Embedded Malicious Code

Overview prebid is a malicious package. This package version contains malicious code that monitors network traffic when run in a browser and targets crypto transactions. The injected malicious code activates a hook whenever a Web3 wallet is present. Once triggered, it intercepts and alters any...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious code that monitors network traffic when run in a browser and targets crypto transactions. The injected malicious code activates a hook whenever a Web3 wallet is present...

Embedded Malicious Code

Overview supports-hyperlinks is a Detect whether a terminal supports hyperlinks Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious code that monitors network traffic when run in a browser and targets crypto transactions. The inject...

Malicious code in aion-web3-eth-iban (npm)

The package aion-web3-eth-iban was found to contain malicious code...

MAL-2025-38983 Malicious code in web3-telegram-mini-app (npm)

The package web3-telegram-mini-app was found to contain malicious code...

Malicious code in web3-telegram-mini-app (npm)

The package web3-telegram-mini-app was found to contain malicious code...

MAL-2025-14180 Malicious code in aion-web3-eth-iban (npm)

The package aion-web3-eth-iban was found to contain malicious code...

Malicious code in web3-plugin-swisstronik (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6783 Malicious code in web3-plugin-swisstronik (npm)

The package communicates with a domain associated with malicious activity...

Malicious Package

Overview web3-rtc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in web3-rtc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9dca49a40515fc43ab5bb3d987aa551a6464961dd1aee2b3e4cadae66831a01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EncryptHub Targets Web3 Developers Using Fake AI Platforms to Deploy Fickle Stealer Malware

The financially motivated threat actor known as EncryptHubaka LARVA-208 and Water Gamayun has been attributed to a new campaign that's targeting Web3 developers to infect them with information stealer malware. "LARVA-208 has evolved its tactics, using fake AI platforms e.g., Norlax AI, mimicking...

MAL-2025-5748 Malicious code in @nomicsfoundation/web3-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8be3c236328576fc8bb353a6101fbbf35e483b67f019623f8d2f7538898b568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

N Korean Hackers Drop NimDoor macOS Malware Via Fake Zoom Updates

SentinelLabs uncovers NimDoor, new North Korea-aligned macOS malware targeting Web3 and crypto firms. Exploits Nim, AppleScript, and steals Keychain, browser, shell, and Telegram data...

North Korean Hackers Target Web3 with Nim Malware and Use ClickFix in BabyShark Campaign

Threat actors with ties to North Korea have been observed targeting Web3 and cryptocurrency-related businesses with malware written in the Nim programming language, underscoring a constant evolution of their tactics. "Unusually for macOS malware, the threat actors employ a process injection...

Malicious code in react-web3-cache (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-5087 Malicious code in react-web3-cache (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in solana-web3-adapter (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12e75c393c8da1b623873b652c0e4024a25d635513e641c2c50d5899421160ec Any computer that has this package installed or running should be considered...

MAL-2025-4943 Malicious code in web3-socketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2131391b300bee27a2d4e470c16bf37492276c2e92a4895a34f5933d5d0602b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3-socketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2131391b300bee27a2d4e470c16bf37492276c2e92a4895a34f5933d5d0602b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...