0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
raydium-clmm-sdk
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting raydium-clmm-sdk, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-16089 | Unknown | Malicious code in raydium-clmm-sdk (npm)raydium-clmm-sdk 0.0.1 and 0.0.2 (identical dist/index.js) present crypto helpers for the Raydium CLMM, but initKeypair(content) base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check through check_validator(), and randomBytes(size) forwards the hex output of crypto.randomBytes to the same host before returning it. Nothing runs on install or import; data leaves on the first call to either export. The README claims the package contains only type definitions. Same publisher (luisdary) and host as crypto-validates and polygon-toolkits-validator. --- _-= Per source |
| OSV (opens in a new tab) |
raydium-clmm-sdk 0.0.1 and 0.0.2 (identical dist/index.js) present crypto helpers for the Raydium CLMM, but initKeypair(content) base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check through check_validator(), and randomBytes(size) forwards the hex output of crypto.randomBytes to the same host before returning it. Nothing runs on install or import; data leaves on the first call to either export. The README claims the package contains only type definitions. Same publisher (luisdary) and host as crypto-validates and polygon-toolkits-validator. --- _-= Per source