10 matches found
MAL-2026-13214 Malicious code in @zzzcrypto/solana-spl-token (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ceac45508e2f9506a082b2195d3bae4b046f096d11856d72ea53f784ad5992e @zzzcrypto/[email protected] is a typosquat/impersonation of @solana/spl-token README self-describes as a 'drop-in replacement'; author metadata...
Malicious code in @solana-labs/spl-toke (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e2ec34996ab8cff20d9ba12cd9f5a8a75346c4e5e25d7c3fd5adc7bb7045f64 Package name @solana-labs/spl-toke is a likely confusion-attack against the well-known @solana/spl-token SPL token client missing trailing n, differe...
Malicious Package
Overview spl-token-py is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in spl-token-py (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e05ba3043dc87365ee0b1dc44cc58243b34b6cdccdf258c5bb9218a06a65d336 On import spltokenpy, the package's init.py collects sensitive files from the installer's machine — /.config/solana/id.json Solana wallet key,...
MAL-2026-5339 Malicious code in spl-token-py (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e05ba3043dc87365ee0b1dc44cc58243b34b6cdccdf258c5bb9218a06a65d336 On import spltokenpy, the package's init.py collects sensitive files from the installer's machine — /.config/solana/id.json Solana wallet key,...
Malicious code in spl-token-v2 (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e11bf75d7bf296658cc93ae700f5656d24c455151b1cb8db46389ec375fbc286 Any computer that has this package installed or running should be considered...
MAL-2025-6127 Malicious code in spl-token-v2 (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e11bf75d7bf296658cc93ae700f5656d24c455151b1cb8db46389ec375fbc286 Any computer that has this package installed or running should be considered...
GHSA-H6XM-C6R4-VMWF Unsound usages of `u8` type casting in spl-token-swap
The library provides a safe public API unpack to cast u8 array to arbitrary types, which can cause to undefined behaviors. The length check of array can only prevent out-of-bound access on the return type. However, it can't prevent misaligned pointer when casting u8 pointer to a type aligned to...