Malicious Code Injection in wallet-connect-adapter Package
Summary
MAL-2026-17179: Malicious code in wallet-connect-adapter (npm). Affects wallet-connect-adapter versions 1.4.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wallet-connect-adapter package is an npm library designed for facilitating wallet connections in JavaScript applications. However, it has been identified to contain a significant security vulnerability that allows malicious code execution during installation. This vulnerability is particularly concerning as it targets Windows developers, executing hidden payloads without their knowledge.
Vulnerability Detail
The vulnerability originates from the package's postinstall hook, which executes a script that base64-decodes an embedded blob and XOR-decrypts it using a hardcoded key. This decrypted code is then piped into a hidden Python process, which can lead to unauthorized actions on the developer's machine. The package's main module is a stub that does not provide any wallet-adapter functionality, making the malicious payload the only active component upon installation. This behavior poses a severe risk, as it can compromise the security of the development environment and potentially lead to further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall wallet-connect-adapterIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid installing the wallet-connect-adapter package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The wallet-connect-adapter package contains a serious vulnerability that allows for the execution of malicious code during installation. Developers should take immediate action to remove the package and monitor for updates. Utilizing tools like Vulert can help in identifying and mitigating such vulnerabilities in the future.
See every vulnerability recorded for wallet-connect-adapter →
FAQ
The wallet-connect-adapter package is an npm library intended for connecting cryptocurrency wallets to JavaScript applications.
The vulnerability allows malicious code to execute on your system during the installation of the package, potentially compromising your development environment.
Check the package's repository for any updates or patches. If a patched version is available, update the package using npm.
If you have installed the wallet-connect-adapter package, it is crucial to remove it immediately and check your system for any unauthorized changes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can also check your application against known vulnerabilities using the Vulert playground without needing to sign up.
