
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
stellar-wallet-kit
Advanced tools
A production-ready wallet connection SDK for Stellar dApps. Built with TypeScript + React, inspired by RainbowKit — but designed for the realities of Stellar wallets.
🔌 Multiple Wallets
🎨 Customizable Wallet Modal
⚡ TypeScript-first
🎯 React Hooks API
💰 Built-in balance fetching
💾 Session persistence
🌓 Light / Dark / Auto theme
🔄 Auto-refresh balances
📱 Next.js (App Router & Pages) compatible
🚀 Framework-agnostic core
npm install stellar-wallet-kit
# or
yarn add stellar-wallet-kit
# or
pnpm add stellar-wallet-kit
WalletProviderimport { WalletProvider, NetworkType } from 'stellar-wallet-kit';
export function App() {
return (
<WalletProvider
config={{
network: NetworkType.TESTNET,
autoConnect: true,
}}
>
<YourApp />
</WalletProvider>
);
}
import { ConnectButton } from 'stellar-wallet-kit';
export function Header() {
return <ConnectButton />;
}
useWallet() hookimport { useWallet } from 'stellar-wallet-kit';
function Dashboard() {
const { account, isConnected, signTransaction } = useWallet();
if (!isConnected) return <p>Please connect your wallet</p>;
return (
<div>
<p>Connected: {account.address}</p>
<button onClick={() => signTransaction(xdr)}>
Sign Transaction
</button>
</div>
);
}
| Wallet | Type | Connection Model | Auto-Reconnect |
|---|---|---|---|
| Freighter | Browser extension | Injected API | ✅ |
| Albedo | Web wallet | Popup + callback | ❌ |
| WalletConnect | Mobile wallets | QR / deep-link session | ✅ |
| LOBSTR | Mobile wallet | WalletConnect | ✅ |
LOBSTR is exposed separately in the UI but internally uses WalletConnect.
WalletConnect does not block the UI like extensions.
connectingWalletThis avoids the “QR hidden behind loader” problem by design.
import { WalletType, useWallet } from 'stellar-wallet-kit';
const { connect } = useWallet();
await connect(WalletType.WALLETCONNECT);
await connect(WalletType.LOBSTR);
Albedo is a web-based wallet and requires a callback route.
If the callback is missing:
This is expected behavior.
// app/albedo-callback/page.tsx
'use client';
import { useEffect } from 'react';
export default function AlbedoCallback() {
useEffect(() => {
const params = Object.fromEntries(
new URLSearchParams(window.location.search)
);
if (window.opener) {
window.opener.postMessage(
{ type: 'ALBEDO_RESULT', payload: params },
window.location.origin
);
}
window.close();
}, []);
return <p>Connecting wallet…</p>;
}
import {
getNativeBalance,
getAssetBalance,
formatBalance,
hasSufficientBalance,
} from 'stellar-wallet-kit';
const xlm = getNativeBalance(account.balances);
const usdc = getAssetBalance(account.balances, 'USDC', issuer);
<WalletProvider
config={{
theme: {
mode: 'dark',
primaryColor: '#8b5cf6',
borderRadius: '16px',
},
}}
>
<App />
</WalletProvider>
useWallet() APIconst {
account,
isConnected,
isConnecting,
connectingWallet,
error,
network,
selectedWallet,
availableWallets,
connect,
disconnect,
signTransaction,
signAuthEntry,
switchNetwork,
refreshBalances,
supports,
} = useWallet();
supports)supports = {
silentReconnect: boolean;
networkDetection: boolean;
authEntrySigning: boolean;
}
Use this to:
✔ Mobile wallet not approved ✔ App not foregrounded on phone ✔ Session rejected in wallet
✔ Handled automatically WalletConnect never blocks UI
✔ Missing callback route ✔ Callback URL mismatch ✔ Popup blocked by browser
✔ Extension not installed / disabled
MIT © Tushar Pamnani
If this SDK saved you pain — ⭐️ it on GitHub.
Built with ❤️ for the Stellar ecosystem.
FAQs
A comprehensive wallet connection kit for Stellar dApps
The npm package stellar-wallet-kit receives a total of 132 weekly downloads. As such, stellar-wallet-kit popularity was classified as not popular.
We found that stellar-wallet-kit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.