CVE-2026-104891 mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control

mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met...

CVE-2026-104891

The @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate packages are vulnerable to an authentication bypass where the software grants free-access receipts based on a wallet address provided in the client-supplied credential.source. The underlying cause is that the system fails to ...

Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites

Attackers modified a JavaScript file served by advertising technology company Adform , turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. Adform detected the incident on July 27, 2026, removed the malicious code, notified affected clients, and reported it to...

Malicious code in yyfinance (PyPI)

Source: checkmarx 35d5ed409824036fc8a52f2193726266e276f1458a5b1fd8c79044eba9590eff Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in ypcodestyle (PyPI)

Source: checkmarx 5c9179a7e95371d31eb4fa1c785548c02eba03a736ebf5372a871b5ea2e8fd55 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yfiance (PyPI)

Source: checkmarx 6c722a77439d6a24ce5b4c77e728ac92edde6c7327fc6849f363376cef1f1421 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yffinance (PyPI)

Source: checkmarx 197adcb4a9df9852620e9e93578b7ce77d3e1348d77521056dc0426405a7dd0a Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yfinannce (PyPI)

Source: checkmarx bcde32d3b23b41e9f99f4137a2fe5ee6eb7fb1324cc8ea86acfb3481ccc82cff Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yfinanec (PyPI)

Source: checkmarx d81489f6e919c12171b1655da889187a032f7ef27746fdfc6dda5c9b811e994b Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in yfinnance (PyPI)

Source: checkmarx b7a38ccdca93d7c136aa29f82ca37564a4cc93a9794a54db65323a6d5fba7586 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in xsxwriter (PyPI)

Source: checkmarx de9ffb88108cef8af4bba32e2ef88b570b329f16448ee849ef43b16ddfeb10f8 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in xllsxwriter (PyPI)

Source: checkmarx 905a95727e94a3d5f476afb63bd28661f7803bf14cc1e4c42f035a446804d756 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in xlsxrwiter (PyPI)

Source: checkmarx 4999fa2cca5fcc18318f83359fbc51d0297ba5b36bbd22dfb6fc84fcaad8c387 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in xlsxxwriter (PyPI)

Source: checkmarx a2bacf1d61fba73dbbccfd6a010dc91f2716efbfa298af08516f46185c13479e Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in wwebsocket-client (PyPI)

Source: checkmarx c5641c17f0936710ba606db1f88a8a964d11f352cebacdcec2c1bf55889debfa Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websokets (PyPI)

Source: checkmarx e8b6f01e8e4ba4dd4d17c1e52ce6ad43d998bbf82b8d5ffa2375d4756437803d Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in wesocket-client (PyPI)

Source: checkmarx 7eadcb411e8d5861ac9390ee335fc77fb5ac4eab3d83c72290380c882bad7624 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-cliet (PyPI)

Source: checkmarx 06412b694edd65cdb47e2702e6629ceb27ac0ab4d17846860a687a380d14c94c Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websockes (PyPI)

Source: checkmarx 2ab13886d1645a850a6309eb8632746bdf06a6ed86aceafc9d90fe2ee7cf3d4f Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-clietn (PyPI)

Source: checkmarx 81783882612ba7b6fae545c40b498a476222def4eab8e8b779ff41cefcb93e3d Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...