381 matches found
Malicious Package
Overview vscode-lsp is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Malicious Package
Overview vscode-tsconfig-gen is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...
ZcToken.withdraw() and ZcToken.redeem() will always revert when msg.sender != holder.
Lines of code Vulnerability details Impact ZcToken.withdraw and ZcToken.redeem will always revert when msg.sender != holder. These 2 functions will work only when users withdraw/redeem from their balances. Proof of Concept When we check allowance here, it reverts when allowance is greater than...
Swivel.setFee() is implemented wrongly.
Lines of code Vulnerability details Impact Swivel.setFee is implemented wrongly. Swivel.feenominators won't be set as expected. Proof of Concept This function has a parameter "i" for the index of the new fee denomination but it isn't used during the update. Tools Used Solidity Visual Developer of...
Malicious Package
Overview vscode-ably is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Malicious Package
Overview polaris-for-vscode is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...
WETH.allowance() returns wrong result.
Lines of code Vulnerability details Impact WETH.allowance returns wrong result. I can't find other contracts that use this function but WETH.sol is a base contract and it should be fixed properly. Proof of Concept In this function, the "return" keyword is missing and it will always output 0 in th...
Malicious code in vscode-npm-script (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 904311064c7159e4258f6f03cc79e3e8fe4fe2ab84531940d686732f1cd9ed01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6976 Malicious code in vscode-npm-script (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 904311064c7159e4258f6f03cc79e3e8fe4fe2ab84531940d686732f1cd9ed01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in vscode-bigquery (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fcbaeb030fbe447717dc360ccef29f0624e6c166e7ad6b8ab5670c617009abf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6973 Malicious code in vscode-bigquery (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fcbaeb030fbe447717dc360ccef29f0624e6c166e7ad6b8ab5670c617009abf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1909 Malicious code in citrixdeveloper-vscode (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b05372f8df2c997750bf0c15b685b4ab01bdc3275b2e929a831dc20a90cff0c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in citrixdeveloper-vscode (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b05372f8df2c997750bf0c15b685b4ab01bdc3275b2e929a831dc20a90cff0c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6979 Malicious code in vscode-zk-autocomplete (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef6c5ab582b886133c756b804fd654aed0d7d98e7ef453af9235dfcf1f21e623 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in vscode-zk-autocomplete (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef6c5ab582b886133c756b804fd654aed0d7d98e7ef453af9235dfcf1f21e623 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6978 Malicious code in vscode-stripe (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1d0c32db564ed63889f6b2cbab203b6f3cf1d7b3a76bdc5c32e8637ba4e8a62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in vscode-stripe (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1d0c32db564ed63889f6b2cbab203b6f3cf1d7b3a76bdc5c32e8637ba4e8a62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2065 Malicious code in com.unity.ide.vscode (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 416753a6cbd610d25709fb4492bbc5bd5b1b083e6aa740bd60884c08f94e39c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in vscode-shadowenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf370493190485f5689b02ce2095ad5dd5fbe11fe1a2dc301434173ee6fabf68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6977 Malicious code in vscode-shadowenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf370493190485f5689b02ce2095ad5dd5fbe11fe1a2dc301434173ee6fabf68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...