evilqr

Evil QR Toolkit demonstrating another approach of a QRLJacking attack, allowing to perform remote account takeover, through sign-in QR code phishing. It consists of a browser extension used by the attacker to extract the sign-in QR code and a server application, which retrieves the sign-in QR cod...

binance-connector (>=1.5.0, <=1.9.0), binance-futures-connector (1.5.0) +11 more potentially affected by CVE-2026-115776 via twisted (21.2.0)

twisted PYPI version 21.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - binance-connector =1.5.0, =1.6.1, =0.1.9, =2019.2.3rc0, =0.0.0, =0.5.3, =0.8.0b1.post1, =0.8.0b1, =0.0.10, =0.0.2, =0.18.0, =0.21.1 Source cves:...

adyanutils (>=0.4.0, <=0.8.6), binance-futures-connector (>=1.6.0, <=1.7.0) +1 more potentially affected by CVE-2026-115776 via twisted (22.1.0)

twisted PYPI version 22.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - adyanutils =0.4.0, =1.6.0, =1.1.0, =1.1.2 Source cves: CVE-2026-115776 Source advisory: OSV:GHSA-53XC-49M8-P798...

binance-futures-connector (>=1.8.0, <=1.10.0), geonode (4.0.0rc0) +1 more potentially affected by CVE-2026-115776 via twisted (22.2.0)

twisted PYPI version 22.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - binance-futures-connector =1.8.0, =1.10.0 - geonode 4.0.0rc0 - nucypher 6.0.0 Source cves: CVE-2026-115776 Source advisory: OSV:GHSA-53XC-49M8-P7...

binance-connector (>=1.5.0, <=1.9.0), binance-futures-connector (1.5.0) +11 more potentially affected by CVE-2026-115778 via twisted (21.2.0)

twisted PYPI version 21.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - binance-connector =1.5.0, =1.6.1, =0.1.9, =2019.2.3rc0, =0.0.0, =0.5.3, =0.8.0b1.post1, =0.8.0b1, =0.0.10, =0.0.2, =0.18.0, =0.21.1 Source cves:...

adyanutils (>=0.4.0, <=0.8.6), binance-futures-connector (>=1.6.0, <=1.7.0) +1 more potentially affected by CVE-2026-115778 via twisted (22.1.0)

twisted PYPI version 22.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - adyanutils =0.4.0, =1.6.0, =1.1.0, =1.1.2 Source cves: CVE-2026-115778 Source advisory: OSV:GHSA-CWM5-JH59-MWXR...

binance-futures-connector (>=1.8.0, <=1.10.0), geonode (4.0.0rc0) +1 more potentially affected by CVE-2026-115778 via twisted (22.2.0)

twisted PYPI version 22.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - binance-futures-connector =1.8.0, =1.10.0 - geonode 4.0.0rc0 - nucypher 6.0.0 Source cves: CVE-2026-115778 Source advisory: OSV:GHSA-CWM5-JH59-MW...

adyanutils (>=0.4.0, <=0.8.6), binance-futures-connector (>=1.6.0, <=1.7.0) +1 more potentially affected by CVE-2026-115877 via twisted (22.1.0)

twisted PYPI version 22.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - adyanutils =0.4.0, =1.6.0, =1.1.0, =1.1.2 Source cves: CVE-2026-115877 Source advisory: OSV:GHSA-Q7QQ-6MHP-9RC4...

binance-futures-connector (>=1.8.0, <=1.10.0), geonode (4.0.0rc0) +1 more potentially affected by CVE-2026-115877 via twisted (22.2.0)

twisted PYPI version 22.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - binance-futures-connector =1.8.0, =1.10.0 - geonode 4.0.0rc0 - nucypher 6.0.0 Source cves: CVE-2026-115877 Source advisory: OSV:GHSA-Q7QQ-6MHP-9R...

