/
/ 

Five security claims you can check yourself in one command

2026-08-01 · Web3 Security Most crypto security writing asks you to accept a firm’s summary of what it found. A narrow slice of that material sits behind public endpoints that answer in one line, with no API key and no account, and the answers are often…

01 / 01 Sections Sections

2026-08-01 · Web3 Security

Most crypto security writing asks you to accept a firm’s summary of what it found. A narrow slice of that material sits behind public endpoints that answer in one line, with no API key and no account, and the answers are often more specific than the coverage.

Case file

Field Value
Method Direct queries to five public endpoints, run 1 August 2026
Credentials None. No API key, no account, no rate-limit token on any of the five
Endpoints registry.npmjs.org, api.npmjs.org, safe-transaction-mainnet.safe.global, treasury.gov, services.nvd.nist.gov
What they answer Publication state, download counts, contract pointers, designation status, CVE existence
What they do not answer Whether any product, wallet, chain or firm is safe to use
Two commands that changed The Safe endpoint now 308-redirects and needs -L. sdn.csv now 302-redirects to signed S3 and needs -L
Endpoint checked and not shipped api.github.com/repos/<org>/<repo>/issues/<n>. Works, returns exact fix timing, cut for length
Defensive action Run the check before you accept the claim, and again before you act on an old article

What the record shows

Five checks, each run on 1 August 2026, with the command as issued and the response as returned. I trimmed each output to the fields that carry the answer and changed nothing else.

Check Endpoint Answers Result on 2026-08-01
Package state registry.npmjs.org Is a malicious package still published? typo-crypto@4.3.0 still live
Real usage api.npmjs.org How many downloads, in what window? debug, 68,402,009 in one day
Wallet pointer Safe tx service What contract holds a Safe’s logic? Bybit still names the attacker’s
Designation treasury.govsdn.csv Is this address or person sanctioned? Semenov listed, DPRK3 only
Vulnerability NVD 2.0 API Did anyone file a CVE? Nine for the npm takeover, zero for drainers

Is a malicious package still published?

The npm registry serves a JSON document per package that states every published version, the timestamp of each publish, and which version carries the latest tag.

curl -s https://registry.npmjs.org/typo-crypto

"dist-tags": { "latest": "4.3.0" },
"versions":  [ "4.3.0" ],
"time": { "created":  "2025-03-31T15:15:31.860Z",
          "4.3.0":    "2025-03-31T15:15:32.064Z",
          "modified": "2025-03-31T15:15:32.343Z" }

One published version, tagged latest, no unpublished key anywhere in the document, and a modified timestamp 279 milliseconds after the publish, meaning nothing has touched the package since the day it went up. Amazon Threat Intelligence reported in July 2026 that a DPRK-linked actor committed a trojanised file to typo-crypto, and the registry shows the package sitting where it was on 31 March 2025, sixteen months on. for the registry state, for the attribution, which is Amazon’s.

The same endpoint answers a second and better question. Removed versions vanish from versions and stay in time, so the difference between those two keys is a list of every version npm pulled, with the minute it was published.

curl -s https://registry.npmjs.org/chalk | python -c "import json,sys; d=json.load(sys.stdin); v=set(d['versions']); print([(k,t) for k,t in d['time'].items() if k not in v and k not in ('created','modified')])"

[('5.6.1', '2025-09-08T13:13:05.239Z')]

chalk 5.6.1 was published at 13:13:05 UTC on 8 September 2025 and is gone from the registry. The clean 5.6.2 landed at 14:47:54 UTC the same day, one hour and thirty-four minutes later. That figure comes out of two registry timestamps, so it does not depend on anybody’s incident write-up. Run the same command against debug and ansi-styles and you get 4.4.2 at 13:12:39 UTC and 6.2.2 at 13:12:10 UTC. Three malicious publishes inside fifty-five seconds.

What are a package’s real download numbers?

