Malware in contracts-upgradeable

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in contracts-upgradeable (npm)

contracts-upgradeable takes the unscoped name of @openzeppelin/contracts-upgradeable and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in contracts-upgradeable (npm)

contracts-upgradeable takes the unscoped name of @openzeppelin/contracts-upgradeable and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

MAL-2026-18451 Malicious code in contracts-upgradeable (npm)

contracts-upgradeable takes the unscoped name of @openzeppelin/contracts-upgradeable and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

WS-2021-0490

openzeppelin/contracts and openzeppelin/contracts-upgradeable are vulnerable to Initializer reentrancy that may lead to double initialization. Initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an...

@0xwen/core (>=0.0.1, <=0.0.3), @0xwen/core-v5 (>=0.0.1, <=0.0.3) +128 more potentially affected by unknown CVE via @openzeppelin/contracts-upgradeable (>=3.4.0, <=4.3.3)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =2.0.0-alpha.1, =3.0.0-alpha0, =2.0.0-alpha.0, =3.0.1-alpha, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0, =1.0.4 and more Source cves: unknown CVE Source advisory: MEND:WS-2021-0490...

@oasisprotocol/sapphire-contracts (0.2.17), @openwhaleorg/pendle (>=0.1.0, <=0.1.14) +15 more potentially affected by CVE-2025-54070 via @openzeppelin/contracts-upgradeable (>=5.2.0, <=5.3.0)

@openzeppelin/contracts-upgradeable NPM version =5.2.0, =0.1.0, =0.1.0, =0.0.4, =1.0.0, =0.1.0, =0.3.0, =0.5.3, =7.9.0-maine3c28f1, =3.0.0-rc.0, =1.0.0-alpha.1, =0.3.0, =0.3.0, =0.3.2, =0.1.0, =0.3.1 and more Source cves: CVE-2025-54070 Source advisory: OSV:GHSA-9RCW-C2F9-2J55...

@oasisprotocol/sapphire-contracts (0.2.17), @openwhaleorg/pendle (>=0.1.0, <=0.1.14) +15 more potentially affected by CVE-2025-54070 via @openzeppelin/contracts-upgradeable (>=5.2.0, <=5.3.0)

@openzeppelin/contracts-upgradeable NPM version =5.2.0, =0.1.0, =0.1.0, =0.0.4, =1.0.0, =0.1.0, =0.3.0, =0.5.3, =7.9.0-maine3c28f1, =3.0.0-rc.0, =1.0.0-alpha.1, =0.3.0, =0.3.0, =0.3.2, =0.1.0, =0.3.1 and more Source cves: CVE-2025-54070 Source advisory: GHSA-9RCW-C2F9-2J55...

@etherisc/gif-next (>=0.0.2-00080dc-272, <=0.0.2-ff8087d-237), @ethsign/sign-protocol-evm (>=1.0.0, <=1.1.3) +9 more potentially affected by CVE-2024-27094 via @openzeppelin/contracts-upgradeable (>=5.0.0, <=5.0.1)

@openzeppelin/contracts-upgradeable NPM version =5.0.0, =0.0.2-00080dc-272, =1.0.0, =2.5.5, =1.0.0, =1.0.0-beta-rc1, =0.0.1, =1.0.1, =0.1.0-alpha.8, =0.1.0 Source cves: CVE-2024-27094 Source advisory: OSV:GHSA-9VX6-7XXF-X967...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +429 more potentially affected by CVE-2024-27094 via @openzeppelin/contracts-upgradeable (>=4.5.0, <=4.9.5)

@openzeppelin/contracts-upgradeable NPM version =4.5.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =0.2.1-alpha, =0.2.1-beta2 and more Source cves: CVE-2024-27094 Source advisory:...

@etherisc/gif-next (>=0.0.2-00080dc-272, <=0.0.2-ff8087d-237), @ethsign/sign-protocol-evm (>=1.0.0, <=1.1.3) +9 more potentially affected by CVE-2024-27094 via @openzeppelin/contracts-upgradeable (>=5.0.0, <=5.0.1)

@openzeppelin/contracts-upgradeable NPM version =5.0.0, =0.0.2-00080dc-272, =1.0.0, =2.5.5, =1.0.0, =1.0.0-beta-rc1, =0.0.1, =1.0.1, =0.1.0-alpha.8, =0.1.0 Source cves: CVE-2024-27094 Source advisory: GHSA-9VX6-7XXF-X967...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +429 more potentially affected by CVE-2024-27094 via @openzeppelin/contracts-upgradeable (>=4.5.0, <=4.9.5)

@openzeppelin/contracts-upgradeable NPM version =4.5.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =0.2.1-alpha, =0.2.1-beta2 and more Source cves: CVE-2024-27094 Source advisory:...

@etherisc/gif-next (>=0.0.2-00080dc-272, <=0.0.2-ff8087d-237), @ethsign/sign-protocol-evm (>=1.0.0, <=1.1.3) +9 more potentially affected by CVE-2024-27094 via @openzeppelin/contracts-upgradeable (>=5.0.0, <=5.0.1)

@openzeppelin/contracts-upgradeable NPM version =5.0.0, =0.0.2-00080dc-272, =1.0.0, =2.5.5, =1.0.0, =1.0.0-beta-rc1, =0.0.1, =1.0.1, =0.1.0-alpha.8, =0.1.0 Source cves: CVE-2024-27094 Source advisory: MEND:CVE-2024-27094...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +429 more potentially affected by CVE-2024-27094 via @openzeppelin/contracts-upgradeable (>=4.5.0, <=4.9.5)

@openzeppelin/contracts-upgradeable NPM version =4.5.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =0.2.1-alpha, =0.2.1-beta2 and more Source cves: CVE-2024-27094 Source advisory:...

PT-2023-31356

Name of the Vulnerable Software and Affected Versions @openzeppelin/contracts versions 4.9.4 @openzeppelin/contracts-upgradeable versions 4.9.4 Description A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication in the Multicall.sol file. This results in all subcall...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +407 more potentially affected by CVE-2023-40014 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.9.2)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =0.2.1-alpha, =0.2.1-beta2 and more Source cves: CVE-2023-40014 Source advisory:...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +407 more potentially affected by CVE-2023-40014 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.9.2)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =0.2.1-alpha, =0.2.1-beta2 and more Source cves: CVE-2023-40014 Source advisory:...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +407 more potentially affected by CVE-2023-40014 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.9.2)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =0.2.1-alpha, =0.2.1-beta2 and more Source cves: CVE-2023-40014 Source advisory:...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +333 more potentially affected by CVE-2023-34459 via @openzeppelin/contracts-upgradeable (>=4.7.0, <=4.8.3)

@openzeppelin/contracts-upgradeable NPM version =4.7.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =3.1.0 - @abheektripathy/nftpass 1.1.0 and more Source cves: CVE-2023-34459 Source...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +333 more potentially affected by CVE-2023-34459 via @openzeppelin/contracts-upgradeable (>=4.7.0, <=4.8.3)

@openzeppelin/contracts-upgradeable NPM version =4.7.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =3.1.0 - @abheektripathy/nftpass 1.1.0 and more Source cves: CVE-2023-34459 Source...