GO · AUGUST 2026 · EARLY WARNING

Klever Go Package Compromised: Early Warning of Supply-Chain Attack

Q: Am I affected?

You are affected if you are using the klever-go package in versions prior to 1.7.19.

Q: What should I do right now?

Avoid using the affected version of the klever-go package until a patched version is released. Check your dependencies and consider switching to an alternative package or implementing temporary safeguards.

Q: Has this been exploited in the wild?

Yes, this vulnerability appears to have been actively exploited, resulting in the minting of tens of millions of KLV tokens.

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: klever-go (go)
Affected versions: < 1.7.19
Patched version: Not yet available

GHSA-P7GW-2PCP-5PF8

The Klever Go package was reportedly compromised, allowing unbounded minting of KLV tokens. This appears to have been actively exploited, minting tens of millions of KLV before an emergency guard was deployed.

What happened

The Klever Go package, specifically versions prior to 1.7.19, was reportedly compromised. This compromise allowed for an integer overflow in the split-royalty validation, enabling unbounded minting of KLV tokens. This vulnerability, tracked as CVE-2026-54755, was actively exploited on mainnet, resulting in the minting of tens of millions of KLV tokens before an emergency guard was deployed. Additionally, another vulnerability, tracked as CVE-2026-54754, allowed for minting of KLV when the referral percentage plus royalty percentage exceeded the bid, silently skipping the negative seller share. This issue was also part of the compromise.

The attack was first flagged on August 28, 2026, at 16:22:15 UTC. The severity of this incident is classified as high due to the potential for significant financial loss and the active exploitation in the wild. The attack type is categorized as a supply-chain attack, with the specific IDs GHSA-P7GW-2PCP-5PF8 and GHSA-CGC5-V3F2-8M2V associated with the vulnerabilities.

What to do about it

Avoid using the affected version of the klever-go package until a patched version is released.
Check your dependencies for any inclusion of klever-go versions prior to 1.7.19.
If you are using an affected version, consider switching to an alternative package or implementing temporary safeguards until a patch is available.
Monitor the primary sources for updates on patched versions and further details.
Consult the GitHub advisories GHSA-CGC5-V3F2-8M2V and GHSA-P7GW-2PCP-5PF8 for the latest information and recommended actions.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If klever-go is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using the klever-go package in versions prior to 1.7.19.

What should I do right now?

Avoid using the affected version of the klever-go package until a patched version is released. Check your dependencies and consider switching to an alternative package or implementing temporary safeguards.

Has this been exploited in the wild?

Yes, this vulnerability appears to have been actively exploited, resulting in the minting of tens of millions of KLV tokens.

Sources

Join the 0Day waitlist →

← Back to all threats