rarisma
Joined 1 year ago
Joined 1 year ago
Just pasted the code into claude to try and decipher the minified js and looks like it tries to find the server via the blockchain? and then download further stuff from there.
We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports. As an alternative, we encourage you to find impact across our other VRP programs and submit there instead, or pursue the Patch Rewards Program.
Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid. We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027.
https://bughunters.google.com/about/rules/open-source/google...