Malicious Code Injection in anthony-wallet-store: A Threat to npm Users
Summary
MAL-2025-99487: Malicious code in anthony-wallet-store (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The anthony-wallet-store package is part of the npm ecosystem, primarily used for managing cryptocurrency wallets. It is designed to facilitate transactions and store user data securely. However, this package has been compromised, making it susceptible to malicious activities that can affect users' security and the integrity of the npm registry.
Vulnerability Detail
The vulnerability originates from the anthony-wallet-store package being part of a malicious campaign associated with the tea.xyz token reward scheme. This package contains scripts that automatically modify its own package.json file to remove private flags, alter version numbers, and generate random package names. The malicious payload continuously republishes these variants, polluting the npm registry and potentially compromising user security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall anthony-wallet-storeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the anthony-wallet-store package from your project until a secure version is released. You can do this by executing the command: 'npm uninstall anthony-wallet-store'. Additionally, monitor your package-lock.json file for any unauthorized changes.
Conclusion
The anthony-wallet-store package has been identified as containing malicious code that can compromise user security and pollute the npm registry. It is essential for users to take immediate action by updating or uninstalling the package and monitoring their projects for vulnerabilities.
See every vulnerability recorded for anthony-wallet-store →
FAQ
The anthony-wallet-store package is an npm package used for managing cryptocurrency wallets, facilitating secure transactions and data storage.
This vulnerability can lead to unauthorized modifications of the package, potentially compromising user data and security, as well as polluting the npm registry.
If you are using anthony-wallet-store, you should uninstall the package until a secure version is released and monitor your project for any changes.
You can use tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time, alerting you to any issues without requiring code access.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
