Malicious code in crypto-trading-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 20c37efbefbfb1922a205d954cdb5666103fd3e343a67e89dc19694ad5b64ef0 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-12082 Malicious code in crypto-trading-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 20c37efbefbfb1922a205d954cdb5666103fd3e343a67e89dc19694ad5b64ef0 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in bip39-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c188f84ee0ad8238ed89a94673968e9f17c44d91d25dfe8012efd39e01705081 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-12080 Malicious code in bip39-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c188f84ee0ad8238ed89a94673968e9f17c44d91d25dfe8012efd39e01705081 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Hidden Ciphers and Where to Find Them: Static Discovery and Assessment of Cryptographic Assets in Software

Modern software systems rely on cryptography for data protection, authentication, and trust establishment, yet organizations often lack a structured view of the cryptography deployed across source code, configuration, dependencies, and cryptographic files. This lack of visibility complicates...

Fedora 45 : rust-crypto-auditing / rust-crypto-auditing-agent / etc (2026-160ff29e13)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-160ff29e13 advisory. Update to 0.3.2 release with security fixes in dependencies: - RUSTSEC-2026-0007 - RUSTSEC-2026-0009 Tenable has extracted the preceding description block...

CLSA-2026-1770682157 TuxCare security update for net.i2p.crypto:eddsa (1 CVE)

TuxCare rebuilt net.i2p.crypto:eddsa to address 1 CVE. Fixed in 0.3.0-tuxcare.1...

Malicious code in psbt-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 82a309d768af6a39f95bb4f7c9f5d8548a95f0074613985f49f0513420dae9fa The code advertised as a firmware upgrader for hardware wallets in fact downloads an infostealer. The stealer searches the machine for cryptocurrency sensitive...

MAL-2026-11521 Malicious code in psbt-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 82a309d768af6a39f95bb4f7c9f5d8548a95f0074613985f49f0513420dae9fa The code advertised as a firmware upgrader for hardware wallets in fact downloads an infostealer. The stealer searches the machine for cryptocurrency sensitive...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses

A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak p...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

Malicious code in psbt-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40293a9b1851f25decc83d08f82fab01f1f373d95e13dc937575b7182d470720 psbt-utils presents itself as a PSBT/Bitcoin wallet signing library handling WIF and hex private keys. update.py contains a fetchanddecrypt loader th...

MAL-2026-11520 Malicious code in psbt-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40293a9b1851f25decc83d08f82fab01f1f373d95e13dc937575b7182d470720 psbt-utils presents itself as a PSBT/Bitcoin wallet signing library handling WIF and hex private keys. update.py contains a fetchanddecrypt loader th...

Multiple vulnerabilities in DEEBOT PRO M1, DEEBOT PRO K1VAC and ECOVACS PRO App

Overview Robotic cleaners DEEBOT PRO M1 and DEEBOT PRO K1VAC, and mobile app ECOVACS PRO App developed by ECOVACS ROBOTICS contain multiple vulnerabilities. They are provided in Japan by Hellohas Robotics Inc. web server for debugging purposes remains enabled CWE-489 - CVE-2026-66403 Missing serv...

Malicious code in coldcard-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aea0829143169ee7227c8974c3b42125e95b89387a00ccb2b37d1d7344b041a The package presents itself as a helper for the Coldcard hardware wallet, but its actual behavior is credential and wallet theft. setup.py detects...

MAL-2026-11516 Malicious code in coldcard-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aea0829143169ee7227c8974c3b42125e95b89387a00ccb2b37d1d7344b041a The package presents itself as a helper for the Coldcard hardware wallet, but its actual behavior is credential and wallet theft. setup.py detects...

PT-2026-74038

TuxCare rebuilt crypto-js to address 1 CVE. Fixed in 3.3.0-tuxcare.1...

ALSA-2026:49838 Important: osbuild-composer security, bug fix, and enhancement update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: crypto/x50...

Important: osbuild-composer security, bug fix, and enhancement update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: crypto/x50...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...