wallet-connect-adapter (npm) · Malicious Code
Affects wallet-connect-adapterSource GCVE Database
Malicious package : remove wallet-connect-adapter and rotate any secrets on hosts that installed it.
Data as of 25 Sep 2026, 04:49 UTC
Malicious package
Published to npm · OSV MAL-2026-17179
What to do
Remove wallet-connect-adapter from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmwallet-connect-adapter | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4135dd91724bdca6fc36f3a49906d219acc67afde7802cb1bd114d128984ca3d) The package's postinstall hook runs `node./loader.js`, which base64-decodes an ~8 KB embedded blob, XOR-decrypts it with a hardcoded 32-byte key, and pipes the resulting bytes into a detached, window-hidden `python -c -` child process via stdin. The loader also silently `pip install`s `requests` if missing. The advertised library surface in `index.js` is an explicit stub whose `connect()` throws, and `package.json` restricts installation to `os: ["win32"]`, so the tarball has no functional wallet-adapter behavior — its only effect on install is to execute the obfuscated Python payload on a Windows developer's machine. The combination of a hidden opaque payload, XOR-obfuscated delivery, detached hidden Python execution at `npm install` time, an inert cover-story main module, and OS pinning to Windows is a targeted install-time dropper.