Coverage of a supply-chain compromise reaches for the largest available number, usually a weekly or monthly figure for the package at its peak. The registry’s own counter takes an arbitrary window.

curl -s "https://api.npmjs.org/downloads/point/2025-09-08:2025-09-08/debug"

{"downloads":68402009,"start":"2025-09-08","end":"2025-09-08","package":"debug"}

68,402,009 downloads of debug on the day its publishing account was taken over. chalk returned 59,080,299 for the same day and ansi-styles 73,404,291. Those are whole-package figures across every version, so they set a ceiling on exposure. They do not count installs of the malicious version, and the endpoint gives no per-version breakdown. Point it at typo-crypto and the answer runs the other way: 28 downloads in the month to 31 July 2026.

Is a wallet still pointed at an attacker’s contract?

A Safe multisig keeps its logic in a separate contract, recorded on the proxy as the masterCopy. Safe’s own transaction service reports the current value for any address. The mainnet host now issues a 308 to api.safe.global, so -L is required and a plain curl -s returns 164 bytes of nginx redirect page.

curl -sL https://safe-transaction-mainnet.safe.global/api/v1/safes/0x1Db92e2EeBC8E0c075a02BeA49a2935BcD2dFCF4/

{"address":"0x1Db92e2EeBC8E0c075a02BeA49a2935BcD2dFCF4","nonce":null,"threshold":null,
 "owners":null,"masterCopy":"0xbDd077f651EBe7f7b3cE16fe5F2b025BE2969516",
 "modules":[],"fallbackHandler":"0xd5D82B6aDDc9027B22dCA772Aa68D5d74cdBdF44",
 "guard":"0x0000000000000000000000000000000000000000",
 "moduleGuard":"0x0000000000000000000000000000000000000000","version":null}

That is Bybit’s cold wallet, seventeen months after the February 2025 theft. owners, nonce, threshold and version all read null, and masterCopy reads 0xbDd077f651EBe7f7b3cE16fe5F2b025BE2969516, the contract NCC Group and Safe’s own post-mortem identify as the one the attacker deployed. for the response, for the identification.

Null fields are worth a control before anybody reads meaning into them. Query a functioning Safe and the same endpoint returns "threshold": 3, a five-address owners array, "version": "1.3.0" and "masterCopy": "0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552", which is Safe’s canonical v1.3.0 singleton. An address that is not a Safe at all returns 404. So three states are distinguishable from one command: not a Safe, a Safe running canonical code, and a Safe whose proxy points somewhere the indexer cannot parse.

Is an address still sanctioned?

OFAC publishes the Specially Designated Nationals list as a CSV. It is plain text, about 5.6 MB and 19,181 rows on the copy served today, and it carries digital currency addresses in the free-text remarks column. The old direct URL now 302s to sanctionslistservice.ofac.treas.gov and on to a signed S3 object, so -L has become mandatory here too. Without it, curl writes a zero-byte file and exits 0.

curl -sL https://www.treasury.gov/ofac/downloads/sdn.csv | grep -i "SEMENOV, Roman"

44718,"SEMENOV, Roman","individual","DPRK3", ... Digital Currency Address - ETH
0xdcbEfFBECcE100cCE9E4b153C4e15cB885643193; alt. Digital Currency Address - ETH
0x5f48c2a71b2cc96e3f0ccae4e39318ff0dc375b2; ...

Semenov’s programme field reads DPRK3 alone. OFAC designated him in August 2022 under DPRK3 and CYBER2, and the second tag has come off with no accompanying press release. The file is the only place that records it.

Swap the grep term for an address and the list becomes a screening tool. The copy served today carries 252 Bitcoin addresses, 72 Ethereum, 64 Tron, 42 Tether and about twenty more across eight other assets. One formatting quirk to know: where an entry sits under two programmes, the CSV embeds the bracket separator inside the quoted field, so Garantex Europe OU reads "RUSSIA-EO14024] [CYBER4" and a naive parser will mangle it. Grep does not care.

Did a vulnerability ever get a CVE?

The National Vulnerability Database answers keyword queries without a key.

curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=npm+publishing+account"

{"totalResults":9, ... "CVE-2025-59140" ... "CVE-2025-59144" ... }

Nine records, all published 2025-09-15, one per compromised package. CVE-2025-59144 covers debug and carries a CVSS v4.0 base score of 8.8 from GitHub’s advisory team. Its description states the version, the date, the mechanism and the scope: 4.4.2 published on 8 September after a phishing attack, malware that redirects cryptocurrency transactions from inside browser environments, with server and command-line use unaffected. That is a government-hosted record naming a wallet-drainer payload.