binance-connector (>=1.5.0, <=1.9.0), binance-futures-connector (1.5.0) +11 more potentially affected by CVE-2026-115877 via twisted (21.2.0)

twisted PYPI version 21.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - binance-connector =1.5.0, =1.6.1, =0.1.9, =2019.2.3rc0, =0.0.0, =0.5.3, =0.8.0b1.post1, =0.8.0b1, =0.0.10, =0.0.2, =0.18.0, =0.21.1 Source cves:...

binance-connector (>=1.5.0, <=1.9.0), binance-futures-connector (1.5.0) +11 more potentially affected by CVE-2026-106454 via twisted (21.2.0)

twisted PYPI version 21.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - binance-connector =1.5.0, =1.6.1, =0.1.9, =2019.2.3rc0, =0.0.0, =0.5.3, =0.8.0b1.post1, =0.8.0b1, =0.0.10, =0.0.2, =0.18.0, =0.21.1 Source cves:...

adyanutils (>=0.4.0, <=0.8.6), binance-futures-connector (>=1.6.0, <=1.7.0) +1 more potentially affected by CVE-2026-106454 via twisted (22.1.0)

twisted PYPI version 22.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - adyanutils =0.4.0, =1.6.0, =1.1.0, =1.1.2 Source cves: CVE-2026-106454 Source advisory: OSV:PYSEC-2026-4304...

binance-futures-connector (>=1.8.0, <=1.10.0), geonode (4.0.0rc0) +1 more potentially affected by CVE-2026-106454 via twisted (22.2.0)

twisted PYPI version 22.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - binance-futures-connector =1.8.0, =1.10.0 - geonode 4.0.0rc0 - nucypher 6.0.0 Source cves: CVE-2026-106454 Source advisory: OSV:PYSEC-2026-4304...

adyanutils (>=0.4.0, <=0.8.6), binance-futures-connector (>=1.6.0, <=1.7.0) +1 more potentially affected by CVE-2026-106454 via twisted (22.1.0)

twisted PYPI version 22.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - adyanutils =0.4.0, =1.6.0, =1.1.0, =1.1.2 Source cves: CVE-2026-106454 Source advisory: OSV:GHSA-8PQF-F4M5-798G...

binance-futures-connector (>=1.8.0, <=1.10.0), geonode (4.0.0rc0) +1 more potentially affected by CVE-2026-106454 via twisted (22.2.0)

twisted PYPI version 22.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - binance-futures-connector =1.8.0, =1.10.0 - geonode 4.0.0rc0 - nucypher 6.0.0 Source cves: CVE-2026-106454 Source advisory: OSV:GHSA-8PQF-F4M5-79...

binance-connector (>=1.5.0, <=1.9.0), binance-futures-connector (>=1.5.0, <=1.10.0) +1 more potentially affected by CVE-2026-77528 via autobahn (21.2.1)

autobahn PYPI version 21.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - binance-connector =1.5.0, =1.5.0, =1.6.1, =1.6.2 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-4027...

binance-connector (>=1.5.0, <=1.9.0), binance-futures-connector (>=1.5.0, <=1.10.0) +1 more potentially affected by CVE-2026-77528 via autobahn (21.2.1)

autobahn PYPI version 21.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - binance-connector =1.5.0, =1.5.0, =1.6.1, =1.6.2 Source cves: CVE-2026-77528 Source advisory: OSV:GHSA-HXP9-W8X3-P566...

Blockchain Transaction Simulation Phishing

Cryptocurrency users have increasingly become targets of phishing and scam attacks. To mitigate these threats, leading crypto wallets e.g., MetaMask have introduced transaction simulation, which previews a transaction's balance changes before on-chain execution. While effective against traditiona...

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan RAT associated with the DEVPOPPER malware family. The list of affected packages is as follows - @joyfill/[email protected] @joyfill/[email protected]...

Malicious code in @wagni_bot/binance-sdk (npm)

Source: amazon-inspector ecce8bb9640527041b349f2309b950c39c04ed3b3d4de2477c43acc7144eeabc The package advertises itself as a Binance SDK but ships only postinstall.js, which is wired to both preinstall and postinstall lifecycle hooks. On npm install it recursively walks the user's home directory ...