Web3 Security Firm - Defending against Hacks & Scams on #BSC & More! 🛡️ Users stay safe with our Chrome Extension & Metamask Snaps! ⚙️ Links below 👇
Joined January 2022
- Tweets1.2K
- Following85
- Followers6.6K
- Likes347
HashDit | now with Pro Extension retweeted
🔐 Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
🔗 nodejs.org/en/blog/vulnerabi…
#NodeJS #Security
HashDit | now with Pro Extension retweeted
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
HashDit | now with Pro Extension retweeted
🚨 LiteLLM 1.107.0 compromised in a supply chain attack.
Malicious PyPI packages and Docker images delivered a credential stealer and backdoor.
⚠️ The malware runs at Python startup, targeting cloud credentials, private keys, and AI tool credentials.
🔗 Full story: thehackernews.com/2026/10/li…
HashDit | now with Pro Extension retweeted
‼️ BREAKING - PHP releases emergency patches for two critical #PHP2Shell RCE flaws (CVSS 9.2) as early exploit attempts emerge.
The flaws can enable unauthenticated code execution and expose server memory.
👉 PATCH NOW (CVE-2026-109618, CVE-2026-109619)
Details ➜ thehackernews.com/2026/10/ph…
HashDit | now with Pro Extension retweeted
Shipping on BNB Chain? Security support just got easier to find.
The AvengerDAO marketplace brings together 11 security teams covering audits, threat monitoring, risk scanning and incident response:
@HashDit @CertiK @zokyo_io @salus_sec @Beosin_com @GoPlusSecurity @BlockSecTeam @pessimistic_io @sherlockdefi @getfailsafe @FirepanHQ
Explore the marketplace: avengerdao.org/marketplace
Learn how the AvengerDAO marketplace works in our blog 👇
bnbchain.org/en/blog/avenger…
HashDit | now with Pro Extension retweeted
Defimon detected a malicious governance proposal that attempts to drain @autonolas Treasury - $100K at risk
Tornado-funded attacker registered ENS name "autonolas-deployer.eth" and submitted a proposal titled "Owner migration: transfer treasury ownership from old timelock to Safe updater".
In fact proposal execution would move Treasury ownership away from the legit Autonolas Timelock to the attacker contract, who could then rebalance and withdraw all 40.196 ETH.
There is 3 days to defeat the proposal. We have shared the alert in the community chat of the @autonolas project.
TX: etherscan.io/tx/0xe435eed3f2…
Attacker: etherscan.io/address/0xd4f8d…
Victim: etherscan.io/address/0xa0da5…
HashDit | now with Pro Extension retweeted
An ongoing security incident has impacted users of the Cosmos EVM module. Cosmos Labs’ security and engineering teams have been proactively responding to this incident. We have advised the Cosmos EVM chains that are in contact with us to request that validators halt their chains.
We thank the teams using Cosmos EVM for their rapid response. An incident report will be shared once the situation is resolved.
If you are a team using Cosmos EVM and have questions, please contact [email protected].
HashDit | now with Pro Extension retweeted
‼️ Rust supply chain attack hits three crates, including 245 million-download arrayref.
A compromised maintainer account pushed malicious releases that pulled in typosquatted proc-macro1, whose build script fetches and runs a remote payload during compilation.
Check your Cargo cache and pinned versions now: thehackernews.com/2026/08/ru…
HashDit | now with Pro Extension retweeted
🚨Every Ledger running the Ethereum app is vulnerable to signature substitution
A malicious dApp with WebHID access could race an APDU during your transaction review and swap the tx being signed while the device still shows the original
Here's what you need to know:
HashDit | now with Pro Extension retweeted
⚠️Official PSA for Discord to address a major widespread issue⚠️
Scammers are violating @discord's ToS to use APIs/Automation to scam users...
They have automated flows set up to watch for new members joining... The moment someone joins, they send a friend request impersonating team members or support...
This confuses new members and can lead to scams. Let me explain ⤵️⤵️
This can happen to any servers, the servers shown in the video below are just an example as scammers do this to all popular servers!! Regardless of the servers security!
HashDit | now with Pro Extension retweeted
🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs into @pypi and is still spreading.
Newly confirmed compromised artifacts:
@opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads)
mistralai: 2.4.6 on PyPI
guardrails-ai: 0.10.1 on PyPI
additional @squawk/* packages on npm
guardrails-ai 0.10.1 executes malicious code on import. On Linux, it downloads git-tanstack[.]com/transformers.pyz, writes it to /tmp/transformers.pyz, and runs it with python3 without integrity verification.
The git-tanstack.com domain displayed a message signed “With Love TeamPCP,” along with: “We've been online over 2 hours now stealing creds
Regardless I just came to say hello :^)”
The page also linked to a YouTube video and you can probably guess which one.
HashDit | now with Pro Extension retweeted
🚨 Bitwarden CLI 2026.4.0 was compromised as part of the ongoing Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.
We’ll continue updating our coverage as more details are confirmed.
socket.dev/blog/bitwarden-cl…
HashDit | now with Pro Extension retweeted
In collaboration with @github, @Microsoft, @npmjs, and @SocketSecurity, our security team has confirmed that no npm packages published by Vercel have been compromised.
There is no evidence of tampering, and we believe the supply chain remains safe.
vercel.com/kb/bulletin/verce…
HashDit | now with Pro Extension retweeted
Earlier today we identified suspicious cross-chain activity involving rsETH. We have paused rsETH contracts across mainnet and several L2s while we investigate.
We are working with @LayerZero_Core, @unichain, our auditors and top security experts on RCA.
We will keep you posted as we learn more about this situation. Please follow only the official @KelpDAO handle for the updates.
HashDit | now with Pro Extension retweeted
our domaim appears to have been compromised and the eth.limo domain has been hijacked. We're actively working with all parties involved to assess the situation and remediate the problem.
HashDit | now with Pro Extension retweeted
🚨🚨
We are currently experiencing an issue with the CoW Swap frontend (swap.cow.fi). While we are investigating, please DO NOT use CoW Swap.
HashDit | now with Pro Extension retweeted
🚨Discord Alert: If you're using Discord channels as Support Tickets, your community is at risk 🚨
Scammers are violating Discord ToS and using the Discord API to view your channels and roles without any access at all. They use this information to scam your community... Here’s how you can prevent it ⤵️
1/ How do scammers do this?
2/ What’s the scam?
3/ What’s the solution?
HashDit | now with Pro Extension retweeted
Security update: we identified and unpublished a malicious version of our SDK, @velora-dex/sdk
This incident is confirmed to be limited to the SDK package only. We have no indication of any issue elsewhere in our systems or infrastructure. Out of caution, developers should avoid installing or upgrading this package for now while we complete the investigation and publish a confirmed safe update.
We’ll share more updates as soon as possible.
HashDit | now with Pro Extension retweeted
🛑 Chrome 0-day Warning!
Tracked as CVE-2026-5281, this WebGPU (Dawn) use-after-free bug allows code execution via a crafted page if the renderer is compromised.
It’s the 4th exploited Chrome browser zero-day in 2026.
🔗 Read → thehackernews.com/2026/04/ne…
