe v1.13.0 to v1.14.0 hardware wallets. This originates from the BIP-39 standard guidelines, which induce non-constant...

EUVD-2025-36815

Malicious code in trezor-rollout npm...

MAL-2025-49053 Malicious code in trezor-rollout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ddacc3033f82ae4ac26ccf3e7b622d3f3d7d8e04418bd1375f8770137641a7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview trezor-rollout is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in trezor-rollout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ddacc3033f82ae4ac26ccf3e7b622d3f3d7d8e04418bd1375f8770137641a7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2020-10099

Malware in sbrugna...

EUVD-2019-5569

Malware in sbrugna...

Malicious code in trezor-link-node-hid (npm)

The package trezor-link-node-hid was found to contain malicious code...

MAL-2025-37190 Malicious code in trezor-link-bridge (npm)

The package trezor-link-bridge was found to contain malicious code...

MAL-2025-37194 Malicious code in trezor-link-node-hid (npm)

The package trezor-link-node-hid was found to contain malicious code...

MAL-2025-37192 Malicious code in trezor-link-chrome-hid (npm)

The package trezor-link-chrome-hid was found to contain malicious code...

Malicious code in trezor-link-bridge (npm)

The package trezor-link-bridge was found to contain malicious code...

Malicious code in trezor-link-chrome-hid (npm)

The package trezor-link-chrome-hid was found to contain malicious code...

Malicious code in trezor-link-chrome-udp (npm)

The package trezor-link-chrome-udp was found to contain malicious code...

Malicious code in trezor-link-chrome-extension (npm)

The package trezor-link-chrome-extension was found to contain malicious code...

Malicious code in trezor-flags (npm)

The package trezor-flags was found to contain malicious code...

MAL-2025-37191 Malicious code in trezor-link-chrome-extension (npm)

The package trezor-link-chrome-extension was found to contain malicious code...

MAL-2025-37193 Malicious code in trezor-link-chrome-udp (npm)

The package trezor-link-chrome-udp was found to contain malicious code...

MAL-2025-37189 Malicious code in trezor-flags (npm)

The package trezor-flags was found to contain malicious code...

CVE-2024-23660

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 202...