HashDit | now with Pro Extension @HashDit

🚨 HashDit Alert🚨 Multiple reports indicate that @dxsale has been compromised! ⚠️ Any project with LP funds locked on DxSale should check immediately and withdraw if possible Our analysis shows around $3M stolen so far, with the exploit still ongoing. Main Theft address: 0xC4574DDEF299e7E563971e200433e592EeaaFA69 The attacker has also raised locking fees to 100 BNB, effectively blocking normal use. With Discord, TG, and X all silent, the project appears either fully compromised or rugpulled... Stay Safe!

🚨 HashDit Alert! 🚨 A crypto stealer campaign has been identified involving malicious npm packages, for example "token-usage-tracker". This is a confirmed TrapDoor attack designed to steal credentials and crypto assets. If installed, delete it immediately and rotate your keys/secrets. To track AI token usage safely, use trusted packages that wrap official APIs, local tokenizers like tiktoken for estimation, and keep cost sheets updated with minimal external dependencies. Stay safe!

Socket @SocketSecurity

a week ago

🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.​io. Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly pushing new releases across ecosystems. TrapDoor targets

133 422 2K 769K 732

References 1/ Binance Oracle : binance.com/en/support/ann… 2/ Pyth Network: docs.pyth.network/price-feeds/co…

🚨 HashDit Update 🚨 Two oracle service changes are underway: • Binance Oracle will transition to @AtlasOracleX , affiliated with @CoinMarketCap , over a 90-day period, with full completion by Aug 6. • @PythNetwork is upgrading Pyth Core on July 31, and Hermes users will now require Pyth API keys. Projects using either provider should update their oracle feed addresses accordingly.

Reported Impact: The exfiltrated data consists of approximately 3,800 GitHub-internal repositories containing GitHub's own platform source code and internal tooling — not user data, secrets, or third-party code. Critical internal credentials have already been rotated. No evidence of follow-on attacks against GitHub's production platform or customer-facing services has been reported.

🚨 HashDit Alert! 🚨 GitHub has reported unauthorized access to some of its internal repositories! Web3 / Crypto devs: now is a good time to audit your repos, check for any abnormal commits and remove any sensitive data that should NOT be there in the first place ⚠️ With AI-powered attacks on the rise, breaches like this will become more and more common. Stay extra cautious with permissions, secrets management, and credential storage 🛡️ Stay safe!

GitHub @github

2 weeks ago

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely

2K 5K 25K 13.8M 6K

5/5 🛡 How can you protect yourself moving forward? - Pin exact dependency versions - Avoid `^` / `~` for critical packages - Delay new package adoption by 7–14 days - Use behavior-based supply chain scanners - Isolate build environments - Never expose production secrets to npm install hosts - Enable 2FA on registry accounts Stay safe!

4/5 🛠 Remediation: Step 1️⃣ — Remove malicious versions Pin a known-safe version, such as: - `12.0.0` - `9.2.1` for the 9.x line Then reinstall cleanly: ```bash rm -rf node_modules package-lock.json npm install ``` Use the equivalent lockfile cleanup for Yarn/pnpm. Step 2️⃣ — Rotate secrets immediately Rotate anything that may have been accessible, including: - cloud credentials - SSH keys - API keys - CI/CD secrets - Kubernetes credentials - deploy keys - wallet-related secrets if present Step 3️⃣ — Block attacker infrastructure Block at firewall/proxy level: - `sh.azurestaticprovider.net` - `37.16.75.69` Also quarantine the malicious versions in your private registry/proxy: - Artifactory - Verdaccio - internal mirrors

🚨 HashDit Alert! 🚨 1/5 The popular `node-ipc` npm package has been compromised with a credential-stealing payload! Confirmed malicious versions: - `9.1.6` - `9.2.3` - `12.0.1` If your environment touched these versions, assume risk ⚠️

Socket @SocketSecurity

3 weeks ago

🚨 Socket detected malicious activity in newly published versions of node-ipc, an npm package with 822K weekly downloads. Affected versions: [email protected] [email protected] [email protected] Socket’s AI scanner flagged the malware within ~3 minutes of publication. Early analysis

22 116 554 467K 185

🚨 HashDit Alert🚨 @zachxbt has reported that @THORChain has been compromised, with total stolen funds amounting to >$7.4m. Source: t.me/investigations… DO NOT interact with the project until the team gives the all clear. Stay Safe!

