Live security feed + exchange risk lab
Tvijo AIOS relays security advisories and turns them into practical risk signals for crypto users: scams, exchange failures, copytrading drift, bot drawdowns, and high-leverage liquidation traps.
Автообновление каждые 5 минут. Вызовов блокчейн RPC пока нет; аномалии в сети — это заглушка.
Интересуетесь, как защищена сама платформа? Прочитайте наше заявление о безопасности платформы .
Why deposits disappear
This risk lens follows the failure modes users actually meet on exchanges: copied traders changing risk, bots averaging into liquidation, API keys with too much power, and leverage bands where a tiny move can erase margin.
Users can enter later, receive different fills, copy a larger effective position, or miss the master trader's hedge. A profitable leader can still liquidate followers.
Grid, DCA, and signal bots can keep adding exposure after the thesis breaks. Without loss limits, one bad regime can consume the full deposit.
At extreme leverage, ordinary candle noise, funding, spread, and liquidation fees can erase margin before a human has time to react.
Wrong deposit networks, fake support links, compromised sessions, stale API keys, delistings, or disabled withdrawals can convert a normal action into a capital lock.
Источники в этом снимке: hn (46), github_security (14). Counts are computed from the live normalized feed only — nothing is hand-curated.
Баллы: 1 | Комментарии: 0
Баллы: 2 | Комментарии: 0
Баллы: 4 | Комментарии: 0
Баллы: 3 | Комментарии: 0
Points: 28 | Comments: 6
### Impact This impacts users of Shescape on Windows that explicitly configure `shell` to CMD, or `true` with the default shell being CMD, using the `escape` and `escapeAll` APIs. An attacker may be able to achieve shell injection depending on the original command. ```javascript import * as cp from "node:child_process"; import { Shescape } from "shescape"; // 1. Prerequisites const options = { shell: "cmd.exe", // Or shell: true, // Only if the default shell is CMD }; // 2. Payload const payload = "x) else if a==a (echo y"; // 3. Usage const shescape = new Shescape(options); let escapedPayload; escapedPayload = shescape.escape(payload); // Or escapedPayload = shescape.escapeAll([payload]); // And (example) const result = cp.execSync(`if defined FALSY (echo ${escapedPayload})`, options); // 4. Impact console.log(result.toString()); // Outputs "y" instead of "" ``` ### Patches This bug has been patched in [v2.1.14] and [v3.0.1] which you can upgrade to now. If yo
## Summary `sm-crypto` (npm package **0.4.0**, the latest release, published 2026-01-20) generates SM2 private keys and signing ephemeral scalars from a single module-wide RNG instance (`src/sm2/utils.js`: `const rng = new SecureRandom()`). `SecureRandom` is jsbn's PRNG, which seeds an **ARC4** stream from `window.crypto.getRandomValues` when available. **In Node.js — sm-crypto's primary runtime — `window` is `undefined`, so the CSPRNG branch is skipped** and the seed pool is instead filled from `Math.random()` (V8 `xorshift128+`, recoverable from a few outputs) plus `new Date().getTime()` (wall clock, attacker-estimable). Node *does* expose Web Crypto as `globalThis.crypto`, but jsbn checks `window.crypto`, not `globalThis.crypto`, so the secure path is never taken. Consequently every SM2 private key produced by the default `sm2.generateKeyPairHex()` and every signing ephemeral scalar is derived from non-cryptographic sources and is **predictable** by an attacker who can observe a f
Баллы: 1 | Комментарии: 0
Баллы: 3 | Комментарии: 1
Снимок риска токена GoPlus для проверки на уровне контракта: honeypot, прокси, права на эмиссию, изменения владельца.
Вставьте адрес контракта токена, чтобы получить последний нормализованный снимок риска.
Проверка кошельков OpenSanctions по базам данных санкций. Это публичный ретранслятор только для чтения, а не механизм принятия решений о соответствии.
Вставьте адрес кошелька для запуска кэшированной/живой проверки.
Баллы: 1 | Комментарии: 0
Баллы: 2 | Комментарии: 0
Баллы: 4 | Комментарии: 0
Баллы: 3 | Комментарии: 0
Points: 28 | Comments: 6
### Impact This impacts users of Shescape on Windows that explicitly configure `shell` to CMD, or `true` with the default shell being CMD, using the `escape` and `escapeAll` APIs. An attacker may be able to achieve shell injection depending on the original command. ```javascript import * as cp from "node:child_process"; import { Shescape } from "shescape"; // 1. Prerequisites const options = { shell: "cmd.exe", // Or shell: true, // Only if the default shell is CMD }; // 2. Payload const payload = "x) else if a==a (echo y"; // 3. Usage const shescape = new Shescape(options); let escapedPayload; escapedPayload = shescape.escape(payload); // Or escapedPayload = shescape.escapeAll([payload]); // And (example) const result = cp.execSync(`if defined FALSY (echo ${escapedPayload})`, options); // 4. Impact console.log(result.toString()); // Outputs "y" instead of "" ``` ### Patches This bug has been patched in [v2.1.14] and [v3.0.1] which you can upgrade to now. If yo
## Summary `sm-crypto` (npm package **0.4.0**, the latest release, published 2026-01-20) generates SM2 private keys and signing ephemeral scalars from a single module-wide RNG instance (`src/sm2/utils.js`: `const rng = new SecureRandom()`). `SecureRandom` is jsbn's PRNG, which seeds an **ARC4** stream from `window.crypto.getRandomValues` when available. **In Node.js — sm-crypto's primary runtime — `window` is `undefined`, so the CSPRNG branch is skipped** and the seed pool is instead filled from `Math.random()` (V8 `xorshift128+`, recoverable from a few outputs) plus `new Date().getTime()` (wall clock, attacker-estimable). Node *does* expose Web Crypto as `globalThis.crypto`, but jsbn checks `window.crypto`, not `globalThis.crypto`, so the secure path is never taken. Consequently every SM2 private key produced by the default `sm2.generateKeyPairHex()` and every signing ephemeral scalar is derived from non-cryptographic sources and is **predictable** by an attacker who can observe a f
Баллы: 1 | Комментарии: 0
Баллы: 4 | Комментарии: 0
### Summary `ValidationHandler.Load()` in `getkin/kin-openapi` silently replaces a nil `AuthenticationFunc` with `NoopAuthenticationFunc`, which always returns `nil` without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI `security` requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application relies on `ValidationHandler` as its enforcement middleware. ### Details `ValidationHandler` is an HTTP middleware exported by `openapi3filter` that validates incoming requests and responses against a loaded OpenAPI specification. Its `Load()` method initialises default fields before the handler begins serving: ```go // openapi3filter/validation_handler.go:47-49 if h.AuthenticationFunc == nil { h.AuthenticationFunc = N
Баллы: 3 | Комментарии: 1
Баллы: 4 | Комментарии: 1
Баллы: 1 | Комментарии: 0
Баллы: 2 | Комментарии: 0
Баллы: 4 | Комментарии: 0
Баллы: 3 | Комментарии: 0
Points: 28 | Comments: 6
Баллы: 1 | Комментарии: 0
Баллы: 4 | Комментарии: 0
Баллы: 3 | Комментарии: 1
На этой странице отслеживаются внешние рыночные угрозы. О том, как защищена сама BibaMoney / Tvijo AIOS, прочитайте полное заявление:
Нормализация Chainabuse/abuse-report не подключена к этой публичной поверхности. После внедрения сборщика этот раздел должен отображать недавно отмеченные кошельки и заметки о кампаниях.
