Critical Malicious Code Vulnerability in walletsdk Package
Summary
MAL-2025-6617: Malicious code in walletsdk (PyPI). Affects walletsdk versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The walletsdk package is a Python library designed for managing cryptocurrency wallets and transactions. It offers functionalities such as wallet creation, transaction signing, and balance checking. However, due to a recently discovered vulnerability, the package has been compromised, potentially exposing users to malicious activities.
Vulnerability Detail
The vulnerability identified in the walletsdk package is classified as malicious code injection. This issue originated from a specific version (0.1.0) of the package, which contains harmful code that can execute unauthorized actions on the user's system. The ramifications of this vulnerability include data theft, unauthorized transactions, and potential system compromise. Users of this package are at risk if they have installed the affected version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall walletsdkIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected version (0.1.0) of the walletsdk package and instead utilize an alternative package or an earlier version that does not contain the malicious code. It is advisable to review the package's documentation for safe alternatives.
Conclusion
The walletsdk package has a critical vulnerability due to malicious code in version 0.1.0. Users are advised to update to a secure version immediately to mitigate risks associated with this vulnerability. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for walletsdk →
FAQ
The walletsdk package is a Python library used for managing cryptocurrency wallets, allowing users to create wallets, sign transactions, and check balances.
You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
If you have the affected version (0.1.0) installed, you should immediately update to a patched version using 'pip install --upgrade walletsdk'.
The risks include data theft, unauthorized transactions, and potential compromise of your system, which can lead to further security issues.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software without requiring access to the code or installation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
