Malicious Package

Overview bitensor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a typosquatting campaign targeting the Bittensor ecosystem. The goal of the attackers is to steal cryptocurrency from...

Malicious Package

Overview qbittensor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a typosquatting campaign targeting the Bittensor ecosystem. The goal of the attackers is to steal cryptocurrency from...

Malicious Package

Overview bittenso-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a typosquatting campaign targeting the Bittensor ecosystem. The goal of the attackers is to steal cryptocurrency fro...

Malicious code in ape-staking-public (npm)

The package ape-staking-public was found to contain malicious code...

MAL-2025-14631 Malicious code in ape-staking-public (npm)

The package ape-staking-public was found to contain malicious code...

Malicious code in staking-eth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4731478e6aab60180622e956a2bb2f96e9fc476bad9c3e95b18183e8cb7ccbe2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in staking-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed875e99aa706cdf029805b265862f59262c88e1e713e3acc53b2cb78fa82ac4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4509 Malicious code in staking-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed875e99aa706cdf029805b265862f59262c88e1e713e3acc53b2cb78fa82ac4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in staking-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb6f84262bc3391750bfa34e411cac0d29c2bf8574e291b22e0a700bb0734554 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4287 Malicious code in staking-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb6f84262bc3391750bfa34e411cac0d29c2bf8574e291b22e0a700bb0734554 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the improper handling of gas limits in precompile executions. An attacker can manipulate the state of the blockchain by causing certain functions to execute with insufficient gas, leading to incomplete...

Malicious code in dforce-staking-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51b7aa18ddef6a3d8adeb5b58454b0054055db56c5d22718d55544b309b8bc0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3761 Malicious code in dforce-staking-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51b7aa18ddef6a3d8adeb5b58454b0054055db56c5d22718d55544b309b8bc0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fireblocks-staking-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2372 Malicious code in fireblocks-staking-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-37153

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that...

PT-2024-27337 · Evmos · Evmos

Name of the Vulnerable Software and Affected Versions: Evmos versions prior to V18.1.0 Description: The issue is related to liquid staking using Safe, which is a contract. The bug appears when there is a local state change together with an ICS20 transfer in the same function, and it uses the...

Staking functionality temporary blocking due to lack of address zero check

Lines of code Vulnerability details Impact Though lack of zero check issue for the addToBlacklist function is already at the automated findings output, I suppose it is necessary to show the importance of this check here. In case of accidental or malicious the BLACKLISTMANAGERROLE behavior the...

Malicious user can completely prevent all users or users without large funds from staking

Lines of code Vulnerability details Vulnerability Details To prevent the issue with the first-depositor attack donation attack as written in the comments of checkMinShares in StakedUSDe.sol to the staking vault, the checkMinShares function is implemented in the StakedUSDe.sol contract when...

Circumvention of soft staking restrictions in StakedUSDeV2 through indirect ERC20 token transfers

Lines of code Vulnerability details Summary The StakedUSDeV2 in the Ethena protocol is designed to allow users to stake USDe tokens and earn rewards. The protocol includes roles and restrictions to manage the staking process, such as SOFTRESTRICTEDSTAKERROLE and FULLRESTRICTEDSTAKERROLE. However,...