Malicious Code Injection in hank-wallet-store: A Threat to npm Users
Summary
MAL-2025-103591: Malicious code in hank-wallet-store (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hank-wallet-store package is part of the npm ecosystem, primarily used for managing wallet functionalities in applications. It is designed to facilitate secure storage and transactions of digital assets. However, this package has been compromised, making it susceptible to malicious activities that can affect developers and users alike.
Vulnerability Detail
The vulnerability originates from the hank-wallet-store package being associated with a malicious campaign that floods the npm registry with harmful packages. These packages contain scripts that modify the package.json file, removing private flags and changing version numbers. They also generate random package names to inflate developer reputation scores, leading to pollution of the npm registry. The ramifications include potential exposure of sensitive data and the risk of executing harmful code within applications that depend on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall hank-wallet-storeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the hank-wallet-store package from your project until a secure version is released. You can do this by executing: npm uninstall hank-wallet-store. Additionally, monitor your package-lock.json file for any unauthorized changes.
Conclusion
The hank-wallet-store package has been compromised, posing significant risks to users and developers. It is essential to take immediate action by updating or removing the package and utilizing tools like Vulert to monitor for vulnerabilities. Staying informed and proactive can help mitigate the risks associated with such malicious activities.
See every vulnerability recorded for hank-wallet-store →
FAQ
The malicious code modifies package.json files to remove private flags and changes version numbers, allowing for unauthorized republishing of the package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Using the compromised package can lead to data exposure, execution of harmful code, and potential security breaches in your application.
Regularly update your dependencies, monitor your package-lock.json file, and utilize tools like Vulert to stay informed about vulnerabilities.
Immediately uninstall the hank-wallet-store package and monitor your application for any unusual behavior. Consider using alternative packages until a secure version is available.
