Malicious code in @spot-dapp/web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92f4a0dbb684268d2185a11b14a430fd159ea41f2c34bfd08c712c3fb1c6f45 The package @spot-dapp/web was found to contain malicious code...

MAL-2026-1637 Malicious code in @spot-dapp/web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92f4a0dbb684268d2185a11b14a430fd159ea41f2c34bfd08c712c3fb1c6f45 The package @spot-dapp/web was found to contain malicious code...

Supply Chain Attack

@metamask/sdk, @metamask/sdk-communication-layer, and @metamask/sdk-react are vulnerable to Supply Chain Attack. The vulnerability is due to a compromised debug package that injected malicious code, allowing attackers to intercept or tamper with dApp-to-wallet communications...

Malicious code in world-id-lens-dapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d27d63976b7108297f8d9a29062b3add9973c83849fd5ab7cd8fbd31b0248701 The OpenSSF Package Analysis project identified 'world-id-lens-dapp' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-4670 Malicious code in world-id-lens-dapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d27d63976b7108297f8d9a29062b3add9973c83849fd5ab7cd8fbd31b0248701 The OpenSSF Package Analysis project identified 'world-id-lens-dapp' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-11054 Malicious code in nft-dapp-starter-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b97b6a233f40dca2413760c7d1f9a8cafb4a0ed8099ab831ebbe6e8a0fba6ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dapp-test-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 223b529f6331e7956b2e49069f8446746e4a8b25ebee059c4de01f152bbd5cc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10851 Malicious code in dapp-test-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 223b529f6331e7956b2e49069f8446746e4a8b25ebee059c4de01f152bbd5cc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Multiple addresses can point to the same cidNFTID

Lines of code Vulnerability details Impact During AddressRegistry.register there is no check to ensure that a cidNFTID has been registered to an address. As CID NFT is transferrable, this means that the same CID NFT can be registered by multiple addresses. This could cause troubles for Dapps that...

Malicious Package

Overview dapp-inter is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview dapp-inter-agservers is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious code in embark-dapp-test-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14ee29d9b1a34c42ed3af3298d81f35bed6803a2e82d22cc3e3ddc48258ae088 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2712 Malicious code in embark-dapp-test-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14ee29d9b1a34c42ed3af3298d81f35bed6803a2e82d22cc3e3ddc48258ae088 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dapp-inter-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8fcf001a6eccc375e5a6be29d2f776607852bbc83af260d0e18ecf0b0b2272b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2328 Malicious code in dapp-inter-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8fcf001a6eccc375e5a6be29d2f776607852bbc83af260d0e18ecf0b0b2272b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2326 Malicious code in dapp-inter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7896c78fa6966c4f1f14b3c18ac93259d9b7798a3ef0ad785bec4b65bba4833b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dapp-inter-agservers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2725f08125ad49db6e4beb536c94c7c696b83eaf8a823a70d2cea9279677e568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dapp-inter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7896c78fa6966c4f1f14b3c18ac93259d9b7798a3ef0ad785bec4b65bba4833b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2327 Malicious code in dapp-inter-agservers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2725f08125ad49db6e4beb536c94c7c696b83eaf8a823a70d2cea9279677e568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

arbitraryCall enables streamCreator to remove incentive tokens before endStream

Handle bitbopper Vulnerability details Impact streamCreator can remove incentive tokens before endStream by calling approve on the token beforehand. streamCreator has following methods of attack: guess from whom and with what he is going to be incentiviced listen in the mempool and win PGA in ord...