Malicious code in ignite-market-contractstest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9babd9b088785649368dbf885050b6a15b218a6b38d2dcd058f0c9eda5109da package.json declares a preinstall lifecycle hook that runs wget --quiet...

MAL-2026-4583 Malicious code in ignite-market-contractstest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9babd9b088785649368dbf885050b6a15b218a6b38d2dcd058f0c9eda5109da package.json declares a preinstall lifecycle hook that runs wget --quiet...

Malicious Package

Overview seaport-core-16 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-2636 Malicious code in seaport-core-16 (npm)

Package exfiltrates user info to a remote server via wget in test, preinstall, and preupdate scripts. Very few published versions. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be2cd9e6e61b20566214a0627d5923ec7cbe799e9757d25fd883f46616e5b58b The package...

Malicious code in seaport-core-16 (npm)

Package exfiltrates user info to a remote server via wget in test, preinstall, and preupdate scripts. Very few published versions. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be2cd9e6e61b20566214a0627d5923ec7cbe799e9757d25fd883f46616e5b58b The package...

Malicious code in immutable-seaport (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d0c3932175941cfb3e5c2e6d1807cec6b147c92543a4a46e15833d6fe6837bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8597 Malicious code in immutable-seaport (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d0c3932175941cfb3e5c2e6d1807cec6b147c92543a4a46e15833d6fe6837bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

There is a potential vulnerability with the nonce not incrementing as expected if there is an error or revert during the seaport flow

Lines of code Vulnerability details Impact This would allow the attacker to reuse the same nonce in multiple seaport transactions by reverting the first transaction after processNonce increments the stored nonce. Proof of Concept There is a potential issue with the nonce not incrementing as...

Wrong input hash given to decodeType function in CreateOffererHelpers library

Lines of code Vulnerability details Impact The RegistryHashes.decodeType function is supposed to take a specific bytes32 hash as input with an encoded token type in the last bytes to know token type is used, but when this function is called in the CreateOffererHelpers library it is given a simple...

Malicious code in seaport-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7c3daf7c2577a44884df2696c8fc7fbc4329e375acf9565ddb84ee007686ec2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-766 Malicious code in seaport-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7c3daf7c2577a44884df2696c8fc7fbc4329e375acf9565ddb84ee007686ec2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Upgraded Q -> 3 from #268 [1677186221526]

Judge has assessed an item in Issue 268 as 3 risk. The relevant finding follows: code423n4 commented on Jan 17 Lines of code Vulnerability details Impact As there is no callback in Seaport 1.1. When listing on OpenSea, Astaria adds an additional item to be received along with payment token. It is...

Malicious code in seaport-gossip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcea3993c918d92835f94dd8679cc99510db8b2eddbdd18ab217a46eb283ba86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5988 Malicious code in seaport-gossip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcea3993c918d92835f94dd8679cc99510db8b2eddbdd18ab217a46eb283ba86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Seaport proxy is missing ERC20 approval, so it can't buy any order that is listed using an ERC20

Lines of code Vulnerability details Impact Seaport proxy is missing ERC20 approval, so it can't buy any order that is listed using an ERC20. Proof of Concept function execute BasicOrder calldata orders, bytes calldata ordersExtraData, bytes calldata extraData, address recipient, bool isAtomic,...

Buyer can take from a seller an item they had not offered

Lines of code Vulnerability details Impact Orders in Seaport can involve "criteria-based items", in which case it isn't one specific item that can fulfill the order but any one of a set of items. This set of items is the "criteria", and it is specified in the order as the merkle root of a merkle...

Integer Overflow in Nonce Possible Via EIP 1271 Compliant Contract

Lines of code Vulnerability details Impact The current NonceManager deployed version does not expect a nonce to go as high to actually trigger an integer overflow and is therefore, unchecked. However, it is completely possible to have the nonce go as high with EIP 1271 contracts that hold the NFT...

Malicious offerers can easily create lots of invalid offers

Lines of code Vulnerability details Impact Creating an offer is pretty convenient in Seaport. Offerers don’t have to give the offered items to Seaport. They just need to make sure that when someone tries to fulfill their order, they already set the sufficient approvals. However, this convenience...

Restricted Trades Vulnerable to Stolen Items Being Traded

Lines of code Vulnerability details Impact The current contract does not check for stolen items. Traditionally, Opensea has frozen items that are stolen based on its stolen item policy. It was possible to do so on Opensea at the UI level. However, with Seaport, anyone can list a restricted trade...

A malicious filler can fill a partial order in such a way that the rest cannot be filled by anyone

Lines of code Vulnerability details Impact For filling a partial order, because Seaport accepts any representation of a fraction, a malicious filler can provide a giant fraction unreduced. This would severely limit what orders can be filled afterwards and in some cases making any more fills...