Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm registry to steal cryptocurrency wallet private keys and mnemonic seed phrases. The compromised version, @injectivelabs/[email protected] , came embedded wi...

MAL-2026-5443 Malicious code in exodus-wallet-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53bf93b626689e980ef2e9c4ba33fd95e81d6a04c665f85908c8cf07b8b36e14 Package name impersonates the Exodus cryptocurrency wallet brand. package.json declares "postinstall": "node src/canary.js", and src/canary.js perfor...

CVE-2025-66692

A buffer over-read in the PublicKey::verify method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-66692

A buffer over-read in the PublicKey::verify method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service DoS via a crafted input...

Buffer Over-read

Overview @trustwallet/wallet-core is a mobile-focused library implementing low-level cryptographic wallet functionality for a high number of blockchains Affected versions of this package are vulnerable to Buffer Over-read via the verify function. An attacker can cause the application to crash or...

Buffer Over-read

Overview trustwallet/wallet-core is a mobile-focused library implementing low-level cryptographic wallet functionality for a high number of blockchains Affected versions of this package are vulnerable to Buffer Over-read via the verify function. An attacker can cause the application to crash or...

CVE-2025-66692

A buffer over-read in the PublicKey::verify method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service DoS via a crafted input...

Trust Wallet Core security vulnerability

Trust Wallet Core is an open-source, cross-platform, mobile-centric library developed by Trust Wallet. Versions of Trust Wallet Core prior to 5668c67 contained a security vulnerability. This vulnerability stemmed from an excessive buffer read in the PublicKey::verify method, which could lead to...

CVE-2025-66692

A buffer over-read in the PublicKey::verify method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-66692

CVE-2025-66692 affects Binance - Trust Wallet Core. A buffer over-read in PublicKey::verify() prior to commit 5668c67 enables DoS via crafted input. Affected: Trust Wallet Core library; root cause: buffer over-read in verify(). Remediation: upgrade wallet-core to 4.4.0+ (e.g., 4.4.0 or newer). Ex...

PT-2026-3650

A buffer over-read in the PublicKey::verify method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-66692

A buffer over-read in the PublicKey::verify method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-66692

A buffer over-read in the PublicKey::verify method of Binance - Trust Wallet Core before commit 5668c67 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

EUVD-2025-199201

Malicious code in victoriaxoaquyet-wallet-core npm...

Malicious code in victoriaxoaquyet-wallet-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c392a47bef024ed55b8fa5f13c1629cc9565b281683139ffd90449d4868386 The package victoriaxoaquyet-wallet-core was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191150 Malicious code in victoriaxoaquyet-wallet-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c392a47bef024ed55b8fa5f13c1629cc9565b281683139ffd90449d4868386 The package victoriaxoaquyet-wallet-core was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199207

Malicious code in victoria-wallet-core npm...

Malicious code in victoria-wallet-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 924849bafc2cba1cd7f57e91e4081641157914e17ec847844133b3b281afebcd The package victoria-wallet-core was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191146 Malicious code in victoria-wallet-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 924849bafc2cba1cd7f57e91e4081641157914e17ec847844133b3b281afebcd The package victoria-wallet-core was found to contain malicious code. Source: ghsa-malware...