Malicious code in blockstack-stats (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01c989174a7c793669e083cc1eb35355f5af108994fab317b0b01d11c443a3f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Hiro: EXIF Geolocation Data Not Stripped From Uploaded Images

The Blockstack Browser does not strip EXIF data on avatar uploads...

Hiro: Blockstack Browser For Mac leaks "Core API Password" to 3rd parties

Hi Blockstack! 😃 I noticed that BlockStack Browser for Mac version is leaking the CoreAPIPassword via Referer Header to several websites: appco.imgix.net a third party site! F471236 api.app.co seems to have some blockstack affiliation? F471235 browser-api.blockstack.org F471237 Steps to Reproduce...

Hiro: REDIRECTION VULNERABILITY/HOST HEADER INJECTION VULNERABILITY

Hiii.. This is vyshnav nk i need to address you a vulnerability i have found in https://github.com/blockstack/blockstack-core/ https://github.com/blockstack/blockstack-core/ is vulnerable to host header injection/redirection vulnerability.. IMPACT:- Attack vectors are somewhat limited but depends...

Hiro: Weak crossdomain.xml

The e-mail list management service used by Blockstack operated by MailChimp has a lenient cross-domain flash policy -- this is not a vulnerability, however, the crossdomain.xml used by the mailing service is more lenient than used by normal web services...

Hiro: Clickjacking https://blockstack.org/

https://blockstack.org/ does not return an X-FRAME-OPTIONS header. However, because blockstack.org does not contain any endpoints where the UI is rendered to invoke a state change action on behalf of users, we do not believe that click-jacking presents a security vulnerability. see this informati...