Malicious code in web3-tools-9 (npm)

Note: This report is updated by a verification record Crypto/SSH/wallet stealer, confirmed sibling of blockchain-helper-0 c960. postinstall scripts/postinstall.js auto-execs, src/index.js harvests /.ssh/idrsa + wallet keys/seeds + env, self-labels "CRYPTO STEALER", exfils to IDENTICAL hardcoded...

MAL-2026-5361 Malicious code in web3-tools-9 (npm)

Note: This report is updated by a verification record Crypto/SSH/wallet stealer, confirmed sibling of blockchain-helper-0 c960. postinstall scripts/postinstall.js auto-execs, src/index.js harvests /.ssh/idrsa + wallet keys/seeds + env, self-labels "CRYPTO STEALER", exfils to IDENTICAL hardcoded...

MAL-2026-5338 Malicious code in solana-web3-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af1a2f1a7c7e3bddb9c8d2fcb8a4c86a6755763c94b95b1eddb81f382318c432 Malicious typosquat impersonating the legitimate Solana Python SDK solana / solana-py and the JS @solana/web3.js. The package ships no SDK...

Malicious code in solana-web3-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af1a2f1a7c7e3bddb9c8d2fcb8a4c86a6755763c94b95b1eddb81f382318c432 Malicious typosquat impersonating the legitimate Solana Python SDK solana / solana-py and the JS @solana/web3.js. The package ships no SDK...

Malicious code in solana-cli-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80ee640ddeeacc31a125ec0fcc11dcb5f9a23e18f5ed003ce2dfcb1de8bbe1dd On import solanaclipy, the package's top-level init.py unconditionally invokes report, which harvests standard developer-side secret material and POS...

MAL-2026-5336 Malicious code in solana-cli-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80ee640ddeeacc31a125ec0fcc11dcb5f9a23e18f5ed003ce2dfcb1de8bbe1dd On import solanaclipy, the package's top-level init.py unconditionally invokes report, which harvests standard developer-side secret material and POS...

Malicious code in solana-web3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4967ebad2d1f4f5802ef50f1d399c05c4dfab94a208079695570b15ffef0fdd2 On import, solana-web3/init.py executes a credential-stealer payload. After a sandbox-evasion gate checks for 12-hex Docker hostname, /.dockerenv, an...

MAL-2026-5337 Malicious code in solana-web3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4967ebad2d1f4f5802ef50f1d399c05c4dfab94a208079695570b15ffef0fdd2 On import, solana-web3/init.py executes a credential-stealer payload. After a sandbox-evasion gate checks for 12-hex Docker hostname, /.dockerenv, an...

MAL-2026-5339 Malicious code in spl-token-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e05ba3043dc87365ee0b1dc44cc58243b34b6cdccdf258c5bb9218a06a65d336 On import spltokenpy, the package's init.py collects sensitive files from the installer's machine — /.config/solana/id.json Solana wallet key,...

Malicious code in spl-token-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e05ba3043dc87365ee0b1dc44cc58243b34b6cdccdf258c5bb9218a06a65d336 On import spltokenpy, the package's init.py collects sensitive files from the installer's machine — /.config/solana/id.json Solana wallet key,...

CVE-2024-0258

creationtimestamp| type| source ---|---|--- 2026-06-08 21:00:04+00:00| published-proof-of-concept| Telegram/Ntg-ofD3LMIChp1i2CdfsMqFjxuqWO46POI-bnFaiH8mdGw...

CVE-2024-33421

creationtimestamp| type| source ---|---|--- 2026-06-08 15:00:06+00:00| published-proof-of-concept| Telegram/UmuNY4LfBfSUFX5R-uebZvyX1exydUHga06-YUYbEohmm0 2026-07-12 12:00:05+00:00| seen| https://t.me/GithubRedTeam/87855 2026-07-13 00:00:44+00:00| seen| https://t.me/GithubRedTeam/87855...

CVE-2024-31509

creationtimestamp| type| source ---|---|--- 2026-06-08 15:00:06+00:00| published-proof-of-concept| Telegram/UmuNY4LfBfSUFX5R-uebZvyX1exydUHga06-YUYbEohmm0...

CVE-2025-43537

creationtimestamp| type| source ---|---|--- 2026-06-08 15:00:06+00:00| published-proof-of-concept| Telegram/UmuNY4LfBfSUFX5R-uebZvyX1exydUHga06-YUYbEohmm0...

CVE-2008-1930

creationtimestamp| type| source ---|---|--- 2026-06-08 15:00:06+00:00| published-proof-of-concept| Telegram/UmuNY4LfBfSUFX5R-uebZvyX1exydUHga06-YUYbEohmm0 2026-08-02 11:51:57+00:00| seen| https://gist.github.com/0x9fury/f506159fd3ab6ce25a54856db53d7545...

CVE-2019-5513

creationtimestamp| type| source ---|---|--- 2026-06-06 23:00:13+00:00| published-proof-of-concept| Telegram/c7MXyeATNZD0sK1-5d5OILU8MuRduQZLfHBlkOmRENhSMHg 2026-06-07 03:00:04+00:00| published-proof-of-concept| Telegram/DV1znv9vfOFGXjV6Dcx30r1JPpntqfr1WGM50vjHajFnEYw...

CVE-2026-25860

creationtimestamp| type| source ---|---|--- 2026-06-05 17:00:04+00:00| seen| https://t.me/GithubRedTeam/87464 2026-06-05 19:00:11+00:00| published-proof-of-concept| Telegram/vT4GraR1tGy8kb2p0gDblUF32yKb9Lm75V4SoCKaucAr0 2026-06-05 21:00:04+00:00| published-proof-of-concept|...

CVE-2026-31266

creationtimestamp| type| source ---|---|--- 2026-06-05 15:00:04+00:00| seen| https://t.me/GithubRedTeam/87450...

CVE-2025-58807

creationtimestamp| type| source ---|---|--- 2026-06-05 03:00:06+00:00| seen| Telegram/w0GkJHs0a-iOGxRnRQVAJ6txbFx-4W5StLXj-Qhn1zDpC10...

CVE-2026-26555

creationtimestamp| type| source ---|---|--- 2026-06-04 23:00:15+00:00| seen| Telegram/ZO8GXKofeRUVwVPphXUXme80ypLutlvGOITV9wiiQ1h3jLc 2026-06-05 03:00:06+00:00| seen| Telegram/w0GkJHs0a-iOGxRnRQVAJ6txbFx-4W5StLXj-Qhn1zDpC10...