Critical Malicious Code Vulnerability in wallet-evm Package
Summary
MAL-2025-191151: Malicious code in wallet-evm (npm). Affects wallet-evm versions 0.3.1 – 0.3.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wallet-evm package is an npm library designed for Ethereum wallet management, enabling developers to interact with Ethereum blockchain functionalities. It provides essential features for creating, managing, and securing Ethereum wallets. However, this package has been compromised, embedding malicious code that poses severe security risks to any system utilizing it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the wallet-evm package, specifically in versions 0.3.1 and 0.3.2. This code can fully compromise any computer running the package, allowing unauthorized access to sensitive information such as secrets and keys. The ramifications are significant, as attackers may gain complete control over the affected systems, leading to potential data breaches and loss of assets.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall wallet-evmIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the affected package and securing your environment. It is recommended to monitor your systems for any unusual activity following the removal.
Conclusion
The wallet-evm package has been identified as containing malicious code that compromises system security. Immediate action is required to remove the package and secure any sensitive information. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for wallet-evm →
FAQ
The wallet-evm package is an npm library used for managing Ethereum wallets, providing functionalities for wallet creation and interaction with the Ethereum blockchain.
If you have installed wallet-evm versions 0.3.1 or 0.3.2, your system is likely compromised. You can use tools like Vulert to monitor and alert for vulnerabilities in your software.
Immediately rotate all secrets and keys stored on the compromised system from a secure, unaffected computer to prevent unauthorized access.
Currently, there is no patched version available. The recommended action is to uninstall the affected versions of the package.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file, allowing you to check for vulnerabilities without needing to access the code.
