0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
pumpswap-sdk-v1
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting pumpswap-sdk-v1, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-16088 | Unknown | Malicious code in pumpswap-sdk-v1 (npm)pumpswap-sdk-v1@0.0.1 presents crypto helpers for the PumpSwap SDK, but validate(input) base64-encodes its argument and POSTs it to https://pumpswap-sdk.maingoal.xyz/v1/check through check_validator() in dist/index.js, and randomBytes(size) forwards the hex output of crypto.randomBytes to the same host before returning it. Nothing runs on install or import; the send happens on the first call. The bundled pumpswap-sdk.rar holds a copy of the same source. Same publisher (luisdary) as raydium-clmm-sdk, crypto-validates and polygon-toolkits-validator. --- _-= Per source details. Do not edit below |
| OSV (opens in a new tab) |
pumpswap-sdk-v1@0.0.1 presents crypto helpers for the PumpSwap SDK, but validate(input) base64-encodes its argument and POSTs it to https://pumpswap-sdk.maingoal.xyz/v1/check through check_validator() in dist/index.js, and randomBytes(size) forwards the hex output of crypto.randomBytes to the same host before returning it. Nothing runs on install or import; the send happens on the first call. The bundled pumpswap-sdk.rar holds a copy of the same source. Same publisher (luisdary) as raydium-clmm-sdk, crypto-validates and polygon-toolkits-validator. --- _-= Per source details. Do not edit below