Now the same endpoint, queried for a technique.

curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=wallet+drainer"

{"totalResults":0,"format":"NVD_CVE","version":"2.0","vulnerabilities":[]}

Zero. increaseAllowance returns zero. ledger hardware wallet returns zero, while electrum returns three and metamask returns ten. Read the zeros carefully. A CVE is filed by somebody, usually a vendor or a CNA with a product to patch, so the database records defects in software that has an owner. Approval phishing has no vendor to notify and no patch to ship, which means the absence of findings partly reflects an absence of looking. A zero here describes the database. It says nothing about how much money the technique takes.

What I think is going on

The thing that struck me running these is how little of it is hard. Five commands, no credentials, and four of the five returned something more specific than the reporting I had read on the same events. The coverage was accurate. It had just rounded off the parts that let you check it. A ninety-four-minute window computed from two registry timestamps beats “the malicious version was live for about an hour and a half,” and it beats it because the registry produced it and will produce it again for anybody who asks.

The default in this beat is a firm publishes a post-mortem, the trade press summarises the post-mortem, and everything downstream summarises the summary. Each hop drops the specifics that make a claim checkable, and by the third hop you get “over 70 million weekly downloads” with no window, no package list and no way back to the number. The firm usually did fine work. Almost nobody re-derives it, so nobody notices when the underlying fact moves.

And it does move. Semenov’s CYBER2 tag came off with no announcement, which means every article that described him as cyber-designated went wrong on a day nobody marked. Bybit’s Safe still reports the attacker’s contract as its masterCopy seventeen months later, which is the sort of detail that gets written once and then assumed to have been cleaned up. typo-crypto is still installable. If you are handling serious money you should treat any security claim older than a few months as a hypothesis, and these endpoints are how you test one in the time it takes to read the paragraph making the claim.

Be honest about the ceiling, though. Everything above verifies a narrow factual thing. None of it tells you whether a wallet is well built, whether a custodian is solvent, whether a bridge has been audited by anyone competent, or whether the package you are about to install is malicious right now. A package absent from the SDN list and clean in NVD can still be hostile. The checks tell you what a specific public record says on a specific day. That is a small claim, and it is worth more than a large one you cannot test.

Which is also the standard I would like applied to this article. Every command here is reproducible. If one of them stops returning what I said it returned, the article is wrong, and you will find that out before I do.

What reduces your exposure

Running a check does not undo anything. A revoked approval does not return tokens already taken, an unpublished package is still sitting in somebody’s lockfile, and a delisting does not unwind a transfer that already settled. What these narrow the odds on is acting on a claim that stopped being true.

Screen an address against sdn.csv while the transfer is still a draft. One curl -sL piped to grep costs a few seconds and covers 252 Bitcoin and 72 Ethereum addresses. It catches designated counterparties only, so it says nothing about one who is merely insolvent or dishonest, and OFAC adds an address when it designates, which always trails the conduct.

Before you trust a supply-chain post-mortem, diff versions against time. It tells you which versions were pulled and when, which is the exposure window you actually care about. It cannot tell you whether your build pulled the bad version, and for that you need your own lockfile history.

Treat a dated security article as a hypothesis with an expiry. The endpoints above are the cheapest available way to test one. Where a claim has no public endpoint behind it, which is most of them, note that you are taking it on trust and let the size of the position reflect how much trust that is.

Give the same treatment to anything you read here. Nothing in this piece asks you to take my word for a fact I did not print the command for.

Sources

Disclosure. Max Avery is affiliated with Digital Ascension Group (DAG). Investment advisory services are offered through DAG Wealth, an SEC-registered investment adviser (CRD No. 328627). Registration does not imply a certain level of skill or training. DAG is not a law firm and does not provide legal or tax advice. Custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them. Nothing here is investment, legal, or tax advice, or a recommendation to buy or sell any asset. This article describes matters of public record; charges are allegations and defendants are presumed innocent unless and until proven guilty.

More from the journal

Continue reading.