⚠️Official PSA for Discord to address a major widespread issue⚠️ Scammers are violating @discord's ToS to use APIs/Automation to scam users... They have automated flows set up to watch for new members joining... The moment someone joins, they send a friend request impersonating team members or support... This confuses new members and can lead to scams. Let me explain ⤵️⤵️ This can happen to any servers, the servers shown in the video below are just an example as scammers do this to all popular servers!! Regardless of the servers security!

🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs into @pypi and is still spreading. Newly confirmed compromised artifacts: @​opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads) mistralai: 2.4.6 on PyPI guardrails-ai: 0.10.1 on PyPI additional @​squawk/* packages on npm guardrails-ai 0.10.1 executes malicious code on import. On Linux, it downloads git-tanstack[.]com/transformers.​pyz, writes it to /tmp/transformers.​pyz, and runs it with python3 without integrity verification. The git-tanstack.​com domain displayed a message signed “With Love TeamPCP,” along with: “We've been online over 2 hours now stealing creds Regardless I just came to say hello :^)” The page also linked to a YouTube video and you can probably guess which one.

🚨 Bitwarden CLI 2026.4.0 was compromised as part of the ongoing Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline. We’ll continue updating our coverage as more details are confirmed. socket.dev/blog/bitwarden…

⚠️ Web3 social managers on X: stay alert. Scam phishing emails targeting crypto are circulating again. If you enter your project's credentials into the fake login page, your X account WILL GET HACKED! Stay vigilant!! Refer to this for more information: malwarebytes.com/blog/news/2025…

HashDit | now with Pro Extension @HashDit

8 months ago

🚨 WARNING: Recently, there has been a rise of Web3 Crypto X Accounts being compromised. Through our investigation, we noticed there has been a 6 month campaign of scam X phishing emails usually preying on the urgency to 'verify' their account. So what should you do if you are a

0 0 3 2K 0

In collaboration with @github, @Microsoft, @npmjs, and @SocketSecurity, our security team has confirmed that no npm packages published by Vercel have been compromised. There is no evidence of tampering, and we believe the supply chain remains safe. vercel.com/kb/bulletin/ve…

3/ Long term solutions: 1. Pin exact dependency versions (avoid using ^ ranges) 2. Use and review lockfile changes in PRs 3. Use --ignore-scripts in CI when possible 4. Run installs in isolated environments without production secrets Stay safe!!

2/ Root cause: a Vercel employee’s account was reportedly compromised via Context.ai, which gave the attacker access to that employee’s Google Workspace account, then access to some Vercel environments and env vars not marked “sensitive.”

🚨 Vercel and Next.js devs do this now! 🚨 ShinyHunters (the threat actor behind the Rockstar/Ticketmaster breach) hacked @vercel via a compromised third-party AI tool's Google Workspace OAuth app!! ⚠️⚠️⚠️ Do this now before reading further! 1. Rotate all important Vercel env vars immediately - especially npm, GitHub, API, and deployment tokens 2. Review and remove unnecessary connected apps - remove context.ai from Google Workspace accessed apps - revoke Vercel/GitHub integrations Why this matters if you are in #Web3/#Crypto: Vercel hosts hundreds of DeFi frontends, and stolen CI/CD credentials could enable wallet-drainer injection at scale! ⚠️ 1/ Affected Impact 2/ Root Cause 3/ Long term solution

Vercel @vercel

2 months ago

We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin: vercel.com/kb/bulletin/ve…

696 2K 9K 10.6M 3K