SVG script injection in Bio.tokenURI

Lines of code Vulnerability details Impact Bio.tokenURI function returns an encoded SVG that is supposed to be parsed by a browser or another tool. A hacker can inject a malicious script in the SVG element by minting Bio NFT with a bio with a javascript .... Depending on how this SVG element is...

Threat Roundup for March 10 to March 17

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 10 and March 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

Lookalike Telegram and WhatsApp Websites Distributing Cryptocurrency Stealing Malware

Copycat websites for instant messaging apps like Telegram and WhatApp are being used to distribute trojanized versions and infect Android and Windows users with cryptocurrency clipper malware. "All of them are after victims' cryptocurrency funds, with several targeting cryptocurrency wallets," ES...

Upgraded Q -> 2 from #345 [1678798679676]

Judge has assessed an item in Issue 345 as 2 risk. The relevant finding follows: Issue 2 - Undermining the fairness of the protocol in swapSource and possibilities for stealing a jackpot --- The text was updated successfully, but these errors were encountered: All reactions...

MAL-2023-6974 Malicious code in tpcraftcraftencode (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d51287043143cc2b77dac9f3dac8fe7c54c6e797cee2425b1a581c4565357235 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6777 Malicious code in selfvisapaypalmine (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 3a524c8256175ba1602631d62ca2c164baceef5887f1703949ab0176bb3b458d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-2934 Malicious code in esqguiproofad (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 2038f714e65a7ca4986eb7682c8618bbe9cef3aa2ae698dfb2a8321669c84b29 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in selfmccontrolstudy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d03dd732353d8a4b704ceabee4dac2c38a0adcb3b1f0dd06041b97a2199dd0fe EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in py-controlpingcraft (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8c99058f83d5f7d5e4269c4fa6066cc572cac0bca48b23b4d296b84a9b658bdd EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6320 Malicious code in selfmccontrolstudy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d03dd732353d8a4b704ceabee4dac2c38a0adcb3b1f0dd06041b97a2199dd0fe EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-2760 Malicious code in esqccpongcpu (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c15d17f192fef96f3398bc91fe19bdcbcca1aa284532b9c0db068eefc1160732 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tpcvadlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d758227301a575ffb8843cdccd4734a806e1bfdee3cc21fbe9e54839748acdbc EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4046 Malicious code in libguireplaceram (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx cbbea9652c38c8cd9deb9c7b785c144b58d88c893c24c59a0a97dc0c10f7978c EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4035 Malicious code in libguigrandmc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6aecdbe6b089ffe59ba97add73503b78ab4c6dc432a5b733ed03687c146effbf EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-2770 Malicious code in esqccstringmask (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ad3667ef6b7620604468e627b774f2339b75086dc8eb705cbaaa95acd784e178 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in selfedgamestudy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c130221eaf03a61a98af0a0a5d361a3d0e2b43e20b9dfe8b746999505f986329 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in py-mcultracraft (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 05f872d3d839e83f4cfa6a29e16e93759396a58f0bb74d8f93ec8f14420b0a40 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4315 Malicious code in libpingreintel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 905aa24883834e7a2283436c5d1bfa4a55a49714f4912738ee4c1e38ec413eed EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6033 Malicious code in selfedgamestudy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c130221eaf03a61a98af0a0a5d361a3d0e2b43e20b9dfe8b746999505f986329 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tpcvurlpong (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 001eabd8aa23a93db2f17fe69268f9eba2dece879e5cde7dbc93297d6d6279f6 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...