← Developer activityStrong match

odudex

Public commit activity attributed with strong match confidence. This page describes observable work, not personal trustworthiness.

122 commits3 monitored projects43 candidates3 high-risk analyses

Project constellation

Where the commits appear

Amber nodes are monitored by CommitWatch. Gray nodes are sampled from authenticated GitHub public commit search and may not represent complete contribution history.

Monitored External sample

Monitored evidence

CommitWatch projects

KruxKrux118 commits43 candidates3 high risk Blockstream JadeBlockstream2 commits0 candidates0 high risk libwally-coreElements Project2 commits0 candidates0 high risk

External discovery

Other public projects

No external sample loaded yet.

A verified GitHub handle is needed before external discovery.

Analyzed activity

Recent published watches

Message quality and risk characterize commits, never the person.

Moderate 62 AI analysisMessage 90 · Strong

5 days, 1 hour ago

KX KruxKrux BitcoinHardware wallets

feat: warn when PSBT input amounts cannot be verified

This commit adds a warning screen to Krux, a hardware signing device, when it is asked to sign a multi-input Bitcoin transaction where the amounts of some inputs cannot be independently verified. The risk is that a malicious transaction co…

New user-facing warning for unverified multi-input SegWit amountsDetection logic tied to BIP143 signature semantics and inp.is_verifiedDoes not enforce previous-transaction inclusion; user can still proceed

518b3314by odudex+159−24 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

High 78 AI analysisMessage 95 · Strong

5 days, 1 hour ago

KX KruxKrux BitcoinHardware wallets

fix: verify PSBT input amounts before showing the fee

This commit fixes a security flaw in Krux, a Bitcoin signing device. Before the fix, an attacker could trick the device into showing a low transaction fee on screen while actually signing a much higher fee. The fix makes the device verify …

Fixes fee-display/sighash amount mismatchAdds prevout txid hash verification for non_witness_utxoMandates non_witness_utxo for legacy inputs

fc808059by odudex+353−122 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Moderate 66 AI analysisMessage 85 · Strong

5 days, 1 hour ago

KX KruxKrux BitcoinHardware wallets

fix: reject a PSBT whose outputs exceed its inputs

This commit fixes a bug in Krux, a Bitcoin signing device, where a malformed transaction whose outputs spend more than its inputs could be loaded and shown to the user. Normally such a transaction is impossible on the Bitcoin network, but …

Input validation gap in PSBT parsingUI rendering bug masking invalid transaction economicsPotential social-engineering / user-confusion attack

d6813d88by odudex+52−02 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Moderate 55 AI analysisMessage 82 · Strong

5 days, 2 hours ago

KX KruxKrux BitcoinHardware wallets

chore: bump MaixPy with Shannon changes and RNG removal

This commit updates a bundled firmware component called MaixPy. The commit message says it fixes a 'Shannon heap overflow,' removes an unused random-number binding, and drops support for one hardware variant (Maix Bit). A heap overflow is …

Commit message explicitly mentions fixing a heap overflowRemoval of an unused cryptographic/randomness binding (os.urandom)Submodule bump only; no source-level patch visible in this commit

5c4ece9aby odudex+1−11 file

Vendor flagged security relevance

Open full analysis →Source commit ↗

Moderate 52 AI analysisMessage 85 · Strong

5 days, 2 hours ago

KX KruxKrux BitcoinHardware wallets

fix: remove Maix Bit and CIF camera support

This commit removes support for an old, discontinued hardware device called the Maix Bit from the Krux Bitcoin wallet firmware. The commit message says the Maix Bit's camera resolution (CIF) was the only one that fed frames larger than QVG…

Buffer overflow / scratch buffer overflow claimed in commit message (49,152 bytes)Removal of vulnerable hardware code path rather than hardening the entropy moduleDiscontinuation of affected device reduces real-world exposure

8090ac73by odudex+11−1279 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Low 37 AI analysisMessage 90 · Strong

1 month, 4 weeks ago

KX KruxKrux BitcoinHardware wallets

docs: self-host math, remove MathJax/require.js CDN

This change removes third-party web scripts (MathJax and require.js loaded from a content delivery network) from the project's documentation and replaces them with self-hosted, pre-rendered math images. That eliminates a supply-chain risk …

