Critical Malicious Code Vulnerability in wallet-utils Package
Summary
MAL-2025-6615: Malicious code in wallet-utils (PyPI). Affects wallet-utils versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wallet-utils package is a Python library designed for managing cryptocurrency wallets and transactions. It provides essential functionalities for developers to integrate wallet operations into their applications. However, the package has been identified to contain malicious code that compromises the security of applications utilizing it, making it crucial for users to be aware of this vulnerability.
Vulnerability Detail
The vulnerability in the wallet-utils package arises from the inclusion of malicious code that can execute unauthorized actions on the host system. This code was discovered by ReversingLabs and is present in version 0.1.0 of the package. The ramifications of this vulnerability can include data theft, unauthorized access to sensitive information, and potential system compromise. Users of this package are strongly advised to take immediate action to mitigate the risks associated with this malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall wallet-utilsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the wallet-utils package from their projects until a secure version is released. This can be done with the following command: pip uninstall wallet-utils. Additionally, consider using alternative libraries that provide similar functionalities without the associated risks.
Conclusion
The wallet-utils package has been identified to contain malicious code that poses significant security risks to applications utilizing it. Users are urged to uninstall the affected version and monitor for updates. Utilizing tools like Vulert can help in real-time monitoring for vulnerabilities in open-source software.
See every vulnerability recorded for wallet-utils →
FAQ
wallet-utils is a Python library for managing cryptocurrency wallets and transactions, providing developers with tools to integrate wallet functionalities into their applications.
The vulnerability involves malicious code that can execute unauthorized actions on the host system, posing significant security risks to applications using the package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you are using wallet-utils, you should immediately uninstall the package and monitor for updates that address the vulnerability.
Yes, consider using other libraries that offer similar wallet management functionalities without the associated security risks.
