wallet-connect-adapter

Details

**Severity:** Critical

**Affected versions:** `= 1.4.2`

## Source: amazon-inspector (4135dd91724bdca6fc36f3a49906d219acc67afde7802cb1bd114d128984ca3d)
The package's postinstall hook runs `node./loader.js`, which base64-decodes an ~8 KB embedded blob, XOR-decrypts it with a hardcoded 32-byte key, and pipes the resulting bytes into a detached, window-hidden `python -c -` child process via stdin. The loader also silently `pip install`s `requests` if missing. The advertised library surface in `index.js` is an explicit stub whose `connect()` throws, and `package.json` restricts installation to `os: ["win32"]`, so the tarball has no functional wallet-adapter behavior — its only effect on install is to execute the obfuscated Python payload on a Windows developer's machine. The combination of a hidden opaque payload, XOR-obfuscated delivery, detached hidden Python execution at `npm install` time, an inert cover-story main module, and OS pinning to Windows is a targeted install-time dropper.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c93fda3f08313c598165839b4fb8b4d4d912f27a/osv/malicious/npm/wallet-connect-adapter/MAL-2026-17179.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/c93fda3f08313c598165839b4fb8b4d4d912f27a/osv/malicious/npm/wallet-connect-adapter/MAL-2026-17179.json
- https://www.npmjs.com/package/wallet-connect-adapter/v/1.4.2
- https://github.com/advisories/GHSA-39rm-rv2w-366r

Compromised versions (1)

• = 1.4.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.