Removal of cdnjs MathJax and require.js external script loadsSelf-hosting of rendered math assets as static SVGsExplicit commit message reference to supply-chain class (polyfill.io incident)

492820a1by odudex+8779−8928 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

High 74 AI analysisMessage 83 · Strong

3 months, 2 weeks ago

KX KruxKrux BitcoinHardware wallets

Security Hardening (#851)

This commit fixes four security weaknesses in Krux, a Bitcoin hardware-wallet project. The changes prevent: (1) encrypted backups from declaring zero or very low password-stretching effort, which would make them easy to brute-force; (2) mu…

Minimum PBKDF2 iteration enforcement against trivial work-factor envelopesRejection of multiple origin-less xpubs in multi-key descriptorsSD file-list filtering of traversal entries ('.', '..', path separators)

8f62c860by Odudex+263−39 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Moderate 60 AI analysisMessage 93 · Strong

3 months, 4 weeks ago

KX KruxKrux BitcoinHardware wallets

fix: warn user before signing raw hashes in message signing (#846)

This commit adds a warning screen to Krux's message-signing feature when the user is about to sign a raw 32-byte hash or a 64-character hex string. Previously, the device would silently treat such inputs as already-hashed values and sign t…

Silent signing of raw 32-byte values allowed transaction sighash spoofingMessage signing path treated raw hashes identically to SHA256(message) digestsFix explicitly references 'C3 of #843' as a security concern

23bc73b3by Odudex+46−726 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

High 78 AI analysisMessage 98 · Strong

4 months ago

KX KruxKrux BitcoinHardware wallets

fix: reject PSBT inputs with non-standard sighash types before signing (#844)

Krux is a small, open-source Bitcoin signing device (hardware wallet). This commit fixes a security flaw where the device would sign transactions even if the sender asked it to use unusual Bitcoin signature modes—specifically SIGHASH_NONE,…

Explicit security fix for externally-reported audit finding (#843 C2)Pre-sign validation added to reject non-standard sighash typesRelevant to transaction-replacement / fund-redirect attacks via SIGHASH_NONE/SINGLE/ANYONECANPAY

e5318112by Odudex+115−03 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Low 36 AI analysisMessage 98 · Strong

7 months, 4 weeks ago

KX KruxKrux BitcoinHardware wallets

chore: require urllib3 >2.6 security fix for CVE-2025-66471 urllib3 is dependency of requests and translate, used in dev tools

This commit updates the project's Python dependency lock file to require urllib3 version 2.6.0 or newer. The commit message says this is a security fix for CVE-2025-66471, a vulnerability in the urllib3 library. urllib3 is used indirectly …

Dependency version bump for a reported CVE (CVE-2025-66471)urllib3 constrained to >=2.6.0Affected packages moved from main to dev dependency group, limiting runtime exposure

268f3f7bby odudex+23−172 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Low 44 AI analysisMessage 58 · Thin

8 months, 3 weeks ago

KX KruxKrux BitcoinHardware wallets

Embit update: Improved BIP39 mnemonic validation (#759)

This commit tightens how a Bitcoin wallet tool (Krux) checks recovery phrases. Previously, the code accepted phrases with extra spaces, tabs, newlines, or commas between words because it used a loose 'strip and split' approach. Now it requ…

Stricter input validation for BIP39 mnemonic parsingRejection of whitespace-normalized parsing that could mask malformed user inputAlignment with upstream embit validation behavior

6806a792by Odudex+43−33 files

No security note in commit

Open full analysis →Source commit ↗

Moderate 64 AI analysisMessage 74 · Adequate

9 months ago

KX KruxKrux BitcoinHardware wallets

Release 25.10.1 (#757)

This release fixes a bug in Krux, a Bitcoin signing device firmware. When a user scanned an encrypted QR code meant to provide a wallet passphrase, address, or wallet descriptor, the device could silently treat the raw encrypted bytes as t…

Silent derivation of wrong wallet from encrypted passphrase/data due to uncaught decoding exceptionCross-runtime behavior difference: CPython UnicodeDecodeError vs MaixPy TypeErrorMissing input validation for passphrase character set

64212093by Odudex+259−610 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Wrong identity?Names can collide and public author strings can be misleading.Contact commitwatch@karma-x.io →