Malicious Code Injection in paul-wallet-store: npm Package Vulnerability
Summary
MAL-2025-106994: Malicious code in paul-wallet-store (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The paul-wallet-store package is part of the npm ecosystem, primarily used for managing wallet functionalities in applications. It allows developers to integrate wallet features seamlessly. However, this package has been compromised, making it susceptible to malicious code that can affect the integrity of applications relying on it.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded in the paul-wallet-store package, which is linked to a broader campaign involving the tea.xyz token reward system. This payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names to inflate developer reputation scores. The continuous republishing of these variants can lead to pollution of the npm registry, potentially affecting other packages and developers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall paul-wallet-storeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the paul-wallet-store package from your project until a secure version is released. Use the following command to uninstall it: npm uninstall paul-wallet-store.
Conclusion
The paul-wallet-store package has been identified as containing malicious code that poses a significant risk to applications using it. It is essential to take immediate action by updating or removing the package to safeguard your projects. Utilizing tools like Vulert can further enhance your security posture by providing real-time vulnerability alerts.
See every vulnerability recorded for paul-wallet-store →
FAQ
The malicious code can compromise the integrity of applications using the package, leading to potential data leaks and security breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
Regularly auditing your dependencies and using tools like Vulert can help identify vulnerabilities early and prevent future issues.
If an immediate update is not possible, consider removing the package temporarily and monitoring for updates from the maintainers.
Detailed information can be found in the vulnerability report on the Open Source Vulnerability database and through community discussions on platforms like GitHub.
