Malicious Code Injection in waldo-validator-catalyst: npm Package Vulnerability
Summary
MAL-2025-110649: Malicious code in waldo-validator-catalyst (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The waldo-validator-catalyst package is part of the npm ecosystem, primarily used for validating transactions within decentralized applications. It is designed to enhance the security and efficiency of blockchain interactions. However, this package has been compromised, making it susceptible to malicious code that can affect its integrity and the applications relying on it.
Vulnerability Detail
The vulnerability in waldo-validator-catalyst stems from its association with a malicious campaign that floods npm with compromised packages. These packages contain scripts that automatically modify the package.json file, removing private flags and changing version numbers. The scripts generate random package names and continuously republish variants, leading to pollution of the npm registry. This can result in developers unknowingly using compromised versions, exposing their applications to security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall waldo-validator-catalystIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the waldo-validator-catalyst package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The waldo-validator-catalyst package has been compromised, posing significant risks to applications that utilize it. It is essential to update to a patched version or find alternatives to mitigate these risks. Regular monitoring and auditing of dependencies can help prevent similar vulnerabilities in the future.
See every vulnerability recorded for waldo-validator-catalyst →
FAQ
The vulnerability involves malicious code that modifies package.json files and repackages the library with harmful scripts.
You can use Vulert, which monitors vulnerabilities in your software using the package-lock.json file. Visit Vulert Scanner to check your application without any signup.
The risks include exposure to malicious code, potential data breaches, and compromised application integrity.
Regularly update your dependencies, use tools like Vulert for monitoring, and audit your packages for known vulnerabilities.
Consider removing the package from your project and using alternatives until a secure version is available.
