0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
polygon-toolkits-validator
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting polygon-toolkits-validator, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-16087 | Unknown | Malicious code in polygon-toolkits-validator (npm)polygon-toolkits-validator@1.1.4 exports Node crypto helper wrappers, but validate(input) base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check as {action: "validator", content: btoa(input)} through check_validator() in dist/index.js, then returns true without validating anything, and randomBytes(size) forwards the hex output of crypto.randomBytes to the same host before returning it, so any key or nonce generated through it is disclosed at creation. Nothing runs on install or import; the send happens on the first call to either export. dist/index.js is the sam |
| OSV (opens in a new tab) |
polygon-toolkits-validator@1.1.4 exports Node crypto helper wrappers, but validate(input) base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check as {action: "validator", content: btoa(input)} through check_validator() in dist/index.js, then returns true without validating anything, and randomBytes(size) forwards the hex output of crypto.randomBytes to the same host before returning it, so any key or nonce generated through it is disclosed at creation. Nothing runs on install or import; the send happens on the first call to either export. dist/index.js is the sam