MetaMask: Possible to spoof Origin in "Connected Sites"

A vulnerability was discovered in MetaMask that allowed for the spoofing of the origin domain name in the "Connected Sites" list. This was caused by a CSS style sheet that set the direction to "right-to-left", which resulted in the order of characters in the domain name being messed up and...

0x-order-utils (>=1.0.2, <=1.1.1), 0x-web3 (>=4.7.1, <=5.0.0a5) +134 more potentially affected by CVE-2022-1930 via eth-account (>=0.1.0a2, <=0.5.8)

eth-account PYPI version =0.1.0a2, =1.0.2, =4.7.1, =0.1.13, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.0, =0.0.0, =0.0.0, =0.0.5, =0.1.0 and more Source cves: CVE-2022-1930 Source advisory: GHSA-V65G-F3CJ-FJP4...

0x-order-utils (>=1.0.2, <=1.1.1), 0x-web3 (>=4.7.1, <=5.0.0a5) +134 more potentially affected by CVE-2022-1930 via eth-account (>=0.1.0a2, <=0.5.8)

eth-account PYPI version =0.1.0a2, =1.0.2, =4.7.1, =0.1.13, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.0, =0.0.0, =0.0.0, =0.0.5, =0.1.0 and more Source cves: CVE-2022-1930 Source advisory: MEND:CVE-2022-1930...

Malicious code in tokenary-web3-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f1e8a0777e06e63c14f7812c77bf6007cf1804e2e33f10d1e76b7b0ea34faf9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview tokenary-web3-provider is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

With $11.5M In Funding, Naoris Protocol Will Use Blockchain & Decentralization To Plug Web3 Security Gaps

By Owais Sultan By creating a decentralized network of trusted devices that are incentivized to continuously validate each other to ensure… This is a post from HackRead.com Read the original post: With $11.5M In Funding, Naoris Protocol Will Use Blockchain & Decentralization To Plug Web3 Security...

Web3 wallets Restore Session Access

The vulnerability of the “Restore Session” function in Web3 wallets for cryptocurrency MetaMask relates to the storage of confidential information in an unencrypted form. Exploiting this vulnerability could allow a attacker to gain access to the session restoration function...

MAL-2022-7082 Malicious code in web3-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5faeaf5e592fa854a38c5ee80aeb77b40c09f82cd8fbdaf7fdc37f6b095cb3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5faeaf5e592fa854a38c5ee80aeb77b40c09f82cd8fbdaf7fdc37f6b095cb3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4596 Malicious code in mina-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fce90ac2154c56898c906006c31912f5bb2bd80e13d5dc7d3c368249a65abba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mina-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fce90ac2154c56898c906006c31912f5bb2bd80e13d5dc7d3c368249a65abba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7083 Malicious code in web3-ppos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4c548943dd0c85744c10b6f12851f7663c9e68d366526bff9b14c987ff303aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3-ppos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4c548943dd0c85744c10b6f12851f7663c9e68d366526bff9b14c987ff303aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4695 Malicious code in moralis-web3-providers-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e15271ff70759690176a5c96c5646ff12bc531be0ff9eec1e3baf0c3c3a9ffa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in moralis-web3-providers-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e15271ff70759690176a5c96c5646ff12bc531be0ff9eec1e3baf0c3c3a9ffa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7081 Malicious code in web3-0.20.7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b862a70b61a696bec847f0c0df8826bd0b41034d6cd593a8f578765c42ff15fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3-0.20.7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b862a70b61a696bec847f0c0df8826bd0b41034d6cd593a8f578765c42ff15fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

magnirepudiandae (>=1.0.0, <=1.2.0), temporibusbeatae (>=1.0.0, <=1.3.1) +2 more potentially affected by unknown CVE via metamask (0.0.1-security)

metamask NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on metamask and may be impacted: - magnirepudiandae =1.0.0, =1.0.0, =1.1.2, =1.1.3 Source cves: unknown CVE Source advisory: GHSA-MJXQ-QW24-Q9PV...

Hackers Using Web3 Backdoor Wallets to Steal Seed Phrases from iOS/Android Users

By Deeba Ahmed A Chinese-speaking, technically skilled threat actor distributes backdoored applications to extract cash from victims in a newly discovered… This is a post from HackRead.com Read the original post: Hackers Using Web3 Backdoor Wallets to Steal Seed Phrases from iOS/Android Users...

Chinese Hackers Distribute Backdoored Web3 Wallets for iOS and Android Users

A technically sophisticated threat actor known as SeaFlower has been targeting Android and iOS users as part of an extensive campaign that mimics official cryptocurrency wallet websites intending to distribute backdoored apps that drain victims' funds. Said to be first discovered in March 2022, t...