MAL-2026-16088 Malicious code in pumpswap-sdk-v1 (npm)

[email protected] presents crypto helpers for the PumpSwap SDK, but validateinput base64-encodes its argument and POSTs it to https://pumpswap-sdk.maingoal.xyz/v1/check through checkvalidator in dist/index.js, and randomBytessize forwards the hex output of crypto.randomBytes to the same host...

Malicious code in pumpswap-sdk-v1 (npm)

[email protected] presents crypto helpers for the PumpSwap SDK, but validateinput base64-encodes its argument and POSTs it to https://pumpswap-sdk.maingoal.xyz/v1/check through checkvalidator in dist/index.js, and randomBytessize forwards the hex output of crypto.randomBytes to the same host...

Malicious code in @pumpswap-sdk4/metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00e7cebe75e2b9e547a927e980ce03c494aa875762beaba4541eb71ef7222566 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-32656

Malicious code in @pumpswap-sdk4/metadata npm...

Malicious Package

Overview @pumpswap-sdk4/metadata is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

MAL-2025-47969 Malicious code in @pumpswap-sdk4/metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00e7cebe75e2b9e547a927e980ce03c494aa875762beaba4541eb71ef7222566 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4112 Malicious code in pumpswap-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f6871522b8b5eebb3eca021b1ead1d42bf21998277934139af4406375de5558 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pumpswap-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f6871522b8b5eebb3eca021b1ead1d42bf21998277934139af4406375de5558 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...